Wiretap Channels With Causal State Information: Strong Secrecy

The coding problem for wiretap channels with <italic>causal</italic> channel state information available at the encoder and/or the decoder is studied under the <italic>strong secrecy</italic> criterion. This problem consists of two aspects: one is due to wiretap channel coding and the other is due to one-time pad cipher based on the secret key agreement between Alice and Bob using the channel state information. These two aspects are closely related to each other and give rise to an intriguing tradeoff between exploiting the state to boost secret-message rates versus extracting cryptographic key to improve secrecy capabilities. This issue has yet to be understood how to optimally reconcile the two. We newly devised the “iterative” forward–backward coding scheme, combining wiretap channel coding and secret-key-agreement-based one-time pad cipher. We then established reasonable lower bounds of the secrecy capacity for wiretap channels with causal channel state information available only at the encoder (<xref ref-type="theorem" rid="theorem1">Theorem 1</xref>), which can be easily extended to general cases with various kinds of correlated channel state information at the encoder (Alice), decoder (Bob), and wiretapper (Eve). In particular, for degraded wiretap channels, we give the secret-message (secret-key) capacity bounds (<xref ref-type="theorem" rid="theorem2">Theorems 2</xref>, <xref ref-type="theorem" rid="theorem4">4</xref>, and <xref ref-type="theorem" rid="theorem5">5</xref>).

Both includes lower bounds on the weak secrecy capacity, but tight secrecy capacity formulas only in special cases.
The present paper is motivated mainly by these two papers, and the main result to be given in this paper includes their results as special cases.
The main achievements of this paper are summarized in the following two features: 1) we establish coding schemes for the WC with causal CSI under the strong secrecy criterion instead of the standard weak secrecy criterion, and also provide the lower bound on the strong secrecy capacity; 2) we establish the generalized framework to incorporate WCs with various directions of CSIs available among Alice, Bob and Eve, which is called the multi-way CSI, and provide the lower bound on the secrecy capacity for this general system.Its expression looks, at first glance, somewhat involved, however, represents an insightful structure based on the relevant quantities which have due functional meanings in coding and cipher schemes.
In Section II, we give the statement of the problem and the first crucial result (Theorem 1) for the WC with causal CSI available only at Alice along with comparisons with typical previous works such as Chia and El Gamal [16].
In Section III, we give the detailed proof of Theorem 1 to establish lower bounds on the strong secrecy capacity.
The main ingredients for the proof are Slepian-Wolf coding, Csiszár-Körner's key construction, Gallager's maximum likelihood decoding, and Han-Verdú's resolvability argument, where in the process of these proofs we do not invoke the argument of typical sequences at all, which enables us to cope with alphabets that are not necessarily finite.This provides the basis for dealing with the problems in the subsequent sections.
In Section IV, we consider WCs with the partial secrecy criterion as a "weaker" version of the strong secrecy criterion to establish Theorem 2 for achievability bounds in this case and compare them with those in Fujita [20].September 13, 2017 DRAFT In Section V, we treat the WC with general multi-way CSI among Alice, Bob and Eve as above to establish the general Theorem 3 for strong secrecy lower bounds, including Theorem 1 as a special case.The proof of this theorem is carried out by introducing the equivalent WC and reducing all of it to that of Theorem 1 along with a due replacement of the intervening variables according to a simple rule.Finally, Examples 1 ∼ 3 are shown to illustate the significance of Theorem 3 in connection with Theorem 1.
In Section VI, we conclude the paper.

II. PROBLEM STATEMENT AND THE RESULT
A stationary memoryless WC ω as illustrated in Fig. 1 is specified by giving the conditional (transition) probability p(y, z|x, s) = P Y Z|XS (y, z|x, s) with input random variable X (for Alice), outputs random variables Y (for Bob), Z (for Eve), and CSI random variable S, which are assumed to take values in alphabets X , Y, Z, S, respectively.Alice X (sender), who only has access to stationary memoryless CSI S available, wants to send a confidential message M ∈ M = [1 : 2 nR ] (over n channel transmissions) to Bob Y (legitimate receiver) while keeping it secret from Eve Z (eavesdropper), where we use here and hereafter the notation [i : j] = {i, i + 1, • • • , j − 1, j} for j ≥ i, and R ≥ 0 is called the rate.A (n, 2 nR ) code for the channel ω with causal CSI S at the encoder consists of (i) a message set M = [1 : 2 nR ], (ii) a stochastic "causal" encoder f i : M × S i → X subject to conditional probability p(x|m, s i ) to produce the channel input X i (M ) = f i (M, S i ) at each time i ∈ [1 : n], and (iii) a decoder g : Y n → M (for Bob) to assign an estimate M to each received sequence Y, where we use the  The probability of error is defined to be P e = Pr{ M = M }.The information leakage at Eve with output sequence Z, which measures the amount of information about M that leaks out to Eve, is defined to be I E = I(M ; Z) (the mutual information), where Z denotes the whole information (including Z) that Eve can observe.It should be noted here that this measure is not R E = 1 n I(M ; Z) (the information leakage rate).This means that in this paper we are concerned only with the strong secrecy but not the weak secrecy as was the case in the literature (e.g., cf.Chia and El Gamal [16], Fujita [20]).
A secrecy rate R is said to be achievable if there exists a sequence of codes (n, 2 nR ) with P e → 0 and I E → 0 as n → ∞.The strong secrecy capacity C s CSI is the supremum of all achievable rates with the strong secrecy criterion.In order to implement the coding scheme for the ω, it is convenient to introduce its modified channel ω * as follows: Let U be an arbitrary auxiliary random variable with values in a set U that is independent of the CSI variable S, and let h : U × S → X be a stochastic mapping subject to conditional probability p(x|u, s).We define the ω * as the WC specified by the conditional probability which gives a new WC with input variable U (Alice), outputs variables Y, Z (Bob and Eve) and CSI variable S (the Shannon strategy [5]), i.e., the channel ω * is a concatenation of ω and h (i.e., ω * = ω • h).Thus, hereafter we can focus solely on the coding problem for the channel ω * .
Let us now describe the main result.Set where Moreover, for simplicity we use the notation where p(u), p(x|u, s) ranges over all possible (conditional) probability distributions such that p(u, s) = p(u)p(s), and notice here that p(s) is a given distribution and so cannot be varied.
September 13, 2017 DRAFT The expression on the right-hand side (4) for R CSI-1 (p(u), p(x|u, s)) looks a little bit involved, so it is convenient to classify it into three cases as follows: which implies that in this case the standard (naive) WC coding without resorting to OTP cipher with the shared secret key using CSI is enough to guarantee the achievability (cf.Csiszár and Körner [2], El Gamal and Kim [24], Dai and Luo [17]).
Case 1): which implies that the achievable rate here consists of two parts; the first one from naive WC coding and the second one from OTP cipher, as will be mentioned below.
Case 2): We notice here that in this case holds, which implies that in this case the achievability of R CSI-1 (p(u), p(x|u, s)) follows from that of R CSI-2 (p(u), p(x|u, s)).
The latter corresponds to the situation where all confidential message is protected by OTP cipher using the CSI, not via naive WC coding, and so it suffices to show only the achievability of R CSI-2 (p(u), p(x|u, s)) (see, the proof for Case 3) later in Section III).
Here, the term H(S|U Y ) in ( 4), ( 5), ( 8), (9) 4), ( 5), ( 8), ( 9) specifies the upper bound on total transmission rates for two kinds of confidential messages as above except for the non-confidential message.The proof of Theorem 1 is provided in the next section.
Remark 1: Chia and El Gamal [16] have considered the WC with the same CSI available at both Alice and Bob as illustrated in Fig. 2.This channel, however, equivalently reduces to that in Fig. 1 where the right-hand side of (11) exactly coincides with the weak secrecy lower bound: given by Chia and El Gamal [16], because H(S|Z) = H(S|U Z) + I(U ; S|Z), I(U ; SZ) = I(U ; Z) + I(U ; S|Z).
Here, we prefer the expression (11) rather than (13), because the former, in contrast to the latter, guarantees the strong secrecy requirement for OTP cipher with the shared secret key using CSI even when U may be exposed also to Eve.Thus, Theorem 1 specialized to the case with the same CSI available at both Alice and Bob provides the strong secrecy version of their result.Specifically, this concludes that Theorems 1, 2 and 3 in [16] all hold with the strong secrecy criterion.
Remark 2: A remarkable feature of this paper is that we do not invoke the argument of typical sequences at all, so we do not need the finiteness of alphabets U, X , Y, Z, while the alphabet S of CSI S needs to be finite.

III. PROOF OF THEOREM 1
The whole coding scheme involves the transmission of b independent messages over the b + 1 channel blocks each of length n (b is a sufficiently large fixed positive integer), which are indexed by j = 0, 1, 2, • • • , b.The formal proof is provided in the sequel, where in block j we let U j , S j , X j , Y j , Z j (correlated i.i.d.sequences of length n subject to joint probability P USXY Z ) denote the random variables to indicate auxiliary channel input sequence, CSI sequence, channel input sequence for Alice, channel output sequences for Bob and Eve, respectively, whereas M j , M 0j , M 1j , N j denote the random variables to indicate uniformly distributed confidential messages to be sent, and non-confidential message, respectively.Their realizations are indicated by the corresponding lower case letters.

A. Proof for Case 1) of R CSI-1 :
In what to follow, many kinds of (nonnegative) rates intervene with inequality constraints, which are listed as follows: Fourier-Motzkin elimination (cf.El Gamal and Kim [24]) claims that the supremum of R over all rates satisfying (14)∼ ( 19) coincides with the right-hand side of ( 8), so it suffices to show that rates R satisfying ( 14)∼ ( 19) are indeed achievable, where R is used to indicate an achievable rate for non-confidential channel coding between Alice and Bob.
Codebook generation: and where, in the process of channel transmission, message M 0j is protected by naive WC coding, and message M 1j is protected by OTP cipher with the shared secret key using CSI.The codebook generation consists of the following two parts:

1) Message codebook generation:
For each block j ∈ [0 : b], randomly and independently generate sequences . This is a random code and is denoted by H j .On the other hand, partition the set [1 : (cf.Fig. 3).These bins are all non-empty because of (18).

2) Key codebook generation:
In order to construct an efficient key K j = κ(S j ) of rate R K using the CSI S j , we invoke the following two celebrated lemmas: Lemma 1 (Slepian and Wolf [3]): Let ε > 0 be an arbitrarily small number and let R 2 > H(S|U Y ) (cf. ( 17)).
In what follows, we use the notation N j+1 ≡ φ(S j ), which is the random variable conveying the non-confidential message used for generating the common secret key between Alice and Bob.
Lemma 2 (Csiszár and Körner [22,Corollary 17.5]): Let ε > 0 be an arbitrarily small number and let ).Then, there exists a (deterministic) key function κ : for all sufficiently large n, where we use the notation (called the security index): with the uniform distribution P K on the range K of K and the KL divergence D(•||•).
We use the thus defined deterministic function K j−1 = κ(S j−1 ) as the key to be used in block j.We use the block coding scheme as in Fig. 4, which is based on the block Markov codings scheme invented by

Block Markov coding scheme
Cover and El Gamal [15] (cf.Fig. 4) and applied to the WC with CSI by Chia and El Gamal [16].In each block j ∈ [1 : b] Alice transmits the current confidential message M j ∈ [1 : 2 nR ] and the non-confidential description of the CSI sequence S j−1 in the previous block j − 1, whereas the first block j = 0 provides only the CSI sequence S 0 for Alice and the output sequence Y 0 for Bob to be used for encoding in the second block j = 1 At the beginning of block j Alice computes the key K j−1 = κ(S j−1 ) ∈ [1 : 2 nR1 ] using the CSI sequence S j−1 to make the cipher C j = K j−1 ⊕M 1j (mod 2 nR1 ), which together with M 0j and N j is stochastically mapped to the auxiliary channel input U j and is sent out for the transmission in block j with the output Y j for Bob.At the end of block j Bob makes an estimate Ŝj−1 = σ( Nj , Ûj−1 , Y j−1 ) of the CSI S j−1 (where Nj , Ûj−1 are estimates of N j , U j−1 made by Bob, respectively) and then obtains the estimate Kj−1 = κ( Ŝj−1 ) of the key K j−1 , which enables Alice and Bob to share the secret common key, and then Bob can recover not only M 0j but also M 1j as M1j = C j ⊖ Kj−1 .The confidentiality of M 0j and M 1j is guaranteed by Wyner's WC coding and Shannon's OTP cipher, respectively.

Encoding scheme:
In the first block j = 0 we send out for channel transmission a randomly generated sequence X 0 according to conditional probability n i=1 p X|US (x i |u i (1), s i ), where ) and let L ∆ = L(m 0 , c j , m 2 ) be the random index uniformly distributed on the bin B(m 0 , c j , m 2 ), where k j−1 = κ(s j−1 ) is specified as in Lemma 2.
We then send out for channel transmission a randomly generated sequence X j according to conditional probability
Then, in view of Lemmas 1 and 3, we have Thus, it is concluded that the total probability of decoding error over all the b blocks is less than or equal to 2bε.
It should be remarked here that the total transmission rate averaged over all b + 1 blocks is bR b+1 because only the b blocks of them are effective for message transmission, which can be made as close to R as desired by letting b large enough.

Evaluation of information leakage:
We use the following notation: where we notice that Z j is the channel output for Eve in block j.
Remark 3: Since K j−1 and M 1j are independent and M 1j is assumed to be uniformly distributed, the OTP cipher claims that K j−1 and C j = K j−1 ⊕ M 1j are independent and C j is uniformly distributed (cf.Shannon [4]).Notice here that K j−1 is not necessarily uniformly distributed, and hence M 1j and C j are not necessarily independent.On the other hand, Z j−1 may affect Z j only through K j−1 N j and inversely Z j−1 may be affected by Z j only through C j N j .This property plays the crucial role in evaluating the performance of our coding scheme (cf.Fig. 4).
In the sequel we show that the information leakage to Eve and Fujita [20].This is because the non-confidential message N j for Bob (due to Slepian-Wolf coding) is not protected by either naive WC coding or OTP cipher, but transmitted under channel coding via the WC ω * , and so it may be exposed also to Eve.
First, set where Then, where (a) follows from the independence of M b 0 and N b given H; (q) follows from the property that M 0j Z j (∀j ∈ [1 : b]) are mutually independent given N b .
Next, C can be upper bounded as where Now, September 13, 2017 DRAFT Moreover, September 13, 2017 DRAFT where (f ) follows from the independence of M 1j and N [j+1] Z [j] given M b 0 M [j+1] 1 C j N j Z j−1 H and hence (g) follows from the independence of M 1j N j Z j−1 and M [j+1] 1 given 0 given H; (m) follows from the independence of K j−1 and M j−1 0 HN j−1 Z j−2 given N j U j−1 Z j−1 and hence Here, the first term I(M 0j ; N j+1 Z j |N j H) on the right-hand side of (36) specifies the resolvability performance for Eve, and the second and third terms I(K j ; N j+1 U j Z j ), D(P Kj ||P Kj ) specify the key performance for Bob.
The latter two are evaluated as follows.We can rewrite the security index S(κ(S j )|N j+1 U j Z j ) in (21) of Lemma 2 as Therefore, Lemma 2 claims that Now, what remains to be done is to evaluate I(M 0j ; N j+1 Z j |N j H).To do so, we invoke the following resolvability lemma: September 13, 2017 DRAFT Lemma 5 (Conditional resolvability lemma): Let ε > 0 be an arbitrarily small number and let R − R 0 > I(U ; Z) + 2H(S|U Y ) (cf. ( 16)).Then, for all sufficiently large n.
Proof: See Appendix A.
An immediate consequence of Lemma 4 together with (38) and (39) is thereby completing the proof for Case 1).

B. Proof for Case 2) of R CSI-1 :
As was pointed out in the foregoing section, this case is subsumed by the following Case 3) (cf.( 10)).

C. Case 3): Proof for the achievability of R CSI-2 :
The remainder of Theorem 1 to be proved is the acievability of R CSI-2 (see ( 5) and ( 6)): where The rate constraints in this case are listed as follows (R 0 = 0): These constraints are the same as those in Case 1) with R 0 = 0, where constraint ( 16) is not necessary here because of R 0 = 0. Fourier-Motzkin elimination claims that the supremum of R over all rates satisfying (43)∼ (47) coincides with the right-hand side of (42), so it suffices to show that rates R satisfying (43)∼ (47) are achievable.
However, in this case too, the whole argument developed in the proof for Case 1) holds with R 0 = 0 as they are, where we notice that, since and hence Lemma 5 is not needed here, thereby completing the achievability proof for this case.

IV. WIRETAP CHANNEL WITH PARTIAL INFORMATION LEAKAGE
We have so far studied WCs with CSI available at Alice under the information leakage (called the strong secrecy criterion).However, one may be interested in other types of secrecy criteria, say, I ′ E = I(M b ; Z b |H) without N b (called the partial information leakage), as was adopted in Fujita [20].Such a partial secrecy criterion is "partial" compared to the strong secrecy criterion as considered in Theorem 1.

With the
, it is also possible to have a counterpart of Theorem 1, that is, a partial version of Theorem 1 as follows, although in general it may cause imperfect confidentiality.
where p(u), p(x|u, s) ranges over all possible (conditional) probability distributions such that p(u, s) = p(u)p(s), and Remark 4: The first and second terms on the right-hand side of (50) are rewritten equivalently as respectively, because ] with the partial but weak secrecy criterion (in the sense that 1 n I(M b ; Z b |H) → 0 as n → ∞).However, we suggest that the proof reasoning in [20] leading to this lower bound does not look quite sound, because [20, Lemma 6, (iii)] (the key lemma) does not seem to be indeed valid.
On the other hand, comparing the strongly achievable rates (in the sense that (4) with that in (50), we see that the rate in (4) is smaller by H(S|U Y ) than that in (50)).
As mentioned before in the footnote, this is the rate penalty to be payed to compensate inter-block interactions due to the transmission of the Slepian-Wolf code N b under the strong secrecy criterion compared to with the partial secrecy criterion.

Proof of Theorem 2: D. Proof for the achievability of R CSI-1 :
It is not difficult to verify that the whole proof can be carried out by literally paralleling that of Theorem 1, except that rate constraint (16) and equation ( 35) are replaced, respectively, by and Lemmas 4 and 5 are replaced, respectively, by the following two simplified Lemmas 6 and 7, where we have used the upper bound: Lemma 6 (Information leakage bound): Lemma 7 (Resolvability lemma): Let ε > 0 be an arbitrarily small number and let ).Then, for all sufficiently large n.

E. Proof for the achievability of R CSI-2 :
This is a special case of the above Case D with R 0 = 0 (hence also I(N j M 0j ; Z j |H) = 0 and inequality (58 is not necessary here).Then, it suffices only to parallel the proof argument in Case D.

V. WIRETAP CHANNEL WITH MULTI-WAY STATE INFORMATION
Thus far, we have established Theorem 1 for the WC with causal CSI available at Alice from the standpoint of achievable rates with the strong secrecy criterion.In many practical situations, however, we may be encountered with other types of CSIs, e.g., cases with some informations available at Eve or at Bob about the state of Eve's channel, not only about Bob's channel.These WCs are modeled in the most extensive form as illustrated in Fig. 5, where the CSIs S, S a , S r may be correlated; T, T a , T r may be correlated; S, T may also be correlated (cf.also Blockh and Laneman [9]).
At first glance, such a complicated "multi-way" system may look to be quite intractable.Remarkably enough, however, we can show that it is possible to reduce the multi-way system as in Fig. 5 (called Model I) equivalently to the system with CSI only at Alice as in Fig. 1 (called Model II).To show this, we first consider the "equivalent" WC with state (S a , T a ) defined by and make the replacement of the quantities as p(y, z|x, s) ← p(y, z|x, s a , t a ), September 13, 2017 DRAFT Fig. 5. General case of WC with CSIs available at all of Alice, Bob and Eve (states S, T may be correlated Then, the resultant WC p((s r , y), (t r , z)|x, s a , t a ) ≡ p(s r , t r |s a , t a )p(y, z|x, s a , t a ) is nothing but the system with CSI (S a , T a ) only at Alice as depicted in Fig. 1 and it is not difficult to check that it is indeed equivalent to the original system given in Fig. 5.
In this way, we can reduce the achievability problem for the system of Model I equivalently to that for the system of Model II.(It should be emphasized that the word of achievability here is used in the sense of strong secrecy criterion.)Then, one way to develop achievable rates for the system Model I is first to develop achievable rates for its equivalent system of Model II, which are possible in view of Theorems 1, and then to convert those into achievable rates in the form for the original system of Model I.
Thus, using such a principle, we have the following theorem for the system of Model I. To describe it, let us first define We notice here that in this case The latter corresponds to the situation where all confidential message is protected by encryption using the CSI, not via naive WC coding.
Example 1: So far we have established two typical ways to share a secret key in common; one is to use CSI available at both Alice and Bob, and the other is to use CSI available only at Alice.In this example, as an application of Theorem 3, we consider a hybrid way of combining them.Specifically, let us consider the system as in Fig. 6 with S a ≡ S r , which is a natural generalization not only of the system by Chia and El Gamal [16] but also of that by Fujita [20], where we use the secret key K j = κ(S aj , T aj ) shared by Alice and Bob as in Theorem 3. Notice here that S aj is provided to both of Alice and Bob, but T aj is provided only to Alice.Then, from Theorem 3 we can derive the following corollary.To describe it, let us first define where p(u), p(x|u, s a , t a ) ranges over all possible (conditional) probability distributions such that p(u, s a , t a ) = p(u)p(s a , t a ).
Proof: It is immediate to see that the right-hand sides of (75) and (76) coincide with the right-hand sides of (67) and (68) with S r ≡ S a respectively.Furthermore, we see also that the right-hand side of (74) coincides with (11) with S a , T r Z instead of S, Z, respectively.
Example 2: Let us again consider the same system as in Fig. 6, but here suppose that we are now interested in the key of the form K j = κ(S aj ) but not of the form K j = κ(S aj , T aj ).This implies that we do not need to invoke the Slepian-Wolf coding because Alice and Bob can use the same CSI S aj to share the secret This is a drastic simplification of Theorem 3, where it is obvious that (78) is redundant in this case.
Example 3: As another example, consider the system as in Fig. 7 with S r = ∅, which is a natural generalization of Fujita [20].In this case too, suppose as above that we are interested in the key of the form K j = κ(S aj ) but not of the form K j = κ(S aj , T aj ).This means that we use only a part S aj of the total CSI (S aj , T aj ) available at Alice to construct the secret key in common for Alice and Bob with N j ≡ φ(S a,j−1 ) = ∅.Then, Theorem 1 holds for this system with S a , T r Z, (s a , t a ), p(x|u, s a , t a ) instead of S, Z, s, p(x|u, s), respectively.Specifically, ∼ (5) are given now as

VI. CONCLUDING REMARKS
So far we have investigated the coding problem for WCs with causal CSI at Alice and/or Bob to establish lower bounds on the strong secrecy capacity, which are stated as Theorems 1 and 3.Although the system with CSI only at Alice (typically, cf.Fujita [20]) is a bit more intractable than the system with CSI at both Alice and Bob (typically, cf.Chia and El Gamal [16]), it turned out that the latter can be "completely" reduced to the former in the sense that to prove the achievability of rates for the latter we do not need to give any other separate arguments different from those for the former.
The main ingredients thereby to establish the main results are Slepian-Wolf coding, Csiszár-Körner's key construction, Gallager's maximum likelihood decoding, and Han-Verdú's resolvability argument, and in establishing these results we did not invoke the celebrated argument of typical sequences, which enabled us to well handle also the case with alphabets not necessarily finite, for example, including the case of Gaussian WCs with CSI.The proof is carried out basically along the line of Han and Verdú [26, (8.3)] and Hayashi [21,Theorem 3]).
Since we are considering a symmetric random code H j , conditioning )) the rate of "effective" size of the bin B(m 0 ) corresponding to each message M 0j = m 0 .Therefore, we see that evaluating the conditional mutual information I(M 0j ; N j+1 Z j |N j H) under rate constraint is tantamount to evaluating the non-conditional mutual information I(M 0j ; N j+1 Z j |H) under rate constraint which is developed as follows.
For each m 0 ∈ B(m 0 ), let U(m 0 ) denote the random variable u j (L(m 0 )) where L(m 0 ) is distributed uniformly on the bin B(m 0 ) with rate constraint (85), and let Z(m 0 ) denote the output for Eve due to U(m 0 ).Set P (m 0 ) = P T(m0) , T(m 0 ) = (N j+1 , Z(m 0 )) (the range of T(m 0 ) is denoted by T n ) and define a channel as W (t|u) = P T(m0)|U(m0) , where we notice that P T(m0)U(m0)Z(m0) does not depend on m 0 , so that we can write P TUZ instead of P T(m0)U(m0)Z(m0) .Now, set for 0 < ρ < 1.Therefore, it follows from (86) that where We notice here that R 2 is arbitrary as far as R 2 > H(S|U Y ) and τ > 0 is arbitrarily small, so that the last term on the right-hand side of (97) can be made larger than δ > 0 by letting R 2 close enough to H(S|U Y ).Then, (95) yields which implies that, for any small ε > 0, for all sufficiently large n, completing the proof of Lemma 5.

Fig. 3 .
Fig.3.Bin-partitioning for message codebook generation in each channel block j.

over the whole b + 1
blocks goes to zero as n → ∞ (the strong secrecy).Here, it should be noted that the information leakage I(M b ; N b Z b |H) contains the term N b in contrast with the usual one I(M b ; Z b |H) as in Chia and El Gamal[16] where (b) follows from the independence of M 1j C j and M b 0 M [j+1] 1 given H; (c) follows from the independence of M 1j C j and H; (o) follows from K j−1 = C j ⊖ M 1j ; (d) follows from the independence of K j−1 and M 1j ; (e) ||G|| denotes the size of the range of G (obviously, log ||C j || = log ||K j−1 ||); (i) P Kj−1 is the uniform distribution on the range K j−1 of K j−1 .
Thus, summarizing up (27)∼ (35), we have the upper bound on the information leakage to Eve I E = I(M b ; N b Z b |H) as Lemma 4 (Information leakage bound):

H
(S|Y ) = H(S|U Y ) + I(U ; S|Y ).(57) Thus, the bound on the right-hand side of (50) is smaller by H(S|U Y ) than the achievability bound I(U ; SY ) − I(U ; SZ) + H(S|Z) − H(S|Y ) given (for a special class of physically degraded WCs) by Fujita [20, Lemma 1,

R
CSI-1 (p(u), p(x|u, s a , t a )) = min I(U ; S r Y ) − I(U ; T r Z) − 2H(S a T a |S r U Y ) +H(S a T a |T r U Z) − H(S a T a |S r U Y ),

Fig. 6 .
Fig.6.Examples 1 and 2 as a generalization of Chia and E1 Gamal[16]: CSIs available at Alice and Bob are the same Sa (states S, T may be correlated).

Fig. 7 .
Fig. 7. Example 3 as a generalization of Fujita [20]: No CSI available at Bob, but CSIs available at Alice and Eve (states S, T may be correlated).

Furthermore, we have
established also Theorems 3 to give lower bounds for WC with multi-way CSI and to obtain a unified view about the systems with various directions of CSIs available among Alice, Bob and Eve.To obtain Theorem 3, we have invoked a simple reduction principle which enabled us to derive Theorem 3 directly from Theorem 1 without any extra proofs.The significance of this general theorem was illustrated in Examples 1

R
CSI-2 (p(u), p(x|u, s a , t a )) = min H(S a T a |U T r Z) − H(T a |S a U Y ),I(U ; S a Y ) − H(T a |S a U Y ) .Let us consider the WC with CSI as in Fig.6with the secret key K j = κ(S aj , T aj ).