{'fraction_non_alphanumeric': 0.0432607189592795, 'fraction_numerical': 0.02147640674312986, 'mean_word_length': 4.057026080186843, 'pattern_counts': {'":': 0, '<': 1, '<?xml version=': 0, '>': 1, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
On Opportunistic Selection of Common Randomness and LLR generation for Algebraic Group Secret-Key Generation

It is well known that physical-layer key generation methods enable wireless devices to harvest symmetric keys by accessing the randomness offered by the wireless channels. Although two-user key generation is well understood, group secret-key (GSK) generation, wherein more than two nodes in a network generate secret-keys, still poses open problems. Recently, Manish Rao et al., have proposed the Algebraic Symmetrically Quantized GSK (A-SQGSK) protocol for a network of three nodes wherein the nodes share quantized versions of the channel realizations over algebraic rings, and then harvest a GSK. Although A-SQGSK protocol guarantees confidentiality of common randomness to an eavesdropper, we observe that the key-rate of the protocol is poor since only one channel in the network is used to harvest GSK. Identifying this limitation, in this paper, we propose an opportunistic selection method wherein more than one wireless channel is used to harvest GSKs without compromising the confidentiality feature, thereby resulting in remarkable improvements in the key-rate. Furthermore, we also propose a log-likelihood ratio (LLR) generation method for the common randomness observed at various nodes, so that the soft-values are applied to execute LDPC codes based reconciliation to reduce the bit mismatches among the nodes.


I. INTRODUCTION
It is well known that the randomness offered by wireless channels can be exploited to harvest symmetric keys among the nodes in a wireless network [1]. In two-user physicallayer key generation, the nodes observe the temporal variation in their wireless channel by sharing probing signals with each other, followed by a consensus algorithm to synthesize a secret-key. However, in a more generic model of group secret-key (GSK) generation, more than two nodes intend to harvest a secret-key for securing communication in broadcast and relaying applications, e.g., in vehicular networks. Broadly, physical-layer GSK generation can be classified into two types: (i) Pairwise GSK generation, wherein a central authority (which is one of the nodes in the network) generates a secret-key by applying two-user key generation algorithm with one of its neighbours, and then shares it with the other nodes in the network in a confidential manner [2], [3], and (ii) This work was supported by the Indigenous 5G Test Bed project from the Department of Telecommunications, Ministry of Communications, New Delhi, India.
Group consensus based GSK generation, wherein the central authority assists multiple nodes in the network to witness a common source of randomness (CSR) so that all the nodes can synthesize a group secret-key using a group consensus algorithm [4], [5], [6], [7]. It is noted that the former scheme trusts the central authority in the process of key generation and key distribution whereas in the latter scheme all the nodes share the responsibility of synthesising the key through a group consensus algorithm on the observed CSR. One of the motivations for using the latter class of methods is that the group consensus algorithm, which is executed after sharing the CSR, allows the nodes to mitigate a number of insider attacks [8], which could be executed by the central authority.
In this paper, we are interested in the latter class of GSK generation protocols for the above mentioned reasons.
Recently, [4], [5] have proposed a group secret-key (GSK) protocol, referred to as the Algebraic Symmetrically Quantized GSK (A-SQGSK) for a three-user network, wherein one of the channels in the network, which is chosen as the CSR, is appropriately quantized over an algebraic ring, and then shared among the nodes while ensuring zero leakage of the CSR to an external eavesdropper. It is observed that the A-SQGSK protocol is the only protocol that preserves confidentiality [4] in the class of group consensus based GSK generation, and this feature is attributed to the use of algebraic rings. Although A-SQGSK protocol provides zero leakage, we point out that its key-rate is low because the protocol uses only one of the channels in the network as the CSR. Furthermore, in the context of two-user key generation, it is well known that reconciliation algorithms, e.g., using low-density parity check (LDPC) codes, can be used to arrive at zero mismatch rate among the keys at the nodes. Towards employing such reconciliation methods in A-SQGSK, we observe that aspects of generating log-likelihood ratios (LLRs) of the secret bits using the CSR samples have not been addressed hitherto. Identifying the above mentioned limitations, we make the following contributions in this work: 1) For the framework of A-SQGSK protocol, we propose an opportunistic CSR selection strategy wherein the randomness offered by two channels are utilized to synthesize a GSK without compromising the confidentiality feature. We show that our approach provides higher key-rate than the protocol proposed in [4], [5]. 2) Furthermore, when both the channels are amenable to key generation, we emphasize that using both would lead to compromise in the confidentiality, and as a result, we present a likelihood based strategy to choose one of them so as to minimize the mismatch rate among the nodes. 3) Finally, for the A-SQGSK protocol, we also propose an LLR generation scheme, using which all the nodes employ a reconciliation algorithm. We also use LDPC based reconciliation to validate the effectiveness of our LLR generation scheme. Although LLR generation on CSR samples for two-user key generation is well known, we highlight that the statistics of the underlying noise is different at different set of nodes in the A-SQGSK protocol [5]. Therefore, the proposed LLR generation scheme is a non-trivial contribution in GSK generation. A network comprising three nodes: node-1, node-2, and node-3 is considered, as shown in Fig. 1. The channel between node-j and node-k is denoted by h jk , where j = k and h jk ∼ CN(0, 1) . Channel h jk is assumed: (i) to be flat-fading and remains quasi-static for a block of at least 4 channel uses, (ii) it exhibits pairwise reciprocity within the coherenceblock i.e., h jk = h kj and (iii) {h jk } are statistically independent and identically distributed. Another assumption made is that all the nodes witness Additive White Gaussian Noise (AWGN) distributed as CN(0, σ 2 ) , so that the average signalto-noise-ratio (SNR) is 1 σ 2 . To synthesize a GSK, a subset of {h 12 , h 13 , h 23 }, referred to as the CSR, must be learned by all the nodes. In [4], the authors proposed the A-SQGSK scheme, wherein the channel h 12 is the chosen CSR among the nodes. While a noisy version of h 12 can be estimated at node-2 and node-1 by probing pilot symbols within a coherence-block, it is clear that node-3 needs to learn h 12 explicitly. To help this cause, [4] proposed a protocol to share quantized version of h 12 over an algebraic ring. First, we recall the A-SQGSK protocol, and then point out its limitations.

A. A-SQGSK Protocol
To execute the A-SQGSK protocol, the three nodes must be equipped with two complex constellations A ′ andĀ, as exemplified in Fig. 2 . The A-SQGSK protocol consists of four phases: Phase-1: node-1 broadcasts a pilot symbol x = 1 using which node-2 and node-3 receive y are distributed as CN(0, σ 2 ) respectively. In this notation, the superscript denotes the phase number in each coherence-block and the subscript denotes the node index. These two nodes then estimate the channel as h 12 + e 3 ∼ CN(0, γ) . Furthermore, these estimates are then quantized as 3 ) ∈Ā, wherein in the superscript denotes the inherently observed channel and the subscript denotes the node index. Also, the quantization operator ϕ(β) for β ∈ C is given as where ϕ(·) works independently on in-phase and the quadrature components. Phase-2: Similarly, node-2 broadcasts a pilot symbol x = 1, which is used by node-1 and node-3 to estimate the channel as h 12 + e 2 ) ∈Ā. Phase-4: Assuming that the CSR is derived using h 12 , node-3 does not have the access to it. To bridge the gap, node-1 computes the sum c sum = φ(C h12 and then it broadcasts node-2 and node-3, where E avg is the average energy of the QAM constellation.
With the knowledge of h 13 + e 3 , node-3 obtains the maximum aposteriori probability (MAP) estimate of φ −1 (c sum ), denoted byθ 3 ∈Ā. Using the above estimate, node-3 obtains the CSR as where ⊖ is the subtraction over the ring Similarly, node-2 will recover C h13 2 , which is the decoded version of the Regular 16-QAM The Algebraic Ring quantized channel h 13 . By the end of the A-SQGSK protocol, node-j has {C h12 j , C h13 j } for j = 1, 2, 3. node-j unfolds the real and the imaginary components of C h12 j , C h13 j , and then uses the samples for key extraction. Henceforth, throughout this paper, we refer to a CSR from the unfolded set of h 12 as R h12 j , and similarly, we refer to a CSR sample from the unfolded set of h 13 as R h13 j .

B. Consensus Phase
In order to extract the secret-key, [4] proposed to run the A-SQGSK protocol for a number of coherence-blocks, and then used {R h12 j } as the CSR at node-j. Subsequently, a twolevel consensus algorithm [1], with guard bands q + ≥ 0, and q − ≤ 0, was employed to synthesize secret bits by satisfying the rule Q(α) = 1 if α > q + , and Q(α) = 0 if α < q − , for any real sample α. A sample α is said to be out of consensus if q − ≤ α ≤ q + . The guards bands were appropriately chosen to upper bound the mismatch rate (referred to as initial error rate), which is the fraction of bits that do not agree between any two nodes. To achieve consensus among the three nodes, [4] proposed all the three nodes to parse through their quantized samples of {R h12 1 , R h12 2 , R h12 3 }, and then create a list of all the CSR samples that are lying outside the guard bands. Subsequently, all the nodes mutually agree on common indices and then generate the secret-key using the samples on the common indices.

III. OPPORTUNISTIC CSR SELECTION
One of the limitations of [4] is that only the CSR {R h12 1 , R h12 2 , R h12 3 } was used to extract secret-keys. However, as depicted on the right-side of Fig. 3, it is clear that the three nodes can opportunistically make use of both 3 } based on the coherence-block under consideration. In particular, the following possibilities arise on a given coherence-block: (i) Only one of the two sets of CSR samples is out of the guard band at all the three nodes, thereby contributing to the key. (ii) Both the CSR sets lie in the guard band of at least one of the nodes, thereby not contributing to the key for this coherence block. (iii) Both the CSR sets lie outside the guard band at all the nodes, and therefore, either of them is a good choice of CSR. In the first case, the nodes can use the CSR which is in consensus on a given coherence-block. As a result, there will be improvement in the key-rate in comparison with the A-SQGSK protocol [4]. We prove that using either of the subset as the CSR preserves confidentiality.
Proposition 1: For a 2 m -QAM constellation, when the two CSR, C h12 1 and C h13 1 , are identically distributed, we have Proof: Following the similar lines of the proof in [5, Theorem 1], it can be proved that I(C h12 1 ; φ −1 (c sum )) = 0 and likewise, I(C h13 1 ; φ −1 (c sum )) = 0. Using Proposition 1, it follows that choosing either of the two CSR sets for a coherence block will not compromise the confidentiality feature of the CSR. As seen in the third case, on a given coherence-block, when both the CSR samples are in consensus, we cannot use both to extract the keys as it does not ensure confidentiality of the CSR samples as we prove next.
Proposition 2: For a 2 m -QAM constellation, when the two complex CSR, C h12 1 and C h13 1 , are identically distributed, we have non-zero value of I(C h12 is the symbol transmitted by node-1. Proof: The expression for I(C h12 (2) such that the second equality holds as C h12 entropy, H(C h12 1 , C h13 1 |φ −1 (c sum )), is equal to H(C h12 1 ) as follows. The first terms after summation in (3), (5). Substituting (5) in (4) gives H(C h12 (6) which is equal to H(C h12 1 ) and then substituting (6) in (3) and (3) in (1) gives Assuming Eve can perfectly retrieve φ −1 (c sum ), the leakage at Eve is non-zero using Proposition 2. Therefore, when 3 } are in consensus on a given coherence-block, we present a method for selecting one of them such that the mismatch rate among the keys is minimized.

A. Likelihood Based CSR selection Strategy
We present an optimal CSR selection strategy, wherein the facilitator first builds the likelihood functions on the CSR observed at node-2 and node-3, and then chooses the one that provides smaller probability of error. First, we define notations needed to explain the technique. For a Gaussian probability density function (PDF) P Θ (θ), denoted by N(µ, γ) with mean µ and variance γ, the notation ℧ (N(µ, γ),Ā I ) represents the probability mass function (PMF) induced on the discrete constellationĀ I when quantizing P Θ (θ) onto the points inĀ I . In other words, ℧(N(µ, γ),Ā I ) is given in (7), where d min represents the minimum Euclidean distance of the constellationĀ I , andĀ I (t) denotes the t-th component for 1 ≤ t ≤ 2 m 2 . We use ∅ s (g) to denote circular shift of the elements of the vector g to the left by s units. For a given PMF H onĀ I , the notation ̺ p (H) denotes the probability of the sample point p ∈Ā I . LetÂ − I andÂ + I denote the set  of PAM points inĀ I that are out of the guard band on the negative and positive sides, respectively. and R h13 1 , node-1 generates the point that was broadcast to node-2 and node-3 as µ = φ −1 φ(R h12 1 )⊕φ(R h13 1 ) . Using h 12 +e 1 as an estimate of the channel seen between node-1 and node-2, node-1 builds an aposteriori PDF at node-2, and in this case it is Gaussian distributed given by N µ, Eavg σ 2 |h12+e (2) 1 | 2 . Furthermore, since node-2 decodes on the PAM constellation using MAP decoder, the corresponding aposteriori PMF on the PAM points is given by H R h 13 2 = ℧ N µ, Eavg σ 2 |h12+e ). Thus, node-1 generates an aposteriori PMF on the CSR R h13 2 seen at node-2. Once the PMFs are generated, then the probability of error at node-2 is computed by summing over the mass points in the complementary region of the PAM constellation with respect to the CSR R h13 1 . By mimicking similar operations at node-3, node-1 also generatesH R h 12 3 , which is an aposteriori PMF on the CSR R h12 3 seen at node-3, and then computes the probability of error at node-3. Finally, the CSR that provides lower probability of error is chosen for key generation. Fig. 4 depicts an example for the likelihood selection strategy at node-1 when both the CSR are in consensus. We highlight that node-1 is able to generate the aposteriori PMFs seen at node-2 and node-3 by using the channel realizations available in the first four phases of the A-SQGSK protocol. As a result, no additional communication-overheads are involved. Furthermore, this method is optimal at moderate values of m and mid-to-high SNR values since the quantized values of the channels used at node-1 would be the same used at node-2 and node-3 with high probability.

B. Consensus Algorithm for Opportunistic Selection
After executing the A-SQGSK protocol over L coherenceblocks, the three nodes have a sequence of samples. For r ∈ {2, 3}, a CSR sample is said to come from ϕ(h 1r ) if it is obtained from either the real or the imaginary part of the quantized version of h 1r on any coherence-block. To achieve consensus, the three nodes use a generalized version of the consensus algorithm in [1] as follows: node-2 obtains two sets of indices, which comprises index values of the CSR samples of ϕ(h 12 ) and ϕ(h 13 ) lying outside the guard band, and then shares it to node-1. Upon receiving the indices, node-1 computes the corresponding sets of indices in a similar fashion for the two sets of CSR samples, and then broadcasts the set of indices that are in consensus with node-2. node-3 computes the corresponding sets of indices lying outside the guard band, and then broadcasts the two sets of indices that are in consensus with both node-1 and node-2. Let (R ϕ(h12) , R ϕ(h13) ) denote the two sets of indices in consensus among the three nodes. Then, all the three nodes generate the set V = R ϕ(h12) ∩ R ϕ(h13) , where V denotes the indices where both {R h12 1 , R h12 2 , R h12 3 } and {R h13 1 , R h13 2 , R h13 3 } are in consensus. With the likelihood based CSR selection strategy, for the indices in V, node-1 calculates the probability of errors at node-2 and node-3 by locally generating the distributions at their side. Then it broadcasts the index of the chosen CSR to both node-2 and node-3. Finally, all the nodes use the CSR samples of ϕ(h 12 ) and ϕ(h 13 ) to extract a secret-key.

IV. LLR BASED RECONCILIATION WITH LDPC CODES
We present an optimal LLR generation scheme for the CSR generated by the A-SQGSK protocol. Since node-1 observes the CSR samples from ϕ(h 12 ) and ϕ(h 13 ) through probing signals, we use the key generated at node-1 as the reference key, and then apply the LDPC reconciliation algorithm at node-2 and node-3. As the statistics of the underlying noise are different, the LLR generation scheme depends on whether the reconciliation is implemented at the (i) reciprocal node, which is the node that inherently observes the CSR through channel reciprocity, e.g., node-2 when the CSR is {R h12 1 , R h12 2 , R h12 3 }, or the (ii) decoding node, which is the node that learns the unseen CSR through the process of decoding and subtraction over the ring, e.g., node-2 when the CSR is {R h13 1 , R h13 2 , R h13 3 }. We discuss the LLR generation scheme at both these types of nodes.

A. LLR Generation at the Reciprocal Node
Let P (X, Y ) denote the joint PMF between the CSR at node-1, denoted by X, and the CSR at the reciprocal node, denoted by Y . For all the 2 m points inĀ I , the probability that the CSR sample at node-1 is quantized to bit 1 and bit 0 is given by Prob 1 (p) = X∈Ā + I P (X, Y = p) and Prob 0 (p) = X∈Ā − I P (X, Y = p), respectively, whereĀ + I andĀ − I are the positive and negative points ofĀ I , respectively, and p is the CSR sample observed at the reciprocal node. Finally, the LLR is computed as log Prob0(p) Prob1(p) .

B. LLR Generation at the Decoding Node
For exposition, we explain the LLR generation scheme at node-2 when the CSR is {R 13 1 , R 13 2 , R 13 3 }. As a result, using R h13 2 , node-2 generates the LLR on the bit generated at node-1 using R h13 1 . The corresponding quantized version of the channel with node-1, as seen by node-2, is C h12 2 . Henceforth, we useÂ + I andÂ − I to represent the positive and negative points inĀ I , respectively, that are out of guard bands upon quantization using Q(·).
Theorem 2: Using the CSR R h13 2 at node-2, the probability that node-1 quantizes its CSR R h13 Proof: node-2 intends to build an aposteriori PMF on its samples conditioned on the hypothesis that the CSR h h13 1 ∈Â + I . This way, node-2 generates the likelihood of CSR R h13 1 being bit 1 conditioned on its CSR R h13 2 . Similarly, using all possible cases of h h13 1 ∈Â − I , it generates the likelihood of CSR R h13 1 being bit 0 conditioned on its CSR R h13 2 . Henceforth, throughout this proof, we explain the steps for generating the likelihood of CSR R h13 1 being bit 1. Similar steps can be followed to obtain the likelihood of CSR R h13 1 being bit 0. Assuming CSR R h13 takes the u-th element ofÂ + I , for 1 ≤ u ≤ |Â + I |. node-2 hypothesizes the point broadcast by node-1 as 2 ) . Note that it is possible to assume this since at mid-to-high SNR ranges, we have R h12 1 = R h12 2 . Using the estimate of the channel between node-1 and node-2, the instantaneous SNR at node-2 is Eavg σ 2 . Therefore, the PDF of the effective noise as seen by node-2 is Gaussian distributed given by N µ xu , Eavg σ 2 |h12+e (1) 2 | 2 . Furthermore, since node-2 decodes on the PAM constellation using MAP decoder, the corresponding aposteriori PMF on the PAM points is is listed on PAM points when enumerated in the increasing order. Finally, since node-2 obtains the CSR R h13 2 by performing a modulo subtraction on the algebraic ring using R h12 2 , node-1 incorporates the corresponding changes in the PMF asH R h 13 ). Thus, node-2 generates an aposteriori PMF on the CSR R h13 2 under the hypothesis that x u was the CSR at node-1. Using the recovered CSR point R h13 2 , node-2 evaluates the probability using the aposteriori PMF as ̺ R h 13 2 (H R h 13 2 ). Overall, by considering all possible CSR points ofÂ + I , the probability that the CSR point at node-1 is quantized to bit 1 is given by Prob(x u ) denotes the probability that the CSR R h13 1 takes the value x u . Along the similar lines, the probability that the CSR point at node-1 is quantized to bit 0 is given by   We highlight that no additional communication-overheads are involved in LLR generation. Furthermore, this method is also optimal at mid-to-high SNR and moderate values of m.

V. SIMULATION RESULTS
In this section, we present simulation results on the proposed CSR selection as well as the LLR generation strategy.

A. Opportunistic Selection of CSR
To showcase the advantages of the opportunistic CSR selection, we present its key-rate along with that of the A-SQGSK protocol, wherein the CSR is fixed to ϕ(h 12 ). In this context, key-rate is defined as the average number of secret bits generated among the three nodes per CSR sample. The plots are presented in Fig. 6 for the cases when the twolevel consensus algorithm delivers secret-keys with an initial error rate of 10 −1 and 10 −2 . In this context, initial error rate is defined as the upper bound on the desired mismatch rate among the nodes when choosing the guard bands for the quantizer Q(·). With an initial error rate of 10 −1 , the plots show that the benefits of the opportunistic method is marginal, and this observation is attributed to the fact that the number of samples from ϕ(h 12 ) and ϕ(h 13 ) that are jointly in consensus is large. However, when the initial error rate is 10 −2 , the benefits are significant since the number of additional CSR samples coming out of ϕ(h 13 ) is large. We note that the above observations continue to hold good for different values of m, which captures the size of the constellation. In this work, we have also proposed a method to choose the CSR sample on those coherence-blocks whenever both ϕ(h 12 ) and ϕ(h 13 ) are in consensus. To showcase the efficacy of the CSR selection method, in Fig. 7, we plot the error rate offered by our scheme on the CSR samples when both ϕ(h 12 ) and ϕ(h 13 ) are in consensus. The plots show that the likelihood based CSR selection outperforms the channel-strength based CSR selection, wherein node-1 chooses the CSR that offers weaker channel-strength since the weaker channel degrades the SNR when recovering the other CSR.

B. LDPC Based Reconciliation for Algebraic-SQGSK
In the context of opportunistic A-SQGSK protocol, the CSR samples in consensus come from either ϕ(h 12 ) or ϕ(h 13 ). With respect to the CSR samples from ϕ(h 12 ), node-2 and node-3 generate the LLR values on the bits generated at node-1 by following the algorithm at the reciprocal node and the decoding node, respectively. Similarly, for the CSR samples from ϕ(h 13 ), node-3 and node-2 generate the LLR values on the bits generated at node-1 by following the algorithm at the reciprocal node and the decoding node, respectively. To execute LDPC based reconciliation, an (N, K) binary LDPC code characterized by the parity check matrix H of dimension (N − K) × N is used. With x ∈ F N 2 denoting an N -length binary key generated at node-1, let s denote its syndrome  , wherein the multiplication operation is over the field F 2 . Subsequently, the syndrome vector s is broadcast to node-2 and node-3, which in turn use it to reduce the mismatch rate by using a message-passing algorithm [9]. In Fig. 8, we plot the performance of LDPC reconciliation when an (N = 12, K = 9) LDPC code [10] is employed. To generate the simulation results, we use the CSR samples out of a two-level consensus algorithm with an initial error rate of 10 −1 and 10 −2 . Upon using LDPC reconciliation, we observe that the mismatch rate among the nodes reduces significantly. It is important to note that the benefits of the reconciliation algorithm is attributed to the LLR generation method at the reciprocal node and the decoding node. While we see significant improvements in the mismatch rate in the GSK, we believe that with the use of large block-length LDPC codes, our LLR generation method can ensure zero mismatch rate among the nodes. From the plots, we also remark that the error rate values at 25 dB and 30 dB are more than that at 20 dB when the initial error rate is 10 −1 , and this is because the initial error rate is only used as an upper bound. Initial error rate = 10 -2 , m = 10 No LDPC LLR-LDPC Fig. 8. Improvement in the mismatch rate among the keys at the three nodes when LDPC based reconciliation is employed at node-2 and node-3.
VI. CONCLUSION In this work, we have presented an opportunistic CSR selection scheme to achieve a higher key-rate than the stateof-the-art A-SQGSK scheme when synthesizing a GSK in a three-node network. Towards guaranteeing non-zero leakage of the CSR to an eavesdropper, we have shown that the proposed CSR selection strategy picks the CSR that minimizes the mismatch rate between the nodes. Finally, to facilitate information reconciliation on the proposed opportunistic CSR selection scheme, we have proposed a novel LLR generation scheme that exploits the underlying noise statistics at the nodes as well as the algebraic ring structure.