{"id":"dcdf04f5-b648-4bc9-bf04-392fd6d7f982","arxiv_id":"1908.03637","paper_version":2,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":2,"one_line_summary":"Induced randomness, exchanging random QAM symbols over a reciprocal static channel, enables high-rate secret key generation in static environments, but the claimed eavesdropping probability bounds are not fully justified.","lead":"A protocol lets two wireless devices extract high-rate secret keys even when their channel is static, by having each side inject fresh random symbols and combine them with the reciprocal channel response. The paper claims provable upper bounds on eavesdropping success, but the proof has a gap at the privacy-amplification step.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Unsupported privacy-amplification step: partial knowledge of qi can make the hashed key guessable with probability far above 2^{-δN}; no min-entropy bound is proved, so the 2^{-31} and 2^{-10.57} claims are not established.","rationale":"Good-faith reading: the paper is a system paper whose central claimed contribution is a quantitative information-theoretic security guarantee for SKG in static channels. The protocol description, the BGR/BMR/BER simulations, the NYUSIM evaluation, and the NIST randomness tests are legitimate supporting evidence for reliability and randomness. The security theorems, however, do not follow from the stated assumptions. The reader's weakest-assumption pick is exactly the point I would stress: the 2^{-δN} term is asserted from 'the property of hash functions' without any leftover-hash/min-entropy argument. I verified that the hash construction of Eq. (24) with equal input and output length is not an extractor; a one-bit uncertainty in qi2 remains a one-bit uncertainty in the key. This is not a matter of numerical constants; it is a missing logical step in both Theorem 3 and Theorem 4. I therefore agree that the paper cannot be accepted in its current form and the reader's REJECT should stand. The product-over-subcarriers issue is real but secondary; I would not base the rejection on it alone.","tokens_in":21856,"tokens_out":14619,"duration_ms":160784,"concrete_test":"Re-evaluate the hash step in Theorem 3 using the actual deterministic construction of Eq. (24): fix q1=1, set the 31 high bits of q2 to 0, and let the least significant bit be unknown. Compute K for q2=0 and q2=1 under Eq. (24); the outcomes are 0 and 1, so an Eve with this partial information (which has nonzero probability under the protocol's uniform randomness) guesses the 32-bit key with probability 1/2, contradicting the asserted universal bound 2^{-δN}=2^{-32}. An independent re-derivation should also state the conditional min-entropy H∞(qi | Eve's full view) and verify the leftover-hash inequality needed to support any 2^{-δN}-type term.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Both security theorems rest on the step in the proofs of Theorem 3 (after Eq. (35)) and Theorem 4 (after Eq. (45)): if Eve does not recover all N subcarriers of shared randomness, then 'the probability that she can guess the secret key correctly, by the property of hash functions in the privacy amplification part of our protocol, is at most 2^{-δN}.' This is not a consequence of Definition 2/Eq. (24). Universal hashing bounds collisions for two distinct inputs with a uniform independent index; it does not say the hashed output is uniform given a partial observation. The standard tool would be a leftover-hash lemma, which requires a lower bound on H∞(qi | SS, Eve's RF observations, public hashes) in excess of the output length; no such bound appears anywhere in the paper. The claimed bound is also false as stated: for the construction in Eq. (24), choose q1=1 and suppose Eve knows all of qi except one bit of q2. Then K = q1 q2 mod p takes two equally likely values (e.g., 0 and 1), so Eve guesses the key with probability 1/2, not ≤ 2^{-δN} = 2^{-32}. Since the first term of Theorem 3 is only about 2^{-36.7}, the headline direct-scenario number 2^{-31} is carried by this unsupported term; the same gap invalidates the proof of Theorem 4.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a physical-layer secret key generation scheme for static environments based on induced randomness, in which Alice and Bob inject local random QAM symbols over OFDM subcarriers and use the reciprocal channel to obtain correlated samples. Two scenarios are considered: a direct channel and an untrusted amplify-and-forward relay. The protocol includes quantization, secure-sketch reconciliation, and universal-hash privacy amplification. The main claimed contributions are upper bounds on the probability of successful eavesdropping: Theorem 3 gives (2^{-2δ} + sqrt(2I(h_b;h_e)))^N + 2^{-δN} for the direct case, and Theorem 4 gives (1 - (H(q_a) - I_{ab,e} - 1)/log_2(|Q_A|))^N + 2^{-δN} for the relay case, with numerical values 2^{-31} and 2^{-10.57} respectively. The paper also includes extensive simulations, NIST randomness tests, and a NYUSIM-based evaluation.","tokens_in":22133,"tokens_out":4932,"duration_ms":51374,"significance":"If the security bounds were rigorously established, this would be a meaningful contribution to key generation in static environments, offering a low-complexity protocol and quantitative semantic-security guarantees where prior work mostly relied on decorrelation assumptions. The protocol design is interesting, and the simulation study is thorough, including realistic 5G mmWave channels. However, the central security proofs contain a load-bearing gap: the asserted bound on the probability of guessing the hashed key given partial information is neither proved nor true as stated, and the N-th power over subcarriers lacks a justification of independence. As a result, the headline numerical security claims are not supported by the current analysis.","major_comments":[{"comment":"The proof states that if Eve cannot recover all the shared randomness, 'the probability that she can guess the secret key correctly, by the property of hash functions in the privacy amplification part of our protocol, is at most 2^{-δN}'. This is not a consequence of Definition 2 or Eq. (23). Universal hashing only bounds the collision probability for two distinct inputs when the hash function is chosen uniformly; it does not imply that the hashed output is uniform or hard to guess conditioned on a partial observation of the input. A leftover-hash lemma would require a lower bound on the min-entropy of q_i given Eve's observations and public information, and no such bound appears in the paper. The claim is also false as stated for the construction in Eq. (24): if Eve knows all of q_{i,2} except one bit and q_{i,1}=1, then K = q_{i,1} q_{i,2} mod p takes two equally likely values, so Eve guesses it with probability 1/2, not ≤ 2^{-δN}. Since this 2^{-δN} term dominates the numerical value 2^{-31} (the first term alone is approximately 2^{-36.7}), Theorem 3 is not established.","section":"Section IV-A"},{"comment":"The same unsupported privacy-amplification step is used verbatim: 'If Eve cannot recover all the shared randomness bits in a single session, the probability that she correctly guesses the secret key, by the property of hash functions ... is at most 2^{-δN}'. No argument is provided that partial knowledge of q_a leaves enough min-entropy to make the hashed key uniform, and no leftover-hash lemma is invoked. Consequently, the relay-scenario bound in Eq. (39) also lacks justification.","section":"Section IV-B"},{"comment":"Both theorems raise a per-subcarrier success probability to the N-th power, with the text saying 'by using the independence of such events across the N subcarriers' (Eq. (45)). This independence is asserted, not proved. Even if the subcarrier channels and the induced symbols are mutually independent, the eavesdropper's success events are not automatically independent: Eve observes all subcarriers jointly and may combine her observations with a joint decoding strategy, so the probability of recovering the entire vector is not generally the product of the marginal per-subcarrier probabilities. This gap affects the form of both Theorem 3 and Theorem 4 independently of the hash-function issue.","section":"Section IV"}],"minor_comments":[{"comment":"The numerical evaluation of the relay scenario relies on simulated estimates of I_{ab,e} and H(q_a). The text should explicitly state that these are empirical estimates rather than analytic upper bounds, so the value 2^{-10.57} is an illustration for the simulated parameters, not a guaranteed security guarantee.","section":"Section IV-B"},{"comment":"The comparison 'around 0.0015%' against '0.00153%' is clearer in decimal notation (e.g., 1.5×10^{-5} versus 1.53×10^{-5}).","section":"Section V-B2"},{"comment":"The NIST test results are empirical; the statement that the sequences 'pass all the tests' should be phrased as 'the tests do not reject the null hypothesis of randomness' to avoid overclaiming.","section":"Section V-B3"},{"comment":"In Eq. (31), the superscript k denoting the subcarrier is dropped in the notation I(h_b^k; h_e^k); the text should define the notation consistently.","section":"Section IV-A"}],"recommendation":"reject","confidential_remarks":"The protocol and simulation work are solid, and the paper is clearly written. However, the security proof gap is not a local detail: the asserted 2^{-δN} term is central to both theorems and is demonstrably false under the paper's own hash construction. This is a load-bearing error that cannot be patched by minor revision. I recommend rejection, though the authors might resubmit with a genuine privacy-amplification analysis based on a leftover-hash lemma and a properly justified independence argument."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this is a well-motivated, clearly described protocol for physical-layer key generation in static environments, but the headline security claims are not established. The gap is not a minor technicality; it is the load-bearing step in both Theorem 3 and Theorem 4.\n\nWhat is new and good: the induced-randomness idea—Alice and Bob exchange random QAM symbols, multiply with the reciprocal channel, and use the product as a shared noisy source—is a sensible low-complexity approach for static IoT settings. The relay-based extension with an untrusted relay is a natural and useful addition. The paper also does real engineering work: OFDM implementation, quantization, reconciliation with secure sketches, NIST randomness tests, and a NYUSIM-based evaluation. The BMR/BER plots show the protocol behaving as intended. If the security claims were solid, this would be a meaningful contribution.\n\nWhere it falls down: the proofs of both Theorem 3 and Theorem 4 contain the same two unjustified steps. First, the per-subcarrier success probability is raised to the power N, which requires independence across subcarriers; no argument is given. Second—and more seriously—the proof asserts that if Eve fails to recover all the shared randomness, her guessing probability for the hashed key is at most 2^{-δN} \"by the property of hash functions.\" That is not a consequence of universal hashing. A universal hash family only bounds collision probabilities for distinct inputs when the hash function is chosen uniformly and independently of the inputs; it does not make the output uniform given partial information about the input. The standard tool would be a leftover-hash lemma, which requires a min-entropy lower bound on the input conditioned on Eve's observations, and no such bound appears anywhere. The stress-test counterexample is correct: with the construction in Eq. (24), if Eve knows all of q_i except one bit of q_2, the key takes two equally likely values, so her guess probability is 1/2, not 2^{-32}. This means the numbers 2^{-31} and 2^{-10.57} are not justified.\n\nTo be fair, the first term in Theorem 3, borrowed from Bellare-Tessaro-Vardy, may be a reasonable application, but it does not carry the whole bound. In the relay case, the numerical bound also depends on simulated estimates of I_{ab,e} and H(q_a) without stating how they were obtained.\n\nWho this is for: researchers working on practical physical-layer key generation, especially for static or IoT scenarios, will find the protocol and the engineering evaluation interesting even if the security proof needs fixing. The paper deserves a serious review, but it should not be accepted without a corrected security analysis—ideally using a proper leftover-hash argument with a verified min-entropy condition.\n\nMy recommendation: send it to peer review, but expect major revision before it can be accepted.","headline":"A clearly written protocol paper for static-environment key generation whose headline security bounds rest on an unproven and actually false privacy-amplification step; the system idea is worth knowing, but the main theorems do not go through as stated.","tokens_in":22642,"tokens_out":2369,"would_cite":false,"duration_ms":25216,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that injecting locally generated random symbols lets Alice and Bob derive high-rate secret keys from a static reciprocal channel, and it bounds Eve's success probability by $(2^{-2\\delta}+\\sqrt{2I(h_b;h_e)})^N+2^{-\\delta…","keywords":["physical layer security","secret key generation","static channels","induced randomness","semantic security","untrusted relay","OFDM","privacy amplification"],"falsifier":"Run the direct protocol with $N=16$, $\\delta=2$, and $\\rho=0.09$ (or any stated parameters), simulate Eve's maximum-likelihood estimate of Alice's quantized sequence from her own observations and the public reconciliation and hash messages, and compare her actual success rate in guessing the final key with the claimed bound $2^{-31}$; a success rate above the bound, or an estimated conditional min-entropy of the quantized sequence given Eve's information below $2\\delta N$, would falsify the hash-uniformity step.","tokens_in":21582,"feed_emoji":"🔐","tokens_out":10582,"duration_ms":104104,"temperature":0.7,"pith_summary":"Static wireless environments usually deny physical-layer key generation, because the channel coefficients do not change and there is no fresh common randomness. This paper claims that Alice and Bob can manufacture that randomness themselves: each side transmits its own randomly chosen QAM symbols, and multiplies what it sent by what it received, so the reciprocal channel coefficients become a shared noisy multiplier. Quantization, error-correction-based reconciliation, and universal hashing then turn those correlated samples into a secret key. The central security contribution is a computable upper bound on the probability that a passive eavesdropper recovers the key, roughly $2^{-31}$ for a direct link and $2^{-10.57}$ through an untrusted relay for the paper's example parameters. If the bounds hold, static IoT and sensor networks can refresh symmetric keys at useful rates without mobility, MIMO, or trusted relays.","feed_headline":"Secret keys from static channels: Eve's odds capped at 2^-31","feed_subtitle":"Alice and Bob inject their own random QAM symbols; reciprocity turns a frozen channel into shared key material.","key_machinery":"The load-bearing mechanism is induced randomness exchange. Each session, Alice and Bob transmit independent random QAM vectors $s_i$ and $v_i$ and multiply their own transmitted vector by the received vector, so the reciprocal channel coefficients act as a common random multiplier. In the relay version, the same multiplication is done with the two-hop channels $h_i$ and $g_i$, and the self-interference terms are cancelled using channel estimates, leaving $w_{i,ab}=s_i \\circ v_i \\circ g_i \\circ \\tilde h_i+\\hat n_{i,3,a}$ at Alice and an analogous expression at Bob. The correlated samples are quantized with resolution $\\delta$, reconciled with a code-offset secure sketch (an error-correcting-code construction that lets Bob recover Alice's exact sequence while leaking limited information), and privacy-amplified with a universal hash family that also produces a consistency check. The security theorems then convert information-theoretic leakage into a guessing probability: Theorem 3 uses a semantic-security relation that bounds how much Eve's observations raise her per-subcarrier success probability, and Theorem 4 uses Fano's inequality because the relay scenario's mutual information is too large for the semantic-security route.","core_discovery":"The paper's central claim is that high-rate secret key generation does not require temporal channel variation. In the protocol, Alice chooses a random vector $s_i$ and Bob chooses a random vector $v_i$ from an $M$-QAM constellation; after they exchange these vectors over an OFDM channel, Alice forms $w_{i,ab}=s_i \\circ v_i \\circ \\tilde h_{i,ab}+s_i \\circ n_{i,a}$ and Bob forms $\\tilde w_{i,ab}=s_i \\circ v_i \\circ h_{i,ab}+v_i \\circ n_{i,b}$. Reciprocity makes $h_{i,ab}\\approx\\tilde h_{i,ab}$, so these are highly correlated even though the channel is constant. The paper proves that if Eve is at least half a wavelength from Bob, her probability of a successful attack in the direct scenario is at most $(2^{-2\\delta}+\\sqrt{2I(h_b;h_e)})^N+2^{-\\delta N}$, where $I(h_b;h_e)=-\\log(1-\\rho^2)$ and $\\rho$ is the spatial correlation of Bob's and Eve's fading coefficients; with $N=16$, $\\delta=2$, $\\rho=0.09$, this is below $2^{-31}$. In the relay scenario, where no direct link exists and the relay is honest but curious, the same protocol structure yields the Fano-inequality bound $\\left(1-\\frac{H(q_a)-I_{ab,e}-1}{\\log_2|Q_A|}\\right)^N+2^{-\\delta N}$, evaluated as roughly $2^{-10.57}$ under the paper's parameters.","pith_inferences":["A direct test of the protocol's security would replace the asserted $2^{-\\delta N}$ hash-uniformity step with a measured conditional min-entropy of the quantized sequence given Eve's transcript; if that entropy is below $2\\delta N$, the numerical bounds would need to shrink.","Because the direct-channel bound is driven by the spatial correlation coefficient $\\rho=[J_0(kd)]^2$, the scheme's security margin widens at higher carrier frequencies, where the half-wavelength decorrelation distance is smaller; this makes the method especially natural for millimetre-wave bands.","The induced-randomness construction suggests a route to multi-user secret sharing: each user contributes an independent random vector, and the reciprocal channel graph determines which pairs can multiply out correlated samples; the paper's relay analysis already treats an honest-but-curious helper, so chains of such helpers are a plausible extension."],"forward_implications":["In static indoor IoT or sensor networks, two devices can generate 64 correlated bits per session and a 32-bit final key after hashing, a rate that earlier static-channel protocols reach only with fractions to small numbers of bits per packet.","The direct-channel security bound decays like $\\text{(per-subcarrier success)}^N+2^{-\\delta N}$, so raising the number of OFDM subcarriers or the quantization resolution gives an exponential security margin under the paper's assumptions.","The relay scenario gives a quantitative guarantee for key agreement through an untrusted amplify-and-forward relay when no direct link exists, with the bound computable from SNR, constellation size, and mutual information estimates.","Both protocols remain applicable in dynamic environments as long as the channel is constant during each two-way exchange of induced randomness.","Universal-hash consistency checking keeps the probability of accepting a mismatched key below $1/p$, enabling automatic session retries without leaking key material."],"supporting_citations":[{"why":"Supplies the semantic-security theorem that turns mutual information between Bob and Eve into a bound on Eve's guessing advantage; Theorem 3 is built on it.","marker":"[49]"},{"why":"Fano's inequality, used in Theorem 4 to bound per-subcarrier estimation error from the conditional entropy of the quantized sequence.","marker":"[50]"},{"why":"Defines universal hash functions and the polynomial-hash construction used for privacy amplification and consistency checking in Theorem 1.","marker":"[42]"},{"why":"Code-offset secure sketch with error-correcting codes, the reconciliation primitive that lets Bob recover Alice's quantized sequence.","marker":"[41]"},{"why":"Formalizes secure sketch schemes and their average min-entropy guarantee, which quantifies information leaked during reconciliation.","marker":"[47]"},{"why":"Gives the spatial correlation coefficient $\\rho=[J_0(kd)]^2$ used in Lemma 2 to compute the mutual information $I(h_b;h_e)$.","marker":"[12]"},{"why":"Establishes OFDM subcarriers as parallel sources of channel randomness, the structure that enables the $N$-fold security bound.","marker":"[17]"}],"fun_headline_variants":["Static wireless: Alice and Bob boost secret key rate via randomness","Induced randomness enables fast secret keys on static channels","Eve's attack chance ≤ 2^-31 with induced randomness scheme","Frozen channel? Not a barrier: induced randomness yields keys"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The proof's final step assumes that if Eve has not recovered all $N$ subcarriers of shared randomness, the universal-hash output is uniform enough from her point of view that her best key guess succeeds with probability at most $2^{-\\delta N}$; this uniformity is asserted rather than derived from a proven min-entropy bound.","fun_headline_variants_meta":{"raw":{"variants":["Static wireless: Alice and Bob boost secret key rate via randomness","Induced randomness enables fast secret keys on static channels","Eve's attack chance ≤ 2^-31 with induced randomness scheme","Frozen channel? Not a barrier: induced randomness yields keys"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00075,"raw_usage":{"total_tokens":3461,"prompt_tokens":1188,"completion_tokens":2273,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":804,"completion_tokens_details":{"reasoning_tokens":2202}},"tokens_in":804,"tokens_out":2273,"duration_ms":18600,"temperature":1.0,"reasoning_tokens":2202,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T14:07:49.821251+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the direct protocol with $N=16$, $\\delta=2$, and $\\rho=0.09$ (or any stated parameters), simulate Eve's maximum-likelihood estimate of Alice's quantized sequence from her own observations and the public reconciliation and hash messages, and compare her actual success rate in guessing the final key with the claimed bound $2^{-31}$; a success rate above the bound, or an estimated conditional min-entropy of the quantized sequence given Eve's information below $2\\delta N$, would falsify the hash-uniformity step.","supporting_citations":[{"cited_title":"Semantic securit y for the wiretap channel,","cited_arxiv_id":null,"evidence_quote":"Supplies the semantic-security theorem that turns mutual information between Bob and Eve into a bound on Eve's guessing advantage; Theorem 3 is built on it."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines universal hash functions and the polynomial-hash construction used for privacy amplification and consistency checking in Theorem 1."},{"cited_title":"A fuzzy commitment scheme,","cited_arxiv_id":null,"evidence_quote":"Code-offset secure sketch with error-correcting codes, the reconciliation primitive that lets Bob recover Alice's quantized sequence."},{"cited_title":"Fuzzy extractors: Ho w to gener- ate strong keys from biometrics and other noisy data,","cited_arxiv_id":null,"evidence_quote":"Formalizes secure sketch schemes and their average min-entropy guarantee, which quantifies information leaked during reconciliation."},{"cited_title":"Secure key genera- tion from OFDM subcarriers’ channel responses,","cited_arxiv_id":null,"evidence_quote":"Establishes OFDM subcarriers as parallel sources of channel randomness, the structure that enables the $N$-fold security bound."}],"review_version":1}