On Analytical and Geometric Lattice Design Criteria for Wiretap Coset Codes

This paper considers physical layer security and the design of secure coset codes for wiretap channels, where information is not to be leaked to an eavesdropper having a degraded channel. The eavesdropper's bounds for correct decoding probability and information are first revisited, and a new variant of the information bound is derived. The new bound is valid for a general channel with any fading and Gaussian noise. From these bounds, it is explicit that both the information and probability are upper bounded by the average flatness factor, i.e., the expected theta function of the faded lattice related to the eavesdropper. Taking the minimization of the average flatness factor as a design criterion, simple geometric heuristics to minimize it in the low signal-to-noise ratio (SNR) regime in Gaussian and Rayleigh fast fading channels are motivated. It is concluded that in the Gaussian channel, the security boils down to the sphere packing density of the eavesdropper's lattice, whereas in the Rayleigh fading channel a full-diversity well-rounded lattice with a dense sphere packing will provide the best secrecy. The proposed criteria are backed up by extensive numerical experiments.


A. Background
In the wiretap scheme two legitimate communication parties, Alice and Bob, exchange information in the presence of an eavesdropper, Eve. In this setting, the communication parties rely on physical layer security rather than cryptographic protocols 1 . Hence, Eve is assumed to have no computational limitations and know the cryptographic key, if any, but to have a worse signal quality than Bob.
Preliminary and partial results of this paper are presented in [1]. Follow-up work is presented in [2], [3]. 1 In practise, physical-layer security can be thought of as a stand-alone security measure, or as a complementary means to provide additional security.

arXiv:1609.07723v2 [cs.IT] 28 Oct 2016
The objective of code design in a wiretap channel is to maximize the data rate and Bob's correct decoding probability while minimizing Eve's information and, in wireless channels, satisfying a power condition. It was shown in the seminal paper of Wyner [4] that the legitimate parties can design codes with asymptotically non-zero rate, zero error probability and zero information leakage. Today, this setup is particularly interesting in wireless channels that are open in nature and vulnerable to distortions.
As a practical construction of a wiretap code, [5] introduced the general technique of coset coding, where random bits are added to the message to confuse the eavesdropper. In the specific case of a wireless channel, lattice codes are commonly used, and the code lattice Λ b is endowed with a sublattice Λ e ⊂ Λ b which carries the random bits [6].
The objective of this paper is to study the design criteria for Λ e so as to maximize the security of a lattice wiretap code. We will tacitly assume throughout that Λ e is a sublattice of a reliable code lattice Λ b with a suitable codebook size given by the nesting index [Λ b : Λ e ], and only consider the secrecy problem.

B. Related Work and Contributions
The security of lattice coset codes can be quantized either by Eve's correct decision probability, or alternatively by the mutual information of the message and Eve's received signal. For the additive white Gaussian noise (AWGN) channel, upper bounds are known for both approaches [6], [7]. More importantly, both are increasing functions of the flatness factor of the lattice Λ e , yielding its minimization as a design criterion. Sequences of lattice coset codes achieving security and reliability are also constructed in [7]. For different fading channel models, various alternative design criteria based on probability and information bounds were derived in [8], [9], and [10], respectively. Codes achieving security and reliability in the multiple-input multiple-output (MIMO) channel, and an information bound, were given in [11]. However, to the best of our knowledge, practical low-dimensional code constructions are an open problem in the fading single-input single-output (SISO) channel.
In this paper, we first motivate a choice of a natural and simple analytic design criterion in this and follow-up work. We take a very general channel model with linear fading and Gaussian noise. We recall the strategy used to derive probability bounds for Rayleigh fading SISO and MIMO channels in [8], [9], and give a new variant of the information bounds derived in [10], [11]. We also derive an information bound in the so-called mod Λ s channel, to the best our knowledge not considered before in the fading case. In particular, the way we compute these probability and information bounds allows us to obtain all the bounds explicitly as increasing functions of the average flatness factor, i.e., the expected flatness factor of the faded lattice related to the eavesdropper. This is a relatively simple design criterion and a natural generalization of the AWGN case. It reduces to the probability bounds of [8], [9] in Rayleigh fading channels. The equivalence of probability and information bounds as presented here hopefully clarifies the situation where several alternative design criteria for each different channel model have been derived, with occasionally rather complicated analytic expressions.
Having motivated the analytical design criterion, we then move on to study the practical finite-dimensional lattice design. We specialize to the AWGN and Rayleigh fast fading channels and motivate geometric heuristics to minimize the (average) flatness factor. We conclude that in the Gaussian channel, analogously to reliability, the security can be geometrized by the sphere-packing density of the eavesdropper's lattice, whereas in the Rayleigh fading channel we suggest taking a full-diversity well-rounded lattice with a dense sphere packing. These criteria are verified with numerical computations. The heuristic nature of our criteria of course cannot allow for pointing at an exact minimizer of the average flatness factor, but the criteria seem to guarantee a good secrecy and, most importantly, they are simple enough to be satisfied simultaneously with the other wiretap objectives.

C. Follow-up work
We discuss number-theoretic and algorithmic ways to construct well-rounded lattices that satisfy the geometric criteria derived in this paper in the conference paper [2]. Also channel simulations are provided in [2], showing the good performance of the well-rounded lattices and the geometric design suggested in this paper. The information bounds derived in this paper were published in a conference paper [1], giving a slightly simplified version. There we also study the numerical computation of the average flatness factor. We compute the average flatness factors of the lattices simulated in [2], finding an agreement of the numerical computations and the channel simulations.
Hence, based on subsequent work, the analytical design criteria suggested in this paper indeed seem to compare and not just bound the secrecy of different lattices. In the conference paper [3], we study analogous geometric heuristics to minimize the average flatness factor in the MIMO channel, for which purpose the general form of the information-theoretic computations here is needed.

D. Organization
This paper is organized as follows. In Secion II, we give the mathematical preliminaries. Section III introduces the channel models, lattice coset codes, and the detailed setups for probability and information bounds. In Section IV, we give the eavesdropper's information and probability bounds, yielding the analytical design criterion of average flatness factor. Section V is devoted to geometrizing this analytical criterion, and the geometric design criteria are verified by extensive numerical computations in Section VI. are defined as usual, see, e.g., [12]. We also recall the trivial bounds M is interpreted as the message, Y the received electric field at the eavesdropper, and H encodes the state of the wireless channel known by the receiver. The random variables M and H are assumed independent, and Y depends on M , H and an additional random variable depicting noise. Whenever M and H are independent, one has

A. Information-theoretic definitions
where {Y |H = h} is the random variable Y conditioned on the realization h of H. The interpretation is that the information in the fading and noisy wireless channel is obtained as the expectation of the noisy-channel information over the different channel states h. This will be our strategy to compute information bounds.
B. Lattices 1) Basic concepts: An n-dimensional lattice is a discrete additive subgroup of R n . A lattice Λ ⊂ R n can be expressed in terms of a generator matrix M Λ ∈ R n×m as We remark that we follow the column vector convention in this paper. The columns of M Λ are linearly independent over Z, and consist of the lattice basis vectors. The basis and hence the generator matrix M Λ of a lattice Λ is not unique. The rank of the lattice is m, and if m = n, the lattice is full (rank). The dual lattice Λ of a full-rank lattice is the one generated by the transposed inverse M −t Λ . We denote the hyperplane spanned by the vectors of Λ as span(Λ). The volume Vol(Λ) of the lattice Λ is the m-dimensional measure of the fundamental parallelotope in span(Λ), spanned by the column vectors of M Λ . It is given by All Voronoi cells become V(0) under translation, and we denote V(0) = V(Λ). Voronoi cells have the mdimensional volume Vol(V(Λ)) = Vol(Λ).
A sublattice of a lattice is an additive subgroup; it has a generator matrix M Λ Z, where M Λ ∈ R n×m is the generator matrix of the original lattice, Z ∈ Z m×k contains the lattice coordinates of the sublattice generators, and k is the rank of the sublattice. If Z is not a square matrix, then the corresponding sublattice has index ∞. Otherwise, the index is given by 2) Geometric properties: A lattice is orthogonal, if it has (some) generator matrix with orthogonal generator vectors. A vector x = 0 of a lattice Λ is a minimal(-length) vector if it is of minimal length among all nonzero lattice vectors. The minimal norm λ 2 min of Λ is then x 2 . To obtain some geometric intuition on the lattice based on the (non-unique) generator matrix, we would like the generator vectors to be "near-orthogonal and short". Choosing a suitable basis is often referred to as lattice reduction. There are several different notions of reduced bases, of which we have chosen the LLL-reduction (see, e.g., [13]) for computational reasons.
A lattice Λ is of full diversity if for all t ∈ Λ, t = 0, all the components t i are nonzero. Diversity is of key importance for reliability in Rayleigh fading channels [14]. This turns out to be the case for the security problem as well. There are number-theoretic constructions of full-diversity lattices [14]. In this paper, they will merely serve as a way to easily generate masses of full-diversity lattices for numerical computations. An unaccustomed reader can simply neglect the very few number-theoretic details discussed, whereas they are probably trivial for those familiar with number-theoretic lattices.
In this paper, the problem of finding the densest lattice packing of spheres of equal radius in R n is called the sphere packing problem. Equivalently, the solution to the sphere packing problem in R n maximizes Vol(B)/Vol(Λ), where B is the insphere of the Voronoi cell, hence with radius equal to half the minimal vector length of the lattice.
The best sphere packings are known in low dimensions [15], [16], [17], but in general the sphere-packing problem is very hard. Well-rounded lattices are a resembling but more easily constructible class. All sphere-packing optimal lattices are well-rounded, and all well-rounded lattices have a packing denser or equally dense to Z n . Bearing this is mind, we shall use the concept of well-roundedness here but we postpone further discussion and construction to [2], [3].
where |q| < 1, and the series converges absolutely. In general, theta functions are defined for complex q, but real q is sufficient for our purposes. Note that g n (Λ; σ) = It is easy to see that g n (Λ + x; σ) is Λ-periodic as a function of x and it defines a PDF on V(Λ), called the lattice Gaussian PDF. The deviation of the lattice Gaussian PDF from the uniform distribution on V(Λ) is characterized by the flatness factor Λ (σ), which we define for full lattices by where we can maximize over R n by periodicity. The flatness factor was introduced as a wiretap information theory tool in [7]. It has useful expressions as theta functions of the primal and dual lattices Λ, Λ From the last expression it is clear that the flatness factor is strictly decreasing in σ and tends to zero as σ → ∞. It also implies the scaling property aΛ (aσ) = Λ (σ). We remark that in this paper we seemingly utilize quite seldom the additive group structure of a lattice. It is however crucial in this work; the formulae above are of key importance and based on the Poisson summation formula for lattices. We also define the flatness factor of a non-full lattice of rank n by (5). Equivalently, the flatness factor of a non-full lattice Λ is defined by regarding it as a full lattice of span(Λ). We also remark that if Λ is generated by This often allows us to perform computations with full lattices. We define the variational distance V (ρ, q) of two PDFs ρ and q as V (ρ, q) =ˆy ∈R n |ρ(y) − q(y)|d n y.
It is clear that the flatness factor bounds the variational distance of the lattice gaussian distribution on V(Λ) and the uniform distribution on V(Λ), The connection between the flatness factor and information estimates is now illustrated by the following lemma that is crucial both in the estimates of [7] and this paper. We remark that the assumption ε ≤ 1/2 is implicit in [7], where the authors are interested in sequences of codes where I[M ; Y] → 0. It is however necessary, as seen by taking ε → ∞. The proof [7, Proposition 1], actually holds for whenever h is increasing in ε, but h achieves the trivial bound I[M ; Y] ≤ log |M| at ε = 1/2.

A. Channel model
We consider a wireless fading channel with noise. Perfect channel state information is assumed at both receivers (CSIR), Bob and Eve; the transmitter is only assumed to know the channel statistics. As we are only interested in the eavesdropper's performance, we henceforth only consider the channel between Alice and Eve, and consequently forgo subscripts in the related quantities. Throughout this paper, random variables are denoted by capital letters and their realizations with lower-case letters. Denote Alice's transmitted vector by x ∈ R n , so that the channel equation is given by where h ∈ R m×n is the realization of the fading, and the noise vector N ∈ R m is composed of i.i.d. components N i ∼ N (0, σ 2 ). We assume that H ∈ R m×n has full rank almost surely, but need not be a square matrix. The random variables H, M and N are assumed independent of each other.
Remark III.1. A complex fading channel model is often considered, together with complex lattice codes. However, separating the real and imaginary parts, a complex channel equation of complex dimension m can be reduced to a real channel equation with real dimension 2m. The class of (2m)-dimensional real lattices is wider than that of m-dimensional complex lattices (identified with their (2m)-dimensional real couterparts), most importantly including "complex Z[e 2πi/3 ] -lattices". Thus, the real model actually allows us to slightly generalize some earlier results given for complex channel models. A complex model would be more beneficial for explicit computations, but the average theta functions, to which both probability and information bounds reduce, are already computed in [8], [9].
In related theoretical work, the most important special cases of the above channel model are the additive white Gaussian noise (AWGN) channel, the Rayleigh fast fading SISO channel, the Rayleigh block fading SISO channel, and the quasi-static Rayleigh fading MIMO channel. Our model however also covers, e.g., the slow fading channel studied in a practical USRP implementation of coset codes [18]. In the numerical part of this work we consider the AWGN channel where H = I always, and the Rayleigh fast fading channel where the fading matrix is diagonal, The random variables h i are i.i.d. and Rayleigh distributed with parameter σ h , i.e., they are real and positive and described by the PDF We refer the reader to, e.g., [9], [14] for definitions and motivations of the Rayleigh fast fading and other channel models.
If x = M Λ z for z ∈ Z n , then hx = hM Λ z, and we can think of a lattice code under fading with CSIR as a Gaussian-channel lattice code where the code lattice realizes a random lattice with generator matrix hM Λ . We will henceforth denote the faded lattices Λ b and Λ e by Λ b,h and Λ e,h , respectively. We repeatedly generalize results from the Gaussian channel to fading channels by then taking the expectation over all channels states h.
B. Coset coding 1) Idea of coset codes: Coset coding is a general coding strategy for discrete channels, first proposed by L.
H. Ozarow and A. D. Wyner in [5]. A lattice variant of coset coding is thoroughly presented in [6]. The general idea is that Alice takes nested lattices to pick a unique representative λ M of the coset of Λ b /Λ e corresponding to M . The rate is hence (log 2 |M|)/n bits per real channel use. Then, Alice chooses randomly (according to some distribution) a representative of the coset class 2 The rate can be divided into parts relating to the message and random bits, Near-complete secrecy is then achieved even if Eve receives information with a nonzero rate, approximately equal to R r . Conceptually, as λ M lies in V(Λ e ), it has a "smaller resolution" than the lattice Λ e , and Eve will lose the relevant information at a "detecting resolution" approximately good enough to decode Λ e .
2) Setups and bounds: When deriving eavesdropper's probability or information estimates for lattice coset coding, the boundary effects of the transmission region cause problems. These problems are not technical but intrinsic since the probability and information essentially depend on how the boundary is shaped. We consider three different estimates, arising by neglecting the boundary, removing it by a modulo operation of a shaping lattice Λ s , and smoothing the boundary, respectively. The estimates are for Setup 1: The eavesdropper's correct decoding probability (ECDP), assuming that she, in the AWGN resp.
fading channel, decodes to the closes point of Λ b resp. Λ b,h . Alternatively, the same ECDP estimate holds for closest-point decoding in the mod Λ s channel discussed below.

Setup 2:
The eavesdropper's information, assuming that she has the mod Λ s channel and Alice chooses uniform random representatives of the coset classes.

Setup 3:
The eavesdropper's information assuming that Alice uses Gaussian coset coding, also discussed below.
A common feature suggested by the different bounds and setups is for secrecy to minimize the function This is the function that we are going to optimize for the Rayleigh fast fading channel.
3) The mod Λ s channel and uniform random representatives: The following shaping lattice approach is identical to [7], called the mod Λ s channel: take three nested lattices Λ s ⊂ Λ e ⊂ Λ b ⊂ R n called shaping, coset, and code lattice, respectively. Then, the random part λ described in the general coset coding strategy has a uniform distribution on the [Λ e /Λ s ] representatives of Λ e /Λ s in V(Λ s ). This is called the uniform representative strategy.
The physical message received by Eve is y as given from x = λ M + λ by the channel equation, but in the mod Λ s channel, Eve only receives knowledge of the equivalence class y/Λ s,h . This is certainly a simplification and contrary to the wiretap assumptions, but it allows a simple derivation of an information bound.

4) Discrete Gaussian coset coding:
In the discrete Gaussian coding, the boundary effects of the transmission region are handled by smoothing the boundary. Fixing a message M ∈ M the random parts λ of the message 2 It is also possible not to choose the coset class representatives randomly but instead encode public messages into this choice. If the public message is uniform random on the corresponding message space, this corresponds to the uniform representative strategy discussed later in this paper. X = λ M + λ are chosen so that the transmitted vector X has the centered discrete Gaussian distribution on the for all x ∈ λ M + Λ e . Here the variance σ 2 s appearing in the continuous Gaussians, called the shaping variance, should be taken large enough compared to Λ e ; see [7]. We remark that the power condition is also discussed there.

A. The AWGN channel
In this subsection we briefly recall the eavesdropper's information and probability bounds in the AWGN channel, first derived in [6], [7].
1) Setup 1: Let us consider Setup 1 of Section III-B2, i.e., study the upper bound for Eve's correct-decoding probability P c,e;Λe,Λb , assuming that she performes a closest-point decoding on the infinite lattice This bound was first derived in [6], and for non-full lattices in [9]. With the properties of the flatness factor, this implies that the probability bound is decreasing with σ and, very intuitively, at poor signal quality σ → ∞ the ECDP tends to the inverse codebook size [Λ b : Λ e ] −1 , i.e., the ECDP with a "uniform random guess". The scaling property of the flatness factor also implies a scaling property of this bound, Vol(aΛ b )g(aΛ e ; aσ) = Vol(Λ b )g(Λ e ; σ).
2) Setups 2 and 3: In Setup 2, we have the information bound for uniform coset representatives and a mod Λ s channel, where we denote and assume ε = Λe (σ) ≤ 1/2. This bound was proven in [7]. In Setup 3, with discrete Gaussian coset coding, we have the information bound [7] denoting and assuming ε := Λe ( σσs √ σ 2 +σ 2 s ) ≤ 1/8. The information bounds for fading channels derived in this paper reduce to these bounds.

B. The fading channel
In this subsection we study design criteria based on the information and probability bounds in the fading channel model. Our aim is to motivate our choice of the various earlier suggested criteria, and to provide clarity to the earlier results. All the derivations are simple, hold in the general fading channel model and the wide class of real lattice codes.
Design criteria in Rayleigh fading MIMO and SISO channels based on bounds for what the authors call average correct decision probability and average information leakage were derived in [8], [9] and [10], with several alternative approximations. In Setup 1, we review the derivation of the probability bounds for the general fading channel, discussing how it characterizes Eve's performance and concluding that it should be termed simply correct decision probability.
In Setup 2, we derive a new information bound for the mod Λ s channel. In Setup 3, the average leakage and an information bound from an achievability proof are known from [10], [11]. We derive an analytic expression for an information bound in a finite-dimensional code, roughly a cross-breed of teh two earlier ones. In particular, all our bounds agree on the design criterion of the average flatness factor, which we hence take as an objective function.
1) Setup 1: Let Λ b , Λ e ⊂ R n be of rank m, and assume that Eve simply decodes the received signal to the closest lattice point in Λ e,h . Then, probability of Eve correctly decoding the message is upper bounded [8], [9] by The first step is Fubini's theorem, and the independence of N, H and M . The second step is the self-similarity of the lattice, and the third step is substituting the probability bound of Setup 1 in the AWGN channel.
2) Analytic design criteria for some fading models: The expectation (12) can be computed explicitly for several channel models. The result is of the form , where according to [8] for the Rayleigh fast fading case, and for the Rayleigh block fading case, as presented in [8], Here T is the coherence time, n = mT is the real dimension of the code, Γ is the standard gamma function, and is the subvector consisting of the components of X ∈ R mT having the i th i.i.d.
fading coefficient (for details on the model, see [9]). Note that the latter formula (14) coincides with the former (13) if we set T = 1. For a Rayleigh fading MIMO channel, in the notation of a complex channel [9], where n t resp. n r are the numbers of transmitting and receiving antennas, T is the coherence time, and C = C(n r , n t , T ) is an explicitly known [9] positive constant. We remark that by virtue of working with a real equation up to (12), the real lattice Λ e appearing in (12) and (15) need not have a complex Z[i] lattice structure even if we employ a complex channel model -the computation of the expectation (12) in [9] is a matter of term-wise integration.
We also remark that the scaling property of the flatness factor is inherited for all fading models, In particular this implies that, for a fixed fading model, the channel can be studied by only varying σ; for instance, the above explicit bounds only depend on the ratio σ h /σ. Knowing the monotonicity and limit of the flatness factor, this implies that the ECPD bound (12) is for any fading channel model a decreasing function of σ, tending at poor 3) Setup 2: We derive a new information bound for setup 2, i.e., a fading mod Λ s channel with uniform coset representatives.
This bound is an increasing function of E, attaining the trivial bound log |M| at E = 1/2.
Proof. By the independence assumptions, we have the identity can be bounded as in [7]: the respective PDFs are where n = dim(span(Λ * )) is the rank of the nested lattices and y ∈ V(Λ s,h ), and .
The definition of the flatness factor now directly implies For simplicity, we denote ε = ε Λe,h (σ) for the rest of this proof. For ε ≤ 1/2, Lemma II.1 now yields an information bound h(ε, |M|), and otherwise we have the trivial upper bound log |M|. Hence, For the first term in (17), we apply Jensen's inequality to the convex function h in ε, The second inequality holds Next, write (17) as a convex combination of two numbers, In the interval [0, 1/2], we have h(·, |M|) ≤ log |M|, so the latter number in the convex combination (18) is the larger one. We can bound its weight using Markov's inequality, Thus, we obtain The theorem follows.

4) Setup 3:
We derive an information bound in Setup 3, i.e., a fading channel with discrete Gaussian coset representatives. This setup has been considered earlier in [11], [10], and our computation is a variant that yields an explicit bound as a function of the average flatness factor.
We first need a lemma that states a discrete and approximative analogue of the fact that the sum of two Gaussians is a Gaussian. Similar estimates depicting this have been given in [ For this particular version, the reader may adapt the earlier proofs or read a technical but straightforward direct computation in the appendices.
Lemma IV.1. Fix h ∈ R m×n and let X have the centered discrete Gaussian distribution D Λe,λM (x; σ s ), where Λ e ⊂ R n is full. Let N ∼ N (0, σ 2 I m ) be a spherical (continuous) Gaussian vector independent of X. Assume furthermore that ε √ σ 2 /σ 2 s In+h t hΛe (σ) ≤ ε max for some ε max < 1. Then, the PDF ρ(y) of Y = hX + N and the PDFρ(y) of N (0, (σ 2 I m + σ 2 s hh t )), have variational distance at most 2ε √ provided that ε √ σ 2 /σ 2 s In+h t hΛe (σ) =: ε ≤ ε max for some fixed ε max < 1. Using Lemma II.1, we get an information bound for channel matrices h such that 2ε/(1 − ε max ) ≤ 1/2 This bound is applicable for a largest range of values of ε if we have 2ε max /(1 − ε max ) = 1/2, so we choose ε max = 1/5. Otherwise, we have the trivial information bound log |M|. This yields The rest of the proof is identical to Theorem IV.1: we use Jensen's inequality for the first term, IV-A2 by omitting the use of the trivial information bound log |M| since ε is deterministic in the AWGN channel.
Theorem IV.2 then actually slightly improves the AWGN information bound.
At a first sight, the flatness factors in the information bounds of Theorems IV.1 and IV.2 are different. However, it is often reasonable to assume that the power invested on coset coding is larger than that related to the receiver's noise, σ 2 /σ 2 s 1. (Note that this by no means contradicts the assumption of Eve's poor signal quality, σ 2 h /σ 2 1.) In the limit σ 2 /σ 2 s → 0 + , the two information bounds actually coincide. A similar limit is stated in [10]. The version below also states that the more power Alice invests on coset coding, the better secrecy she has.
Proof. We write the dual formula for the flatness factor (6) and The monotonicity in σ s is now clear from (20), and the limiting property for the expected values follows by dominated convergence, since from (20) and (21) we have that ε √ σ 2 /σ 2 s In+h t hΛe (σ) decreases to ε hΛe (σ) as σ s → ∞.

5) Discussion:
In both Gaussian and fading channel models, the probability and information bounds agree on minimizing the (average) flatness factor ε Λe (σ) and E[ε hΛe (σ)], respectively. At poor signal quaity σ → ∞, the probability bound decreases to the uniform guess probability and the information decreases to zero. The probability upper bound (9) is a relatively good approximation for large σ -see error terms in [8]. The derivation of (12) contained no new approximations after (9), and can therefore be expected to be approximative at poor signal quality.
The two information bounds on the contrary seem to be mostly suitable for achievability proofs and poor-signal asymptotics σ → ∞; substituting the average flatness factors E = 1/2 and E = 1/5 for which the respective information bounds become trivial, the probability bound (12) suggests a notably good secrecy. Nonetheless, the agreement of the information and probability bound, the latter being more approximative a quantification and the former a more rigorous approach, suggests that the average flatness factor should be taken as a design criterion of both practical lattice design and information-theoretic constructions.
We conclude this section by re-phrasing the full wiretap problem and the design criterion: we study sublattices Λ e of a reliable lattice Λ b ⊂ R n , with a fixed coset code rate log 2 [Λ b : Λ e ]/n (bits per real channel use). Equivalently, we fix the index [Λ b : Λ e ]. We design secure coset codes Λ b : Λ e in the relevant low-SNR range by The average flatness factor criterion: 6) A remark on the inverse norm sum approximation: There are both information-theoretic and number-theoretic studies [8], [25], [29], [20] that come up with an inverse norm sum (INS) approximation: consider the probability bound (13) for a full-diversity lattice Λ e . Then.
Note that we are not dividing by zero in the expression above if Λ b (and hence its sublattice Λ e ) is chosen fulldiversity as conventional in Rayleigh fading channels. As pointed out in, e.g. [24], [25], inverse norm sums also appear in the reliablility problem, and studying them is relevant. In the wiretap problem, however, one should be cautious with this approximation; the information and probability bounds based on ψ F F Λe are tight at poor signal quality, σ h /σ → 0, whereas the INS approximation of ψ F F Λe above is asymptotic at good signal quality σ h /σ → ∞. Secondly, if we do not truncate the INS onto a finite sending region, it will automatically diverge for most algebraic lattices adn for any σ h /σ, whereas the series ψ F F Λe ( σh σ ) remains finite, and the corresponding probability bound tends to [Λ b : Λ e ] −1 < 1 at poor signal quality. Analogous inverse norm and inversre determinant approximations have been suggested both in reliability [24] and security [8], [9] problems for the block fading and MIMO channels, and they should probably also be used carefully in wiretap applications.

V. GEOMETRIC DESIGN HEURISTICS
In the previous section we concluded the analytical design criterion of the average flatness factor E H ε Λe,h (σ) of the lattice Λ e . We dedicate the rest of this paper to obtaining intuitive simple geometrizations of this criterion in the AWGN and Rayleigh fast fading channel models. This seems to provide a good solution to the lattice design problems at hands and we hope that it serves as a starting point for further analysis.
A. Gaussian channel 1) Geometric design -sphere packings: In the Gaussian channel, the objective of minimizing the flatness factor seems to boil down to the sphere-packing density of Λ e . Indeed, this was already pointed out in [6] to be the subleading-term optimization of the theta function (2) giving the flatness factor (the leading term originating from the lattice point 0 is common for all lattices). More rigorously but less generally, [21] proved the counterpart of the fact that orthogonal lattices are sphere-packing suboptimal: minimizing the theta series of a fixed-volume lattice, an orthogonal lattice is always suboptimal. Finally, providing probably the best motivation for the sphere-packing design, [22] proved the following approximation for the flatness factor in terms of the minimal vector length, i.e., the sphere-packing radius of the lattice.
Proposition V.1. [22,Prop. 1] Let Λ ⊂ R n be a full-rank lattice with volume Vol(Λ) and minimal norm λ. The theta series Θ Λ (e −πτ ), as a function of τ , can be expressed as where the error term is given by The constant C(n, Λ, L) depends on n, Λ, and a Lipschitz constant L, but is independent of τ .
Note that due to the dual formula for flatness factor, similar criteria could be imposed for the dual lattice Λ e (see also [11]). However, we recall that coset codes are most interesting when Eve's detection resolution is approximately that of the lattice Λ e . In terms of the probability expression (9), this means exactly that the leading and subleading terms of the primal theta series are non-negligible and others are small. This supports the idea of studying the primal theta series via a leading-term analysis, i.e., the sphere-packing density of Λ e . Second, to give an analogy, the successful reliability designs for AWGN and Rayleigh fast fading channels based on sphere-packings and minimum products, respectively, can also both be regarded as a leading-term analysis of the pairwise error probability series.

2) Numerical examples:
We give two computational examples to support the conclusions of the previous subsection. In the first plot of Fig. 1 we have computed the ECDP bounds (9) for four coset codes based on 8-dimensional lattices. The three first ones have Λ b = 1 2 Z 8 and the eavesdropper's lattice Λ e has been chosen to be Z 8 , L := 2Z × 1 2 Z × Z 6 , and the Gosset lattice E 8 , respectively. For the fourth code, Λ e is the unit-volume scaling of the root lattice A 8 and Λ b = 1 2 Λ e . All these give a message set size [Λ b : Λ e ] = 2 8 . We remark that E 8 has the best sphere packing in R 8 [16], and A 8 has the best known covering [15]. The lattice L in turn is certainly poor in the sense of both sphere packings and sphere coverings and by the results of [21], E 8 should always perform better than L. For the numerical computations, formulae for the theta functions are given in [15] and Θ A 8 in [23, The plot in Fig. 1 shows the probability estimates obtained from the theta series as a function of the signal-tonoise ratio SNR= 10 log 10 (σ −2 ). We notice that over the whole SNR range, the lattices are ordered according to the minimal norms, i.e., the sphere-packing density. We also notice that in the low-SNR regime, the ECDP estimates tend to the inverse message set size 2 −8 as they should.
In our second example, we construct codes based on 24-dimensional lattices with Λ e = 2Λ b and hence message set size 2 24 . We have taken Λ e to be Z 24 , the Leech lattice Λ 24 , and three Gosset lattices E 3 8 (all unit-volume) and the unit-volume scaling of E 4 6 . Leech lattice has the best sphere packing in 24 dimensions [17] and E 6 in 6 [16]. As depicted in the second plot of Fig. 1, the Leech lattice indeed performs best of these lattices. Also in this case the lattices appear in order of sphere-packing density (the minimal norms are given, e.g., in [15]).

B. Rayleigh fast fading channels
As our next target, we consider geometric design heuristics to minimize the average flatness factor in the simplest model of a channel with fading, the Rayleigh fast fading channel presented in III-A. The minimization of the average flatness factor is of course more difficult than that of a flatness factor, which we were not able to do rigorously either. The heuristics we give should be regarded as a rough criterion serving as a starting point for more detailed analysis, and they are verified here with several numerical computations. To restrict the space taken, other models such as the block fading or MIMO channel are not studied here. We expect however that similar heuristics are applicable in related channel models.
We suggest that a rough minimization criterion for the function (13) is to choose a full-diversity lattice with a dense sphere packing, such as a well-rounded lattice. We give here two different heuristics that result in the same conclusion. We remark that the requirement of full diversity could be relaxed to what is called local diversity as is done for reliable codes in [25]. We omit this discussion for simplicity.

1) A geometric heuristic:
Recall that the design criterion for the AWGN channel was the sphere-packing density of the lattice Λ e . Analogously, we would now like to maximize the packing density or, equivalently, the minimal norm of the faded lattice hΛ e , where h = diag(h i ) and h i are i.i.d. real Rayleigh-distributed random variables with parameter σ h . Now, for any λ ∈ Λ e , so a first criterion is to maximize the minimal norm of Λ e . This is the sphere-packing criterion. In addition, the random norms diag(h i )λ 2 should be stabilized around Hence, for all λ ∈ Λ e , we should control the variances where · p denotes the usual L p vector norm. This is the diversity criterion: λ 4 4 / λ 4 2 is minimized for "maximally diverse" vectors parallel to (±1, . . . , ±1) and maximized for "minimally diverse" vectors parallel to (1, 0, . . . , 0), (0, 1, 0, . . . , 0) etc. Since not all lattice vectors can be maximally diverse, full diversity is, roughly speaking, the best we can achieve.
Remark V.1. As an alternative approach, we can construct well-rounded lattices where all minimal vectors are parallel to (±1, . . . , ±1). Such lattices are, e.g., all Hadamard rotations of Z n (which exist if n = 2 or n is a multiple of 4), and the body-centered cubic lattice in R 3 , generated by This has been studied in the reliability context: [25] suggests that Hadamard rotations provide reliable codes in the low-SNR range of Bob. Well-rounded lattices with maximally diverse minimal vectors are hence of the utmost interest, but out of the scope of this paper.
2) A computational heuristic: Recall that the successful sphere-packing criterion for AWGN channels could also be regarded as a subleading-term analysis of the flatness factor. There, the subleading-term analysis predicted well the behaviour of the flatness factor. Here, however, the terms in the average flatness factor series decay polynomially and not exponentially in t 2 . Hence, also smaller terms play a role in the average flatness factor. Roughly speaking, small subleading term is a necessary but not sufficient criterion in the minimization of the flatness factor, and we would like to minimize all small terms of the average flatness factor similarly to the subleading one. Let us perform a computation for simplicity for the subleading terms of the average flatness factor, It is clear why full diversity is beneficial as σ 2 h /σ 2 grows large. However, we are most interested in values of the channel quality parameter γ := σ 2 h /σ 2 such that the subleading term is non-negligible compared to the leading term 1, as pointed out in Sec. III-B. This only happens at a poor signal quality. Let us hence study the low-SNR range where γt 2 i 1 for all i. Analogous to [26], we expand the polynomial above in powers of SNR, Hence, minimizing the subleading term of the average flatness factor boils down to maximizing min t∈Λe,t =0 and, ultimately, the same expression should be maximized for all short lattice vectors t. The primary goal is hence to maximize the dominating linear term γ t 2 2 for all t ∈ Λ e , i.e., to maximize the sphere-packing density. Then, for a lattice with a dense sphere packing, we would like to choose a rotation that maximizes the quadratic terms, i.e., minimizes t 4 4 , for all short lattice vectors t ∈ Λ e . As in the previous subsection, this can be interpreted as a diversity criterion.

VI. NUMERICAL EXAMPLES OF RAYLEIGH FAST FADING CHANNELS
In this section, we provide some simple numerical examples to support the design heuristics motivated in Sec. and V-B. We point out that the computations should not be regarded as realistic code design examples but rather as a validation of the heuristics on the behaviour of the average flatness factor.
All calculations in this section are based on the following ideas and softwares. First, we generated (pseudo)randomly totally real extensions K : Q of a given degree, here 4. This was done by randomly generating integer polynomial coefficients and picking those polynomials that generate totally real extensions. Then, we calculated the relevant number-theoretic invariants of the extensions, such as the integral basis, discriminant, etc. The calculations explained above were done on PARI gp [27], after which the results were moved to MATLAB for numerical computations.
In MATLAB, we normalized all the algebraic lattices Λ b to unit volume, and chose for simplicity Λ e = 2Λ b . Then, we approximated the eavesdropper's probability bound (13), truncated over a spherical region of radius 15. Radii between 6 and 15 were tested, and the results were always similar. The truncated probability series is denoted by P c,e,upper throughout this section.
We point out that this strategy is far from "picking a random full-diversity lattice" in the sense that the numbertheoretic construction immediately implies certain regularity. We shall also discuss this restriction in more detail below. Nevertheless, given the simple and natural appearance of our design criteria and their agreement with the computations, we find the results convincing and a good starting point for more careful lattice design.

A. The effect of sphere packing
We first study the effect of the sphere-packing density on the average flatness factor. This is easy to test for algebraic lattices; the shortest vector of an algebraic lattice of a totally real number field is always ±(1, ..., 1).
(This occurs since all points x of an algebraic lattice satisfy i x i ∈ Z, and ±(1, ..., 1) is the innermost point of the innermost hyperboloid i x i = ±1.) Hence, in unit-volume normalization, the minimal vector length, i.e., the sphere packing diameter, is inversely proportional the unnormalized volume. This given in terms of the number The numerical results for σ 2 h /σ 2 = 1 and σ 2 h /σ 2 = 2 are depicted in Fig. 2. Similar plots were obtained for different values of the σ 2 h /σ 2 , but for the values in the figures, the numerical probability estimate P c,e,upper is comparable but still larger than its "complete secrecy value" 1/2 4 . There is a clear correlation between the discriminant and the ECDP bound.
The lattice Λ generated by m 1 , 2 k2 m 2 ,...,2 kn m n has then generators whose length varies at most by factor two.
Since we started from an LLL-reduced basis, the generators of Λ should be near-orthogonal, and thus we expect it to have a reasonably dense sphere-packing, even if this argument is not completely rigorous due to the ambiguity of reduced bases. Furthermore, Λ is fully diverse, since scaled by 2 max |ki| , it will become a sublattice of the original full-diversity lattice generated by m 1 , ..., m n . Now, after the described sublattice procedure the ECDP seems not to depend on the discriminant anymore, as can be seen from Fig. 3. Most importantly, comparing the values of the ECDP in this and the previous example, we can see that the sublattice procedure vastly improved the ECDP estimate and that all lattices now perform quite equally. The latter observation is remarkable in that the construction of the lattices Λ by no means guarantees a particularly dense sphere packing, or that the different Λ would have similar packing density. This hints that a moderately dense sphere packing is good enough for wiretap applications.

B. The effect of diversity
It was motivated that full-diversity (or local-diversity) coset lattices would be beneficial. In Figure 4, we have plotted the ECDP bounds as a function of σ 2 h /σ 2 . We compare the unit lattice Z 4 and full-diversity lattices obtained from sublattice procedure described in Sec. VI-A1. Figure 4 shows that the ECDP is indeed always smaller for  the full-diversity lattices. At most, there is a difference by a factor of approximately 2 0.5 . Secondly, recall that in the limit σ h /σ → 0 + , we obtained the sphere-packing criterion. The plot agrees with this heuristic, since for large values of σ 2 h /σ 2 , the best and worst full-diversity lattices are near each other, with a gap to the unit lattice Z 4 . In the limit σ h /σ → 0 + the gaps are equally large.

C. On the inverse norm sum
Next, we study the correlation of the INS and the ECDP, discussed in Sec. IV-B6. In Fig. 5, we have depicted the ECDP bound P c,e,upper as a function of the INS approximation. Since INS is a lagre-SNR approximation, we have chosen the largest value of σ 2 h /σ 2 for which lattice design plays a role by our previous example. The left plot depicts the randomly generated algebraic lattices and the right plot the sublattices Λ of Sec. VI-A1. In the right plot, there is little correlation between the two variables. Note also that all the lattices in the right plot have smaller ECDP but larger INS than the left plot. The left plot shows a correlation. We expect that this due to the fact that before the sublattice procedure, the ECDP bound correlates strongly with the discriminant of the underlying number field, as motivated in Sec. VI-A. The same property has been shown to hold for the INS both theoretically [28] and numerically [29]. Regarding this numerical example, the discussion in Section IV-B6, and the fact that the average flatness factor is a natural generalization of the flatness factor to fading channels, we suggest using the average flatness factor as a design criterion rather than the inverse norm sum. Analogously, considering the inverse determinant sums appearing in a MIMO approximation of Eve's probability bound [9], these results suggest preferring the probability bound form (15), also derived originally in [9]. As a final remark, we remind that the inverse norm and determinant sums remain as a relevant approximation in the design of reliable lattices.

D. A number-theoretic effect: biquadratic fields
In Figure 2, one can see one of the lattices behave differently than all others. This turned out to be a field extension with a square-root. To exemplify the effect of square-roots, we consider algebraic lattices of biquadratic fields Q( √ p, √ q), p, q ∈ P. A plot corresponding to that in Fig. 2 but for biquadratic fields with small primes is given in Fig. 6. It is clear that the ECDP estimates now grow faster and in a less predictable manner as √ ∆ grows, but we have no straightforward explanation for this. This nevertheless exemplifies the fact that number-theoretic properties of the underlying field extension may drastically affect the performance of the lattice.
VII. ACKNOWLEDGEMENTS D. Karpuk is supported by the Academy of Finland grant #268364, and Camilla Hollanti by the Academy of Finland grants #276031, #282938, and #283262. The support from the European Science Foundation under the ESF COST Action IC1104 is also gratefully acknowledged. We thank the authors of [11] for bringing recent results to our attention. Let us expand separately the norms in the exponential: σ 2 x 2 + σ 2 s y − hx 2 = σ 2 x t x + σ 2 s x t h t hx − σ 2 s (y t hx + x t h t y) + σ 2 s y 2 Notice that (σ 2 I n + σ 2 s h t h) is a positive definite symmetric matrix. Let Q ∈ R n×n be its square-root matrix, (σ 2 I n + σ 2 s h t h) = Q t Q. Note that Q is invertible since ker(Q t Q) = {0}. Continue the expanding of the norms, changing from the variables x and y to the variables Qx and (Q −t h t y), The latter term can be expressed as a positive definite quadratic form: we claim that which, as an inverse of a symmetric positive definite matrix is itself symmetric and positive definite. To see this, notice first that Q −1 Q −t = (Q t Q) −1 = (σ 2 I n + σ 2 s h t h) −1 . Then, by a straightforward computation, (I m − σ 2 s hQ −1 Q −t h t )(σ 2 I m + σ 2 s hh t ) = (σ 2 I m + σ 2 s hh t ) − σ 2 s hQ −1 Q −t (σ 2 I m + σ 2 s h t h)h t = σ 2 I m + σ 2 s hh t − σ 2 s hh t = σ 2 I m .
First, notice that the deviation of the numerator (resp. denominator) from one is bouded by the corresponding flatness factor. Next, note that the flatness factor is rotationally invariant. Hence, let us study the flatness factors in the eigenbasis of h t h. Since h t h is symmetric and positive semi-definite, the basis is orthonormal and in this basis h t h = diag(h 2 i ), and Q = 1 σ σ 2 I n + σ 2 s h t h = diag( 1 + σ 2 s h 2 i /σ 2 ). Let us study the latter factor in (26). The deviation of the numerator from 1 is Similarly, the denominator of the latter factor in (26) From expressions (27) and (28) it is also clear that diag(h)Λe (σ s σ) ≥ Λe (σ s ). Hence, the latter factor in (26) is between 1−ε 1+ε and 1+ε 1−ε , where ε = 1 σ QΛe (σ s ) = 1 σs QΛe (σ) = ε √ σ 2 /σ 2 s In+h t hΛe (σ), using the scaling property. Consequently, the deviation of the latter factor in (26) from 1 is at most where we used the assumption ε ≤ ε max . Thus, |ρ(y) −ρ(y)| ≤ 2ε 1 − ε maxρ (y) and integrating or R n we get the proposed statistical distance.