Polar Coding for Confidential Broadcasting

Abstract

A polar coding scheme is proposed for the Wiretap Broadcast Channel with two legitimate receivers and one eavesdropper. We consider a model in which the transmitter wishes to send the same private (non-confidential) message and the same confidential message reliably to two different legitimate receivers, and the confidential message must also be (strongly) secured from the eavesdropper. The coding scheme aims to use the optimal rate of randomness and does not make any assumption regarding the symmetry or degradedness of the channel. This paper extends previous work on polar codes for the wiretap channel by proposing a new chaining construction that allows to reliably and securely send the same confidential message to two different receivers. This construction introduces new dependencies between the random variables involved in the coding scheme that need to be considered in the secrecy analysis.

1. Introduction

Information-theoretic security over noisy channels was introduced by Wyner in [1], which characterized the secrecy-capacity of the degraded wiretap channel. Later, Csiszár and Körner in [2] generalized Wyner’s results to the general wiretap channel. In these settings, one transmitter wishes to reliably send one message to a legitimate receiver, while keeping it secret from an eavesdropper, where secrecy is defined based on a condition of some information-theoretic measure that is fully quantifiable. One of these measures is the information leakage, defined as the mutual information $I(W;Z^n)$ between a uniformly distributed random message W and the channel observations $Z^n$ at the eavesdropper, n being the number of uses of the channel. Based on this measure, the most common secrecy conditions required to be satisfied by channel codes are the weak secrecy, which requires ${lim}_{n\to \infty }\frac{1}{n}I(W;Z^n)=0$, and the strong secrecy, requiring ${lim}_{n\to \infty }I(W;Z^n)=0$. Although the second notion of security is stronger, surprisingly both conditions result in the same secrecy-capacity [3].

In the last decade, information-theoretic security has been extended to a large variety of contexts, and polar codes have become increasingly popular in this area, due to their easily provable secrecy capacity achieving property. Polar codes were originally proposed by Arikan in [4] to achieve the capacity of binary-input, symmetric, and point-to-point channels under Successive Cancellation (SC) decoding. Secrecy capacity achieving polar codes for the binary symmetric degraded wiretap channel were introduced in [5,6], satisfying the weak and the strong secrecy condition, respectively. Recently, polar coding has been extended to the general wiretap channel in [7,8,9,10] and to different multiuser scenarios (for instance, see [11,12]). Indeed, [9,10] generalize their results providing polar codes for the broadcast channel with confidential messages.

This paper provides a polar coding scheme that allows to transmit strongly confidential common information to two legitimate receivers over the Wiretap Broadcast Channel (WTBC). Although [13] provided an obvious lower-bound on the secrecy-capacity of this model, no constructive polar coding scheme has already been proposed so far. Our polar coding scheme is based mainly on the one introduced by [10] for the broadcast channel with confidential messages. Therefore, the proposed polar coding scheme aims to use the optimal amount of randomness in the encoding. Moreover, in order to construct an explicit polar coding scheme that provides strong secrecy, the distribution induced by the encoder must be close in terms of the statistical distance to the original one considered for the code construction, and transmitter and legitimate receivers need to share a secret key of negligible size in terms of rate. Nevertheless, the particularization for the model proposed in this paper is not straightforward. Specifically, we propose a new chaining construction [14] (transmission will take place over several blocks) that is crucial to secretly transmit common information to different legitimate receivers. Indeed, this model generalizes, in part, the one described in [10], where the confidential message is intended only for one legitimate receiver, and the one in [15], which considers only the transmission of non-confidential messages intended for two different receivers. The proposed chaining introduces new bidirectional dependencies between encoding random variables of adjacent blocks that must be considered carefully in the secrecy analysis. Indeed, we need to make use of an additional secret key of negligible size in terms of rate that is privately shared between transmitter and legitimate receivers, which will be used to prove that dependencies between blocks can be broken and, therefore, the strong secrecy condition will be satisfied.

1.1. Notation

Throughout this paper, let $[n]=\{1,\dots ,n\}$ for $n\in {\mathbb{Z}}^{+}$, $a^n$ denotes a row vector $(a(1),\dots ,a(n))$. We write $a^{1:j}$ for $j\in [n]$ to denote the subvector $(a(1),\dots ,a(j))$. Let $\mathcal{A}\subset [n]$, then we write $a[\mathcal{A}]$ to denote the sequence ${\{a(j)\}}_{j\in \mathcal{A}}$, and we use ${\mathcal{A}}^{\mathrm{C}}$ to denote the set complement with respect to the universal set $[n]$, that is, ${\mathcal{A}}^{\mathrm{C}}=[n]\setminus \mathcal{A}$. If $\mathcal{A}$ denotes an event, then ${\mathcal{A}}^{\mathrm{C}}$ also denotes its complement. We use ln to denote the natural logarithm, whereas log denotes the logarithm base 2. Let X be a random variable taking values in $\mathcal{X}$, and let $q_x$ and $p_x$ be two different distributions with support $\mathcal{X}$, then $\mathbb{D}(q_x,p_x)$ and $\mathbb{V}(q_x,p_x)$ denote the Kullback–Leibler divergence and the total variation distance respectively. Finally, $h_2(p)$ denotes the binary entropy function, i.e., $h_2(p)=-plogp-(1-p)log(1-p)$.

1.2. Organization

The remainder of this paper is organized as follows. Section 2 introduces the channel model formally. In Section 3, the fundamental theorems of polar codes are revisited. Section 4 describes the proposed polar coding scheme, and Section 5 proves that this polar coding scheme achieves the best known inner-bound on the secrecy-capacity of this model. Finally, the concluding remarks are presented in Section 6.

2. Channel Model and Achievable Region

Formally, a WTBC $(\mathcal{X},p_{Y_{(1)}{Y}_{(2)}Z|X},{\mathcal{Y}}_{(1)}\times {\mathcal{Y}}_{(2)}\times \mathcal{Z})$ with 2 legitimate receivers and an external eavesdropper is characterized by the probability transition function $p_{Y_{(1)}{Y}_{(2)}Z|X}$, where $X\in \mathcal{X}$ denotes the channel input, $Y_{(k)}\in {\mathcal{Y}}_{(k)}$ denotes the channel output corresponding to the legitimate Receiver $k\in [1,2]$, and $Z\in \mathcal{Z}$ denotes the channel output corresponding to the eavesdropper. We consider a model, namely Common Information over the Wiretap Broadcast Channel (CI-WTBC), in which the transmitter wishes to send a private message W and a confidential message S to both legitimate receivers. A code $\left(\lceil 2^{n{R}_W}\rceil ,\lceil 2^{n{R}_S}\rceil ,\lceil 2^{n{R}_R}\rceil ,n\right)$ for the CI-WTBC consists of a private message set $\mathcal{W}\triangleq \left[1,\lceil 2^{n{R}_W}\rceil \right]$, a confidential message set $\mathcal{S}\triangleq \left[1,\lceil 2^{n{R}_S}\rceil \right]$, a randomization sequence set $\mathcal{R}\triangleq \left[1,\lceil 2^{n{R}_R}\rceil \right]$ (needed to confuse the eavesdropper about the confidential message S), an encoding function $f:\mathcal{W}\times \mathcal{S}\times \mathcal{R}\to {\mathcal{X}}^n$ that maps $(w,s,r)$ to a codeword $x^n$, and two decoding functions $g_{(1)}$ and $g_{(2)}$ such that $g_{(k)}:{\mathcal{Y}}_{(k)}^n\to \mathcal{W}\times \mathcal{S}$ ($k\in [1,2]$) maps the k-th legitimate receiver observations $y_{(k)}^n$ to the estimates $({\widehat{w}}^{(k)},{\widehat{s}}^{(k)})$. The reliability condition to be satisfied by this code is measured in terms of the average probability of error and is given by

$$\begin{array}{c}\hfill \underset{n\to \infty }{lim}\mathbb{P}\left[(W,S)\ne ({\widehat{W}}^{(k)},{\widehat{S}}^{(k)})\right]=0,k\in [1,2].\end{array}$$

(1)

The strong secrecy condition is measured in terms of the information leakage and is given by

$$\begin{array}{c}\hfill \underset{n\to \infty }{lim}I\left(S;Z^n\right)=0.\end{array}$$

(2)

This model is graphically illustrated in Figure 1. A triple of rates $(R_W,R_S,R_R)\in {\mathbb{R}}_{+}^3$ will be achievable for the CI-WTBC if there exists a sequence of $(\lceil 2^{n{R}_W}\rceil ,\lceil 2^{n{R}_S}\rceil ,\lceil 2^{n{R}_R}\rceil ,n)$ codes such that satisfy the reliability and secrecy conditions (1) and (2), respectively.

The achievable rate region is defined as the closure of the set of all achievable rate triples $(R_W,R_S,R_R)$. The following proposition defines an inner-bound on this region.

Proposition 1

(Adapted from [13,16]). The region ${\mathfrak{R}}_{\mathrm{CI}-\mathrm{WTBC}}$ defined by the union over the triples of rates $(R_W,R_S,R_R)\in {\mathbb{R}}_{+}^3$ satisfying

$$\begin{array}{cc}\hfill R_W+R_S& \le min\left\{I(V;Y_{(1)}),I(V;Y_{(2)})\right\},\hfill \\ \hfill R_S& \le min\left\{I(V;Y_{(1)}),I(V;Y_{(2)})\right\}-I(V;Z),\hfill \\ \hfill R_W+R_R& \ge I(X;Z),\hfill \\ \hfill R_R& \ge I(X;Z|V),\hfill \end{array}$$

where the union is taken over all distributions $p_{VX}$ such that $V-X-(Y_{(1)},Y_{(2)},Z)$ forms a Markov chain, defines an inner-bound on the achievable region of the CI-WTBC.

In this model, the private message W introduces part of the randomness required to confuse the eavesdropper about the confidential message S, and the randomization sequence R denotes the additional randomness that is required for channel prefixing.

3. Review of Polar Codes

Let $(\mathcal{X}\times \mathcal{Y},p_{XY})$ be a Discrete Memoryless Source (DMS), where $X\in \{0,1\}$ (Throughout this paper, we assume binary polarization. Nevertheless, an extension to q-ary alphabets is possible [10,17,18]) and $Y\in \mathcal{Y}$. The polar transform over the n-sequence $X^n$, n being any power of 2, is defined as $U^n\triangleq X^n{G}_n$, where $G_n\triangleq {\left[\begin{array}{cc}1& 1\\ 1& 0\end{array}\right]}^{\otimes n}$ is the source polarization matrix [19]. Since $G_n=G_n^{-1}$, then $X^n=U^n{G}_n$.

The polarization theorem for source coding with side information [19] (Th. 1) states that the polar transform extracts the randomness of $X^n$ in the sense that, as $n\to \infty$, the set of indices $j\in [n]$ can be divided practically into two disjoint sets, namely ${\mathcal{H}}_{X|Y}^{(n)}$ and ${\mathcal{L}}_{X|Y}^{(n)}$, such that $U(j)$ for $j\in {\mathcal{H}}_{X|Y}^{(n)}$ is practically independent of $(U^{1:j-1},Y^n)$ and uniformly distributed, i.e., $H(U(j)|U^{1:j-1},Y^n)\to 1$, and $U(j)$ for $j\in {\mathcal{L}}_{X|Y}^{(n)}$ is almost determined by $(U^{1:j-1},Y^n)$, i.e., $H(U(j)|U^{1:j-1},Y^n)\to 0$. Formally, let

$$\begin{array}{cc}\hfill {\mathcal{H}}_{X|Y}^{(n)}& \triangleq \left\{j\in [n]:H\left(U(j)|U^{1:j-1},Y^n\right)\ge 1-{\delta }_n\right\},\hfill \\ \hfill {\mathcal{L}}_{X|Y}^{(n)}& \triangleq \left\{j\in [n]:H\left(U(j)|U^{1:j-1},Y^n\right)\le {\delta }_n\right\},\hfill \end{array}$$

where ${\delta }_n\triangleq 2^{-n^{\beta }}$ for some $\beta \in (0,\frac{1}{2})$. Then, by Lemma 4 of [10] we have ${lim}_{n\to \infty }\frac{1}{n}|{\mathcal{H}}_{X|Y}^{(n)}|=H(X|Y)$ and ${lim}_{n\to \infty }\frac{1}{n}|{\mathcal{L}}_{X|Y}^{(n)}|=1-H(X|Y)$, which imply that ${lim}_{n\to \infty }\frac{1}{n}|{({\mathcal{H}}_{X|Y}^{(n)})}^{\mathrm{C}}\setminus {\mathcal{L}}_{X|Y}^{(n)}|=0$, i.e., the number of elements that have not been polarized is asymptotically negligible in terms of rate. Furthermore, Th. 2 of [19] states that given $U[{({\mathcal{L}}_{X|Y}^{(n)})}^{\mathrm{C}}]$ and $Y^n$, $U[{\mathcal{L}}_{X|Y}^{(n)}]$ can be reconstructed using SC decoding with error probability in $O(n{\delta }_n)$. Alternatively, the previous sets can be defined based on the Bhattacharyya parameters ${\{Z(U(j)|U^{1:j-1},Y^n)\}}_{j=1}^n$ because both parameters polarize simultaneously Proposition 2 of [19]. It is worth mentioning that both the entropy terms and the Bhattacharyya parameters required to define these sets can be obtained deterministically from $p_{XY}$ and the algebraic properties of $G_n$ [20,21,22].

Similarly to ${\mathcal{H}}_{X|Y}^{(n)}$ and ${\mathcal{L}}_{X|Y}^{(n)}$, the sets ${\mathcal{H}}_X^{(n)}$ and ${\mathcal{L}}_X^{(n)}$ can be defined by considering that observations $Y^n$ are absent. A discrete memoryless channel $(\mathcal{X},p_{Y|X},\mathcal{Y})$ with some arbitrary $p_X$ can be seen as a DMS $(\mathcal{X}\times \mathcal{Y},p_X{p}_{Y|X})$. In channel polar coding, first we define ${\mathcal{H}}_{X|Y}^{(n)}$, ${\mathcal{L}}_{X|Y}^{(n)}$, ${\mathcal{H}}_X^{(n)}$ and ${\mathcal{L}}_X^{(n)}$ from the target distribution $p_X{p}_{Y|X}$ (polar construction). Then, based on the previous sets, the encoder somehow constructs (since the polar-based encoder will construct random variables that must approach the target distribution of the DMS, throughout this paper we use tilde above the random variables to emphazise this purpose) ${\tilde{U}}^n$ and applies the inverse polar transform ${\tilde{X}}^n={\tilde{U}}^n{G}_n$ with distribution ${\tilde{q}}_{X^n}$. Afterwards, the transmitter sends ${\tilde{X}}^n$ over the channel, which induces ${\tilde{Y}}^n\sim {\tilde{q}}_{Y^n}$. If $\mathbb{V}({\tilde{q}}_{X^n{Y}^n},p_{X^n{Y}^n})\to 0$, then the receiver can reliably reconstruct $\tilde{U}[{\mathcal{L}}_{X|Y}^{(n)}]$ from ${\tilde{Y}}^n$ and $\tilde{U}[{({\mathcal{L}}_{X|Y}^{(n)})}^{\mathrm{C}}]$ by using SC decoding [23].

4. Polar Coding Scheme

Let $(\mathcal{V}\times \mathcal{X}\times {\mathcal{Y}}_{(1)}\times {\mathcal{Y}}_{(2)}\times \mathcal{Z},p_{VX{Y}_{(1)}{Y}_{(2)}Z})$ denote the DMS that represents the input $(V,X)$ and output $(Y_{(1)},Y_{(2)},Z)$ random variables of the CI-WTBC, where $|\mathcal{V}|=|\mathcal{X}|\triangleq 2$. Without loss of generality, and to avoid the trivial case $R_S=0$ in Proposition 1, we assume that

$$\begin{array}{c}\hfill H(V|Z)>H(V|Y_{(1)})\ge H(V|Y_{(2)}).\end{array}$$

(3)

If $H(V|Y_{(1)})<H(V|Y_{(2)})$, one can simply exchange the role of $Y_{(1)}$ and $Y_{(2)}$ in the polar coding scheme described in Section 4. We propose a polar coding scheme that achieves the following rate triple,

$$\begin{array}{c}\hfill (R_W,R_S,R_R)=(I(V;Z),I(V;Y_{(1)})-I(V;Z),I(X;Z|V)),\end{array}$$

(4)

which corresponds to the one of the region in Proposition 1 such that the private and the confidential message rate are maximum and the amount of randomness is minimum.

For the input random variable V, we define the polar transform $A^n\triangleq V^n{G}_n$ and the sets

$$\begin{array}{cc}\hfill {\mathcal{H}}_V^{(n)}& \triangleq \left\{j\in [1,n]:H\left(A(j)|A^{1:j-1}\right)\ge 1-{\delta }_n\right\},\hfill \end{array}$$

(5)

$$\begin{array}{cc}\hfill {\mathcal{H}}_{V|Z}^{(n)}& \triangleq \left\{j\in [1,n]:H\left(A(j)|A^{1:j-1}{Z}^n\right)\ge 1-{\delta }_n\right\},\hfill \end{array}$$

(6)

$$\begin{array}{cc}\hfill {\mathcal{L}}_{V|Y_{(k)}}^{(n)}& \triangleq \left\{j\in [1,n]:H\left(A(j)|A^{1:j-1}{Y}_{(k)}^n\right)\le {\delta }_n\right\},k=1,2.\hfill \end{array}$$

(7)

For the input random variable X, we define $T^n\triangleq X^n{G}_n$ and the associated sets

$$\begin{array}{cc}\hfill {\mathcal{H}}_{X|V}^{(n)}& \triangleq \left\{j\in [1,n]:H\left(T(j)|T^{1:j-1}{V}^n\right)\ge 1-{\delta }_n\right\}.\hfill \end{array}$$

(8)

$$\begin{array}{cc}\hfill {\mathcal{H}}_{X|VZ}^{(n)}& \triangleq \left\{j\in [1,n]:H\left(T(j)|T^{1:j-1}{V}^n{Z}^n\right)\ge 1-{\delta }_n\right\}.\hfill \end{array}$$

(9)

We have $p_{A^n{T}^n}(a^n,t^n)=p_{V^n{X}^n}(a^n{G}_n,t^n{G}_n)$, due to the invertibility of $G_n$, and we write

$$\begin{array}{cc}\hfill p_{A^n{T}^n}(a^n,t^n)& =\left(\prod _{j=1}^n{p}_{A(j)|A^{1:j-1}}(a(j)|a^{1:j-1})\right)\left(\prod _{j=1}^n{p}_{T(j)|T^{1:j-1}{V}^n}(t(j)|t^{1:j-1},a^n{G}_n)\right).\hfill \end{array}$$

Consider that the encoding takes place over L blocks indexed by $i\in [1,L]$. At the i-th block, the encoder will construct ${\tilde{A}}_i^n$, which will carry the private and the confidential messages intended for both legitimate receivers. Additionally, the encoder will store into ${\tilde{A}}_i^n$ some elements from ${\tilde{A}}_{i-1}^n$ (if $i\in [2,L]$) and ${\tilde{A}}_{i+1}^n$ (if $i\in [1,L-1]$), so that both legitimate receivers are able to reliably reconstruct ${\tilde{A}}_{1:L}^n$. Then, given ${\tilde{V}}_i^n={\tilde{A}}_i^n{G}_n$, the encoder will perform the polar-based channel prefixing to construct ${\tilde{T}}_i^n$. Finally, it will obtain ${\tilde{X}}_i^n={\tilde{T}}_i^n{G}_n$, which will be transmitted over the WTBC, inducing the channel output observations $({\tilde{Y}}_{(1),i}^n,{\tilde{Y}}_{(2),i}^n,{\tilde{Z}}_i^n)$.

Consider the construction of ${\tilde{A}}_{1:L}^n$. Besides, sets in (5)–(7), define the partition of ${\mathcal{H}}_V^{(n)}$:

$$\begin{array}{cc}\hfill {\mathcal{G}}^{(n)}& \triangleq {\mathcal{H}}_{V|Z}^{(n)},\hfill \end{array}$$

(10)

$$\begin{array}{cc}\hfill {\mathcal{C}}^{(n)}& \triangleq {\mathcal{H}}_V^{(n)}\cap {\left({\mathcal{H}}_{V|Z}^{(n)}\right)}^{\mathrm{C}}.\hfill \end{array}$$

(11)

Moreover, we also define the following partition of the set ${\mathcal{G}}^{(n)}$:

$$\begin{array}{cc}\hfill {\mathcal{G}}_0^{(n)}& \triangleq {\mathcal{G}}^{(n)}\cap {\mathcal{L}}_{V|Y_{(1)}}^{(n)}\cap {\mathcal{L}}_{V|Y_{(2)}}^{(n)},\hfill \end{array}$$

(12)

$$\begin{array}{cc}\hfill {\mathcal{G}}_1^{(n)}& \triangleq {\mathcal{G}}^{(n)}\cap {\left({\mathcal{L}}_{V|Y_{(1)}}^{(n)}\right)}^{\mathrm{C}}\cap {\mathcal{L}}_{V|Y_{(2)}}^{(n)},\hfill \end{array}$$

(13)

$$\begin{array}{cc}\hfill {\mathcal{G}}_2^{(n)}& \triangleq {\mathcal{G}}^{(n)}\cap {\mathcal{L}}_{V|Y_{(1)}}^{(n)}\cap {\left({\mathcal{L}}_{V|Y_{(2)}}^{(n)}\right)}^{\mathrm{C}},\hfill \end{array}$$

(14)

$$\begin{array}{cc}\hfill {\mathcal{G}}_{1,2}^{(n)}& \triangleq {\mathcal{G}}^{(n)}\cap {\left({\mathcal{L}}_{V|Y_{(1)}}^{(n)}\right)}^{\mathrm{C}}\cap {\left({\mathcal{L}}_{V|Y_{(2)}}^{(n)}\right)}^{\mathrm{C}},\hfill \end{array}$$

(15)

and the following partition of the set ${\mathcal{C}}^{(n)}$:

$$\begin{array}{cc}\hfill {\mathcal{C}}_0^{(n)}& \triangleq {\mathcal{C}}^{(n)}\cap {\mathcal{L}}_{V|Y_{(1)}}^{(n)}\cap {\mathcal{L}}_{V|Y_{(2)}}^{(n)},\hfill \end{array}$$

(16)

$$\begin{array}{cc}\hfill {\mathcal{C}}_1^{(n)}& \triangleq {\mathcal{C}}^{(n)}\cap {\left({\mathcal{L}}_{V|Y_{(1)}}^{(n)}\right)}^{\mathrm{C}}\cap {\mathcal{L}}_{V|Y_{(2)}}^{(n)},\hfill \end{array}$$

(17)

$$\begin{array}{cc}\hfill {\mathcal{C}}_2^{(n)}& \triangleq {\mathcal{C}}^{(n)}\cap {\mathcal{L}}_{V|Y_{(1)}}^{(n)}\cap {\left({\mathcal{L}}_{V|Y_{(2)}}^{(n)}\right)}^{\mathrm{C}},\hfill \end{array}$$

(18)

$$\begin{array}{cc}\hfill {\mathcal{C}}_{1,2}^{(n)}& \triangleq {\mathcal{C}}^{(n)}\cap {\left({\mathcal{L}}_{V|Y_{(1)}}^{(n)}\right)}^{\mathrm{C}}\cap {\left({\mathcal{L}}_{V|Y_{(2)}}^{(n)}\right)}^{\mathrm{C}};\hfill \end{array}$$

(19)

These sets are graphically represented in Figure 2. Roughly speaking, $A[{\mathcal{H}}_V^{(n)}]$ is the nearly uniformly distributed part of $A^n$. Thus, ${\tilde{A}}_i[{\mathcal{H}}_V^{(n)}]$, $i\in [1,L]$, is suitable for storing uniformly distributed random sequences. The sequence $A[{\mathcal{H}}_{V|Z}^{(n)}]$ is almost independent of $Z^n$ and, hence, ${\tilde{A}}_i[{\mathcal{G}}^{(n)}]$ is suitable for storing information to be secured from the eavesdropper, whereas ${\tilde{A}}_i[{\mathcal{C}}^{(n)}]$ is not. Sets in (12)–(19) with subscript 1 (sets inside the red curve in Figure 2) form ${\mathcal{H}}_V^{(n)}\cap {\left({\mathcal{L}}_{V|Y_{(1)}}^{(n)}\right)}^{\mathrm{C}}$, while those with subscript 2 (sets inside the blue curve) form ${\mathcal{H}}_V^{(n)}\cap {\left({\mathcal{L}}_{V|Y_{(2)}}^{(n)}\right)}^{\mathrm{C}}$. From Th. 2 of [19,23], recall that ${\tilde{A}}_i\left[{\mathcal{H}}_V^{(n)}\cap {({\mathcal{L}}_{V|Y_{(k)}}^{(n)})}^{\mathrm{C}}\right]$ is the nearly uniformly distributed part of the sequence ${\tilde{A}}_i^n$ required by legitimate Receiver k to reliably reconstruct the entire sequence by performing SC decoding.

For sufficiently large n, assumption (3) imposes the following restriction on the size of the previous sets:

$$\begin{array}{c}\hfill |{\mathcal{G}}_1^{(n)}|-|{\mathcal{C}}_2^{(n)}|\ge |{\mathcal{G}}_2^{(n)}|-|{\mathcal{C}}_1^{(n)}|>|{\mathcal{C}}_{1,2}^{(n)}|-|{\mathcal{G}}_0^{(n)}|.\end{array}$$

(20)

The left-hand inequality in (20) holds from the fact that

$$\begin{array}{cc}\hfill & |{\mathcal{C}}_1^{(n)}\cup {\mathcal{G}}_1^{(n)}|-|{\mathcal{C}}_2^{(n)}\cup {\mathcal{G}}_2^{(n)}|\hfill \\ \hfill & =|{\mathcal{H}}_V^{(n)}\cap {\left({\mathcal{L}}_{V|Y_{(1)}}^{(n)}\right)}^{\mathrm{C}}\setminus {\mathcal{H}}_V^{(n)}\cap {\left({\mathcal{L}}_{V|Y_{(2)}}^{(n)}\right)}^{\mathrm{C}}|-|{\mathcal{H}}_V^{(n)}\cap {\left({\mathcal{L}}_{V|Y_{(2)}}^{(n)}\right)}^{\mathrm{C}}\setminus {\mathcal{H}}_V^{(n)}\cap {\left({\mathcal{L}}_{V|Y_{(1)}}^{(n)}\right)}^{\mathrm{C}}|\hfill \\ \hfill & =|{\mathcal{H}}_V^{(n)}\cap {\left({\mathcal{L}}_{V|Y_{(1)}}^{(n)}\right)}^{\mathrm{C}}|-|{\mathcal{H}}_V^{(n)}\cap {\left({\mathcal{L}}_{V|Y_{(2)}}^{(n)}\right)}^{\mathrm{C}}|\ge 0,\hfill \end{array}$$

where the positivity holds by Lemma 4 of [10] because, for any $k\in [1,2]$, we have

$$\begin{array}{cc}\hfill \frac{1}{n}|{\mathcal{H}}_V^{(n)}\cap {\left({\mathcal{L}}_{V|Y_{(k)}}^{(n)}\right)}^{\mathrm{C}}|& =\frac{1}{n}|{\mathcal{H}}_{V|Y_{(k)}}^{(n)}|+\frac{1}{n}|{\mathcal{H}}_V^{(n)}\cap {\left({\mathcal{L}}_{V|Y_{(k)}}^{(n)}\right)}^{\mathrm{C}}\setminus {\mathcal{H}}_{V|Y_{(k)}}^{(n)}|\stackrel{n\to \infty }{\to }H(V|Y_{(k)})\hfill \end{array}$$

Similarly, the right-hand inequality in (20) holds by Lemma 4 of [10] and the fact that

$$\begin{array}{cc}\hfill |{\mathcal{G}}_0^{(n)}\cup {\mathcal{G}}_2^{(n)}|-|{\mathcal{C}}_1^{(n)}\cup {\mathcal{C}}_{1,2}^{(n)}|& =|{\mathcal{H}}_{V|Z}^{(n)}\setminus {\mathcal{H}}_V^{(n)}\cap {\left({\mathcal{L}}_{V|Y_{(1)}}^{(n)}\right)}^{\mathrm{C}}|-|{\mathcal{H}}_V^{(n)}\cap {\left({\mathcal{L}}_{V|Y_{(1)}}^{(n)}\right)}^{\mathrm{C}}\setminus {\mathcal{H}}_{V|Z}^{(n)}|\hfill \\ \hfill & =|{\mathcal{H}}_{V|Z}^{(n)}|-|{\mathcal{H}}_V^{(n)}\cap {\left({\mathcal{L}}_{V|Y_{(1)}}^{(n)}\right)}^{\mathrm{C}}|.\hfill \end{array}$$

Thus, according to (20), we must consider four cases:

• $|{\mathcal{G}}_1^{(n)}|>|{\mathcal{C}}_2^{(n)}|$, $|{\mathcal{G}}_2^{(n)}|>|{\mathcal{C}}_1^{(n)}|$ and $|{\mathcal{G}}_0^{(n)}|\ge |{\mathcal{C}}_{1,2}^{(n)}|$;
• $|{\mathcal{G}}_1^{(n)}|>|{\mathcal{C}}_2^{(n)}|$, $|{\mathcal{G}}_2^{(n)}|>|{\mathcal{C}}_1^{(n)}|$ and $|{\mathcal{G}}_0^{(n)}|<|{\mathcal{C}}_{1,2}^{(n)}|$;
• $|{\mathcal{G}}_1^{(n)}|\ge |{\mathcal{C}}_2^{(n)}|$, $|{\mathcal{G}}_2^{(n)}|\le |{\mathcal{C}}_1^{(n)}|$ and $|{\mathcal{G}}_0^{(n)}|>|{\mathcal{C}}_{1,2}^{(n)}|$;
• $|{\mathcal{G}}_1^{(n)}|<|{\mathcal{C}}_2^{(n)}|$, $|{\mathcal{G}}_2^{(n)}|<|{\mathcal{C}}_1^{(n)}|$ and $|{\mathcal{G}}_0^{(n)}|>|{\mathcal{C}}_{1,2}^{(n)}|$.

4.1. General Polar-Based Encoding

The generic encoding process for all cases is summarized in Algorithm 1. For $i\in [1,L]$, let $W_i$ be a uniformly distributed vector of length $|{\mathcal{C}}^{(n)}|$ that represents the private message. The encoder forms ${\tilde{A}}_i[{\mathcal{C}}^{(n)}]$ by simply storing $W_i$. Indeed, if $i\in [1,L-1]$, notice that the encoder forms ${\tilde{A}}_{i+1}[{\mathcal{C}}^{(n)}]$ before constructing ${\tilde{A}}_i^n$ entirely. From ${\tilde{A}}_i[{\mathcal{C}}^{(n)}]$, $i\in [1,L]$, we define

$$\begin{array}{cc}\hfill {\Psi }_i^{(V)}& \triangleq {\tilde{A}}_i[{\mathcal{C}}_2^{(n)}],\hfill \end{array}$$

(21)

$$\begin{array}{cc}\hfill {\Gamma }_i^{(V)}& \triangleq {\tilde{A}}_i[{\mathcal{C}}_{1,2}^{(n)}],\hfill \end{array}$$

(22)

$$\begin{array}{cc}\hfill {\Theta }_i^{(V)}& \triangleq {\tilde{A}}_i[{\mathcal{C}}_1^{(n)}].\hfill \end{array}$$

(23)

Notice that $[{\Psi }_i^{(V)},{\Gamma }_i^{(V)}]={\tilde{A}}_i[{\mathcal{C}}_2^{(n)}\cup {\mathcal{C}}_{1,2}^{(n)}]$ is required by legitimate Receiver 2 to reliably estimate ${\tilde{A}}_i^n$ and, thus, the encoder will repeat $[{\Psi }_i^{(V)},{\Gamma }_i^{(V)}]$, if $i\in [1,L-1]$, conveniently in ${\tilde{A}}_{i+1}[{\mathcal{G}}^{(n)}]$ (the function form_A_G is responsible of the chaining construction and is described later). On the other hand, $[{\Theta }_i^{(V)},{\Gamma }_i^{(V)}]={\tilde{A}}_i[{\mathcal{C}}_1^{(n)}\cup {\mathcal{C}}_{1,2}^{(n)}]$ is required by legitimate Receiver 1. Nevertheless, in order to satisfy the strong secrecy condition in (2), $[{\Theta }_i^{(V)},{\Gamma }_i^{(V)}]$, $i\in [2,L]$, is not repeated directly into ${\tilde{A}}_{i-1}[{\mathcal{G}}^{(n)}]$, but the encoder copies instead ${\overline{\Theta }}_i^{(V)}$ and ${\overline{\Gamma }}_i^{(V)}$ obtained as follows. Let ${\kappa }_{\Theta }^{(V)}$ and ${\kappa }_{\Gamma }^{(V)}$ be uniformly distributed keys with length $|{\mathcal{C}}_1^{(n)}|$ and $|{\mathcal{C}}_{1,2}^{(n)}|$ respectively that are privately shared between transmitter and both legitimate receivers. For any $i\in [2,L]$, we define the sequences

$$\begin{array}{cc}\hfill {\overline{\Theta }}_i^{(V)}& \triangleq {\tilde{A}}_i[{\mathcal{C}}_1^{(n)}]\oplus {\kappa }_{\Theta }^{(V)},\hfill \\ \hfill {\overline{\Gamma }}_i^{(V)}& \triangleq {\tilde{A}}_i[{\mathcal{C}}_{1,2}^{(n)}]\oplus {\kappa }_{\Gamma }^{(V)}.\hfill \end{array}$$

Since these secret keys are reused in all blocks, their size becomes negligible in terms of rate for L large enough. The need of these secret keys may not be obvious at this point, but a further discussion of this question can be found in Section 5.4. Indeed, they are required to prove independence between an eavesdropper’s observations of adjacent blocks (see Lemma 3), which is crucial to prove that the polar coding scheme satisfies the strong secrecy condition in (2).

The function form_A_G in Algorithm 1 constructs sequences ${\tilde{A}}_{1:L}[{\mathcal{G}}^{(n)}]$ differently depending on which case, among cases A, B, C or D described before, characterizes the given CI-WTBC. This part of the encoding is described in detail in Section 4.2 and Algorithm 2.

Then, given ${\tilde{A}}_i[{\mathcal{C}}^{(n)}\cup {\mathcal{G}}^{(n)}]$, the encoder forms the remaining entries of ${\tilde{A}}_i^n$, i.e., ${\tilde{A}}_i[{({\mathcal{H}}_V^{(n)})}^{\mathrm{C}}]$, as follows. If $j\in {\mathcal{L}}_V^{(n)}$, where ${\mathcal{L}}_V^{(n)}\triangleq \left\{j\in [1,n]:H\left(A(j)|A^{1:j-1}\right)\le {\delta }_n\right\}$, it constructs ${\tilde{A}}_i(j)$ deterministically by using SC encoding [24], and only ${\tilde{A}}_i[{({\mathcal{H}}_V^{(n)})}^{\mathrm{C}}\setminus {\mathcal{L}}_V^{(n)}]$ is constructed randomly.

Finally, given ${\tilde{V}}_i^n={\tilde{A}}_i^n{G}_n$, a randomization sequence $R_i$ and a uniformly distributed random sequence ${\Lambda }_0^{(V)}$, the encoder performs polar-based channel prefixing (function pb_ch_pref in Algorithm 1) to obtain ${\tilde{X}}_i^n$, which is transmitted over the WTBC inducing $\left({\tilde{Y}}_{(1),i}^n,{\tilde{Y}}_{(2),i}^n,{\tilde{Z}}_i^n\right)$. This part of the encoding is described in detail in Section 4.3.

Furthermore, the encoder obtains the sequence

$$\begin{array}{c}\hfill {\Phi }_{(k),i}^{(V)}\triangleq {\tilde{A}}_i\left[{\left({\mathcal{H}}_V^{(n)}\right)}^{\mathrm{C}}\cap {\left({\mathcal{L}}_{V|Y_{(k)}}^{(n)}\right)}^{\mathrm{C}}\right]\end{array}$$

for any $k\in [1,2]$ and $i\in [1,L]$, which is required by legitimate Receiver k to reliably estimate ${\tilde{A}}_i^n$ entirely. Since ${\Phi }_{(k),i}^{(V)}$ is not nearly uniform, the encoder cannot make it available to the legitimate Receiver k by means of the chaining structure. Furthermore, the encoder obtains

$$\begin{array}{cc}\hfill {{\rm Y}}_{(1)}^{(V)}& \triangleq {\tilde{A}}_1\left[{\mathcal{H}}_V^{(n)}\cap {({\mathcal{L}}_{V|Y_{(1)}}^{(n)})}^{\mathrm{C}}\right],\hfill \\ \hfill {{\rm Y}}_{(2)}^{(V)}& \triangleq {\tilde{A}}_L\left[{\mathcal{H}}_V^{(n)}\cap {({\mathcal{L}}_{V|Y_{(2)}}^{(n)})}^{\mathrm{C}}\right].\hfill \end{array}$$

The sequence ${{\rm Y}}_{(k)}^{(V)}$ is required by legitimate Receiver $k\in [1,2]$ to initialize the decoding process. Therefore, the transmitter additionally sends $\left({{\rm Y}}_{(k)}^{(V)},{\Phi }_{(k),i}^{(V)}\right)\oplus {\kappa }_{{{\rm Y}\Phi }_{(k)}}^{(V)}$ to legitimate Receiver k, where ${\kappa }_{{{\rm Y}\Phi }_{(k)}}^{(V)}$ is a uniformly distributed key with size

$$\begin{array}{c}\hfill L|{\left({\mathcal{H}}_V^{(n)}\right)}^{\mathrm{C}}\cap {\left({\mathcal{L}}_{V|Y_{(k)}}^{(n)}\right)}^{\mathrm{C}}|+|{\mathcal{H}}_V^{(n)}\cap {\left({\mathcal{L}}_{V|Y_{(k)}}^{(n)}\right)}^{\mathrm{C}}|\end{array}$$

that is privately shared between transmitter and the corresponding receiver. In Section 5.1 we show that the length of ${\kappa }_{{{\rm Y}\Phi }_{(1)}}^{(V)}$ and ${\kappa }_{{{\rm Y}\Phi }_{(2)}}^{(V)}$ is asymptotically negligible in terms of rate.

Algorithm 1 Generic encoding scheme

Require: Private and confidential messages $W_{1:L}$ and $S_{1:L}$; randomization sequences $R_{1:L}$; random sequence ${\Lambda }_0^{(X)}$; and secret keys ${\kappa }_{\Theta }^{(V)}$, ${\kappa }_{\Gamma }^{(V)}$, ${\kappa }_{{{\rm Y}\Phi }_{(1)}}^{(V)}$ and ${\kappa }_{{{\rm Y}\Phi }_{(2)}}^{(V)}$.

1: ${\Psi }_0^{(V)}$, ${\Gamma }_0^{(V)}$, ${\Pi }_0^{(V)}$, ${\Lambda }_0^{(V)}$, ${\overline{\Theta }}_{L+1}^{(V)}$, ${\overline{\Gamma }}_{L+1}^{(V)}\leftarrow ⌀$  2: ${\tilde{A}}_1[{\mathcal{C}}^{(n)}]\leftarrow W_1$  3: ${\Psi }_1^{(V)},{\Gamma }_1^{(V)}\leftarrow {\tilde{A}}_1[{\mathcal{C}}^{(n)}]$  4: for$i=1$ to L do  5:     if $i\ne L$ then  6:         ${\tilde{A}}_{i+1}[{\mathcal{C}}^{(n)}]\leftarrow W_{i+1}$  7:         ${\Psi }_{i+1}^{(V)},{\Gamma }_{i+1}^{(V)},{\overline{\Theta }}_{i+1}^{(V)},{\overline{\Gamma }}_{i+1}^{(V)}\leftarrow \left({\tilde{A}}_{i+1}[{\mathcal{C}}^{(n)}],{\kappa }_{\Theta }^{(V)},{\kappa }_{\Gamma }^{(V)}\right)$  8:     end if  9:     ${\tilde{A}}_i\left[{\mathcal{G}}^{(n)}\right]$, ${\Pi }_i^{(V)}$, ${\Lambda }_i^{(V)}\leftarrow$form_AG$\left(i,S_i,{\overline{\Theta }}_{i+1}^{(V)},{\overline{\Gamma }}_{i+1}^{(V)},{\Psi }_{i-1}^{(V)},{\Gamma }_{i-1}^{(V)},{\Pi }_{i-1}^{(V)},{\Lambda }_{i-1}^{(V)}\right)$ 10:     if $i=1$then ${{\rm Y}}_{(1)}^{(V)}\leftarrow {\tilde{A}}_1\left[{\mathcal{H}}_V^{(n)}\cap {\left({\mathcal{L}}_{V|Y_{(1)}}^{(n)}\right)}^{\mathrm{C}}\right]$ 11:     if $i=L$then ${{\rm Y}}_{(2)}^{(V)}\leftarrow {\tilde{A}}_L\left[{\mathcal{H}}_V^{(n)}\cap {\left({\mathcal{L}}_{V|Y_{(2)}}^{(n)}\right)}^{\mathrm{C}}\right]$ 12:     for $j\in {\left({\mathcal{H}}_V^{(n)}\right)}^{\mathrm{C}}$ do 13:         if $j\in {\left({\mathcal{H}}_V^{(n)}\right)}^{\mathrm{C}}\setminus {\mathcal{L}}_V^{(n)}$ then 14:            ${\tilde{A}}_i(j)\leftarrow p_{A(j)|A^{1:j-1}}\left({\tilde{A}}_i(j)|{\tilde{A}}_i^{1:j-1}\right)$ 15:         else if $j\in {\mathcal{L}}_V^{(n)}$ then 16:            ${\tilde{A}}_i(j)\leftarrow {arg\; max}_{a\in \mathcal{V}}{p}_{A(j)|A^{1:j-1}}\left({\tilde{a}}_i(j)|{\tilde{A}}_i^{1:j-1}\right)$ 17:         end if 18:     end for 19:     ${\Phi }_{(1),i}^{(V)}\leftarrow {\tilde{A}}_i\left[{\left({\mathcal{H}}_V^{(n)}\right)}^{\mathrm{C}}\cap {\left({\mathcal{L}}_{V|Y_{(1)}}^{(n)}\right)}^{\mathrm{C}}\right]$ 20:     ${\Phi }_{(2),i}^{(V)}\leftarrow {\tilde{A}}_i\left[{\left({\mathcal{H}}_V^{(n)}\right)}^{\mathrm{C}}\cap {\left({\mathcal{L}}_{V|Y_{(2)}}^{(n)}\right)}^{\mathrm{C}}\right]$ 21:     ${\tilde{X}}_i^n,{\Lambda }_i^{(X)}\leftarrow \mathtt{pb\_ch\_pref}\left({\tilde{A}}_i^n{G}_n,R_i,{\Lambda }_{i-1}^{(X)}\right)$ 22: end for 23: Send $\left({\Phi }_{(k),i}^{(V)},{{\rm Y}}_{(k)}^{(V)}\right)\oplus {\kappa }_{{{\rm Y}\Phi }_{(k)}}^{(V)}$ to Receiver $k\in [1,2]$ 24: return${\tilde{X}}_{1:L}^n$

Algorithm 2 Function form_AG

Require:i, $S_i$, ${\overline{\Theta }}_{i+1}^{(V)}$, ${\overline{\Gamma }}_{i+1}^{(V)}$, ${\Psi }_{i-1}^{(V)}$, ${\Gamma }_{i-1}^{(V)}$, ${\Pi }_{i-1}^{(V)}$, ${\Lambda }_{i-1}^{(V)}$

1: Define ${\mathcal{R}}_1^{(n)}$, ${\mathcal{R}}_1^{\prime (n)}$, ${\mathcal{R}}_2^{(n)}$, ${\mathcal{R}}_2^{\prime (n)}$, ${\mathcal{R}}_{1,2}^{(n)}$, ${\mathcal{R}}_{1,2}^{\prime (n)}$, ${\mathcal{I}}^{(n)}$, ${\mathcal{R}}_{\mathrm{S}}^{(n)}$, ${\mathcal{R}}_{\Lambda }^{(n)}$ (depending on the case)  2: if$i=1$then${\tilde{A}}_1[{\mathcal{I}}^{(n)}\cup {\mathcal{G}}_1^{(n)}\cup {\mathcal{G}}_{1,2}^{(n)}]\leftarrow S_1$  3: if$i\in [2,L-1]$then${\tilde{A}}_i[{\mathcal{I}}^{(n)}]\leftarrow S_i$  4: if$i=L$then${\tilde{A}}_L[{\mathcal{I}}^{(n)}\cup {\mathcal{G}}_2^{(n)}]\leftarrow S_L$  5: ${\Psi }_{1,i-1}^{(V)}$, ${\Psi }_{2,i-1}^{(V)}\leftarrow {\Psi }_{i-1}^{(V)}$ (depending on the case)  6: ${\Gamma }_{1,i-1}^{(V)}$, ${\Gamma }_{2,i-1}^{(V)}\leftarrow {\Gamma }_{i-1}^{(V)}$ (depending on the case)  7: ${\overline{\Theta }}_{1,i+1}^{(V)}$, ${\overline{\Theta }}_{2,i+1}^{(V)}\leftarrow {\overline{\Theta }}_{i+1}^{(V)}$ (depending on the case)  8: ${\overline{\Gamma }}_{1,i+1}^{(V)}$, ${\overline{\Gamma }}_{2,i+1}^{(V)}\leftarrow {\overline{\Gamma }}_{i+1}^{(V)}$ (depending on the case)  9: ${\tilde{A}}_i[{\mathcal{R}}_{1,2}^{(n)}]\leftarrow {\Gamma }_{1,i-1}^{(V)}\oplus {\overline{\Gamma }}_{1,i+1}^{(V)}$ 10: ${\tilde{A}}_i[{\mathcal{R}}_{1,2}^{\prime (n)}]\leftarrow {\Psi }_{2,i-1}^{(V)}\oplus {\overline{\Theta }}_{2,i+1}^{(V)}$ 11: if$i\in [1,L-1]$then 12:     ${\tilde{A}}_i[{\mathcal{R}}_1^{(n)}]\leftarrow {\overline{\Theta }}_{1,i+1}^{(V)}$ 13:     ${\tilde{A}}_i[{\mathcal{R}}_1^{\prime (n)}]\leftarrow {\overline{\Gamma }}_{2,i+1}^{(V)}$ 14: end if 15: if$i\in [2,L]$then 16:     ${\tilde{A}}_i[{\mathcal{R}}_2^{(n)}]\leftarrow {\Psi }_{1,i-1}^{(V)}$ 17:     ${\tilde{A}}_i[{\mathcal{R}}_2^{\prime (n)}]\leftarrow {\Gamma }_{2,i-1}^{(V)}$ 18:     ${\tilde{A}}_i[{\mathcal{R}}_{\mathrm{S}}^{(n)}]\leftarrow {\Pi }_{i-1}^{(V)}$ 19:     ${\tilde{A}}_i[{\mathcal{R}}_{\Lambda }^{(n)}]\leftarrow {\Lambda }_{i-1}^{(V)}$ 20: end if 21: ${\Pi }_i^{(V)}\leftarrow {\tilde{A}}_i[{\mathcal{I}}^{(n)}\cap {\mathcal{G}}_2^{(n)}]$ 22: ${\Lambda }_i^{(V)}\leftarrow {\tilde{A}}_i[{\mathcal{R}}_{\Lambda }^{(n)}]$ 23: return the sequences ${\tilde{A}}_i\left[{\mathcal{G}}^{(n)}\right]$, ${\Pi }_i^{(V)}$ and ${\Lambda }_i^{(V)}$

4.2. Function form_A_G

The function form_A_G encodes the confidential messages $S_{1:L}$ and builds the chaining construction. Based on the sets in (10)–(19), let ${\mathcal{R}}_1^{(n)}\subseteq {\mathcal{G}}_0^{(n)}\cup {\mathcal{G}}_2^{(n)}$, ${\mathcal{R}}_1^{\prime (n)}\subseteq {\mathcal{G}}_2^{(n)}$, ${\mathcal{R}}_2^{(n)}\subseteq {\mathcal{G}}_1^{(n)}$, ${\mathcal{R}}_2^{\prime (n)}\subseteq {\mathcal{G}}_1^{(n)}$, ${\mathcal{R}}_{1,2}^{(n)}\subseteq {\mathcal{G}}_0^{(n)}$, ${\mathcal{R}}_{1,2}^{\prime (n)}\subseteq {\mathcal{G}}_0^{(n)}$, ${\mathcal{I}}^{(n)}\subseteq {\mathcal{G}}_0^{(n)}\cup {\mathcal{G}}_2^{(n)}$, ${\mathcal{R}}_{\mathrm{S}}^{(n)}\subseteq {\mathcal{G}}_1^{(n)}$ and ${\mathcal{R}}_{\Lambda }^{(n)}\subseteq {\mathcal{G}}_1^{(n)}$ form an additional partition of ${\mathcal{G}}^{(n)}$. The definition of ${\mathcal{R}}_1^{(n)}$, ${\mathcal{R}}_1^{\prime (n)}$, ${\mathcal{R}}_2^{(n)}$, ${\mathcal{R}}_2^{\prime (n)}$, ${\mathcal{R}}_{1,2}^{(n)}$ and ${\mathcal{R}}_{1,2}^{\prime (n)}$ will depend on the particular case (among A to D), while

$$\begin{array}{cc}\hfill {\mathcal{I}}^{(n)}& \triangleq \left({\mathcal{G}}_0^{(n)}\cup {\mathcal{G}}_2^{(n)}\right)\setminus \left({\mathcal{R}}_1^{(n)}\cup {\mathcal{R}}_1^{\prime (n)}\cup {\mathcal{R}}_{1,2}^{(n)}\cup {\mathcal{R}}_{1,2}^{\prime (n)}\right),\hfill \end{array}$$

(24)

$$\begin{array}{cc}\hfill {\mathcal{R}}_{\mathrm{S}}^{(n)}& \triangleq \mathrm{any}\mathrm{subset}\mathrm{of}{\mathcal{G}}_1^{(n)}\setminus \left({\mathcal{R}}_2^{(n)}\cup {\mathcal{R}}_2^{\prime (n)}\right)\mathrm{with}\mathrm{size}|{\mathcal{I}}^{(n)}\cap {\mathcal{G}}_2^{(n)}|,\hfill \end{array}$$

(25)

$$\begin{array}{cc}\hfill {\mathcal{R}}_{\Lambda }^{(n)}& \triangleq {\mathcal{G}}_{1,2}^{(n)}\cup \left({\mathcal{G}}_1^{(n)}\setminus \left({\mathcal{R}}_2^{(n)}\cup {\mathcal{R}}_2^{\prime (n)}\cup {\mathcal{R}}_{\mathrm{S}}^{(n)}\right)\right).\hfill \end{array}$$

(26)

For $i\in [1,L]$, let $S_i$ denote a uniformly distributed vector that represents the confidential message. The message $S_1$ has size $|{\mathcal{I}}^{(n)}\cup {\mathcal{G}}_1^{(n)}\cup {\mathcal{G}}_{1,2}^{(n)}|$; for $i\in [2,L-1]$, $S_i$ has size $|{\mathcal{I}}^{(n)}|$; and $S_L$ has size $|{\mathcal{I}}^{(n)}\cup {\mathcal{G}}_2^{(n)}|$. Furthermore, for $i\in [1,L]$, we write ${\Psi }_i^{(V)}\triangleq \left[{\Psi }_{1,i}^{(V)},{\Psi }_{2,i}^{(V)}\right]$, ${\Gamma }_i^{(V)}\triangleq \left[{\Gamma }_{1,i}^{(V)},{\Gamma }_{2,i}^{(V)}\right]$, ${\overline{\Theta }}_i^{(V)}\triangleq \left[{\overline{\Theta }}_{1,i}^{(V)},{\overline{\Theta }}_{2,i}^{(V)}\right]$ and ${\overline{\Gamma }}_i^{(V)}\triangleq \left[{\overline{\Gamma }}_{1,i}^{(V)},{\overline{\Gamma }}_{2,i}^{(V)}\right]$, where we define ${\Psi }_{p,i}$, ${\Gamma }_{p,i}$, ${\overline{\Theta }}_{p,i}$ and ${\overline{\Gamma }}_{p,i}$, for any $p\in [1,2]$, accordingly in each case.

This function, which is used in Case A to Case D, is described in Algorithm 2.

4.2.1. Case A

In this case, recall that $|{\mathcal{G}}_1^{(n)}|>|{\mathcal{C}}_2^{(n)}|$, $|{\mathcal{G}}_2^{(n)}|>|{\mathcal{C}}_1^{(n)}|$ and $|{\mathcal{G}}_0^{(n)}|\ge |{\mathcal{C}}_{1,2}^{(n)}|$. We define

$$\begin{array}{cc}\hfill {\mathcal{R}}_1^{(n)}& \triangleq \mathrm{any}\mathrm{subset}\mathrm{of}{\mathcal{G}}_2^{(n)}\mathrm{with}\mathrm{size}|{\mathcal{C}}_1^{(n)}|,\hfill \end{array}$$

(27)

$$\begin{array}{cc}\hfill {\mathcal{R}}_2^{(n)}& \triangleq \mathrm{any}\mathrm{subset}\mathrm{of}{\mathcal{G}}_1^{(n)}\mathrm{with}\mathrm{size}|{\mathcal{C}}_2^{(n)}|,\hfill \end{array}$$

(28)

$$\begin{array}{cc}\hfill {\mathcal{R}}_{1,2}^{(n)}& \triangleq \mathrm{any}\mathrm{subset}\mathrm{of}{\mathcal{G}}_0^{(n)}\mathrm{with}\mathrm{size}|{\mathcal{C}}_{1,2}^{(n)}|,\hfill \end{array}$$

(29)

and ${\mathcal{R}}_1^{\prime (n)}={\mathcal{R}}_2^{\prime (n)}={\mathcal{R}}_{1,2}^{\prime (n)}\triangleq \varnothing$. By the assumption of Case A, it is clear that ${\mathcal{R}}_1^{(n)}$, ${\mathcal{R}}_2^{(n)}$ and ${\mathcal{R}}_{1,2}^{(n)}$ exist. Furthermore, by (20), the set ${\mathcal{I}}^{(n)}$ exists, and so will ${\mathcal{R}}_{\mathrm{S}}^{(n)}$ because

$$\begin{array}{cc}\hfill |{\mathcal{G}}_1^{(n)}\setminus \left({\mathcal{R}}_2^{(n)}\cup {\mathcal{R}}_2^{\prime (n)}\right)|-|{\mathcal{I}}^{(n)}\cap {\mathcal{G}}_2^{(n)}|& =|{\mathcal{G}}_1^{(n)}\setminus \left({\mathcal{R}}_2^{(n)}\cup {\mathcal{R}}_2^{\prime (n)}\right)|-|\left({\mathcal{G}}_2^{(n)}\setminus {\mathcal{R}}_1^{(n)}\cup {\mathcal{R}}_1^{\prime (n)}\right)|\hfill \\ \hfill & =|{\mathcal{G}}_1^{(n)}|-|{\mathcal{C}}_2^{(n)}|-|{\mathcal{G}}_2^{(n)}|-|{\mathcal{C}}_1^{(n)}|\ge 0.\hfill \end{array}$$

These sets that form the partition of ${\mathcal{G}}^{(n)}$ in Case A can be seen in Figure 3, which also displays the encoding process that aims to construct ${\tilde{A}}_{1:L}\left[{\mathcal{H}}_V^{(n)}\right]={\tilde{A}}_{1:L}\left[{\mathcal{C}}^{(n)}\cup {\mathcal{G}}^{(n)}\right]$.

For $i\in [1,L]$, we define ${\Psi }_{1,i}^{(V)}\triangleq {\Psi }_i^{(V)}$, ${\Gamma }_{1,i}^{(V)}\triangleq {\Gamma }_i^{(V)}$, ${\overline{\Theta }}_{1,i}^{(V)}\triangleq {\overline{\Theta }}_i^{(V)}$, ${\overline{\Gamma }}_{1,i}^{(V)}\triangleq {\overline{\Gamma }}_i^{(V)}$ and, therefore, we have ${\Psi }_{2,i}^{(V)}={\Gamma }_{2,i}^{(V)}={\overline{\Theta }}_{2,i}^{(V)}={\overline{\Gamma }}_{2,i}^{(V)}\triangleq ⌀$.

From (18), we have ${\mathcal{C}}_2^{(n)}\subseteq {\mathcal{L}}_{V|Y_{(1)}}^{(n)}\setminus {\mathcal{L}}_{V|Y_{(2)}}^{(n)}$. Thus, the sequence ${\Psi }_{1,i-1}^{(V)}={\tilde{A}}_{i-1}\left[{\mathcal{C}}_2^{(n)}\right]$ is needed by legitimate Receiver 2 to reliably reconstruct ${\tilde{A}}_{i-1}^n$, but can be reliably inferred by legitimate Receiver 1 given ${\tilde{A}}_{i-1}\left[{({\mathcal{L}}_{V|Y_{(1)}}^{(n)})}^{\mathrm{C}}\right]$. Hence, according to Algorithm 2, the encoder repeats the entire sequence ${\Psi }_{1,i-1}^{(V)}$ in ${\tilde{A}}_i\left[{\mathcal{R}}_2^{(n)}]\subseteq {\tilde{A}}_i[{\mathcal{L}}_{V|Y_{(2)}}^{(n)}\setminus {\mathcal{L}}_{V|Y_{(1)}}^{(n)}\right]$.

Similarly, from (17), we have ${\mathcal{C}}_1^{(n)}\subseteq {\mathcal{L}}_{V|Y_{(2)}}^{(n)}\setminus {\mathcal{L}}_{V|Y_{(1)}}^{(n)}$. Thus, ${\Theta }_{1,i+1}^{(V)}={\tilde{A}}_{i+1}\left[{\mathcal{C}}_1^{(n)}\right]$ is needed by Receiver 1 to form ${\tilde{A}}_{i+1}^n$ but can be inferred by Receiver 2 given ${\tilde{A}}_{i+1}\left[{({\mathcal{L}}_{V|Y_{(2)}}^{(n)})}^{\mathrm{C}}\right]$. Hence, the encoder repeats the sequence ${\overline{\Theta }}_{1,i+1}^{(V)}$ in ${\tilde{A}}_i[{\mathcal{R}}_1^{(n)}]\subseteq {\tilde{A}}_i\left[{\mathcal{L}}_{V|Y_{(1)}}^{(n)}\setminus {\mathcal{L}}_{V|Y_{(2)}}^{(n)}\right]$.

Finally, from (19), ${\mathcal{C}}_{1,2}^{(n)}\subseteq {({\mathcal{L}}_{V|Y_{(2)}}^{(n)})}^{\mathrm{C}}\cap {({\mathcal{L}}_{V|Y_{(1)}}^{(n)})}^{\mathrm{C}}$. Thus, sequences ${\Gamma }_{1,i-1}^{(V)}={\tilde{A}}_{i-1}\left[{\mathcal{C}}_{1,2}^{(n)}\right]$ and ${\Gamma }_{1,i+1}^{(V)}={\tilde{A}}_{i+1}\left[{\mathcal{C}}_{1,2}^{(n)}\right]$ are needed by both receivers to form ${\tilde{A}}_{i-1}^n$ and ${\tilde{A}}_{i+1}^n$ respectively. Hence, the encoder repeats ${\Gamma }_{1,i-1}^{(V)}$ and ${\overline{\Gamma }}_{1,i+1}^{(V)}$ in ${\tilde{A}}_i\left[{\mathcal{R}}_{1,2}^{(n)}\right]\subseteq {\tilde{A}}_i\left[{\mathcal{L}}_{V|Y_{(1)}}^{(n)}\cap {\mathcal{L}}_{V|Y_{(2)}}^{(n)}\right]$. Indeed, both sequences are repeated in the same entries of ${\tilde{A}}_i[{\mathcal{G}}_0^{(n)}]$ by performing ${\Gamma }_{1,i-1}^{(V)}\oplus {\overline{\Gamma }}_{1,i+1}^{(V)}$. Since ${\Gamma }_{1,0}^{(V)}={\overline{\Gamma }}_{1,L+1}^{(V)}=⌀$, only ${\overline{\Gamma }}_{1,2}^{(V)}$ is repeated at Block 1 and ${\Gamma }_{1,L-1}^{(V)}$ at Block L.

Moreover, part of secret message $S_i$, $i\in [1,L]$, is stored into some entries of ${\tilde{A}}_i^n$ whose indices belong to ${\mathcal{G}}_2^{(n)}$. Thus, in any Block $i\in [2,L]$, the encoder repeats

$$\begin{array}{c}\hfill {\Pi }_{i-1}^{(V)}\triangleq {\tilde{A}}_{i-1}\left[{\mathcal{I}}^{(n)}\cap {\mathcal{G}}_2^{(n)}\right]\end{array}$$

in ${\tilde{A}}_i[{\mathcal{R}}_{\mathrm{S}}^{(n)}]\subseteq {\tilde{A}}_i[{\mathcal{L}}_{V|Y_{(2)}}^{(n)}\setminus {\mathcal{L}}_{V|Y_{(1)}}^{(n)}]$. Furthermore, it repeats

$$\begin{array}{c}\hfill {\Lambda }_{i-1}^{(V)}\triangleq {\tilde{A}}_{i-1}\left[{\mathcal{R}}_{\Lambda }^{(n)}\right]\end{array}$$

in ${\tilde{A}}_i[{\mathcal{R}}_{\Lambda }^{(n)}]$. Hence, notice that ${\Lambda }_1^{(V)}$ is replicated in all blocks.

4.2.2. Case B

In this case, $|{\mathcal{G}}_1^{(n)}|>|{\mathcal{C}}_2^{(n)}|$, $|{\mathcal{G}}_2^{(n)}|>|{\mathcal{C}}_1^{(n)}|$ and $|{\mathcal{G}}_0^{(n)}|<|{\mathcal{C}}_{1,2}^{(n)}|$. We define ${\mathcal{R}}_1^{(n)}$ and ${\mathcal{R}}_2^{(n)}$ as in (27) and (28) respectively, and ${\mathcal{R}}_{1,2}^{\prime (n)}\triangleq \varnothing$. Now, since $|{\mathcal{G}}_0^{(n)}|<|{\mathcal{C}}_{1,2}^{(n)}|$, only a part of ${\Gamma }_{i-1}^{(V)}$ and ${\overline{\Gamma }}_{i+1}^{(V)}$, $i\in [1,L]$, can be repeated in ${\tilde{A}}_i\left[{\mathcal{G}}_0^{(n)}\right]$. Thus, we define ${\mathcal{R}}_{1,2}^{(n)}\triangleq {\mathcal{G}}_0^{(n)}$ and

$$\begin{array}{cc}\hfill {\mathcal{R}}_1^{\prime (n)}& \triangleq \mathrm{any}\mathrm{subset}\mathrm{of}{\mathcal{G}}_2^{(n)}\setminus {\mathcal{R}}_1^{(n)}\mathrm{with}\mathrm{size}|{\mathcal{C}}_{1,2}^{(n)}|-|{\mathcal{G}}_0^{(n)}|,\hfill \end{array}$$

(30)

$$\begin{array}{cc}\hfill {\mathcal{R}}_2^{\prime (n)}& \triangleq \mathrm{any}\mathrm{subset}\mathrm{of}{\mathcal{G}}_1^{(n)}\setminus {\mathcal{R}}_2^{(n)}\mathrm{with}\mathrm{size}|{\mathcal{C}}_{1,2}^{(n)}|-|{\mathcal{G}}_0^{(n)}|.\hfill \end{array}$$

(31)

Obviously, ${\mathcal{R}}_{1,2}^{(n)}$ exists and, by the assumption of Case B, so do ${\mathcal{R}}_1^{(n)}$ and ${\mathcal{R}}_2^{(n)}$. By (20), ${\mathcal{R}}_1^{\prime (n)}$ exists and so does ${\mathcal{I}}^{(n)}$. Indeed, since ${\mathcal{G}}_0^{(n)}\setminus {\mathcal{R}}_{1,2}^{(n)}=\varnothing$, then ${\mathcal{I}}^{(n)}\subseteq {\mathcal{G}}_2^{(n)}$. Again, by the property in (20), ${\mathcal{R}}_2^{\prime (n)}$ exists and so does ${\mathcal{R}}_{\mathrm{S}}^{(n)}$ because

$$\begin{array}{cc}\hfill & |{\mathcal{G}}_1^{(n)}\setminus \left({\mathcal{R}}_2^{(n)}\cup {\mathcal{R}}_2^{\prime (n)}\right)|-|\left({\mathcal{G}}_2^{(n)}\setminus {\mathcal{R}}_1^{(n)}\cup {\mathcal{R}}_1^{\prime (n)}\right)|\hfill \\ \hfill & =|{\mathcal{G}}_1^{(n)}|-|{\mathcal{C}}_2^{(n)}|-\left(|{\mathcal{C}}_{1,2}^{(n)}|-|{\mathcal{G}}_0^{(n)}|\right)-\left(|{\mathcal{G}}_2^{(n)}|-|{\mathcal{C}}_1^{(n)}|-\left(|{\mathcal{C}}_{1,2}^{(n)}|-|{\mathcal{G}}_0^{(n)}|\right)\right)\hfill \\ \hfill & =|{\mathcal{G}}_1^{(n)}|-|{\mathcal{C}}_2^{(n)}|-|{\mathcal{G}}_2^{(n)}|+|{\mathcal{C}}_1^{(n)}|\ge 0.\hfill \end{array}$$

Indeed, since ${\mathcal{I}}^{(n)}\subseteq {\mathcal{G}}_2^{(n)}$, notice that $|{\mathcal{R}}_{\mathrm{S}}^{(n)}|=|{\mathcal{I}}^{(n)}|$. These sets that form the partition of ${\mathcal{G}}^{(n)}$ in Case B can be seen in Figure 4, which also displays the encoding process that aims to construct ${\tilde{A}}_{1:L}\left[{\mathcal{H}}_V^{(n)}\right]={\tilde{A}}_{1:L}\left[{\mathcal{C}}^{(n)}\cup {\mathcal{G}}^{(n)}\right]$.

In this case, for any $i\in [1,L]$, ${\Psi }_{1,i}^{(V)}\triangleq {\Psi }_i^{(V)}$, ${\overline{\Theta }}_{1,i}^{(V)}\triangleq {\overline{\Theta }}_i^{(V)}$ and ${\Psi }_{2,i}^{(V)}={\overline{\Theta }}_{2,i}^{(V)}\triangleq ⌀$; and we define ${\Gamma }_{1,i}^{(V)}$ and ${\overline{\Gamma }}_{1,i}^{(V)}$ as any part of ${\Gamma }_i^{(V)}$ and ${\overline{\Gamma }}_i^{(V)}$, respectively, with size $|{\mathcal{G}}_0^{(n)}|$, and ${\Gamma }_{2,i}^{(V)}$ and ${\overline{\Gamma }}_{2,i}^{(V)}$ as the remaining parts with size $|{\mathcal{C}}_{1,2}^{(n)}|-|{\mathcal{G}}_0^{(n)}|$. Now, the encoder copies ${\Gamma }_{1,i-1}^{(V)}\oplus {\overline{\Gamma }}_{1,i+1}^{(V)}$ into ${\tilde{A}}_i\left[{\mathcal{R}}_{1,2}^{(n)}\right]$, and ${\Gamma }_{2,i-1}^{(V)}$ and ${\overline{\Gamma }}_{2,i+1}^{(V)}$ into ${\tilde{A}}_i\left[{\mathcal{R}}_2^{\prime (n)}\right]$ and ${\tilde{A}}_i\left[{\mathcal{R}}_1^{\prime (n)}\right]$ respectively. Moreover, since ${\mathcal{I}}^{(n)}\subseteq {\mathcal{G}}_2^{(n)}$, notice that ${\Pi }_i^{(V)}=S_i$ for any $i\in [2,L-1]$.

4.2.3. Case C

In this case, recall that $|{\mathcal{G}}_1^{(n)}|\ge |{\mathcal{C}}_2^{(n)}|$, $|{\mathcal{G}}_2^{(n)}|\le |{\mathcal{C}}_1^{(n)}|$ and $|{\mathcal{G}}_0^{(n)}|>|{\mathcal{C}}_{1,2}^{(n)}|$. Hence, we define ${\mathcal{R}}_2^{(n)}$ and ${\mathcal{R}}_{1,2}^{(n)}$ as in (28) and (29) respectively, and ${\mathcal{R}}_1^{\prime (n)}={\mathcal{R}}_2^{\prime (n)}={\mathcal{R}}_{1,2}^{\prime (n)}\triangleq \varnothing$. On the other hand, since $|{\mathcal{G}}_2^{(n)}|\le |{\mathcal{C}}_1^{(n)}|$, now for $i\in [1,L-1]$ only a part of ${\overline{\Theta }}_{i+1}^{(V)}$ can be repeated entirely in ${\tilde{A}}_i\left[{\mathcal{G}}_2^{(n)}\right]$. Consequently, we define

$$\begin{array}{c}\hfill {\mathcal{R}}_1^{(n)}\triangleq \mathrm{the}\mathrm{union}\mathrm{of}{\mathcal{G}}_2^{(n)}\mathrm{with}\mathrm{any}\mathrm{subset}\mathrm{of}{\mathcal{G}}_0^{(n)}\setminus {\mathcal{R}}_{1,2}^{(n)}\mathrm{with}\mathrm{size}|{\mathcal{C}}_1^{(n)}|-|{\mathcal{G}}_2^{(n)}|.\end{array}$$

(32)

It is clear that ${\mathcal{R}}_2^{(n)}$ and ${\mathcal{R}}_{1,2}^{(n)}$ exist. By (20), ${\mathcal{R}}_1^{(n)}$ also exists and so does ${\mathcal{I}}^{(n)}$. Since ${\mathcal{R}}_1^{(n)}\supseteq {\mathcal{G}}_2^{(n)}$, then ${\mathcal{I}}^{(n)}\cap {\mathcal{G}}_2^{(n)}=\varnothing$ and ${\mathcal{R}}_{\mathrm{S}}^{(n)}=\varnothing$. These sets that form ${\mathcal{G}}^{(n)}$ are represented in Figure 5, which also displays the part of the encoding that aims to construct ${\tilde{A}}_{1:L}\left[{\mathcal{H}}_V^{(n)}\right]$.

In this case, for $i\in [1,L]$, we define ${\Psi }_{1,i}^{(V)}\triangleq {\Psi }_i^{(V)}$, ${\Gamma }_{1,i}^{(V)}\triangleq {\Gamma }_i^{(V)}$, ${\overline{\Theta }}_{1,i}^{(V)}\triangleq {\overline{\Theta }}_i^{(V)}$, ${\overline{\Gamma }}_{1,i}^{(V)}\triangleq {\overline{\Gamma }}_i^{(V)}$, and ${\Psi }_{2,i}^{(V)}={\Gamma }_{2,i}^{(V)}={\overline{\Theta }}_{2,i}^{(V)}={\overline{\Gamma }}_{2,i}^{(V)}\triangleq ⌀$. Moreover, note that ${\Pi }_i^{(V)}=⌀$ because ${\mathcal{I}}^{(n)}\cap {\mathcal{G}}_2^{(n)}=\varnothing$.

4.2.4. Case D

In this case, recall that $|{\mathcal{G}}_1^{(n)}|<|{\mathcal{C}}_2^{(n)}|$, $|{\mathcal{G}}_2^{(n)}|<|{\mathcal{C}}_1^{(n)}|$ and $|{\mathcal{G}}_0^{(n)}|>|{\mathcal{C}}_{1,2}^{(n)}|$. The sets that form the partition of ${\mathcal{G}}^{(n)}$ in Case D are defined below and can be seen in Figure 6, which also displays the encoding process that aims to construct of ${\tilde{A}}_{1:L}\left[{\mathcal{H}}_V^{(n)}\right]$.

As in Case A and Case C, since $|{\mathcal{G}}_0^{(n)}|>|{\mathcal{C}}_{1,2}^{(n)}|$ then we define the set ${\mathcal{R}}_{1,2}^{(n)}$ as in (29) and ${\mathcal{R}}_1^{\prime (n)}={\mathcal{R}}_2^{\prime (n)}\triangleq \varnothing$. On the other hand, since $|{\mathcal{G}}_1^{(n)}|<|{\mathcal{C}}_2^{(n)}|$, now for $i\in [2,L]$ only a part of ${\Psi }_{i-1}^{(V)}$ can be repeated entirely in ${\tilde{A}}_i[{\mathcal{G}}_1^{(n)}]$. Consequently, we define ${\mathcal{R}}_2^{(n)}\triangleq {\mathcal{G}}_1^{(n)}$ and

$$\begin{array}{c}\hfill {\mathcal{R}}_{1,2}^{\prime (n)}\triangleq \mathrm{any}\mathrm{subset}\mathrm{of}{\mathcal{G}}_0^{(n)}\setminus {\mathcal{R}}_{1,2}^{(n)}\mathrm{with}\mathrm{size}|{\mathcal{C}}_2^{(n)}|-|{\mathcal{G}}_1^{(n)}|.\end{array}$$

(33)

By (20), it is clear that ${\mathcal{R}}_{1,2}^{\prime (n)}$ exists. Now, despite $|{\mathcal{G}}_2^{(n)}|<|{\mathcal{C}}_1^{(n)}|$ as in Case C, the set ${\mathcal{R}}_1^{(n)}$ is not defined as in (32), but

$$\begin{array}{cc}\hfill {\mathcal{R}}_1^{(n)}& \triangleq \mathrm{the}\mathrm{union}\mathrm{of}{\mathcal{G}}_2^{(n)}\mathrm{with}\mathrm{any}\mathrm{subset}\hfill \\ \hfill & \mathrm{of}{\mathcal{G}}_0^{(n)}\setminus \left({\mathcal{R}}_{1,2}^{(n)}\cup {\mathcal{R}}_{1,2}^{\prime (n)}\right)\mathrm{with}\mathrm{size}|{\mathcal{C}}_1^{(n)}|-|{\mathcal{G}}_2^{(n)}|-\left(|{\mathcal{C}}_2^{(n)}|-|{\mathcal{G}}_1^{(n)}|\right),\hfill \end{array}$$

(34)

which exists because, by the assumption in (20), we have

$$\begin{array}{cc}\hfill & |{\mathcal{G}}_0^{(n)}\setminus \left({\mathcal{R}}_{1,2}^{(n)}\cup {\mathcal{R}}_{1,2}^{\prime (n)}\right)|-|{\mathcal{R}}_1^{(n)}|\hfill \\ \hfill & =|{\mathcal{G}}_0^{(n)}|-|{\mathcal{C}}_{1,2}^{(n)}|-|{\mathcal{C}}_2^{(n)}|+|{\mathcal{G}}_1^{(n)}|-\left(|{\mathcal{C}}_1^{(n)}|-|{\mathcal{G}}_2^{(n)}|-|{\mathcal{C}}_2^{(n)}|+|{\mathcal{G}}_1^{(n)}|\right)\hfill \\ \hfill & =|{\mathcal{G}}_0^{(n)}|-|{\mathcal{C}}_{1,2}^{(n)}|-|{\mathcal{C}}_1^{(n)}|+|{\mathcal{G}}_2^{(n)}|\ge 0.\hfill \end{array}$$

In this case, for $i\in [1,L]$, we set ${\Gamma }_{1,i}^{(V)}\triangleq {\Gamma }_i^{(V)}$, ${\overline{\Gamma }}_{1,i}^{(V)}\triangleq {\overline{\Gamma }}_i^{(V)}$ and ${\overline{\Gamma }}_{2,i}^{(V)}={\Gamma }_{2,i}^{(V)}\triangleq ⌀$. Furthermore, we define ${\Psi }_{1,i}^{(V)}$ as any part of ${\Psi }_i^{(V)}$ with size $|{\mathcal{G}}_1^{(n)}|$, and ${\Psi }_{2,i}^{(V)}$ as the remaining part with size $|{\mathcal{C}}_2^{(n)}|-|{\mathcal{G}}_1^{(n)}|$. Lastly, we define ${\overline{\Theta }}_{1,i}^{(V)}$ as any part ${\overline{\Theta }}_i^{(V)}$ with size $|{\mathcal{C}}_1^{(n)}|-\left(|{\mathcal{C}}_2^{(n)}|-|{\mathcal{G}}_1^{(n)}|\right)$, and ${\overline{\Theta }}_{2,i}^{(V)}$ as the remaining part with size $|{\mathcal{C}}_2^{(n)}|-|{\mathcal{G}}_1^{(n)}|$.

Thus, according to Algorithm 2, instead of repeating ${\Psi }_{2,i-1}^{(V)}$, that is, the part of ${\Psi }_{i-1}^{(V)}$ that does not fit in ${\tilde{A}}_i^n\left[{\mathcal{G}}_1^{(n)}\right]$, in a specific part of ${\tilde{A}}_i\left[{\mathcal{G}}_0^{(n)}\right]$, the encoder stores ${\Psi }_{2,i-1}^{(V)}\oplus {\overline{\Theta }}_{2,i+1}^{(V)}$ into ${\tilde{A}}_i\left[{\mathcal{R}}_{1,2}^{\prime (n)}\right]\subseteq {\tilde{A}}_i\left[{\mathcal{G}}_0^{(n)}\right]$, where ${\overline{\Theta }}_{2,i+1}^{(V)}$ denotes part of those elements of ${\overline{\Theta }}_{i+1}^{(V)}$ that do not fit in ${\tilde{A}}_i\left[{\mathcal{G}}_2^{(n)}\right]$. Furthermore, as in Case C, since ${\mathcal{I}}^{(n)}\cap {\mathcal{G}}_2^{(n)}=\varnothing$, we have ${\Pi }_i^{(V)}=⌀$.

4.3. Channel Prefixing

For $i\in [1,L]$, let $R_i$ be a uniformly distributed vector of length $|{\mathcal{H}}_{X|V}^{(n)}\setminus {\mathcal{H}}_{X|VZ}^{(n)}|$ that represents the randomization sequence. Furthermore, let ${\Lambda }_0^{(X)}$ be a uniformly distributed random sequence of size $|{\mathcal{H}}_{X|VZ}^{(n)}|$. The channel prefixing aims to construct ${\tilde{X}}_i^n={\tilde{T}}_i^n{G}_n$ and is summarized in Algorithm 3.

Algorithm 3 Function pb_ch_pref

Require:${\tilde{V}}_i^n$, $R_i$, ${\Lambda }_{i-1}^{(X)}$

1: ${\tilde{T}}_i\left[{\mathcal{H}}_{X|VZ}^{(n)}\right]\leftarrow {\Lambda }_{i-1}^{(X)}$  2: ${\tilde{T}}_i\left[{\mathcal{H}}_{X|V}^{(n)}\setminus {\mathcal{H}}_{X|VZ}^{(n)}\right]\leftarrow R_i$  3: for$j\in {\left({\mathcal{H}}_{X|V}^{(n)}\right)}^{\mathrm{C}}$do  4:     if $j\in {\left({\mathcal{H}}_{X|V}^{(n)}\right)}^{\mathrm{C}}\setminus {\mathcal{L}}_{X|V}^{(n)}$ then  5:         ${\tilde{T}}_i(j)\leftarrow p_{T(j)|T^{1:j-1}{V}^n}\left({\tilde{T}}_i(j)|{\tilde{T}}_i^{1:j-1}{\tilde{V}}_i^n\right)$  6:     else if $j\in {\mathcal{L}}_{X|V}^{(n)}$ then  7:         ${\tilde{T}}_i(j)\leftarrow {arg\; max}_{t\in \mathcal{X}}{p}_{T(j)|T^{1:j-1}{V}^n}\left(t|{\tilde{T}}_i^{1:j-1}{\tilde{V}}_i^n\right)$  8:     end if  9: end for 10: ${\tilde{X}}_i^n\leftarrow {\tilde{T}}_i^n{G}_n$ 11: ${\Lambda }_i^{(X)}\leftarrow {\tilde{T}}_i\left[{\mathcal{H}}_{X|V}^{(n)}\setminus {\mathcal{H}}_{X|VZ}^{(n)}\right]$ 12: return${\tilde{X}}_i^n$ and ${\Lambda }_i^{(X)}$

Notice that the sequence ${\Lambda }_0^{(X)}$ is copied in ${\tilde{T}}_i\left[{\mathcal{H}}_{X|VZ}^{(n)}\right]$ at any Block $i\in [1,L]$, while $R_i$ is stored into ${\tilde{T}}_i\left[{\mathcal{H}}_{X|V}^{(n)}\setminus {\mathcal{H}}_{X|VZ}^{(n)}\right]$. After forming ${\tilde{T}}_i\left[{\mathcal{H}}_{X|V}^{(n)}\right]$, and given the sequence ${\tilde{V}}_i^n\triangleq {\tilde{A}}_i^n{G}_n$, the encoder forms the remaining entries of ${\tilde{T}}_i^n$, that is, ${\tilde{T}}_i\left[{\left({\mathcal{H}}_{X|V}^{(n)}\right)}^{\mathrm{C}}\right]$ as follows. If $j\in {\mathcal{L}}_{X|V}^{(n)}$, where ${\mathcal{L}}_{V|X}^{(n)}\triangleq \left\{j\in [1,n]:H\left(T(j)|T^{1:j-1}{V}^n\right)\le {\delta }_n\right\}$, it constructs ${\tilde{T}}_i(j)$ deterministically by using SC encoding [24]. Otherwise, if $j\in ({\mathcal{H}}_{X|V}^{(n)}{)}^{\mathrm{C}}\setminus {\mathcal{L}}_{X|V}^{(n)}$, the encoder randomly draws ${\tilde{T}}_i(j)$ from distribution $p_{T(j)|T^{1:j-1}{V}^n}$.

4.4. Decoding

Consider that $\left({{\rm Y}}_{(k)}^{(V)},{\Phi }_{(k),1:L}^{(V)}\right)$, for all $k\in [1,2]$, is available to the k-th legitimate receiver. In the decoding process, both legitimate receivers form the estimates ${\widehat{A}}_{1:L}^n$ of ${\tilde{A}}_{1:L}^n$ and then obtain the messages $\left({\widehat{W}}_{1:L},{\widehat{S}}_{1:L}\right)$.

4.4.1. Legitimate Receiver 1

This receiver forms the estimates ${\widehat{A}}_{1:L}^n$ by going forward, i.e., from ${\widehat{A}}_1^n$ to ${\widehat{A}}_L^n$, and this process is summarized in Algorithm 4.

Algorithm 4 Decoding at legitimate Receiver 1

Require:${{\rm Y}}_{(1)}^{(V)}$, ${\Phi }_{(1),1:L}^{(V)}$, ${\kappa }_{\Theta }^{(V)}$ and ${\kappa }_{\Gamma }^{(V)}$, and ${\tilde{Y}}_{(1),1:L}^n$.

1: ${\widehat{A}}_1^n\leftarrow \left({{\rm Y}}_{(1)}^{(V)},{\Phi }_{(1),1}^{(V)},{\tilde{Y}}_{(1),1}^n\right)$  2: ${\widehat{\Lambda }}_{2:L}^{(V)}\leftarrow {\widehat{A}}_1\left[{\mathcal{R}}_{\Lambda }^{(n)}\right]$  3: for$i=1$ to $L-1$ do  4:     ${\widehat{\Psi }}_i^{(V)}\leftarrow {\widehat{A}}_i[{\mathcal{C}}_2^{(n)}]$  5:     ${\widehat{\Gamma }}_i^{(V)}\leftarrow {\widehat{A}}_i[{\mathcal{C}}_{1,2}^{(n)}]$  6:     ${\widehat{\overline{\Theta }}}_{i+1}^{(V)}\leftarrow \left({\widehat{A}}_i[{\mathcal{R}}_1^{(n)}],{\widehat{A}}_i[{\mathcal{R}}_{1,2}^{\prime (n)}]\oplus {\widehat{\Psi }}_{2,i-1}^{(V)}\right)$  7:     ${\widehat{\Theta }}_{i+1}^{(V)}\leftarrow {\widehat{\overline{\Theta }}}_{i+1}^{(V)}\oplus {\kappa }_{\Theta }^{(V)}$  8:     ${\widehat{\overline{\Gamma }}}_{i+1}^{(V)}\leftarrow \left({\widehat{A}}_i[{\mathcal{R}}_{1,2}^{(n)}]\oplus {\widehat{\Gamma }}_{1,i-1}^{(V)},{\widehat{A}}_i[{\mathcal{R}}_1^{\prime (n)}]\right)$  9:     ${\widehat{\Gamma }}_{i+1}^{(V)}\leftarrow {\widehat{\overline{\Gamma }}}_{i+1}^{(V)}\oplus {\kappa }_{\Gamma }^{(V)}$ 10:     ${\widehat{\Pi }}_i^{(V)}\leftarrow {\widehat{A}}_i[{\mathcal{I}}^{(n)}\cap {\mathcal{G}}_2^{(n)}]$ 11:     ${\widehat{{\rm Y}}}_{(1),i+1}^{\prime (V)}\leftarrow \left({\widehat{\Psi }}_{1,i}^{(V)},{\widehat{\Gamma }}_{2,i}^{(V)},{\widehat{\Theta }}_{i+1}^{(V)},{\widehat{\Gamma }}_{i+1}^{(V)},{\widehat{\Pi }}_i^{(V)},{\widehat{\Lambda }}_i^{(V)}\right)$ 12:     ${\widehat{A}}_{i+1}^n\leftarrow \left({\widehat{{\rm Y}}}_{(1),i+1}^{\prime (V)},{\Phi }_{(1),i+1}^{(V)},{\tilde{Y}}_{(1),i+1}^n\right)$ 13: end for

In all cases (among Case A to Case D), Receiver 1 constructs ${\widehat{A}}_1^n$ as follows. Given ${{\rm Y}}_{(1)}^{(V)}$ (all the elements inside the red curve at Block 1 in Figure 3, Figure 4, Figure 5 and Figure 6) and ${\Phi }_{(1),1}^{(V)}$, notice that Receiver 1 knows ${\tilde{A}}_1\left[{\left({\mathcal{L}}_{V|Y_{(1)}}^{(n)}\right)}^{\mathrm{C}}\right]$. Therefore, from $\left({{\rm Y}}_{(1)}^{(V)},{\Phi }_{(1),1}^{(V)}\right)$ and channel observations ${\tilde{Y}}_{(1),1}^n$, Receiver 1 performs SC decoding to form ${\widehat{A}}_1^n$. Moreover, since ${\Lambda }_1^{(V)}$ has been replicated in all blocks, legitimate Receiver 1 obtains ${\widehat{\Lambda }}_{2:L}^{(V)}={\widehat{A}}_1\left[{\mathcal{R}}_{\Lambda }^{(n)}\right]$ (gray pentagons in all blocks).

For $i\in [1,L-1]$, consider the construction of ${\widehat{A}}_{i+1}^n$. First, since ${\widehat{A}}_{1:i}^n$ have already been estimated, from ${\widehat{A}}_i^n$ Receiver 1 obtains ${\widehat{\Psi }}_i^{(V)}={\widehat{A}}_i\left[{\mathcal{C}}_2^{(n)}\right]$ (e.g., red circles at Block 2 in Figure 3, Figure 4, Figure 5 and Figure 6) and ${\widehat{\Gamma }}_i^{(V)}={\widehat{A}}_i\left[{\mathcal{C}}_{1,2}^{(n)}\right]$ (red triangles).

Furthermore, from ${\widehat{A}}_i^n$, Receiver 1 obtains ${\widehat{\Theta }}_{i+1}^{(V)}$ as follows. At Block 1, in all cases it gets ${\widehat{\overline{\Theta }}}_2^{(V)}={\tilde{A}}_1\left[{\mathcal{R}}_1^{(n)}\cup {\mathcal{R}}_{1,2}^{\prime (n)}\right]$ (all the red squares with a line through them at Block 1 in Figure 3, Figure 4, Figure 5 and Figure 6). At Block $i\in [2,L-1]$, we distinguish two situations:

• In Case D, Receiver 1 gets ${\widehat{\overline{\Theta }}}_{1,i+1}^{(V)}={\widehat{A}}_i\left[{\mathcal{R}}_1^{(V)}\right]$ (e.g., yellow squares with a line through them at Block 2 in Figure 6) and ${\widehat{\Psi }}_{2,i-1}^{(V)}\oplus {\widehat{\overline{\Theta }}}_{2,i+1}^{(V)}={\widehat{A}}_i\left[{\mathcal{R}}_{1,2}^{\prime (V)}\right]$ (yellow squares with a line through them overlapped by blue circles). Since ${\widehat{\Psi }}_{2,i-1}^{(V)}\subset {\widehat{A}}_{i-1}^n$ (blue circles) has already been estimated, Receiver 1 obtains ${\widehat{\overline{\Theta }}}_{2,i+1}^{(V)}={\widehat{\Psi }}_{2,i-1}^{(V)}\oplus {\widehat{A}}_i\left[{\mathcal{R}}_{1,2}^{\prime (V)}\right]$ (yellow squares with a line through them).
• Otherwise, in other cases, Receiver 1 obtains ${\widehat{\overline{\Theta }}}_{i+1}^{(V)}={\widehat{A}}_i\left[{\mathcal{R}}_1^{(n)}\right]$ directly (yellow squares with a line through them at Block 2 in Figure 3, Figure 4 and Figure 5).

Then, given ${\widehat{\overline{\Theta }}}_{i+1}^{(V)}=\left[{\widehat{\overline{\Theta }}}_{1,i+1}^{(V)},{\widehat{\overline{\Theta }}}_{2,i+1}^{(V)}\right]$, in all cases Receiver 1 recovers ${\widehat{\Theta }}_{i+1}^{(V)}={\widehat{\overline{\Theta }}}_{i+1}^{(V)}\oplus {\kappa }_{\Theta }^{(V)}$.

From ${\widehat{A}}_i^n$, Receiver 1 also obtains ${\widehat{\Gamma }}_{i+1}^{(V)}$ as follows. At Block 1, in all cases it gets ${\widehat{\overline{\Gamma }}}_2^{(V)}={\tilde{A}}_1\left[{\mathcal{R}}_{1,2}^{(n)}\cup {\mathcal{R}}_1^{\prime (n)}\right]$ directly (e.g., all red triangles with a line through them at Block 1 in Figure 3, Figure 4, Figure 5 and Figure 6). At Block $i\in [2,L-1]$, in all cases it obtains ${\widehat{\Gamma }}_{1,i-1}^{(V)}\oplus {\widehat{\overline{\Gamma }}}_{1,i+1}^{(V)}={\widehat{A}}_i\left[{\mathcal{R}}_{1,2}^{(n)}\right]$ (e.g., blue and yellow diamonds with a line through them at Block 2). Since ${\widehat{\Gamma }}_{1,i-1}^{(V)}\subset {\widehat{A}}_{i-1}^n$ (blue triangles) has already been estimated, Receiver 1 obtains ${\widehat{\overline{\Gamma }}}_{1,i+1}^{(V)}={\widehat{A}}_i\left[{\mathcal{R}}_{1,2}^{(n)}\right]\oplus {\widehat{\Gamma }}_{1,i-1}^{(V)}$ (yellow triangles with a line through them). Only in Case B, Receiver 1 obtains ${\widehat{\overline{\Gamma }}}_{2,i+1}^{(V)}={\widehat{A}}_i\left[{\mathcal{R}}_1^{\prime (n)}\right]$ (remaining yellow triangles with a line through them at Block 2 in Figure 4). Then, given ${\widehat{\overline{\Gamma }}}_{i+1}^{(V)}=\left[{\widehat{\overline{\Gamma }}}_{1,i+1}^{(V)},{\widehat{\overline{\Gamma }}}_{2,i+1}^{(V)}\right]$, in all cases Receiver 1 recovers ${\widehat{\Gamma }}_{i+1}^{(V)}={\widehat{\overline{\Gamma }}}_{i+1}^{(V)}\oplus {\kappa }_{\Gamma }^{(V)}$.

Lastly, only in Case A and Case B, Receiver 1 obtains ${\widehat{\Pi }}_i^{(V)}={\widehat{A}}_i\left[{\mathcal{I}}^{(n)}\cap {\mathcal{G}}_2^{(n)}\right]$ (e.g., purple crosses at Block 2 in Figure 3 and Figure 4).

Finally, define the sequence ${\widehat{{\rm Y}}}_{(1),i+1}^{\prime (V)}\triangleq \left[{\widehat{\Psi }}_{1,i}^{(V)},{\widehat{\Gamma }}_{2,i}^{(V)},{\widehat{\Theta }}_{i+1}^{(V)},{\widehat{\Gamma }}_{i+1}^{(V)},{\widehat{\Pi }}_i^{(V)},{\widehat{\Lambda }}_i^{(V)}\right]$. Notice that ${\widehat{{\rm Y}}}_{(1),i+1}^{\prime (V)}\supseteq {\widehat{A}}_{i+1}\left[{\mathcal{H}}_V^{(n)}\setminus {\mathcal{L}}_{V|Y_{(1)}}^{(n)}\right]$ (elements inside red curve at Block $i+1$ in Figure 3, Figure 4, Figure 5 and Figure 6). Therefore, Receiver 1 performs SC decoding to form ${\widehat{A}}_{i+1}^n$ by using ${\widehat{{\rm Y}}}_{(1),i+1}^{\prime (V)}$, ${\Phi }_{(1),i+1}^{(V)}$ and the channel observations ${\tilde{Y}}_{(1),i+1}^n$.

4.4.2. Legitimate Receiver 2

This receiver forms the estimates ${\widehat{A}}_{1:L}^n$ by going backward, i.e., from ${\widehat{A}}_L^n$ to ${\widehat{A}}_1^n$, and this process is summarized in Algorithm 5.

Algorithm 5 Decoding at legitimate Receiver 2

Require:${{\rm Y}}_{(2)}^{(V)}$, ${\Phi }_{(2),1:L}^{(V)}$, ${\kappa }_{\Theta }^{(V)}$ and ${\kappa }_{\Gamma }^{(V)}$, and ${\tilde{Y}}_{(2),1:L}^n$.

1: ${\widehat{A}}_L^n\leftarrow \left({{\rm Y}}_{(2)}^{(V)},{\Phi }_{(2),L}^{(V)},{\tilde{Y}}_{(2),L}^n\right)$  2: ${\widehat{\Lambda }}_{1:L-1}^{(V)}\leftarrow {\widehat{A}}_L\left[{\mathcal{R}}_{\Lambda }^{(n)}\right]$  3: for$i=L$ to 2 do  4:     ${\widehat{\overline{\Theta }}}_i^{(V)}\leftarrow {\widehat{A}}_i[{\mathcal{C}}_1^{(n)}]\oplus {\kappa }_{\Theta }^{(V)}$  5:     ${\widehat{\overline{\Gamma }}}_i^{(V)}\leftarrow {\widehat{A}}_i[{\mathcal{C}}_{1,2}^{(n)}]\oplus {\kappa }_{\Gamma }^{(V)}$  6:     ${\widehat{\Psi }}_{i-1}^{(V)}\leftarrow \left({\widehat{A}}_i[{\mathcal{R}}_2^{(n)}],{\widehat{A}}_i[{\mathcal{R}}_{1,2}^{\prime (n)}]\oplus {\widehat{\overline{\Theta }}}_{2,i+1}^{(V)}\right)$  7:     ${\widehat{\Gamma }}_{i-1}^{(V)}\leftarrow \left({\widehat{A}}_i[{\mathcal{R}}_{1,2}^{(n)}]\oplus {\widehat{\overline{\Gamma }}}_{1,i+1}^{(V)},{\widehat{A}}_i[{\mathcal{R}}_2^{\prime (n)}]\right)$  8:     ${\widehat{\Pi }}_{i-1}^{(V)}\leftarrow {\widehat{A}}_i[{\mathcal{R}}_{\mathrm{S}}^{(n)}]$  9:     ${{\rm Y}}_{(2),i-1}^{\prime (V)}\leftarrow \left({\widehat{\overline{\Theta }}}_{1,i}^{(V)},{\widehat{\overline{\Gamma }}}_{2,i}^{(V)},{\widehat{\Psi }}_{i-1}^{(V)},{\widehat{\Gamma }}_{i-1}^{(V)},{\widehat{\Pi }}_{i-1}^{(V)},{\widehat{\Lambda }}_{i-1}^{(V)}\right)$ 10:     ${\widehat{A}}_{i-1}^n\leftarrow \left({{\rm Y}}_{(2),i-1}^{\prime (V)},{\Phi }_{(2),i-1}^{(V)},{\tilde{Y}}_{(2),i-1}^n\right)$ 11: end for

In all cases (among Case A to Case D), Receiver 2 constructs ${\widehat{A}}_L^n$ as follows. Given ${{\rm Y}}_{(2)}^{(V)}$ (all the elements inside blue curve at Block 4 in Figure 3, Figure 4, Figure 5 and Figure 6) and ${\Phi }_{(2),L}^{(V)}$, notice that Receiver 2 knows ${\tilde{A}}_L\left[{\left({\mathcal{L}}_{V|Y_{(2)}}^{(n)}\right)}^{\mathrm{C}}\right]$. Hence, from $({{\rm Y}}_{(2)}^{(V)}$, ${\Phi }_{(2),L}^{(V)})$ and channel output observations ${\tilde{Y}}_{(2),L}^n$, Receiver 2 performs SC decoding to form ${\widehat{A}}_L^n$. Since ${\Lambda }_1^{(V)}$ has been replicated in all blocks, from ${\widehat{A}}_L^n$ it obtains ${\widehat{\Lambda }}_{1:L-1}^{(V)}={\widehat{A}}_L\left[{\mathcal{R}}_{\Lambda }^{(n)}\right]$ (gray pentagons at all blocks).

For $i\in [2,L]$, consider the construction of ${\widehat{A}}_{i-1}^n$. First, since ${\widehat{A}}_{i:L}^n$ have already been estimated, from ${\widehat{A}}_i^n$ Receiver 2 obtains the sequence ${\widehat{\Theta }}_i^{(V)}={\widehat{A}}_i\left[{\mathcal{C}}_1^{(n)}\right]$ (e.g., yellow squares at Block 3 in Figure 3, Figure 4, Figure 5 and Figure 6). Given ${\widehat{\Theta }}_i^{(V)}$, it computes ${\widehat{\overline{\Theta }}}_i^{(V)}={\widehat{\Theta }}_i^{(V)}\oplus {\kappa }_{\Theta }^{(V)}$ (yellow squares with a line through them). Furthermore, Receiver 2 obtains ${\widehat{\Gamma }}_i^{(V)}={\widehat{A}}_i\left[{\mathcal{C}}_{1,2}^{(n)}\right]$ (yellow triangles at Block 3 in Figure 3, Figure 4, Figure 5 and Figure 6). Given this sequence, it computes ${\widehat{\overline{\Gamma }}}_i^{(V)}={\widehat{\Gamma }}_i^{(V)}\oplus {\kappa }_{\Gamma }^{(V)}$ (yellow triangles with a line through them).

Furthermore, from ${\widehat{A}}_i^n$, Receiver 2 obtains ${\widehat{\Psi }}_{i-1}^{(V)}$ as follows. At block L, in all cases it gets ${\widehat{\Psi }}_{L-1}^{(V)}={\widehat{A}}_i\left[{\mathcal{R}}_2^{(n)}\cup {\mathcal{R}}_{1,2}^{\prime (n)}\right]$ directly (all yellow circles at Block L in Figure 3, Figure 4, Figure 5 and Figure 6). At Block $i\in [2,L-1]$, we distinguish two situations:

• In Case D, Receiver 2 obtains ${\widehat{\Psi }}_{1,i-1}^{(V)}={\widehat{A}}_i\left[{\mathcal{R}}_2^{(n)}\right]$ (e.g., red circles at Block 3 in Figure 6) and ${\widehat{\Psi }}_{2,i-1}^{(V)}\oplus {\widehat{\overline{\Theta }}}_{2,i+1}^{(V)}={\widehat{A}}_i\left[{\mathcal{R}}_{1,2}^{\prime (n)}\right]$ (cyan squares with a line through them overlapped by red circles). Since ${\widehat{\overline{\Theta }}}_{2,i+1}^{(V)}$ (cyan squares with a line through them) has already been estimated, it obtains ${\widehat{\Psi }}_{2,i-1}^{(V)}={\widehat{A}}_i\left[{\mathcal{R}}_{1,2}^{\prime (n)}\right]\oplus {\widehat{\overline{\Theta }}}_{2,i+1}^{(V)}$ (red circles).
• Otherwise, in other cases, Receiver 2 obtains directly ${\widehat{\Psi }}_{i-1}^{(V)}={\widehat{A}}_i\left[{\mathcal{R}}_2^{(n)}\right]$ (e.g., red circles at Block 3 in Figure 3, Figure 4 and Figure 5).

From ${\widehat{A}}_i^n$, Receiver 2 also obtains ${\widehat{\Gamma }}_{i-1}^{(V)}$ as follows. At block L, in all cases it gets ${\widehat{\overline{\Gamma }}}_{L-1}^{(V)}={\widehat{A}}_L\left[{\mathcal{R}}_{1,2}^{(n)}\cup {\mathcal{R}}_2^{\prime (n)}\right]$ (e.g., all yellow triangles at Block L in Figure 3, Figure 4, Figure 5 and Figure 6). At Block $i\in [2,L-1]$, in all cases Receiver 2 obtains ${\widehat{\Gamma }}_{1,i-1}^{(V)}\oplus {\widehat{\overline{\Gamma }}}_{1,i+1}^{(V)}={\widehat{A}}_i\left[{\mathcal{R}}_{1,2}^{(n)}\right]$ (e.g., red and cyan diamonds with a line through them at Block 3). Since ${\widehat{\overline{\Gamma }}}_{1,i+1}^{(V)}$ (cyan triangles with a line through them) has already been estimated, Receiver 2 obtains ${\widehat{\Gamma }}_{1,i-1}^{(V)}={\widehat{A}}_i\left[{\mathcal{R}}_{1,2}^{(n)}\right]\oplus {\widehat{\overline{\Gamma }}}_{1,i+1}^{(V)}$ (red triangles). Furthermore, only in Case B, Receiver 2 obtains the sequence ${\widehat{\Gamma }}_{2,i-1}^{(V)}={\widehat{A}}_i\left[{\mathcal{R}}_2^{\prime (n)}\right]$ (remaining red triangles at Block 3 in Figure 4).

Lastly, only in Case A and Case B, Receiver 2 obtains the sequence ${\widehat{\Pi }}_{i-1}^{(V)}={\widehat{A}}_i\left[{\mathcal{R}}_{\mathrm{S}}^{(n)}\right]$ (e.g., purple crosses at Block 3 in Figure 3 and Figure 4).

Finally, define the sequence ${{\rm Y}}_{(2),i-1}^{\prime (V)}\triangleq \left[{\widehat{\overline{\Theta }}}_{1,i}^{(V)},{\widehat{\overline{\Gamma }}}_{2,i}^{(V)},{\widehat{\Psi }}_{i-1}^{(V)},{\widehat{\Gamma }}_{i-1}^{(V)},{\widehat{\Pi }}_{i-1}^{(V)},{\widehat{\Lambda }}_{i-1}^{(V)}\right]$. Notice that ${{\rm Y}}_{(2),i-1}^{\prime (V)}\supseteq {\widehat{A}}_{i-1}\left[{\mathcal{H}}_V^{(n)}\setminus {\mathcal{L}}_{V|Y_{(2)}}^{(n)}\right]$ (elements inside blue curve at Block $i-1$ in Figure 3, Figure 4, Figure 5 and Figure 6). Thus, Receiver 2 performs SC decoding to form ${\widehat{A}}_{i-1}^n$ by using ${{\rm Y}}_{(2),i-1}^{\prime (V)}$, ${\Phi }_{(2),i-1}^{(V)}$ and ${\tilde{Y}}_{(2),i-1}^n$.

5. Performance of the Polar Coding Scheme

The analysis of the polar coding scheme of Section 4 leads to the following theorem.

Theorem 1.

Let $(\mathcal{X},p_{Y_{(1)}{Y}_{(2)}Z|X},{\mathcal{Y}}_{(1)}\times {\mathcal{Y}}_{(2)}\times \mathcal{Z})$ be an arbitrary WTBC, such that $\mathcal{X}\in \{0,1\}$. The polar coding scheme described in Section 4 achieves the corner point in Equation (4) of the region ${\mathfrak{R}}_{\mathrm{CI}-\mathrm{WTBC}}$ defined in Proposition 1.

The proof of Theorem 1 follows in four steps and is provided in the following subsections. In Section 5.1 we show that the polar coding scheme approaches the rate tuple in (4). In Section 5.2 we prove that the joint distribution of $({\tilde{V}}_i^n,{\tilde{X}}_i^n,{\tilde{Y}}_{(1),i}^n,{\tilde{Y}}_{(2),i}^n,{\tilde{Z}}_i^n)$, for all $i\in [1,L]$, is asymptotically indistinguishable of the one of the original DMS that is used for the polar code construction. Finally, in Section 5.3 and Section 5.4 we show that the polar coding scheme satisfies the reliability and the secrecy conditions (1) and (2) respectively.

5.1. Transmission Rates

We prove that the polar coding scheme described in Section 4 approaches the rate tuple in Equation (4). Furthermore, we show that the overall length of the secret keys ${\kappa }_{\Theta }^{(V)}$, ${\kappa }_{\Gamma }^{(V)}$, ${\kappa }_{{\rm Y}{\Phi }_{(1)}}^{(V)}$ and ${\kappa }_{{\rm Y}{\Phi }_{(2)}}^{(V)}$, and the additional randomness used in the encoding (besides the randomization sequences) are asymptotically negligible in terms of rate.

5.1.1. Private Message Rate

For $i\in [1,L]$, we have $W_i={\tilde{A}}_i\left[{\mathcal{C}}^{(n)}\right]$. According to the definition of ${\mathcal{C}}^{(n)}$ in (11), and since ${\mathcal{H}}_{V|Z}^{(n)}\subseteq {\mathcal{H}}_V^{(n)}$, the rate of $W_{1:L}$ is

$$\begin{array}{c}\hfill \frac{1}{nL}\sum _{i=1}^L|W_i|=\frac{1}{n}|{\mathcal{H}}_V^{(n)}\cap {\left({\mathcal{H}}_{V|Z}^{(n)}\right)}^{\mathrm{C}}|=\frac{1}{n}|{\mathcal{H}}_V^{(n)}|-\frac{1}{n}|{\mathcal{H}}_{V|Z}^{(n)}|\stackrel{n\to \infty }{\to }H(V)-H(V|Z)\end{array}$$

where the limit holds by Lemma 4 of [10]. Therefore, the private message rate achieved by the polar coding scheme is $R_W=I(V;Z)$, as in (4).

5.1.2. Confidential Message Rate

From Section 4.2, in all cases we have $S_1={\tilde{A}}_1\left[{\mathcal{I}}^{(n)}\cup {\mathcal{G}}_1^{(n)}\cup {\mathcal{G}}_{1,2}^{(n)}\right]$; for $i\in [2,L-1]$, we have $S_i={\tilde{A}}_i\left[{\mathcal{I}}^{(n)}\right]$; and $S_L={\tilde{A}}_L\left[{\mathcal{I}}^{(n)}\cup {\mathcal{G}}_2^{(n)}\right]$. Thus, we have

$$\begin{array}{cc}\hfill & \frac{1}{nL}\sum _{i=1}^L|S_i|\hfill \\ \hfill & =\frac{(L-2)}{nL}|{\mathcal{I}}^{(n)}|+\frac{1}{nL}\left(|{\mathcal{I}}^{(n)}\cup {\mathcal{G}}_1^{(n)}\cup {\mathcal{G}}_{1,2}^{(n)}|+|{\mathcal{I}}^{(n)}\cup {\mathcal{G}}_2^{(n)}|\right)\hfill \\ \hfill & =\frac{1}{n}|{\mathcal{I}}^{(n)}|+\frac{1}{nL}\left(|{\mathcal{G}}_1^{(n)}|+|{\mathcal{G}}_2^{(n)}|+|{\mathcal{G}}_{1,2}^{(n)}|\right)\hfill \\ \hfill & =\frac{1}{n}|{\mathcal{I}}^{(n)}|+\frac{1}{nL}|{\mathcal{G}}^{(n)}\setminus {\mathcal{G}}_0^{(n)}|\hfill \\ \hfill & \stackrel{(a)}{=}\frac{1}{n}\left(|{\mathcal{G}}_0^{(n)}|+|{\mathcal{G}}_2^{(n)}|-|{\mathcal{R}}_{1,2}^{(n)}|-|{\mathcal{R}}_{1,2}^{\prime (n)}|-|{\mathcal{R}}_1^{(n)}|-|{\mathcal{R}}_1^{\prime (n)}|\right)+\frac{1}{nL}|{\mathcal{G}}^{(n)}\setminus {\mathcal{G}}_0^{(n)}|\hfill \\ \hfill & \stackrel{(b)}{=}\frac{1}{n}\left(|{\mathcal{G}}_0^{(n)}|+|{\mathcal{G}}_2^{(n)}|-|{\mathcal{C}}_1^{(n)}|-|{\mathcal{C}}_{1,2}^{(n)}|\right)+\frac{|{\mathcal{G}}^{(n)}\setminus {\mathcal{G}}_0^{(n)}|}{nL}\hfill \\ \hfill & \stackrel{(c)}{\ge }\frac{1}{n}\left(|{\mathcal{H}}_{V|Z}^{(n)}\cap {\mathcal{L}}_{V|Y_{(1)}}^{(n)}|-|{\left({\mathcal{H}}_{V|Z}^{(n)}\right)}^{\mathrm{C}}\cap {\left({\mathcal{L}}_{V|Y_{(1)}}^{(n)}\right)}^{\mathrm{C}}|\right)+\frac{1}{nL}|{\mathcal{H}}_{V|Z}^{(n)}\cap {\left({\mathcal{L}}_{V|Y_{(1)}}^{(n)}\cap {\mathcal{L}}_{V|Y_{(2)}}^{(n)}\right)}^{\mathrm{C}}|\hfill \\ \hfill & \stackrel{(d)}{\ge }\frac{1}{n}\left(|{\mathcal{H}}_{V|Z}^{(n)}\cap {\mathcal{L}}_{V|Y_{(1)}}^{(n)}|-|{\left({\mathcal{H}}_{V|Z}^{(n)}\right)}^{\mathrm{C}}\cap {\left({\mathcal{L}}_{V|Y_{(1)}}^{(n)}\right)}^{\mathrm{C}}|\right)+\frac{1}{nL}|{\mathcal{H}}_{V|Z}^{(n)}|-\frac{1}{nL}|{\left({\mathcal{L}}_{V|Y_{(1)}}^{(n)}\right)}^{\mathrm{C}}|\hfill \\ \hfill & =\frac{1}{n}|{\mathcal{H}}_{V|Z}^{(n)}|-\frac{1}{n}|{\left({\mathcal{L}}_{V|Y_{(1)}}^{(n)}\right)}^{\mathrm{C}}|+\frac{1}{nL}|{\mathcal{H}}_{V|Z}^{(n)}|-\frac{1}{nL}|{\left({\mathcal{L}}_{V|Y_{(1)}}^{(n)}\right)}^{\mathrm{C}}|\hfill \\ \hfill & \stackrel{n\to \infty }{\to }H(V|Z)-H(V|Y_{(1)})+\frac{1}{L}\left(H(V|Z)-H(V|Y_{(1)})\right)\hfill \\ \hfill & \stackrel{L\to \infty }{\to }H(V|Z)-H(V|Y_{(1)})\hfill \end{array}$$

where $(a)$ holds by the definition of ${\mathcal{I}}^{(n)}$ in (24); $(b)$ holds because, in all cases, we have $|{\mathcal{R}}_{1,2}^{(n)}|+|{\mathcal{R}}_1^{\prime (n)}|=|{\mathcal{C}}_{1,2}^{(n)}|$ and $|{\mathcal{R}}_1^{(n)}|+|{\mathcal{R}}_{1,2}^{\prime (n)}|=|{\mathcal{C}}_1^{(n)}|$; $(c)$ follows from the partition of ${\mathcal{H}}_V^{(n)}$ defined in (12)–(19); $(d)$ follows from applying elementary set operations and because, by assumption, $H(V|Y_{(1)})\ge H(V|Y_{(2)})$, which means that $|{\left({\mathcal{L}}_{V|Y_{(1)}}^{(n)}\right)}^{\mathrm{C}}|\ge |{\left({\mathcal{L}}_{V|Y_{(2)}}^{(n)}\right)}^{\mathrm{C}}|$ (by Lemma 4 of [10]); and the limit when n goes to infinity holds also by Lemma 4 of [10]. Hence, the polar coding scheme operates as close to the rate $R_S$ in (4) as desired by choosing a sufficiently large L.

5.1.3. Randomization Sequence Rate

For $i\in [1,L]$, we have $R_i={\tilde{T}}_i\left[{\mathcal{H}}_{X|V}^{(n)}\cap {({\mathcal{H}}_{X|VZ}^{(n)})}^{\mathrm{C}}\right]$. Since ${\mathcal{H}}_{X|VZ}^{(n)}\supseteq {\mathcal{H}}_{X|V}^{(n)}$, we have

$$\begin{array}{cc}\hfill \frac{1}{nL}\sum _{i=1}^L|R_i|& =\frac{1}{n}|{\mathcal{H}}_{X|V}^{(n)}\cap {\left({\mathcal{H}}_{X|VZ}^{(n)}\right)}^{\mathrm{C}}|=\frac{1}{n}|{\mathcal{H}}_{X|V}^{(n)}|-\frac{1}{n}|{\mathcal{H}}_{X|VZ}^{(n)}|\stackrel{n\to \infty }{\to }H(X|Z)-H(X|VZ)\hfill \end{array}$$

where the limit holds by Lemma 4 of [10]. Thus, the randomization sequence rate used by the polar coding scheme is $R_R=I(X;Z|V)$ as in (4).

5.1.4. Private-Shared Sequence Rate

Transmitter and legitimate Receiver $k\in [1,2]$ must privately share the keys ${\kappa }_{\Theta }^{(V)}$, ${\kappa }_{\Gamma }^{(V)}$ and ${\kappa }_{{\rm Y}{\Phi }_{(k)}}^{(V)}$. Hence, the overall rate is

$$\begin{array}{cc}\hfill & \frac{1}{nL}\left(|{\kappa }_{\Theta }^{(V)}|+|{\kappa }_{\Gamma }^{(V)}|+\sum _{k=1}^2|{\kappa }_{{\rm Y}{\Phi }_{(k)}}^{(V)}|\right)\hfill \\ \hfill & =\frac{1}{nL}\left(|{\mathcal{C}}_1^{(n)}|+|{\mathcal{C}}_{1,2}^{(n)}|\right)+\frac{1}{nL}\sum _{k=1}^2\left(L|{\left({\mathcal{H}}_V^{(n)}\right)}^{\mathrm{C}}\cap {\left({\mathcal{L}}_{V|Y_{(k)}}^{(n)}\right)}^{\mathrm{C}}|+|{\mathcal{H}}_V^{(n)}\cap {\left({\mathcal{L}}_{V|Y_{(k)}}^{(n)}\right)}^{\mathrm{C}}|\right)\hfill \\ \hfill & \stackrel{(a)}{=}\frac{1}{nL}\left(|{\mathcal{H}}_V^{(n)}\cap {\left({\mathcal{H}}_{V|Z}^{(n)}\right)}^{\mathrm{C}}\cap {\left({\mathcal{L}}_{V|Y_{(1)}}^{(n)}\right)}^{\mathrm{C}}|\right)\hfill \\ \hfill & +\frac{1}{nL}\sum _{k=1}^2\left(L|{\left({\mathcal{H}}_V^{(n)}\right)}^{\mathrm{C}}\cap {\left({\mathcal{L}}_{V|Y_{(k)}}^{(n)}\right)}^{\mathrm{C}}|+|{\mathcal{H}}_V^{(n)}\cap {\left({\mathcal{L}}_{V|Y_{(k)}}^{(n)}\right)}^{\mathrm{C}}|\right)\hfill \\ \hfill & \stackrel{(b)}{\le }\frac{1}{nL}|{\left({\mathcal{L}}_{V|Y_{(1)}}^{(n)}\right)}^{\mathrm{C}}|+\frac{1}{nL}\sum _{k=1}^2\left(L|{\left({\mathcal{H}}_{V|Y_{(k)}}^{(n)}\right)}^{\mathrm{C}}\cap {\left({\mathcal{L}}_{V|Y_{(k)}}^{(n)}\right)}^{\mathrm{C}}|+|{\left({\mathcal{L}}_{V|Y_{(k)}}^{(n)}\right)}^{\mathrm{C}}|\right)\hfill \\ \hfill & \stackrel{n\to \infty }{\to }\frac{1}{L}\left(2H(V|Y_{(1)})+H(V|Y_{(2)})\right)\hfill \\ \hfill & \stackrel{L\to \infty }{\to }0,\hfill \end{array}$$

where $(a)$ follows from the definition of ${\mathcal{C}}_1^{(n)}$ and ${\mathcal{C}}_{1,2}^{(n)}$ in (17) and (19), respectively; $(b)$ follows from standard set properties and because ${\left({\mathcal{H}}_{V|Z}^{(n)}\right)}^{\mathrm{C}}\subseteq {\left({\mathcal{H}}_{V|Y_{(k)}}^{(n)}\right)}^{\mathrm{C}}$ for any $k\in [1,2]$; and the limit when n goes to infinity holds by Lemma 4 of [10].

5.1.5. Rate of the Additional Randomness

Besides the randomization sequences $R_{1:L}$, the encoder uses the random sequence ${\Lambda }_0^{(X)}$, with size $|{\mathcal{H}}_{X|V}^{(n)}|$, for the polar-based channel prefixing. Moreover, for $i\in [1,L]$, the encoder randomly draws those elements ${\tilde{A}}_i(j)$ such that $j\in {\left({\mathcal{H}}_V^{(n)}\right)}^{\mathrm{C}}\setminus {\mathcal{L}}_V^{(n)}$, and those elements ${\tilde{T}}_i(j)$ such that $j\in {\left({\mathcal{H}}_{X|V}^{(n)}\right)}^{\mathrm{C}}\setminus {\mathcal{L}}_{X|V}^{(n)}$. Nevertheless, we have

$$\begin{array}{cc}\hfill & \frac{1}{nL}\left(|{\mathcal{H}}_{X|V}^{(n)}|+L|{\left({\mathcal{H}}_V^{(n)}\right)}^{\mathrm{C}}\setminus {\mathcal{L}}_V^{(n)}|+L|{\left({\mathcal{H}}_{X|V}^{(n)}\right)}^{\mathrm{C}}\setminus {\mathcal{L}}_{X|V}^{(n)}|\right)\hfill \\ \hfill & \stackrel{n\to \infty }{\to }\frac{1}{L}H(X|V)\hfill \\ \hfill & \stackrel{L\to \infty }{\to }0,\hfill \end{array}$$

where the limit when n approaches to infinity follows from applying Lemma 4 of [10].

5.2. Distribution of the DMS after the Polar Encoding

For $i\in [1,L]$, let ${\tilde{q}}_{A_i^n{T}_i^n}$ denote the distribution of $({\tilde{A}}_i^n,{\tilde{T}}_i^n)$ after the encoding. The following lemma proves that ${\tilde{q}}_{A_i^n{T}_i^n}$ and the marginal distribution $p_{A^n{T}^n}$ of the original DMS are nearly statistically indistinguishable for sufficiently large n and, consequently, so are ${\tilde{q}}_{V_i^n{X}_i^n{Y}_{(1),i}^n{Y}_{(2),i}^n{Z}_i^n}$ and $p_{V^n{X}^n{Y}_{(1)}^n{Y}_{(2)}^n{Z}^n}$. This result is crucial for the reliability and secrecy performance of the polar coding scheme.

Lemma 1.

For any $i\in [1,L]$, we obtain

$$\begin{array}{cc}\hfill \mathbb{V}({\tilde{q}}_{A_i^n{T}_i^n},p_{A^n{T}^n})& \le {\delta }_n^{(*)},\hfill \\ \hfill \mathbb{V}({\tilde{q}}_{V_i^n{X}_i^n{Y}_{(1),i}^n{Y}_{(2),i}^n{Z}_i^n},p_{V^n{X}^n{Y}_{(1)}^n{Y}_{(2)}^n{Z}^n})& \le {\delta }_n^{(*)},\hfill \end{array}$$

where ${\delta }_n^{(*)}\triangleq 2n\sqrt{4\sqrt{n{\delta }_{n}ln2}\left(2n-log\left(2\sqrt{n{\delta }_{n}ln2}\right)\right)+{\delta }_n}+2\sqrt{n{\delta }_{n}ln2}$.

Proof. 

Omitted because it follows similar reasoning as in Lemma 3 of [11]. □

5.3. Reliability Analysis

In this section we prove that both legitimate receivers can reliably reconstruct the private and the confidential messages $(W_{1:L},S_{1:L})$ with arbitrary small error probability.

For $i\in [1,L]$ and $k\in [1,2]$, let ${\tilde{q}}_{V_i^n{Y}_{(k),i}^n}$ and $p_{V^n{Y}_{(k)}^n}$ be marginals of ${\tilde{q}}_{V_i^n{X}_i^n{Y}_{(1),i}^n{Y}_{(2),i}^n{Z}_i^n}$ and $p_{V^n{X}^n{Y}_{(1)}^n{Y}_{(2)}^n{Z}^n}$ respectively, and define an optimal coupling Proposition 4.7 of [25] between ${\tilde{q}}_{V_i^n{Y}_{(k),i}^n}$ and $p_{V^n{Y}_{(k)}^n}$ such that $\mathbb{P}\left[{\mathcal{E}}_{V_i^n{Y}_{(k),i}^n}\right]=\mathbb{V}\left({\tilde{q}}_{V_i^n{Y}_{(k),i}^n},p_{V^n{Y}_{(k)}^n}\right)$, where ${\mathcal{E}}_{V_i^n{Y}_{(k),i}^n}\triangleq \left\{\left({\tilde{V}}_i^n,{\tilde{Y}}_{(k),i}^n\right)\ne \left(V^n,Y_{(k)}^n\right)\right\}$. Additionally, define the error event

$$\begin{array}{c}\hfill {\mathcal{E}}_{(k),i}\triangleq \left\{{\widehat{A}}_i\left[{\left({\mathcal{L}}_{V|Y_{(k)}}^{(n)}\right)}^{\mathrm{C}}\right]\ne {\tilde{A}}_i\left[{\left({\mathcal{L}}_{V|Y_{(k)}}^{(n)}\right)}^{\mathrm{C}}\right]\right\}.\end{array}$$

Recall that $({{\rm Y}}_{(k)}^{(V)},{\Phi }_{(k),1:L}^{(V)})$ is available to Receiver $k\in [1,2]$. Thus, $\mathbb{P}[{\mathcal{E}}_{(1),1}]=\mathbb{P}[{\mathcal{E}}_{(2),L}]=0$ because given ${{\rm Y}}_{(1)}^{(V)}$ and ${\Phi }_{(1),1}^{(V)}$ legitimate Receiver 1 knows ${\tilde{A}}_1\left[{\left({\mathcal{L}}_{V|Y_{(1)}}^{(n)}\right)}^{\mathrm{C}}\right]$, and given ${{\rm Y}}_{(2)}^{(V)}$ and ${\Phi }_{(2),L}^{(V)}$ legitimate Receiver 2 knows ${\tilde{A}}_L\left[{\left({\mathcal{L}}_{V|Y_{(2)}}^{(n)}\right)}^{\mathrm{C}}\right]$. Moreover, due to the chaining structure, in Section 4.4 we have seen that ${\tilde{A}}_i\left[{\mathcal{H}}_V^{(n)}\cap {\left({\mathcal{L}}_{V|Y_{(1)}}^{(n)}\right)}^{\mathrm{C}}\right]$ is repeated in ${\tilde{A}}_{i-1}^n$ for $i\in [2,L]$. Therefore, at legitimate Receiver 1, for $i\in [2,L]$ we have

$$\begin{array}{c}\hfill \mathbb{P}[{\mathcal{E}}_{(1),i}]\le \mathbb{P}\left[{\widehat{A}}_{i-1}^n\ne {\tilde{A}}_{i-1}^n\right].\end{array}$$

(35)

Similarly, due to the chaining construction, we have seen that ${\tilde{A}}_i\left[{\mathcal{H}}_V^{(n)}\cap {\left({\mathcal{L}}_{V|Y_{(2)}}^{(n)}\right)}^{\mathrm{C}}\right]$ is repeated in ${\tilde{A}}_{i+1}^n$ for $i\in [1,L-1]$. Thus, at legitimate Receiver 2, for $i\in [1,L-1]$ we obtain

$$\begin{array}{c}\hfill \mathbb{P}[{\mathcal{E}}_{(2),i}]\le \mathbb{P}\left[{\widehat{A}}_{i+1}^n\ne {\tilde{A}}_{i+1}^n\right].\end{array}$$

(36)

Hence, the probability of incorrectly decoding $(W_i,S_i)$ at the Receiver $k\in [1,2]$ is

$$\begin{array}{cc}\hfill \mathbb{P}\left[(W_i,S_i)\ne ({\widehat{W}}_i,{\widehat{S}}_i)\right]& \le \mathbb{P}\left[{\widehat{A}}_i^n\ne {\tilde{A}}_i^n\right]\hfill \\ \hfill & =\mathbb{P}\left[{\widehat{A}}_i^n\ne {\tilde{A}}_i^n|{\mathcal{E}}_{V_i^n{Y}_{(k),i}^n}^{\mathrm{C}}\cap {\mathcal{E}}_{(k),i}^{\mathrm{C}}\right]\mathbb{P}\left[{\mathcal{E}}_{V_i^n{Y}_{(k),i}^n}^{\mathrm{C}}\cap {\mathcal{E}}_{(k),i}^{\mathrm{C}}\right]\hfill \\ \hfill & +\mathbb{P}\left[{\widehat{A}}_i^n\ne {\tilde{A}}_i^n|{\mathcal{E}}_{V_i^n{Y}_{(k),i}^n}\cup {\mathcal{E}}_{(k),i}\right]\mathbb{P}\left[{\mathcal{E}}_{V_i^n{Y}_{(k),i}^n}\cup {\mathcal{E}}_{(k),i}\right]\hfill \\ \hfill & \le \mathbb{P}\left[{\widehat{A}}_i^n\ne {\tilde{A}}_i^n|{\mathcal{E}}_{V_i^n{Y}_{(k),i}^n}^{\mathrm{C}}\cap {\mathcal{E}}_{(k),i}^{\mathrm{C}}\right]+\mathbb{P}\left[{\mathcal{E}}_{V_i^n{Y}_{(k),i}^n}\right]+\mathbb{P}\left[{\mathcal{E}}_{(k),i}\right]\hfill \\ \hfill & \stackrel{(a)}{\le }n{\delta }_n+\mathbb{P}\left[{\mathcal{E}}_{V_i^n{Y}_{(k),i}^n}\right]+\mathbb{P}\left[{\mathcal{E}}_{(k),i}\right]\hfill \\ \hfill & \stackrel{(b)}{\le }n{\delta }_n+{\delta }_n^{(*)}+\mathbb{P}\left[{\mathcal{E}}_{(k),i}\right]\hfill \\ \hfill & \stackrel{(c)}{\le }i\left(n{\delta }_n+{\delta }_n^{(*)}\right),\hfill \end{array}$$

where $(a)$ holds by Th. 2 of [19]; $(b)$ follows from the optimal coupling and Lemma 1; and $(c)$ holds by induction and Equations (35) and (36). Therefore, by the union bound we obtain

$$\begin{array}{c}\hfill \mathbb{P}\left[(W_{1:L},S_{1:L})\ne ({\widehat{W}}_{1:L},{\widehat{S}}_{1:L})\right]\le \sum _{i=1}^L\mathbb{P}\left[{\tilde{A}}_i^n\ne {\widehat{A}}_i^n\right]\le \frac{L(L+1)}{2}\left(n{\delta }_n+2{\delta }_n^{(*)}\right),\end{array}$$

and for sufficiently large n the polar coding scheme satisfies the reliability condition in (1).

5.4. Secrecy Analysis

Since encoding in Section 4 takes place over L blocks of size n, we need to prove that

$$\begin{array}{c}\hfill \underset{n\to \infty }{lim}I(S_{1:L},{\tilde{Z}}_{1:L}^n)=0.\end{array}$$

For clarity and with slight abuse of notation, for any Block $i\in [1,L]$ let

$$\begin{array}{c}\hfill {\Xi }_i^{(V)}\triangleq \left[{\Pi }_i^{(V)},{\Lambda }_i^{(V)},{\Psi }_i^{(V)},{\Gamma }_i^{(V)}\right],\end{array}$$

which denotes the entire sequence depending on ${\tilde{A}}_i^n$ that is repeated at Block $i+1$. Furthermore, let

$$\begin{array}{c}\hfill {\overline{\Omega }}_i^{(V)}\triangleq [{\overline{\Theta }}_i^{(V)},{\overline{\Gamma }}_i^{(V)}],\end{array}$$

which represents the sequence depending on ${\tilde{A}}_i^n$ that is repeated at Block $i-1$. Furthermore, we define ${\kappa }_{\Omega }^{(V)}\triangleq [{\kappa }_{\Theta }^{(V)},{\kappa }_{\Gamma }^{(V)}]$. Then, a Bayesian graph describing the dependencies between all the variables involved in the polar coding scheme of Section 4 is given in Figure 7.

Despite ${\Gamma }_i^{(V)}\subseteq {\Xi }_i^{(V)}$ and ${\overline{\Gamma }}_i^{(V)}={\Gamma }_i^{(V)}\oplus {\kappa }_{\Gamma }^{(V)}\subseteq {\overline{\Omega }}_i^{(V)}$, we represent ${\Xi }_i^{(V)}$ and ${\overline{\Omega }}_i^{(V)}$ as two separate nodes in the Bayesian graph because, by crypto lemma [26], ${\Gamma }_i^{(V)}$ and ${\overline{\Gamma }}_i^{(V)}$ are statistically independent. Furthermore, for convenience, we have considered that dependencies only take place forward (from Block i to Block $i+1$), which is possible by reformulating the encoding as follows. According to Section 4.1, for any $i\in [1,L]$ we have ${\tilde{A}}_i\left[{\mathcal{C}}^{(n)}\right]=W_i$. Consequently, we can write $W_i\triangleq [W_{1,i},W_{2,i}]$, where $W_{1,i}\triangleq {\tilde{A}}_i[{\mathcal{C}}_1^{(n)}\cup {\mathcal{C}}_{1,2}^{(n)}]$ and $W_{2,i}\triangleq {\tilde{A}}_i[{\mathcal{C}}_2^{(n)}\cup {\mathcal{C}}_0^{(n)}]$. Since ${\overline{\Theta }}_i^{(V)}={\tilde{A}}_i\left[{\mathcal{C}}_1^{(n)}\right]\oplus {\kappa }_{\Theta }^{(V)}$ and ${\overline{\Gamma }}_i^{(V)}={\tilde{A}}_i\left[{\mathcal{C}}_{1,2}^{(n)}\right]\oplus {\kappa }_{\Gamma }^{(V)}$, we regard ${\overline{\Omega }}_i^{(V)}$ as an independent random sequence generated at Block $i-1$ that is stored properly into some part of ${\tilde{A}}_{i-1}[{\mathcal{G}}^{(n)}]$. Then, we consider that the encoder obtains $W_{1,i}\triangleq {\overline{\Omega }}_i^{(V)}\oplus {\kappa }_{\Omega }^{(V)}$, which is stored into ${\tilde{A}}_i[{\mathcal{C}}_1^{(n)}\cup {\mathcal{C}}_{1,2}^{(n)}]$ at Block i. On the other hand, the remaining part $W_{2,i}$ is independently generated at Block i. Recall that the secret-key${\kappa }_{\Omega }^{(V)}$ is reused in all blocks.

The following lemma shows that strong secrecy holds for any Block $i\in [1,L]$.

Lemma 2.

For any $i\in [1,L]$ and sufficiently large n,

$$\begin{array}{c}\hfill I\left(S_i{\Xi }_{i-1}^{(V)}{\Lambda }_{i-1}^{(X)};{\tilde{Z}}_i^n\right)\le {\delta }_n^{(\mathrm{S})},\end{array}$$

where ${\delta }_n^{(\mathrm{S})}\triangleq 2n{\delta }_n+2{\delta }_n^{(*)}\left(2n-log{\delta }_n^{(*)}\right)$ and ${\delta }_n^{(*)}$ defined as in Lemma 1.

Proof. 

For n sufficiently large, we have

$$\begin{array}{cc}\hfill & I\left(S_i{\Xi }_{i-1}^{(V)}{\Lambda }_{i-1}^{(X)};{\tilde{Z}}_i^n\right)\hfill \\ \hfill & \stackrel{(a)}{=}I\left({\tilde{A}}_i\left[{\mathcal{H}}_{V|Z}^{(n)}\right]{\tilde{T}}_i\left[{\mathcal{H}}_{X|VZ}^{(n)}\right];{\tilde{Z}}_i^n\right)\hfill \\ \hfill & \stackrel{(b)}{=}|{\mathcal{H}}_{V|Z}^{(n)}|+|{\mathcal{H}}_{X|VZ}^{(n)}|-H\left({\tilde{A}}_i\left[{\mathcal{H}}_{V|Z}^{(n)}\right]{\tilde{T}}_i\left[{\mathcal{H}}_{X|VZ}^{(n)}\right]|{\tilde{Z}}_i^n\right)\hfill \\ \hfill & \stackrel{(c)}{\le }|{\mathcal{H}}_{V|Z}^{(n)}|+|{\mathcal{H}}_{X|VZ}^{(n)}|-H\left(A\left[{\mathcal{H}}_{V|Z}^{(n)}\right]T\left[{\mathcal{H}}_{X|VZ}^{(n)}\right]|Z_i^n\right)+4n{\delta }_n^{(*)}-2{\delta }_n^{(*)}log{\delta }_n^{(*)}\hfill \\ \hfill & \stackrel{(d)}{\le }2n{\delta }_n+4n{\delta }_n^{(*)}-2{\delta }_n^{(*)}log{\delta }_n^{(*)}\hfill \end{array}$$

where $(a)$ holds by the encoding described in Section 4; $(b)$ holds by the uniformity of ${\tilde{A}}_i\left[{\mathcal{H}}_{V|Z}^{(n)}\right]$ and ${\tilde{A}}_i\left[{\mathcal{H}}_{X|VZ}^{(n)}\right]$; $(c)$ holds because, for n large enough, we obtain

$$\begin{array}{cc}\hfill & |H\left({\tilde{A}}_i\left[{\mathcal{H}}_{V|Z}^{(n)}\right]{\tilde{T}}_i\left[{\mathcal{H}}_{X|VZ}^{(n)}\right]|{\tilde{Z}}_i^n\right)-H\left(A_i\left[{\mathcal{H}}_{V|Z}^{(n)}\right]T_i\left[{\mathcal{H}}_{X|VZ}^{(n)}\right]|Z_i^n\right)|\hfill \\ \hfill & \le |H\left({\tilde{Z}}_m^n\right)-H\left(Z_m^n\right)|+|H\left({\tilde{A}}_i\left[{\mathcal{H}}_{V|Z}^{(n)}\right]{\tilde{T}}_i\left[{\mathcal{H}}_{X|VZ}^{(n)}\right]{\tilde{Z}}_i^n\right)-H\left(A_i\left[{\mathcal{H}}_{V|Z}^{(n)}\right]T_i\left[{\mathcal{H}}_{X|VZ}^{(n)}\right]Z_i^n\right)|\hfill \\ \hfill & \le \mathbb{V}({\tilde{q}}_{Z_m^n},p_{Z_m^n})log\frac{2^n}{\mathbb{V}({\tilde{q}}_{Z_m^n},p_{Z_m^n})}\hfill \\ \hfill & +\mathbb{V}\left({\tilde{q}}_{A_i[{\mathcal{H}}_{V|Z}^{(n)}]T_i[{\mathcal{H}}_{X|VZ}^{(n)}]Z^n},p_{A_i[{\mathcal{H}}_{V|Z}^{(n)}]T_i[{\mathcal{H}}_{X|VZ}^{(n)}]Z^n}\right)log\frac{2^{(n+|{\mathcal{H}}_{V|Z}^{(n)}|+|{\mathcal{H}}_{X|VZ}^{(n)}|)}}{\mathbb{V}\left({\tilde{q}}_{A_i[{\mathcal{H}}_{V|Z}^{(n)}]T_i[{\mathcal{H}}_{X|VZ}^{(n)}]Z^n},p_{A_i[{\mathcal{H}}_{V|Z}^{(n)}]T_i[{\mathcal{H}}_{X|VZ}^{(n)}]Z^n}\right)}\hfill \\ \hfill & \stackrel{(b)}{\le }4n{\delta }_{\mathrm{ld}-\mathrm{nls}}^{(n)}-2{\delta }_{\mathrm{ld}-\mathrm{nls}}^{(n)}log{\delta }_{\mathrm{ld}-\mathrm{nls}}^{(n)},\hfill \end{array}$$

where we have used the chain rule of entropy and the triangle inequality, ([27], Lemma 30), the fact that the function $x\to xlogx$ is decreasing for $x>0$ small enough and Lemma 1; and, lastly, $(d)$ holds because

$$\begin{array}{cc}\hfill & H\left(A\left[{\mathcal{H}}_{V|Z}^{(n)}\right]T\left[{\mathcal{H}}_{X|VZ}^{(n)}\right]|Z^n\right)\hfill \\ \hfill & \ge H\left(A\left[{\mathcal{H}}_{V|Z}^{(n)}\right]|Z^n\right)+H\left(T\left[{\mathcal{H}}_{X|VZ}^{(n)}\right]|A^n{Z}^n\right)\hfill \\ \hfill & \ge \sum _{j\in {\mathcal{H}}_{V|Z}^{(n)}}H\left(A(j)|A^{1:j-1}{Z}^n\right)+\sum _{j\in {\mathcal{H}}_{X|VZ}^{(n)}}H\left(T(j)|T^{1:j-1}{V}^n{Z}^n\right)\hfill \\ \hfill & \ge |{\mathcal{H}}_{V|Z}^{(n)}|(1-{\delta }_n)+|{\mathcal{H}}_{X|VZ}^{(n)}|(1-{\delta }_n)\hfill \end{array}$$

where we have used the fact that conditioning does not increase entropy, the invertibility of $G_n$, and the definition of ${\mathcal{H}}_{V|Z}^{(n)}$ and ${\mathcal{H}}_{X|VZ}^{(n)}$ in (6) and (9) respectively. □

Next, the following lemma shows that eavesdropper observations ${\tilde{Z}}_i^n$ are asymptotically statistically independent of observations ${\tilde{Z}}_{1:i-1}^n$ from previous blocks.

Lemma 3.

For any $i\in [2,L]$ and sufficiently large n,

$$\begin{array}{c}\hfill I\left(S_{1:L}{\tilde{Z}}_{1:i-1}^n;{\tilde{Z}}_i^n\right)\le {\delta }_n^{(\mathrm{S})},\end{array}$$

where ${\delta }_n^{(\mathrm{S})}$ is defined as in Lemma 2.

Proof. 

For any $i\in [2,L]$ and sufficiently large n, we have

$$\begin{array}{cc}\hfill & I\left(S_{1:L}{\tilde{Z}}_{1:i-1}^n;{\tilde{Z}}_i^n\right)\hfill \\ \hfill & =I\left(S_{1:i}{\tilde{Z}}_{1:i-1}^n;{\tilde{Z}}_i^n\right)+I\left(S_{i+1:L};{\tilde{Z}}_i^n|S_{1:i}{\tilde{Z}}_{1:i-1}^n\right)\hfill \\ \hfill & \stackrel{(a)}{=}I\left(S_{1:i}{\tilde{Z}}_{1:i-1}^n;{\tilde{Z}}_i^n\right)\hfill \\ \hfill & \le I\left(S_{1:i}{\tilde{Z}}_{1:i-1}^n{\Xi }_{i-1}^{(V)}{\Lambda }_{i-1}^{(X)};{\tilde{Z}}_i^n\right)\hfill \\ \hfill & =I\left(S_i{\Xi }_{i-1}^{(V)}{\Lambda }_{i-1}^{(X)};{\tilde{Z}}_i^n\right)+I\left(S_{1:i-1}{\tilde{Z}}_{1:i-1}^n;{\tilde{Z}}_i^n|S_i{\Xi }_{i-1}^{(V)}{\Lambda }_{i-1}^{(X)}\right)\hfill \\ \hfill & \stackrel{(b)}{\le }{\delta }_n^{(\mathrm{S})}+I\left(S_{1:i-1}{\tilde{Z}}_{1:i-1}^n;{\tilde{Z}}_i^n|S_i{\Xi }_{i-1}^{(V)}{\Lambda }_{i-1}^{(X)}\right)\hfill \\ \hfill & \le {\delta }_n^{(\mathrm{S})}+I\left(S_{1:i-1}{\tilde{Z}}_{1:i-1}^n;{\tilde{Z}}_i^n{W}_{1,i}|S_i{\Xi }_{i-1}^{(V)}{\Lambda }_{i-1}^{(X)}\right)\hfill \\ \hfill & ={\delta }_n^{(\mathrm{S})}+I\left(S_{1:i-1}{\tilde{Z}}_{1:i-1}^n;W_{1,i}|S_i{\Xi }_{i-1}^{(V)}{\Lambda }_{i-1}^{(X)}\right)+I\left(S_{1:i-1}{\tilde{Z}}_{1:i-1}^n;{\tilde{Z}}_i^n|S_i{\Xi }_{i-1}^{(V)}{\Lambda }_{i-1}^{(X)}{W}_{1,i}\right)\hfill \\ \hfill & \stackrel{(c)}{=}{\delta }_n^{(\mathrm{S})}+I\left(S_{1:i-1}{\tilde{Z}}_{1:i-1}^n;W_{1,i}|S_i{\Xi }_{i-1}^{(V)}{\Lambda }_{i-1}^{(X)}\right)\hfill \\ \hfill & \le {\delta }_n^{(\mathrm{S})}+I\left({\tilde{A}}_{1:i-1}^n{\tilde{Z}}_{1:i-1}^n;W_{1,i}|S_i{\Xi }_{i-1}^{(V)}{\Lambda }_{i-1}^{(X)}\right)\hfill \\ \hfill & ={\delta }_n^{(\mathrm{S})}+I\left({\tilde{A}}_{1:i-1}^n;W_{1,i}|S_i{\Xi }_{i-1}^{(V)}{\Lambda }_{i-1}^{(X)}\right)+I\left({\tilde{Z}}_{1:i-1}^n;W_{1,i}|{\tilde{A}}_{1:i-1}^n{S}_i{\Xi }_{i-1}^{(V)}{\Lambda }_{i-1}^{(X)}\right)\hfill \\ \hfill & \stackrel{(d)}{=}{\delta }_n^{(\mathrm{S})}+I\left({\tilde{A}}_{1:i-1}^n;W_{1,i}|S_i{\Xi }_{i-1}^{(V)}{\Lambda }_{i-1}^{(X)}\right)\hfill \\ \hfill & \stackrel{(e)}{=}{\delta }_n^{(\mathrm{S})}+I\left({\tilde{A}}_{1:i-1}^n;{\overline{\Omega }}_i^{(V)}\oplus {\kappa }_{\Omega }^{(V)}|S_i{\Xi }_{i-1}^{(V)}{\Lambda }_{i-1}^{(X)}\right)\hfill \\ \hfill & \stackrel{(f)}{=}{\delta }_n^{(\mathrm{S})}\hfill \end{array}$$

where $(a)$ holds by independence between $S_{i+1:L}$ and any random variable from Blocks 1 to i; $(b)$ holds by Lemma 2; $(c)$ follows from applying d-separation [28] over the Bayesian graph in Figure 7 to obtain that ${\tilde{Z}}_i^n$ and $(S_{1:i-1},{\tilde{Z}}_{1:i-1}^n)$ are conditionally independent given $(S_i,{\Xi }_{i-1}^{(V)},{\Lambda }_{i-1}^{(X)},W_{1,i})$; $(d)$ also follows from applying d-separation to obtain that $W_{1,i}$ and ${\tilde{Z}}_{1:i-1}^n$ are conditionally independent given $({\tilde{A}}_{1:i-1}^n,S_i,{\Xi }_{i-1}^{(V)},{\Lambda }_{i-1}^{(X)})$; $(e)$ holds by definition; and $(f)$ holds because ${\overline{\Omega }}_i^{(V)}$ is independent of $(S_i,{\Xi }_{i-1}^{(V)},{\Lambda }_{i-1}^{(X)})$ and any random variable from Block 1 to $(i-2)$, and because from applying crypto-lemma [26] we obtain that ${\overline{\Omega }}_i^{(V)}\oplus {\kappa }_{\Omega }^{(V)}$ is independent of ${\tilde{A}}_{i-1}^n$. □

Therefore, we obtain

$$\begin{array}{cc}\hfill I\left(S_{1:L};{\tilde{Z}}_{1:L}^n\right)& \stackrel{(a)}{=}I\left(S_{1:L};{\tilde{Z}}_1^n\right)+\sum _{i=2}^{L}I\left(S_{1:L};{\tilde{Z}}_i^n|{\tilde{Z}}_{1:i-1}^n\right)\hfill \\ \hfill & \stackrel{(b)}{\le }I\left(S_{1:L};{\tilde{Z}}_1^n\right)+(L-1){\delta }_n^{(\mathrm{S})}\hfill \\ \hfill & =I\left(S_1;{\tilde{Z}}_1^n\right)+I\left(S_{2:L};{\tilde{Z}}_1^n|S_1\right)+(L-1){\delta }_n^{(\mathrm{S})}\hfill \\ \hfill & \stackrel{(c)}{=}I\left(S_1;{\tilde{Z}}_1^n\right)+(L-1){\delta }_n^{(\mathrm{S})}\hfill \\ \hfill & \stackrel{(d)}{\le }L{\delta }_n^{(\mathrm{S})}\hfill \end{array}$$

where $(a)$ follows from applying the chain rule; $(b)$ holds by Lemma 3; $(c)$ holds by independence between $S_{2:L}$ and any random variable from Block 1; and $(d)$ holds by Lemma 2. Thus, for sufficiently large n the polar coding scheme satisfies the strong secrecy condition in (2).

Remark 1.

We conjecture that the use ${\kappa }_{\Omega }^{(V)}$ is not needed for the polar coding scheme to satisfy the strong secrecy condition. However, the key is required in order to prove this condition by means of analyzing a causal Bayesian graph similar to the one in Figure 7.

Remark 2.

Although backward dependencies between random variables of different blocks appear in [12], a secret seed as ${\kappa }_{\Omega }^{(V)}$ is not necessary for the polar coding scheme to provide strong secrecy. This is because random sequences that are repeated in adjacent blocks are stored only into those corresponding entries whose indices belong to the “high entropy set given eavesdropper observations”, i.e., the equivalent sets of ${\mathcal{H}}_{V|Z}^{(n)}$ and ${\mathcal{H}}_{X|VZ}^{(n)}$ in our polar coding scheme. By contrast, notice that our polar coding scheme repeats $\left[{\Theta }_i^{(V)},{\Gamma }_i^{(V)}\right]\subseteq {\tilde{A}}_i\left[{({\mathcal{H}}_{V|Z}^{(n)})}^{\mathrm{C}}\right]$.

Remark 3.

Another possibility for the polar coding scheme is to repeat at Block $i+1$ the modulo-2 addition between $\left[{\Psi }_i^{(V)},{\Gamma }_i^{(V)}\right]$ and a particular secret-key, instead of repeating an encrypted version of $\left[{\Theta }_i^{(V)},{\Gamma }_i^{(V)}\right]$ at Block $i-1$. Then, it is not difficult to prove that $I\left(S_{1:L}{\tilde{Z}}_{i+1:L}^n;{\tilde{Z}}_i^n\right)\le {\delta }_n^{(\mathrm{S})}$ (similar to Lemma 3). Thus, one can minimize the length of this secret-key depending on whether $|{\mathcal{C}}_1^{(n)}|<|{\mathcal{C}}_2^{(n)}|$ or vice versa.

6. Concluding Remarks

A strongly secure polar coding scheme is proposed for the WTBC with two legitimate receivers and one eavesdropper. This polar code achieves the best known inner-bound on the achievable region of the CI-WTBC model, where a transmitter wants to send common information (private and confidential) to both receivers. Due to the non-degradedness assumption of the channel, the encoder builds a chaining construction that induces bidirectional dependencies between adjacent blocks, which need to be taken carefully into account in the secrecy analysis.

These bidirectional dependencies involve elements from adjacent blocks whose indices belong to the “low entropy sets given eavesdropper observations”. Consequently, in order to prove that the polar coding scheme satisfies the strong secrecy condition, we have introduced a secret-key whose length becomes negligible in terms of rate as the number of blocks grows indefinitely. In the proposed polar coding scheme, this key has been used to randomize part of these elements from any block that are repeated in the previous (or next) one. In this way, we can analyze the dependencies between all random variables involved in the secrecy analysis by means of a causal Bayesian graph and apply d-separation to prove that the polar coding scheme induces eavesdropper’s observations that are statistically independent of one another.

Despite the good performance of the polar coding schemes, some issues still persist. First, it is worth saying that the additional secret transmission (that is negligible in terms of rate) required to initialize the decoding algorithms at both receivers can be omitted by using a similar approach as in [29], where an initialization phase to generate a secret-key can be performed without worsening the communication rate. On the other hand, how to replace the random decisions entirely by deterministic ones in SC encoding is a problem that still remains unsolved. Additionally, we conjecture that the previous secret-keys that are used to prove independence between blocks are not necessary. However, how to prove this independence without using them seems a difficult problem to address at this point.