Multi-Entity and Multi-Enrollment Key Agreement with Correlated Noise

A basic model for key agreement with a remote (or hidden) source is extended to a multi-user model with joint secrecy and privacy constraints over all entities that do not trust each other. Multiple entities using different measurements of the same source through broadcast channels (BCs) to agree on mutually-independent local secret keys are considered. Our model is the proper multi-user extension of the basic model since the encoder and decoder pairs are not assumed to trust other pairs, unlike assumed in the literature. Strong secrecy constraints imposed on all secret keys jointly, which is more stringent than separate secrecy leakage constraints for each secret key considered in the literature, are satisfied. Inner bounds for maximum key rate, and minimum privacy-leakage and database-storage rates are proposed for any finite number of entities. Inner and outer bounds for degraded and less-noisy BCs are given to illustrate cases with strong privacy. A multi-enrollment model that is used for common physical unclonable functions is considered to establish inner and outer bounds for key-leakage-storage regions that differ only in the Markov chains imposed. For this special case, the encoder and decoder measurement channels have the same channel transition matrix and secrecy leakage is measured for each secret key separately. We illustrate cases for which it is useful to have multiple enrollments as compared to a single enrollment and vice versa.


I. INTRODUCTION
A natural source of randomness is biometric identifiers such as fingerprints that are generally transformed into a frequency domain and quantized to obtain bit sequences that are unique to an individual [1]. Similarly, physical identifiers such as fine variations of ring oscillator (RO) outputs or random startup values of static random access memories (SRAMs) that are caused by uncontrollable manufacturing variations, are safer and cheaper alternatives to key storage in a non-volatile memory [2]. Physical identifiers for digital devices, such as Internet-of-Things (IoT) devices, can be implemented using physical unclonable functions (PUFs) [2]. One can use PUFs in various coding schemes as a source of local randomness [3, Chapter 1], e.g., in the randomized encoder of the wiretap channel [4] and of the strong coordination problem [5], [6].
We use the basic source model for key agreement from [7], [8] to find achievable rate regions for key agreement with PUFs and biometric identifiers. In this classic model, an encoder observes a source output to generate a secret key and O. Günlü is with the Information Theory and Applications Chair, Technische Universität Berlin, 10623 Berlin, Germany (e-mail: guenlue@tuberlin.de). sends public side information, i.e., helper data, to a decoder, so the decoder can reliably reconstruct the same secret key by observing another source output and the helper data. The main constraints are that the information leaked about the secret key, i.e., secrecy leakage, is negligible and the information leaked about the identifier output, i.e., privacy leakage, is small [9], [10]. Furthermore, the amount of storage should also be minimized to limit the hardware cost [11].
Suppose the encoder generates a key from a noisy measurement of a hidden (or remote) source output, and a decoder has access to another noisy measurement of the same source and the helper data to reconstruct the same key. We call this model the generated-secret (GS) model with a hidden source. This model is introduced in [12] as an extension of the visible (noiseless) source outputs observed by the encoder, considered in [9], [10]. Similarly, for the chosen-secret (CS) model, an embedded (or chosen) key and noisy identifier measurements are combined by the encoder to generate the public helper data. We consider both models to address different applications.

A. Related Work and Motivation
The same identifier is used by multiple encoder and decoder pairs in [13], where the identifier outputs observed by different encoders are the same because the encoder measurements are assumed to be noiseless. Therefore, the multiple use of the same noiseless source output allows all encoders to know the secret key of the other encoders. This model does not fit well to the practical key agreement with identifiers scenarios because there is noise in every identifier measurement.
Multiple enrollments of a hidden source using noisy measurements are considered in [14], where weakly secure secret keys are generated without privacy leakage and storage constraints. Furthermore, there is a causality assumption in [14] on the availability of the helper data, i.e., any decoder has access to all previously-generated helper data. This assumption is not necessarily realistic as a decoder of, e.g., an IoT device that embodies a PUF should be low complexity and the amount of data to process increases linearly with the number of enrollments. In addition, any manipulation in any of the helper data can cause the complete multi-enrollment system to fail.
A classic method used for key agreement, i.e., the fuzzy commitment scheme (FCS) [15], is used in [16] in combination with an SRAM PUF to enroll the noisy outputs of the same SRAM multiple times. The symmetry condition in [16,Eq. (16)] conditioned on a fixed SRAM cell state is entirely similar to the symmetry satisfied by binary-input symmetric output (BISO) channels; see e.g., [17, p. 613], [12,Eq. (14)]. For SRAM outputs that satisfy this symmetry, the normalized (weak) secrecy leakage about each separate secret key is shown to be zero. It is discussed in [18,Section 3.4] that any uniformly-distributed hidden identifier output with BISO measurement channels satisfies the results in [16]. In [18, Theorem 1] the secret-key capacity of the two-enrollment key agreement problem is established for measurement channels with the same channel transition matrix. However, these multienrollment models do not consider the privacy leakage and storage constraints, there is no constraint on the independence of the secret keys of different enrollments, and the secrecy leakage constraint is weak and is not applied jointly on all secret keys. Furthermore, optimal random linear code constructions that achieve the boundaries of the key-leakage-storage regions are given in [19], where the classic code constructions FCS and code-offset fuzzy extractors [20] are shown to be strictly suboptimal. Therefore, the multi-enrollment models and constructions in the literature are strictly suboptimal and not necessarily realistic. We therefore list stronger secrecy constraints jointly on all entities, which approximates the reality better in combination with storage rate and joint privacyleakage rate constraints. These constraints define the multientity key agreement problem, where the entities that use the same identifier do not have to trust other entities. Therefore, the multi-entity key agreement problem is a proper multi-user extension of single-enrollment models.
Every measurement of an identifier is considered to be noisy due to, e.g., local temperature and voltage changes in the hardware of the PUF circuit or a cut on the finger. Noise components at the encoder and decoder measurements of a hidden source can be also correlated due to, e.g., the surrounding logic in the hardware [21] or constant fingertip moisture. This correlation between the noise sequences is modeled in [22] as a broadcast channel (BC) [23] with an input that is the hidden source output and with outputs that are the noisy encoder and decoder measurements. We use this model for multi-entity key agreement with identifiers, where each entity (i.e., each encoder and decoder pair) observes noisy identifier outputs of the same hidden source through different BCs. We allow the BCs to be different as trusted entities generally use different hardware implementations of the encoder and decoder pairs, which results in different correlations between noise components.
We also consider physically-degraded (PD) and less-noisy (LN) BCs to give finer inner and outer bounds to the keyleakage-storage regions for the GS and CS models of the multi-entity key agreement problem. For the considered PD and LN BCs, we prove that strong privacy can be achieved. In [9], [10], [24], an extra common randomness that is available to the encoder and decoder and that is hidden from the eavesdropper is required to obtain strong privacy. This assumption is not realistic since such a common randomness requires hardware protection against invasive attacks, and if such a protection is feasible, then it is not necessary to use an identifier for key agreement.

B. Models for Identifier Outputs
We study physical and biometric identifier outputs that are independent and identically distributed (i.i.d.) according to a given probability distribution. These models are reasonable if one uses transform-coding algorithms from [25] that occupy a small hardware area to extract almost i.i.d. bits from PUFs under varying environmental conditions. Similar transformcoding based algorithms have been applied to biometric identifiers to obtain independent output symbols [26]. These transform-coding algorithms provide almost i.i.d. identifier outputs and noise sequences; however, the correlation between the noise components on the encoder and decoder components are not removed using these methods. Furthermore, PUFs are used for on-demand key reconstruction and physical attacks on PUFs permanently change the identifier outputs [27], so we assume that the eavesdropper cannot obtain information correlated with the PUF outputs, unlike biometric identifiers.

C. Summary of Contributions
We extend the key-leakage-storage rate tuple analysis of the single-enrollment model for hidden identifier outputs measured through general BCs in [22] to consider multi-entity key agreement with a set of stringent secrecy constraints. A summary of the main contributions is as follows.
• We derive achievable key-leakage-storage rate tuples for the GS model with strong secrecy for any finite number of entities using the same identifier's measurements through different BCs for key agreement. Separate identifier measurements considered in [12], [28] correspond to a PD BC and the visible source model in [9], [10] corresponds to a semi-deterministic BC. • For a set of PD and LN BCs, the privacy-leakage rates for the two-entity key agreement problem are calculated. These PD and LN BCs are shown to provide strong privacy without the need of a common randomness. An outer bound is given for the considered PD and LN BCs. • We consider a special case of the multi-enrollment key agreement problem, where all measurement channels are separate (i.e., PD BCs) and they have the same transition matrix. This is a common model used for SRAM PUFs [16]. Using a less stringent secrecy leakage constraint that bounds the information leakage for each secret key separately and without the mutual independence constraint on the secret keys, we establish inner and outer bounds for the strong-secrecy key-leakage-storage region for this two-enrollment key agreement problem. The bounds differ only in the Markov chains imposed. This result is a significant improvement to the two-enrollment secretkey rate region (without storage and privacy-leakage rate constraints) established in [18] for weak secrecy, which is recovered by eliminating auxiliary random variables in the proposed rate regions. • All inner and outer bounds for the GS model are extended to the CS model, which comprises secret-key binding methods that embed a chosen secret key to the encoder. • We give two scenarios to compare single-enrollment and two-enrollment models and illustrate that for different assumptions on measurement channels, either of the two models can perform better in terms of the privacy-leakage vs. secret-key rate boundary tuples.

D. Organization
This paper is organized as follows. In Section II, we describe the multi-entity key agreement problem with BC measurements. We give achievable key-leakage-storage regions for the GS and CS models with strong secrecy and BC measurements for any finite number of entities in Section III in addition to inner and outer bounds for PD and LN BCs that satisfy strong privacy. The proposed inner bounds for the two-entity key agreement problem in Section IV are shown to differ from the outer bounds only in the Markov chains imposed for a special case with less stringent secrecy constraints. In Sections V and VI, proofs of the given rate regions for the general multi-entity key agremeent problem and for the twoenrollment key agreement problem, respectively, are given. Section VII concludes the paper.

E. Notation
Upper case letters represent random variables and lower case letters their realizations. A superscript denotes a string of variables, e.g., X n = X 1 , X 2 , . . . , X i , . . . , X n , and a subscript i denotes the position of a variable in a string. A random variable X has probability distribution P X . Calligraphic letters such as X denote sets, set sizes are written as |X | and their complements as X c .
is the binary entropy function, where we take logarithms to the base 2, and H −1 b (·) denotes its inverse with range [0, 0.5]. X ∼ Bern(α) is a binary random variable with Pr[X = 1] = α. A binary symmetric channel (BSC) with crossover probability p is denoted by BSC(p). Q(·) is the Q-function that gives the tail probability for the standard normal distribution.

II. PROBLEM DEFINITIONS
Consider hidden identifier outputs X n that are i.i.d. according to a probability distribution P X . If there are a finite number J of trusted entities that use the same identifer, the j-th encoder and decoder pair observes noisy source measurements that are outputs of a BC P Xj Yj |X , with abuse of notation, for j ∈ [1 : J], where X j , Y j , and X are finite sets.
For the GS model shown in Fig. 1(a) for J = 2 trusted entities, the j-th encoder f GS,j (·) generates helper data W j and a secret key S j from X n j . All secret keys are stored in a secure database, whereas helper data are stored in a public database so that an eavesdropper has access only to the helper data. Using the helper data W j and the noisy measurements Y n j , the j-th decoder g j (·, ·) generates the key estimateŜ j . Similar steps are applied for the CS model in Fig. 1(b) also for J = 2 trusted entities, except that each S j should be embedded into the j-th encoder f CS,j (·, ·).
Denote a set of secret keys as and a set of helper data as Similarly, we denote a set of secret-key rates, for any K ⊆ [1 : J], as and a set of storage rates as We next define the key-leakage-storage regions for the GS and CS models.
is achievable for the GS and CS models with j-th encoder and decoder measurements through a BC P Xj Yj |X if, given any δ > 0, there is some n ≥ 1, and J encoder and decoder pairs for which R s,j = log |S j | n for all j ∈ [1 : J] and The key-leakage-storage regions C gs for the GS model and C cs for the CS model are the closures of the set of all achievable rate tuples (R s,[1:J] , R , R w, [1:J] ).
The mutual key independence constraint in (7) is not imposed in the multi-enrollment key agreement problem considered in [16]. Furthermore, a normalized (weak) version of this constraint is imposed in the multi-enrollment key agreement problem considered in [14], where the j-th decoder g j (·, ·) is assumed to have access to the set of helper data W [1:j] for all j ∈ [1 : J]. The lack of the mutual key independence constraint and the assumption of availability of all previous helper data require that different encoder and decoder pairs should trust each other. This can be the case, e.g., if all enrollments are made by the same entity. Therefore, the multientity key agreement problem imposes strictly more stringent constraints than the multi-enrollment key agreement problem.
The unnormalized privacy leakage I(X n ; W [1:J] ) cannot be bounded by a finite number in general. We illustrate special strong privacy cases in the next section.

III. INNER BOUNDS
We are interested in characterizing the optimal trade-off among the secret-key, privacy-leakage, and storage rates with strong secrecy for BC measurements at the encoders and decoders of any finite number J of entities that use the same hidden identifier outputs. We give achievable rate regions for the GS and CS models in Theorem 1. The proofs are given in Section V. Denote and define a function max{·, ·} that gives the maximum of the input values as its output.
Theorem 1 (Inner Bounds for Multi-entity GS and CS Models). An achievable rate region R gs for the GS model with J entities is the union over all P Uj | Xj for all j ∈ [1 : J] of the rate tuples such that R s,j ≥ 0 for all j ∈ [1 : J] and An achievable rate region R cs for the CS model with J entities is the union over all P Uj | Xj for all j ∈ [1 : J] of the rate tuples such that R s,j ≥ 0 for all j ∈ [1 : J], (12), (13), and For the achievable rate regions R gs and R cs , we have For these cases, strong privacy, i.e., can be achieved for the GS and CS models in combination with the other corresponding bounds given in Theorem 1.
The proof of Corollary 1 follows from Theorem 1 because I(U j ; X) − I(U j ; Y j ) ≤ 0 for all j ∈ [1 : J] for BCs considered in Corollary 1.
Corollary 1 illustrates that it is possible to obtain strong privacy, i.e., negligible unnormalized privacy leakage, without the requirement of a common randommness that is hidden from an eavesdropper assumed in [9], [10], [24]. This is the case because the observation Y n j of each decoder is "better" than the observation X n j of the corresponding encoder with respect to the hidden source X n for all entities. Remark 1. The rate regions for our problem depend on the joint conditional probability distributions P XYj | Xj rather than only the marginal conditional distributions. Thus, the keyleakage-storage regions for the stochastically-degraded BCs are not necessarily equal to the regions for the corresponding PD BCs, unlike in the classic BC problem. Furthermore, since P X [1:J] XY [1:J] is fixed, the distinction between the LN BCs and essentially-less noisy BCs [29], is not necessary.
We next give simple outer bounds for the key-leakagestorage regions C gs for the GS model and C cs for the CS model when the BCs P XYj | Xj for all j ∈ [1 : J] are PD BCs or LN BCs as defined in Corollary 1. These simple outer bounds give insights into the reason for different bounds on the secret-key rates. Based on these insights, we show a special case in the next section with a less stringent secrecy constraint, for which the inner and outer bounds differ only in the Markov chains imposed and we illustrate that they match for simpler models.
Lemma 1. Suppose one of the cases given in Corollary 1 is satisfied by the BCs P XYj | Xj for all j ∈ [1 : J]. An outer bound on the key-leakage-storage region C gs is the union over (14), (19), and An outer bound to the key-leakage-storage region C cs for the same BCs P XYj | Xj is the union over all (19), (20), and The proof of Lemma 1 follows straightforwadly by following the steps in [12, Section VI], defining the auxiliary random variables U j,i = (S j , W j , Y i−1 j ) for all j ∈ [1 : J] and i ∈ [1 : n], and by bounding I(X n ; W [1:J] ) ≥ 0; therefore, we omit the proof.
The outer bounds do not include the inequalities in (15) and (17). Furthermore, the secret-key rate achieved by the inner bound in (12) is smaller than the outer bound given in (20), where the difference is the term −I(U j ; U [1:J]\{j} ). This term is a result of the constraint in (44) that is imposed to satisfy the strong and mutual key independence constraint given in (7). Therefore, we next consider a model without the constraint in (7) and use a secrecy-leakage constraint that is less stringent than the one in (9), i.e., replace (9) by which is also a strong secrecy metric. Due to the lack of a mutual key independence constraint, the model in the next section is not a multi-entity model but rather a multienrollment model. For a special case of this multi-enrollment key agreement problem, we establish inner and outer bounds for the key-leakage-storage regions that comprise the same bounds but for different Markov chains.

IV. BOUNDS FOR A MULTI-ENROLLMENT MODEL
Consider J = 2 entities that measure the noisy outputs of the same hidden source X n through separate channels that have the same channel transition matrices, i.e., for all j ∈ [1 : 2],x j ∈ X , and y j ∈ X we have P Xj Yj |X (x j , y j |x) = P X|X (x j |x)P X|X (y j |x).
Using (23), we define a new multi-enrollment model.

Definition 2.
A key-leakage-storage rate tuple ( s R s,1 , s R s,2 , s R , s R w,1 , s R w,2 ) is achievable for the GS and CS models with measurements through a BC P XY |X (x, y|x) as in (23) if, given any δ > 0, there is some n ≥ 1, and two encoder and decoder pairs for which s R s,1 = log |S 1 | n , 1 n H(S j ) = s R s,j − δ, j = 1, 2 (key uniformity) (25) The key-leakage-storage regions s C gs,J=2 for the GS model and s C cs,J=2 for the CS model are the closures of the set of all achievable rate tuples ( s We characterize in Theorem 2 inner and outer bounds for key-leakage-storage regions s C gs,J=2 and s C cs,J=2 . The proofs of Theorem 2 are given in Section VI, where the reason for the necessity of the secrecy-leakage constraint in (27) that is less stringent than the joint secrecy-leakage constraint in (9) is given in Remark 2. Similarly, the reason for the necessity of the strong helper data (storage) independence constraint in (29) is discussed in Remark 4. Denote Theorem 2. (Inner Bounds): An achievable key-leakagestorage region Ď R gs,J=2 is the union over all P U1| X1 and P U2| X2 of the rate tuples such that s R s,j ≥ 0 for j = 1, 2 and An achievable key-leakage-storage region Ď R cs,J=2 is the union over all P U1| X1 and P U2| X2 of the rate tuples such that s R s,j ≥ 0 for j = 1, 2, (31)-(33), and For both achievable rate regions Ď R gs,J=2 and Ď R cs,J=2 , we have P U1U2 X1 X2XY1Y2 (u 1 , u 2 , x 1 , x 2 , x, y 1 , y 2 ) = P U1| X1 (u 1 |x 1 )P U2| X2 (u 2 |x 2 )P X|X (x 1 |x)P X|X (x 2 |x) × P X|X (y 1 |x)P X|X (y 2 |x)P X (x).
(Outer Bounds) An outer bound for the key-leakage-storage region s C gs,J=2 is the union over all P U1| X1 and P U2| X2 of the rate tuples such that s R s,j ≥ 0, (31) - (36), and U j − X j − X − Y j form a Markov chain for j = 1, 2.
An outer bound for the key-leakage-storage region s C cs,J=2 is the union over all P U1| X1 and P U2| X2 of the rate tuples such that s R s,j ≥ 0, (31) -(33), (37) -(39), and U j − X j − X − Y j form a Markov chain for j = 1, 2.
The inner and outer bounds differ because the outer bounds define rate regions for the Markov chains U 1 − X 1 − X − Y 1 and U 2 − X 2 − X − Y 2 , which are larger than the rate regions defined by the inner bounds that satisfy (40). For instance, in the achievability proof of Theorem 2, we apply the properties of the Markov chain U 2 − X 2 − U 1 in (87)(b), which does not form a Markov chain for the choice of U 1 and U 2 in the outer bounds. Therefore, inner and outer bounds do not match in general.
Corollary 2. Choosing U 1 = X 1 and U 2 = X 2 , it is straightforward to show that inner and outer bounds in Theorem 2 match if we do not impose any storage or privacy constraints, i.e., impose only (24), (25), and (27). This result improves on the secret-key capacity region given in [18, Theorem 1] for a weak secrecy constraint.

Example 1.
Consider the RO PUF model from [25, Section 4.1] where a transform-coding method is applied to conservatively model the measurement channels P Y |X = P X|X as independent BSCs with the same crossover probability of p A and where the hidden source output is Bern( 1 2 ). We therefore can apply the achievability results from Theorem 2 to this RO PUF model. Using [12,Theorem 3] to evaluate the boundary tuples of Ď R gs,J=2 , it suffices to consider probability distributions P Uj | Xj for j = 1, 2 such that P Xj |Uj are BSCs with crossover probabilities Consider the projection of the boundary tuples of Ď R gs,J=2 onto key-leakage plane, i.e., (31) and (32). We plot in Fig. 2 singleenrollment results where the privacy-leakage rate is measured with respect to single helper data and two-enrollment results for the sum rate of the two keys, both for p A = 0.06 [25]. To achieve a total secret-key rate of I( X 1 ; Y 1 ) = I( X 2 ; Y 2 ), the privacy-leakage rate for the two-enrollment model is approximately 13.5% less than the privacy-leakage rate for the single-enrollment model for RO PUFs. The reason for this gain is the information bottleneck problem that arises from (31) and (32) to find the boundary tuples.  Define the signal power as P S and the noise power as P N , so we have a signal-to-noise ratio (SNR) of SN R = P S P N . If a matched filter, which maximizes the SN R at the sampling instant for the AWGN channel, is applied at the encoder and decoder, the bit error probability P b is given by [31, pp. 96] The channel between the input binary symbols and the outputs of the matched filter is a BISO channel. Using [12, Theorem 3], we have that P Xj |Uj for j = 1, 2 that are BSCs with crossover probabilities given in (41) by replacing p A with P b , suffice to obtain the boundary tuples of Ď R gs,J=2 . We remark that p A = 0.06 used in Example 1 corresponds to an SNR of approximately 3.83dB.
In Fig. 3, the privacy-leakage rate vs. secret-key rate boundary tuples are depicted for two cases. First, a two-enrollment model at SN R = 3.83dB with a sum rate for secret keys is depicted. For comparison, we plot a single-enrollment model where the signal power P s is doubled, i.e., we have an SNR of approximately 6.84dB. Fig. 3 shows for the two cases with the same total signal power of 2P s that the single enrollment boundary tuple can result in a gain of approximately 228.55% at the corner point in terms of the secret-key rates achieved for a given privacyleakage rate. For such an AWGN channel with a fixed total signal power; therefore, the single-enrollment model can result in significant gains in terms of achieved secret-key rates as compared to the two-enrollment model for small s R values.
V. PROOF OF THEOREM 1 We provide a proof that follows from the output statistics of random binning (OSRB) method, proposed in [32] and further extended in [33], by applying the steps in [ (18). Assign three random bin indices (S j , W j , C j ) to each realization u n j for all j ∈ [1 : J], where S j represents the secret key, W j the helper data, and C j a public index. Assume S j ∈ [1 : 2 nRs,j ], W j ∈ [1 : 2 nRw,j ], and C j ∈ [1 : 2 nRc,j ] such that R s,j , R w,j , R c,j ≥ 0 for all j ∈ [1 : J].
Apply the union bound to the reliability constraint in (5) to obtain the sum of J error probabilities. This sum vanishes for any finite number J when n → ∞ by using a Slepian-Wolf (SW) [35] decoder to estimate U n j from (C j , W j , Y n j ) if [32, The key uniformity (6), mutual key independence (7), and strong secrecy (9)  Similarly, the public randomness C j is almost independent of X n j , so it is almost independent of ( X n Thus, the public indices C [1:J] can be fixed by generating them uniformly at random. The j-th encoder can generate U n j according to P U n j | X n j Cj obtained from the binning scheme above to compute the bins (S j , W j ) from U n j for all j ∈ [1 : J]. This procedure induces a joint probability distribution that is almost equal to P U [1:J] X [1:J] XY [1:J] fixed in (18) [34,Section 1.6].
To satisfy the constraints (46)-(48), we can fix the rates to where (a) follows from the fact that C j is almost independent of ( X n [1:J] , X n , Y n [1:J] ) for all j ∈ [1 : J] due to (45). Therefore, C j is almost independent of (X n , C [1:J]\{j} ) because U n k determines C k and U n k − X n k − X n j − U n j form a Markov chain for all k = j and j, k ∈ [1 : J], so we have I(X n ; C [1:J] ) = I(X n ; C 1 ) + I(X n ; C 2 |C 1 ) + . . . + I(X n ; C J |C [1: for some n > 0 such that n → 0 when n → ∞; i.e., H(U j |X) > H(U j |Y j ), so (W j , C j , X n ) are almost mutually independent [32, Theorem 1]. Therefore, we have for some n > 0 such that n → 0 when n → ∞. Combining (52) and (55) proves strong privacy.
where (a) follows because U n j determines (W j , C j ), (W j , C j , X n ) can realiably estimate U n for some n > 0 such that n → 0 when n → ∞, and (U n j , X n ) are i.i.d., and (b) follows by (50) and (51).
Combining (52) and (57), we obtain These prove the achievability of the rate region R gs .

B. Proof for the CS Model
We use the achievability proof for the GS model. Suppose the key S j , generated as in the GS model together with the helper data W j and public index C j , have the same cardinality as the corresponding embedded secret key S j , i.e., |S j | = |S j | for all j ∈ [1 : J]. The chosen key S j is uniformly distributed and independent of (X n , X n Consider the j-th encoder f cs,j (·, ·) with inputs ( X n j , S j ) and output W j = (S j + S j , W j ), and the j-th decoder g j (·, ·) with inputs (Y n j , W j ) and outputŜ j = S j + S j −Ŝ j . All addition and subtraction operations are modulo-|S j | for all j ∈ [1 : J]. The j-th decoder of the GS model is used to obtainŜ j for all j ∈ [1 : J].
We have the error probability which is small due to the proof of achievability for the GS model. Using (49) and (50), and from the one-time padding operation applied above, we can achieve a storage rate of are almost mutually independent and each S j is almost uniformly distributed due to (44) for some n > 0 such that n → 0 when n → ∞, and (e) follows because the GS model satisfies the strong secrecy constraint (9) due to (44) for some (4) n > 0 such that (4) n → 0 when n → ∞. Using the selection lemma, there exists a binning that achieves all rate tuples given in (49), (51), and (60). Consider the privacy leakage for this binning. This proves the achievability of the rate region R cs .

A. Achievability Proof for the GS Model
Fix Let (U n 1 , U n 2 , X n 1 , X n 2 , X n , Y n 1 , Y n 2 ) be i.i.d. according to (40). Assign three random bin indices (S j , W j , C j ) to each realization u n j for all j = 1, 2. Assume S j ∈ [1 : 2 n Ď Rs,j ], W j ∈ [1 : 2 n Ď Rw,j ], and C j ∈ [1 : 2 n Ď Rc,j ] such that s R s,j , s R w,j , s R c,j ≥ 0 for j = 1, 2. Apply the union bound to the reliability constraint in (24), which vanishes when n → ∞ by using an SW decoder to estimate U n j from (C j , W j , Y n j ) if [32, Lemma 1] The key uniformity (25) constraint is satisfied if [32, Theorem 1] since (65) ensures that the three random indices (S j , W j , C j ) are almost mutually independent and uniformly distributed. Suppose a virtual joint encoder assigns six indices (S 1 , W 1 , C 1 , S 2 , W 2 , C 2 ) to each realization pair (u n 1 , u n 2 ). This virtual encoder is an operational dual of the virtual decoder used in the proof of [18,Theorem 1]. Using the virtual joint encoder, the strong secrecy constraint in (27) and the strong helper data independence constraint in (29) are satisfied if [32, Theorem 1] and because (66) ensures that (S 1 , W 1 , C 1 , W 2 , C 2 ) are almost mutually independent; whereas, (67) ensures that (S 2 , W 2 , C 2 , W 1 , C 1 ) are almost mutually independent.
Remark 2. The set of equations considered in (65)-(67) cannot be imposed for the joint secrecy-leakage constraint in (9) for general probability distributions P X1 X2XY1Y2 , since to impose (9) one would replace (66) and (67) with which would also imply the mutual independence of secret keys in (7). However, the inequalities in (65) and (68) cannot be satisfied simultaneously in general as H(U 1 ) + H(U 2 ) ≥ H(U 1 , U 2 ). This problem is avoided in the proof of Theorem 1 by imposing the inequality in (44) rather than (65).
The public randomness C j is almost independent of X n j , so it is almost independent of ( X n 1 , X n 2 , X n , Y n 1 , Y n 2 ), if we have [32, Theorem 1] Thus, the public indices (C 1 , C 2 ) can be fixed by generating them uniformly at random. U n j can be generated according to P U n j | X n j Cj for j = 1, 2 obtained from the binning scheme above to compute the bins (S j , W j ) from U n j for j = 1, 2. This procedure induces a joint probability distribution that is almost equal to P U1U2 X1 X2XY1Y2 that is fixed in (40) [34,Section 1.6].
Applying the Fourier Motzkin elimination to (64)-(67) and (69), we obtain the inequalities Observe that we have due to (23) and (63). We therefore obtain where (a) follows by (84) for some > 0 such that → 0 when n → ∞ due to (84)-(87). Furthermore, using the selection lemma, there exists a binning that achieves all rate tuples given in (90)-(92). Consider the privacy leakage for a binning that satisfies (90)-(92). Since C 1 and C 2 are public, we can bound the privacy leakage as follows.

B. Achievability Proof for the CS Model
The achievability proof for the CS model follows by applying the one-time padding step used in Section V-B.

C. Outer Bound Proofs for the GS and CS Models
Suppose for some δ n > 0 and n, there is a pair of encoders and decoders such that (24)- (29) are satisfied by some keyleakage-storage tuple ( s R s,1 , s R s,2 , s R , s R w,1 , s R w,2 ). Using (24) and Fano's inequality, we obtain where (a) permits randomized decoding, n = δ n max{ s R s,1 , s R s,2 }+H b (δ n )/n such that n → 0 if δ n → 0. Let U j,i (S j , W j , X i−1 ), which satisfies the Markov chain U j,i − X j,i − X i − Y j,i for all i ∈ [1 : n] and j = 1, 2.
Remark 3. For the choice of U j,i = (S j , W j , X i−1 ) (and similarly for U j,i = (S j , W j , Y i−1 j )) for j = 1, 2, U 1,i − X 1,i − U 2,i do not form a Markov chain for all i ∈ [1 : n] although for the inner bound we use this Markov chain. This is the reason why inner and outer bounds do not match in general.
Proof for (31): We obtain for the GS and CS models for j = 1, 2 that (a) follows by (25) and (96), (b) follows by (27), (c) follows by applying the data-processing inequality to the Markov chain where (a) follows by (26) and from the Markov chain W 1 − X n − W 2 , (b) follows because I(W 1 ; Y n 1 ) = I(W 1 ; X n 2 ) due to (23), (c) follows from the Markov chain W 1 − X n 2 −W 2 , (d) follows by (96), (e) follows because the channel and source are memoryless and from the Markov chain in (98), and (f ) follows from the definition of U j,i .
Proof for (33): We have for the GS and CS models that where (a) follows by (26) and from the Markov chain W 1 − X n −W 2 , (b) follows by (96) and from the Markov chain S j − (W j , X n ) − Y n for j = 1, 2, (c) follows because the channel and source are memoryless, (d) follows from the Markov chain 101) and (e) follows from the definition of U j,i . Proof for (34): Observe for the GS model for j = 1, 2 that where (a) follows by (28), (b) follows from the encoding steps, (c) follows by (96), (d) follows because the source and channel are memoryless, (e) follows from the data-processing inequality applied to the Markov chains in (98) and (101), and (f ) follows from the definition of U j,i . Proof for (37): Observe for the CS model for j = 1, 2 that n( s R w,j +δ n ) (a) ≥ I(S j , W j ; X n j )−H(S j |W j )+H(S j , W j | X n j )

(b)
≥ I(S j , W j ; X n j ) + I(S j ; W j ) where (a) follows by (28), (b) follows because X n is independent of S j and from the encoding step, (c) follows because the source and channel are memoryless, (d) follows by applying the data-processing inequality to the Markov chain in (101), and (e) follows from the definition of U j,i . Proof for (35): We have for the GS model for j = 1, 2 that n( s R s,j + s R w,j ) where (a) follows by (25), (b) follows by (27), and (c) follows from the definition of U j,i .
Proof for (38): Similarly, we have for the CS model for j = 1, 2 that n s R w,j ≤ n i=1 H(S j , W j , X i−1 ) where (a) follows from the definition of U j,i . Proof for (36): We obtain for the GS model for j = 1, 2 and j as defined in (30)  = H(S j , W j , W j ) + I(S j ; W j , W j ) + I(W j ; W j ) + nδ n H(S j , W j , W j , S j , X i−1 ) + 2δ n n + δ n (106) where (a) follows by (25), (b) follows by (27) and (29), and (c) follows from the definitions of U j,i and U j ,i . Proof for (39): We have for the CS model for j = 1, 2 and j as defined in (30) that H(W j , W j , S j , S j , X i−1 ) + δ n n + s R s,j (108) H(U j,i , U j ,i ) + δ n n + s R s,j where (a) follows by (29) and (b) follows from the definitions of U j,i and U j ,i .
Remark 4. (106) and (108) are the only places we use the strong helper data independence constraint in (29) and it does not seem straightforward to obtain the inequalities in (106) and (108) without (29).

VII. CONCLUSION
We derived inner bounds for the multi-entity key-leakagestorage regions for GS and CS models with strong secrecy, a hidden identifier source, and correlated noise components at the encoder and decoder measurements that are modeled as BCs. The inner bounds are valid for any finite number of entities that use the same hidden source to agree on a secret key. We argued that the mutual key independence constraint we impose makes the proposed multi-entity key agreement problem a proper multi-user extension of the classic single-enrollment key agreement problem, unlike the multienrollment key agreement problem considered in the literature. A set of degraded and less-noisy BCs was shown to provide strong privacy without a need for a common randomness. We established inner and outer bounds for the key-lekagestorage regions for a two-enrollment model with measurement channels that are valid for SRAM and RO PUFs. Inner and outer bounds were shown to differ only in the Markov chains imposed and they match if the storage and privacy-leakage rate constraints are removed. Two examples illustrated that depending on the constraints of the practical scenario, single or multiple enrollment might perform better in terms of the secret-key vs. privacy-leakage rate ratio. In future work, we will find a set of probability distributions for which the strong helper data independence constraint in the two-enrollment model can be eliminated.
ACKNOWLEDGMENT O. Günlü thanks Rafael F. Schaefer for fruitful discussions.