Keywords: Secure Voice Communications, Data over Voice Channels, Voice Encryption, Joint Speech Coding, Formal Verification, Semantic Security. vi

Codage conjoint source-chiffrement-canal pour les canaux de communication vocaux sécurisés en temps réel Résumé Les risques croissants de violation de la vie privée et d'espionnage associés à la forte croissance des communications mobiles ont ravivé l'intérêt du concept originel de chiffrement de la parole sous forme de signaux audio transmis sur des canaux vocaux non spécifiques. Les méthodes habituelles utilisées pour la transmission de données cryptées par téléphonie analogique se sont révélées inadaptées pour les communications vocales modernes (réseaux cellulaires, VoIP) avec leurs algorithmes de compression de la voix, de détection d'activité vocale et de suppression adaptative du bruit. La faible bande passante disponible, les distorsions non linéaires des canaux et les phénomènes d'évanouissements du signal motivent l'introduction d'une approche conjointe du codage et du chiffrement de la parole adaptée aux distorsions introduites par les canaux vocaux modernes. Dans cette thèse sont développés, analysés et validés divers schémas sûrs et efficaces pour le chiffrement et la transmission de la parole en temps réel pour les canaux vocaux modernes. En plus du chiffrement de la parole, cette étude couvre les aspects sécurité et algorithmique de l'ensemble du système de communication vocale -aspects critiques d'un point de vue industriel. La thèse détaille un système de chiffrement de la parole associé à un codage avec perte, par brouillage aléatoire des paramètres vocaux (volume, hauteur, timbre) de certaines représentations de la parole. En résulte un pseudo-signal vocal chiffré robuste aux erreurs ajoutées par les canaux de transmission modernes. La technique de chiffrement repose sur l'introduction de translations et rotations aléatoires sur des maillages de tores plats associés à des codes sphériques. Face aux erreurs de transmission, le schéma déchiffre approximativement les paramètres vocaux et reconstruit, grâce à un synthétiseur vocal utilisant un réseau de neurones par apprentissage, un signal de parole perceptuellement très proche du signal d'origine. Le dispositif expérimental a été validé par la transmission de signaux de type pseudo-voix chiffrés sur un canal vocal réel. Les signaux de parole déchiffrés ont été favorablement notés lors d'une évaluation subjective de qualité incluant environ 40 participants. La thèse décrit également une nouvelle technique de transmission de données sur canaux vocaux en utilisant un dictionnaire d'ondes harmoniques courtes représentant les mots d'un code quaternaire. La technique fournit un débit binaire variable allant jusqu'à 6.4 kbps et a été testée avec succès sur différents canaux vocaux réels. Enfin, est présenté aussi un protocole d'échange de clés cryptographiques dédié pour les canaux vocaux authentifiés par signatures et vérification vocale. La sécurité du protocole a été vérifiée sous forme d'un modèle symbolique par l'assistant de preuve formelle Tamarin. L'étude conclut qu'une communication vocale sécurisée sur des canaux vocaux numériques réels est techniquement et de fait viable lorsque les canaux vocaux utilisés pour la communication sont suffisamment stables et ne présentent que des distorsions prévisibles. Mots-clés : Communications vocales sécurisées, Données sur les canaux vocaux, Chiffrement de la voix, Codage conjoint de la parole, Vérification formelle, Sécurité sémantique. vi Joint source-cryptographic-channel coding for real-time secure voice communications on voice channels

Undertaking this PhD has been a truly life-forming experience that broadened my horizons and profoundly changed my view of the world. However, it would not have been possible without many people who provided me the guidance and support.

First of all, I am deeply grateful to the Agence de l'Innovation de Défense and the Direction Générale de l'Armement for the funding needed to pursue my research and the financial and administrative support when the future of my PhD project was at risk. I would like to sincerely thank my joint supervisors, Professor Bruno Martin and Dr.-Sc. Jerome Lebrun, for being my real academic and life mentors. I cannot fully express my gratitude for your wise scientific guidance and your help in solving all the hurdles I encountered during my studies. Thank you very much for every inspiring discussion, your encouraging words in challenging situations, and all your hard work until late night hours.

I gratefully appreciate the work of my tutor Thierry Plesse from the Direction Générale de l'Armement, who supervised the progress of my research, and whose unwavering support enabled me to continue this PhD.

I thank my former company advisor Arnaub Graube for his in-depth technical advice, his patience with explaining to me all the subtleties of engineering work, and for showing that solving any scientific problem does not end just by publishing a research article.

I express my gratefulness to Professor Cheon Jung-Hee and Professor Park Hyung-Ju for inviting me to Seoul National University. It was a great honor to work with you and a wonderful experience I will always keep in my memory.

I would like to thank all the professors and researchers I had a pleasure to collaborate with during my work at I3S: Professor Enrico Formenti, Dr. MCF Cinzia Di Giusto, Dr. MCF Sandrine Julia, Dr. MCF Marie Pelleau, Professor Jean-Charles Régin, and the PhD students: Marie Baillet, Samvel Balassanian Dersarkissian, François Doré, Rémy Garcia, Loïc Germerie, Laetitia Gibart, Assia Kamal-Idrissi, Nicolas Isoart, Laetitia Laversa, Ninad Manerikar, Sara Riva, and Giulia Rocco. I appreciate all the time we spent together in a friendly atmosphere. Without your help and advice, my PhD would have been far incomplete.

Many thanks to all my colleagues from I3S-CNRS and INRIA whom I met during my studies: Dmitry Anisimov, Eva Gil San Antionio, Jean-Philippe Bauchet, Denys Bulavka, Fernando Ireta, Franco Fusco, Nicolas Girard, Jean-Marie Kai, Lyes Khacef, Ivana Kojcic, Muxingzi Li, Pedro Marinho, Timothée O'Donnel, Cédric Portaneri, Siddharth Pritam, Flora Quilichini, Miguel Romero, Melissa Sanabria, Méliné Simsir, Onur Tasar, Carlos Jorge Zubiaga Peña. I was truly impressed by the vibrant, diverse, and inclusive community you have built. It has made my PhD such an exciting experience.

I offer my special thanks to Arnab Dey, Sardor Israilov, and Giulia Rocco for bringing hope during the sombre and solitary lockdown periods and helping me to re-discover the meaning of friendship.

Finally, I would like to thank my dear Polish friends: Małgorzata Drozd, Nikodem Dymski, Paweł Młynarski, and Katarzyna Tomasiak, with whom I spent many joyful moments on discussing the specificities of the French life and on exploring the beautiful French Riviera. The mainstreaming of mobile networks opens new possibilities for personal communication. However, the rising numbers of reported privacy violations and cyber-espionage cases undermine confidence in the communication infrastructure. Another issue is inadequate security of many voice communication systems, such as GSM which encrypted voice traffic using the insecure A5/1 stream cipher with a 64-bit key [START_REF] Biham | Cryptanalysis of the A5/1 GSM stream cipher[END_REF]. Low trust results in a growing need for alternative methods of securing vocal communication.

This work addresses the issue of secure voice communications over untrusted voice channels. The procedure for establishing a secure vocal link is illustrated in Figure 1.1. In the first step, two users carrying dedicated devices initiate an insecure call using a preferred communication technique, like cellular telephony, Voice over Internet Protocol, or fixed-line telephone circuits. Then, the two devices securely acknowledge their cryptographic keys by sending binary messages over the voice channel, the same way as ordinary voice. Once the cryptographic key is computed and authenticated, the speakers can start a secure conversation. Each device encrypts speech in real-time into an incomprehensible noise and sends the encrypted signal over the channel. Upon reception, the paired device decrypts the signal and restores the initial voice. The outlined communication scheme involved into sending the encrypted audio is more complicated than exchanging encrypted bits over digital packet networks. Modern voice channels aim at preserving speech intelligibility at an acceptable speech quality degradation. This goal is accomplished by applying perceptual speech processing, such as voice compression, voice activity detection, and adaptive noise suppression. All these operations considerably modify the synthetic signal, hindering secure communication.

CHAPTER 1 -Introduction

On the other hand, secure communication over voice channels is supposed to be more versatile because the encrypted audio signal can be made compatible with arbitrary communication infrastructure. Furthermore, the encrypted audio signal is more likely to pass through firewalls without being blocked [START_REF] Lee | The Vulnerability Exploitation Conveying Digital Data Over Mobile Voice Call Channels[END_REF]. Finally, the system can protect against spying malware installed on the portable device if speech encryption is done by an external unit [START_REF] Krasnowski | Introducing a Verified Authenticated Key Exchange Protocol over Voice Channels for Secure Voice Communication[END_REF]. The mentioned advantages suggest that the proposed setting could be especially useful for diplomatic and military services, journalists, lawyers, and traders who require secure communications in an unreliable environment and without confidential communication infrastructure. Consequently, the system should reflect high security requirements by elevating the level of secrecy, privacy, and authentication.

Research rationale

Transforming speech into an encrypted signal is a multi-step process that consists of speech encoding, enciphering, appending redundancy for error protection, and signal synthesis. The classical and also the most straightforward approach is to treat each of these steps separately, as depicted in Figure 1.2. However, this approach is not suitable in secure voice communications because the information conveyed in speech is non-uniformly distributed in the time-frequency plane. Consequently, the system ignores the fact that some speech parameters are more relevant in terms of privacy and intelligibility, resulting in suboptimal bandwidth allocation and data protection. It is especially true in communication over a very low-bitrate vocal channel with distortion. Firstly, the error-protection block does not prioritize the most relevant voice parameters needed to maintain the speech quality. In parallel, the speech encoder cannot be sensibly tuned to mitigate typical transmission errors introduced by the voice channel.

Secondly, classical cryptographic algorithms are unsuitable for enciphering speech as they usually require error-less data for decryption. In the discussed setting, however, transmission errors are unavoidable. On the contrary, one may observe that perfect data decryption is not mandatory, and small imperfections are likely to be perceptually irrelevant. Consequently, it would be advantageous to design a cryptographic scheme aware of the channel constraints and the unequal importance of vocal parameters.

The aforementioned interdependencies suggest that speech encoding, encryption, errorcorrection, and signal synthesis must be considered jointly. As a result, robust real-time communication over voice channels requires combining the processing blocks into a single unit, as shown in Figure 1.3.

This thesis aims to develop, analyze, and validate secure and efficient schemes for real-time speech encryption and transmission via real voice channels in the form of pseudo-voice in the audio domain. This multi-domain study combines elements from the fields of audio signal processing, cryptography, cybersecurity, and error-correcting codes, encouraging the joint approach for speech encryption schemes with lossy encoding and resistant to the distortion introduced by digital voice channels.

-Origins of secure voice communications 3

In addition to developing algorithms for speech encryption, this study covers the relevant aspects of the whole voice communication system from an industrial perspective. Cryptographic key management, key exchange protocols, and usage scenarios are important parts of this work.

Origins of secure voice communications

The history of secure voice communications is marked by various inventions that progressively shaped our modern understanding of secure communications. The first 'secure' speech scrambler patented in 1881 alternated speech signal between multiple telephone circuits at a high rate [Rogers, 1881]. The system did not offer high protection, and until the First World War was replaced by analog frequency inverters making the speech signal incomprehensible for an ordinary listener (Figure 1.4). Again, it turned out that trained operators could understand inverted speech, effectively breaking the secrecy of communication [Kak, 1983]. In the third attempt, engineers added analog band splitters for permuting speech subbands, as shown in Figure 1.5. The A-3 splitter installed by AT&T in 1937 for radiotelephone service used five subbands with 5! • 2 5 = 3840 combinations of permutations and inversions. However, only 11 codes were considered suitable for privacy, which was far too low to resist cryptanalysis [Kahn, 1996]. The progress in analog speech scrambling moved towards higher permutation complexity and reached maturity by introducing sequentially updated time-frequency segment permutations (TFSP) [START_REF] Jayant | Analog scramblers for speech based on sequential permutations in time and frequency[END_REF]. In these systems, speech was scrambled by combined time and frequency permutations using permutation matrices. Moreover, the matrices were frequently updated according to a random sequence to improve robustness to cryptanalysis. Despite these efforts, novel analog speech scramblers were consistently broken during the wartime period and later [Goldburg et al., 1993, Kahn, 1996, Zhao et al., 2007, Ghasemzadeh et al., 2014].

Another family of analog speech scramblers altered speech with additive or multiplicative masking noise that could be filtered out at the unscrambler (Figure 1.6) [Sugar, 1974, MacKinnon, 1980]. First systems superimposed masking tones or white noise [Sivian, 1928], whereas more advanced systems used chaotic maps [START_REF] Kocarev | Experimental demonstration of secure communications via chaotic synchronization[END_REF]. Unfortunately, transmission errors and imperfect filters significantly degraded the speech quality at the receiving end. In consequence, designers faced a negative tradeoff between speech quality and secrecy.

CHAPTER 1 -Introduction

The limitations of analog speech scrambling encouraged engineers to experiment with digital speech encryption. The inspiration was the famous Vernam cipher patented in 1919 [Vernam, 1919, Vernam, 1926], the electronic realization of an unbreakable 'one-time pad' used during the First World War for telegram communication. The initial idea was to encipher a digital representation of the speech samples with a random digital keystream (Figure 1.7) [MacKinnon, 1980]. While highly secure, the technique required wide bandwidth (12-18 kbps), error-less digital channels, which were prohibitively expensive at that time. The technical challenge remained unresolved until the late 30s when first voice coders (vocoders) were proposed [Dudley, 1939]. Vocoders enabled speech compression and reduction of encrypted data to be send. Figure 1.7 -Digital speech enciphering.

Probably the first secret telephony system using a vocoder was SIGSALY 1 ('X-System'), constructed in 1943 for secure communication during the Second World War [Bennett, 1983]. Figure 1.8 illustrates the block diagram of the transmitting part. The input speech was filtered by ten band splitters distributed nearly uniformly over the 150-3000 Hz range. The amplitudes of filtered streams were sampled by a six-level non-uniform quantizer, resulting ten trains of numbers between 0 and 5. Parallelly, a separate unit performed a two-step pitch prediction. The output was two numbers between 0 and 5 representing the coarse pitch value and the pitch refinement, or a single voicing bit.

The twelve trains of encoded values were independently enciphered with twelve trains of random six-valued numbers by a modulo-6 addition. The random numbers were obtained by continuously sampling white noise generated by a hot gas tube, based on the one-time-pad principle. The result of enciphering were twelve trains of randomly-looking numbers.

The last step of speech encryption involved signal synthesis. Each of the twelve trains had an assigned subchannel in the telephone band. Data transmission was done by modulating twelve frequency carriers, each carrier occupying one subchannel. The encoding and enciphering operations were repeated every 20 milliseconds, resulting in the 3.6 kbps transmission bitrate.

-Contributions

5

A successful deployment of SIGSALY, sometimes viewed as one of the most outstanding technical achievement, marked the beginning of the vocoder era in secure voice communications. Over the years, as more data bandwidth became available, the quality of speech synthesis was improved, and the price of computing units went down, vocoder-based speech communication became the predominant technique in the military and civilian applications. Around 1972, there were first attempts to replace secure voice communication over fading telephone lines with packet networks [Forgie, 1975], paving the way to modern secure VoIP communication.

Contributions 1.4.1 Data over Voice (DoV) technique

In Chapter 3, we propose a novel technique for data transmission over digital voice channels with Linear Predictive Coding (LPC), such as cellular networks and VoIP. The technique relies on codebooks of short waveforms with 7-10 phase-modulated harmonics over the 0 to 4 kHz audio band. The solution's novelty comes from the simplified codebook building process, which uses short quaternary error correction codes to determine appropriate phases of the harmonics. Moreover, the structure of the codebook of symbols enables many computational optimizations at the receiving side and partial compensation of channel distortion. The method is more versatile than other data transmission techniques over digital voice channels, often trained to a specific channel model. The possibility of variable transmission rate up to 6.4 kbps gives control over the robustness against channel distortion.

The DoV technique has been successfully validated in experiments with mobile phones and real-world voice channels (3G networks, WhatsApp, Skype, FaceTime, Signal Messenger). We achieved robust data transfer up to 2.4 kbps over 3G networks and 6.4 kbps over VoIP. The high throughput and the robustness enabled transmission of encrypted speech in a setting simulating real-time communication. As a result, the proposed method can be used in cryptographic key exchange and secure voice communications over voice channels.

The work has been presented in the article 'Introducing a Novel Data over Voice Technique for Secure Voice Communication' and submitted to the journal of Wireless Personal Communications, Springer.

Distortion-tolerant encryption of vectors on N-spheres

In Chapter 4, we describe a new method of enciphering unit vectors on a hypersphere that is robust against transmission error. The technique exploits spherical group codes and rotations from a commutative group of orthogonal matrices introduced by Slepian [Slepian, 1968] in the new context of securing data. The scrambled data are indistinguishable from uniformly distributed noise in the presence of an eavesdropper when the matrices are selected according to a secure pseudo-random sequence with fresh secret seed.

The presented encryption scheme decrypts data approximately despite channel distortion. It makes the scheme suitable for protecting voice or images in real-time applications that prioritize robustness over representation's fidelity. To describe the scheme's ability to decrypt mildly distorted ciphertexts, we defined a new notion of distortion-tolerant encryption.

CHAPTER 1 -Introduction

The enciphering technique is an essential building block in the experimental speech encryption scheme described later in Chapter 5. The scheme is used to securely scramble multi-dimensional spectral envelopes, which are responsible for speech timbre perception.

Distortion-tolerant speech encryption

In Chapter 5, we present a novel distortion-tolerant speech encryption scheme for secure voice communications over voice channels that combines the robustness of analog speech scrambling and a higher security level offered by digital ciphers. The system scrambles vocal parameters of a speech signal (loudness, pitch, timbre) using random translations and the previously mentioned random rotations on a hypersphere of parameters. In the next step, randomized parameters are encoded to a pseudo-speech signal adapted to transmission over digital voice channels equipped with voice activity detection.

The use of translations and rotations in enciphering makes the speech decryption algorithm tolerant against moderate channel distortion. Upon reception of some pseudo-speech signal, the receiver restores distorted copies of the initial vocal parameters. Despite some deciphering errors, an integrated neural-based vocoder based on the LPCNet architecture [Valin and Skoglund, 2019] reconstructs an intelligible speech.

The experimental implementation of this speech encryption scheme has been tested by simulations and sending an encrypted signal over FaceTime between two iPhones 6 connected to the same WiFi network. Moreover, speech excerpts restored from encrypted signals were evaluated by a speech quality assessment on a group of about 40 participants. The experiments demonstrated that the proposed scheme produces intelligible speech with a gracefully progressive quality degradation depending on the channel distortion. Finally, the preliminary computational analysis suggested that the presented setting may operate on high-end portable devices in nearly real-time.

Authenticated Key Exchange over voice channels

In Chapter 6, we designed a two-party authenticated key exchange (AKE) protocol for secure voice communication over fading voice channels. The protocol does not require any reliable datadriven side-channel nor a remote trusted party like a Certificate Authority (CA). The protocol is based on the Ephemeral Elliptic Curve Diffie-Hellman key exchange and provides a flexible double authentication mechanism with cryptographic signatures, and Short Authentication Strings (SAS) pronounced aloud by the users. Considerable protocol simplifications lead to robustness against signal fading and message dropouts.

The protocol's security properties were successfully verified in a symbolic model using Tamarin Prover [START_REF] Meier | The TAMARIN prover for the symbolic analysis of security protocols[END_REF], a cryptographic protocol verification tool. Formal symbolic verification can be considered as the first important step in evaluating the protocol security. Parallelly, the work emphasizes some practical aspects of the cryptographic key exchange such as user-friendliness, easiness of implementing, and resilience against adversarial attacks.

The protocol and the symbolic verification in Tamarin Prover were published in 'Introducing a Verified Authenticated Key Exchange Protocol over Voice Channels for Secure Voice Communication' at the 6th International Conference on Information Security and Privacy [START_REF] Krasnowski | Introducing a Verified Authenticated Key Exchange Protocol over Voice Channels for Secure Voice Communication[END_REF].

1.5 -Organization Chapter 2 reviews the principles of speech parametrization, speech synthesis, and digital voice communication, which help to understand some challenges related to secure communications over voice channels. The investigation revealed that many real voice channels (cellular networks, VoIP) rely on Linear Predictive Coding (LPC), inspiring the robust DoV technique presented in Chapter 3. Furthermore, the analysis of various speech coding techniques concluded that achieving error-less data transmission over general voice channels is very unlikely. This result motivated the work on distortion-tolerant encryption techniques in Chapter 4 and Chapter 5. Finally, the characterization of cellular networks and VoIP highlighted their susceptibility to signal dropouts, which encouraged designing a robust AKE protocol detailed in Chapter 6.

Organization

Chapter 3 describes the DoV technique based on codebooks of harmonic waveforms. The technique description is preceded by an examination of the typical signal distortion introduced by a selection of LPC coders. This chapter details an efficient codebook design method using quaternary codes and derives a demodulation rule with distortion compensation. Transmission performance over cellular networks and VoIP is presented and discussed. Finally, the chapter outlines an experimental secure voice system using DoV and proposes a technique countering voice activity detection by repetitive silence insertion.

Chapter 4 details the distortion-tolerant encryption scheme for scrambling spherical data using commutative spherical group codes. The chapter starts by recalling the fundamental theory of lattices, spherical codes, and secure pseudo-random generators. The chapter then introduces the notion of distortion-tolerant encryption that describes the system's capability to decipher distorted ciphertexts approximately.

CHAPTER 1 -Introduction

The encryption scheme using spherical codes is thoroughly detailed. The chapter explains the computational indistinguishability of encryptions in the presence of an eavesdropper when the source of randomness is a secure pseudo-random number generator (PRNG). For illustration, the chapter finishes with a toy example of distortion-tolerant color scrambling of an RGB image.

Chapter 5 introduces the distortion-tolerant speech encryption scheme. The chapter details all processing steps, including speech encoding, enciphering, pseudo-speech synthesis, and final speech reconstruction using so-called LPCNet voice synthesizer based on Machine Learning. Further, the chapter investigates the security, operational, and computational aspects of the system. Finally, it presents the results of some simulations and a speech quality assessment.

Chapter 6 presents the authenticated key exchange protocol over fading voice channels. The chapter enlists the security requirements posed by secure voice communication systems and discusses some typical use cases. Moreover, the chapter briefly describes a symbolic protocol verification in Tamarin Prover from the user perspective. The protocol properties and verification results are thoroughly discussed.

Chapter 7 concludes the manuscript and gives prospects for future work.

Highlights

My PhD started in December 2017 as a DGA 2 CIFRE 3 -Defense fellowship at the cybersecurity startup BlackBoxSécu in Sophia Antipolis, France, and in cooperation with I3S 4 -CNRS 5 and the Université Côte d'Azur, France. The project was co-funded by BlackBoxSécu and the DGA grant No 01D17022178.

During my PhD at BlackBoxSécu, I helped with developing a stand-alone device for speech encryption that could be connected to a mobile phone in tandem, and would enable a secure communication over voice channels. This application-oriented study resulted in a new Data over Voice technique and an optimized Authenticated Key Exchange protocol over voice channels, both described in this manuscript.

In December 2019, I was a visiting student at the group of Prof. Cheon Jung-hee at Seoul National University, South Korea, where I had a great pleasure to observe the cutting-edge research on homomorphic encryption, and to exchange valuable ideas.

In February 2020 my DGA CIFRE-Defense grant was converted to a fully academic PhD at I3S and the Université Côte d'Azur due to some financial difficulties faced by BlackBoxSécu. The studies were funded by AID 6 from the grant No SED0456JE75. Starting from that moment, I moved my attention towards more theoretical aspects of my project, which was a new distortiontolerant speech encryption scheme using spherical commutative group codes.

2. Direction Générale de l'Armement 3. Conventions Industrielles de Formation par la Recherche 4. https://www.i3s.unice.fr/ 5. http://www.cnrs.fr/ 6. Agence de l'Innovation de Défense CHAPTER 2

Speech processing and voice communications

Secure voice communication over voice channels encompasses three technical problems associated with speech processing: ensuring conversation secrecy, maintaining high speech quality at the reception side, and enabling robust and low-latency signal transmission via vocal channels. These seemingly different topics should be considered jointly due to severe constraints posed by voice channels, which operate differently than traditional data-driven communication channels. This chapter provides some essential background for understanding challenges related to secure voice communication over voice channels. The chapter reviews the principles of speech parametrization, speech synthesis, and digital voice communication. Furthermore, it gives a general overview of popular voice coding techniques, briefly characterizes vocal channels, and points out some relevant state-of-the-art solutions. The chapter concludes with some guiding rules for designing a robust communication system over voice channels.

Motivation

The secure voice communication setting considered in this study involves sending a synthetic signal with data using some voice-oriented application. This seemingly simple problem, however, turns out to be rather challenging. For example, Figure 2.1 illustrates a received and recorded synthetic signal sent between two mobile phones through WhatsApp. The signal consisted of eight phase-modulated harmonics in the 0.4-3.2 kHz range with short repeated synchronization tones at 3.6 kHz. Harmonics were modulated using traditional Phase-Shift-Keying (PSK) modulation, and carried some binary information. After a few seconds of transmission, WhatsApp suppressed these modulated harmonics and significantly amplified the synchronization tones instead. The binary data encoded into harmonics were irreversibly lost.

This experiment revealed that real-world digital voice channels cannot be considered as classical communication channels. Voice channels aim at preserving speech intelligibility, which is quite a different goal than of data-driven channels. Consequently, voice-oriented applications perform complex processing that may completely disarrange the fine time-structure of the input signal.

Voice channels are the primary limiting factor for a secure communication system. The pseudo-speech signal must conform with the speech model implemented in a particular voice channel, otherwise risking signal distortion or suppression. Moreover, some channel characteristics (e.g., audio bandwidth, signal compression ratio, latency) limit the available data throughput for sending encrypted speech. Consequently, robust communication is possible only if the available channel throughput (i.e., determined by compression bitrate) is sufficiently high. This chapter reviews the principles of speech coding and communication and gives some essential background needed to answer the three questions: how modern voice channels process and transmit the input signal, how to produce pseudo-speech that conforms with digital voice channels, and what speech data to protect. The chapter outlines speech production and perception mechanisms that underlie speech parameterization, speech compression, and speech synthesis. Furthermore, it focuses on the core elements and parameters of 2G/3G cellular networks and Voice over Internet Protocol (VoIP), which are anticipated to cover most usage scenarios for the secure voice system. This chapter is organized as follows. Section 2.2 recalls the speech chain concept, helpful in understanding speech processing paradigms. Section 2.3 describes the source-filter speech production model and the speech encoding method based on Linear Predictive Coding. Section 2.4 focuses on the auditory system and perceptual speech parametrization. Section 2.5 overviews four prominent voice coding families: waveform coders, LPC coders, perceptual coders, and parametric coders, which are widely adopted in digital voice communications and can be used in speech encryption with lossy encoding. Moreover, the section enlists possible speech synthesis methods, including autoregressive-moving-average (source-filter) synthesis, sinusoidal speech synthesis, and synthesis using trained neural networks. Finally, Section 2.6 briefly characterizes voice channels in cellular networks and VoIP with an emphasis on operational constraints (delay, bandwidth, reliability) and algorithms such as Voice Activity Detection (VAD), Adaptive Gain Control (AGC), and Noise Suppression (NS). Section 2.7 summarizes the chapter.

The speech chain

The speech signal is an acoustic, analog waveform that conveys some encoded message and is used in natural human communication [Benesty et al., 2008, Chap. 1, Rabiner andSchafer, 2011, Chap. 1]. Apart from the linguistic content, speech provides much paralinguistic information such as the speaker's identity [Furui, 1996, Campbell, 1997], age and gender [START_REF] Ptacek | Age recognition from voice[END_REF], Childers and Wu, 1991, Metze et al., 2007, Li et al., 2013], emotions [Nwe et al., 2003, Vogt andAndré, 2006], and the linguistic origin [Hanani et al., 2013, Kolly andDellwo, 2014]. From a security standpoint, all this information is considered sensitive and must be protected by the speech encryption system. If protection of some paralinguistic information becomes too burdensome for the system (for example, due to insufficient bandwidth), this information should be suppressed rather than leaked.

The linguistic and paralinguistic information conveyed in the speech signal may be seen as a multi-step speech production process, shown in Figure 2.2. Speech production involves an abstract message formulation, language-level representation, and physiological articulation. These encoding steps add natural redundancy that robustifies communication in a noisy environment. The speech signal captured at the ear is decoded in the reversed order. Firstly, the auditory system performs a spectral analysis of the received speech and extracts the spectral features. In the next step, the auditory nerves forward the spectral information to the brain, which recognizes particular phonemes, and forms words and sentences. Finally, the brain translates the linguistic representation into the initial message [Rabiner and Schafer, 2011, Chap. 1]. These combined speech production and perception processes are called the speech chain [START_REF] Denes | The speech chain -the physics and biology of spoken language[END_REF].

The speech chain intuitively describes the information flow in vocal communication. The initial message formulation, described as a product of the syllable-level information density (in bits/ syllable) and the average utterance speed (in syllables/second), is done approximately at the rate of 39 bps [START_REF] Coupé | Different languages, similar encoding efficiency: Comparable information rates across the human communicative niche[END_REF]. This estimated value is believed to reflect the neurocognitive capabilities of the human brain and be independent of the speaker's language. Another approach is to represent the message as a sequence of phonemes. For example, the English phonological system consists of 42 phonemes [Cohen, 1971] where each phoneme could be encoded with 6 bits. Assuming an average utterance speed of 10 phonemes/seconds, we obtain 60 bps of the information rate [START_REF] Ramasubramanian | Ultra Low Bit-Rate Speech Coding[END_REF]. Appending the minimum prosodic information (e.g., duration, intensity, intonation) also adds some redundancy [Rabiner and Schafer, 2011, Chap. 1]. Speech articulation transforms the discrete message into the analog, continuous domain. The slowly moving articulatory system needs about 100 ms to significantly change the produced sound's characteristic [START_REF] Gay | Effect of speaking rate on labial consonant-vowel articulation[END_REF], Tasko and Westbury, 2004, Flanagan, 1972]. The result of speech articulation is a speech signal that could be represented as a sequence of speech samples. Since the audible spectrum ranges between 20 Hz to 20 kHz (the upper bound drops somewhat in adulthood) [Purves et al., 2018, Chap. 13], one may assume the 'CD-quality' sampling rate of 44.1 kHz and 16-bit quantization. The data rate of such sampled signal goes up to 705 kbps.

Interestingly, there is growing evidence for some physical correlation between the production and perceptual systems [START_REF] Miller | Speaking rate and segments: A look at the relation between speech production and speech perception for the voicing contrast[END_REF], Wilson et al., 2004, Ackermann et al., 2007]. Thus, it is believed that the information rates associated with respective speech production and perception steps are comparable to each other [Rabiner and Schafer, 2011, Chap. 1].

The last important element of the speech chain is the transmission channel. In natural conversation, the channel is a noisy acoustic connection between the speaker and the listener. In longdistance communication, an acoustic speech signal is transduced to electric intensity and sent in the analog or the digital domain over the network.

Modern digital voice channels encode and compress speech signals to reduce the data to send. Again, the speech chain provides a good outline of strategies for extracting relevant information from the speech signal. For instance, increasingly popular speech-to-text applications mimic the whole speech perception process, firstly converting the speech signal into a sequence of features, and then mapping these features into phonemes, syllables, and finally into full words [START_REF] Huang | Spoken language processing: A guide to Theory, Algorithm, and System Development[END_REF], Chap. 9, Gold et al., 2011, Chap. 22-24, Rabiner and Schafer, 2011, Chap. 14]. However, building highly abstract representations of the speech signal requires some computational effort and introduces a significant processing delay. Thus, coding algorithms intended for real-time voice communications are mostly inspired by physiological voice production and perception mechanisms. The same processing constraint applies to securing speech and to producing an encrypted pseudo-speech signal in real-time.

CHAPTER 2 -Speech processing and voice communications

Source-filter model and Linear Predictive Coding

One of the most efficient techniques used in real-time voice compression (and hence popular in vocal communications) takes inspiration from the mechanism of speech production by phonatory and articulatory systems, illustrated in Figure 2.3. The phonatory system, consisting of lungs, a larynx, and vocal cords, is responsible for producing excitation sound. The role of articulatory organs -a lower jaw, a velum, a tongue, and lips -is to change the shape of a vocal tract, which begins at the opening of the glottis, and then continues through a pharynx, oral and nasal cavities, and finishes at lips and nostrils [START_REF] Benesty | Handbook of Speech Processing[END_REF], Chap. 2, Rabiner and Schafer, 2011, Chap. 3, Bäckström, 2017]. According to the source-filter model of speech [Müller, 1840,Fant, 1960,Kelly and Lochbaum, 1962], voice production starts with the air pushed out by the lungs and flowing through the vocal cords located in the larynx. When the vocal cords are tense, the air pressure causes the organ to open and close in a quasi-periodic manner. As a result, the vibrating vocal cords generate pulseshaped buzzing sound. The cords' tension and size, combined with the airflow speed, control the sound frequency. Then, the buzzing excitation propagates through the vocal tract, where it is spectrally and temporarily shaped. A continuous movement of the tongue, the teeth, and the lips change the tract's transfer function, resulting in different sounds emitted by the speaker. The size and the shape of the tract may significantly differ between each person, resulting in the unique prosodic voice characteristics that enable speaker identification. Table 2.1 lists ranges of the sound frequency produced in glottis for male, female and child speakers [Rabiner and Schafer, 2011, Chap. 3], and Table 2.2 describes the average size of the vocal tract [START_REF] Fitch | Morphology and development of the human vocal tract: A study using magnetic resonance imaging[END_REF].

Table 2.1 -The range of frequencies (pitch periods) produced in glottis by male, female and child speakers [Rabiner and Schafer, 2011, Chap. 3 The sound characteristics produced by the vocal cords and the moving vocal tract can be well observed on a spectrogram (Figure 2.4). The voiced parts of the signal have a clear harmonic structure, with the harmonics located at the multiples of the fundamental frequency of excitation. On the contrary, the unvoiced signal resembles noise of intensity concentrating at higher frequencies. The darker lines in the spectrogram correspond to formants, the tract's resonant frequencies. When the articulatory organs are moving, formants are continuously changing their position and amplitude. In practice, variation and relative position of formants are crucial in phonemic classification [Lindblom andStuddert-Kennedy, 1967, Syrdal and[START_REF] Syrdal | [END_REF]. In speech coding, the outlined speech production system is often approximated by a simplified, discrete-time model illustrated in Figure 2.5. According to the model, speech production consists of two distinct elements: a discrete-time excitation (source signal) generator and a filtering transfer function. The latter element represents the combined effect of the glottal pulse shaping, the vocal tract, and radiation at the lips [Rabiner and Schafer, 2011, Chap. 3].

An excitation signal can take two different forms, depending on whether a generated sound is classified as voiced or unvoiced. When the sound is voiced, the excitation generator simulates vibrating vocal cords and produces an impulse train (Dirac comb) with a specified period. In another case, the generator outputs white noise. The resulted excitation signal is amplified by some gain G.

Derivation of the correct tract transfer function is challenging because it requires the exact knowledge of the transient tract shape and the soft tissue covering. Instead, the vocal tract is approximated by N concatenated lossless tubes, as illustrated in Figure 2

V(z) = 1 1 -N k=1 a k z -k . (2.1)
The function V(z) is experimentally extended to an all-pole transfer function H(z) with 12-16 coefficients to include effects introduced by the glottal shaping, the nasal cavity, and the lips radiation:

H(z) = 1 1 -p k=1 a k z -k . (2.2)
In real-world applications, the transfer function H(z) is usually not known a priori. It is possible to estimate H(z) and the excitation signal from the sampled speech signal s[n] in the process called linear prediction analysis. The big success of linear prediction popularized the term 'linear predictive coding' (LPC) when referring to all speech processing techniques based on the linear source-filter model shown in Figure 2.5 [Rabiner and Schafer, 2011, Chap. 9]. Assuming that the recorded speech follows the source-filter model shown in Figure 2.5 with the excitation u[n] and the all-pole filter H(z) described by coefficients a 1 , ..., a p , discrete-time speech samples s[n] can be expressed using the difference equation:

s[n] = p k=1 a k s[n -k] + Gu[n].
(2.3) Thus, H(z) acts like a linear prediction filter. Since the true values of the coefficients a k and the excitation samples Gu [n] are not known beforehand, the prediction algorithm searches coefficients α k such that the prediction error e[n] (the residual) has the minimum energy n e 2 [n]:

s[n] = p k=1 α k s[n -k] + e[n].
(2.4)

The resulting coefficients α k and the residual e[n] are assumed to be the true coefficients a k and the excitation Gu[n], respectively. In practical realizations, the algorithm processes only short portions of the speech signal, assumed to be stationary [START_REF] Elliott | The modulation transfer function for speech intelligibility[END_REF]. For the speech interval of length L and starting at ñ, samples s ñ[ℓ] used in the prediction analysis have the following form:

s ñ[ℓ] = s[ℓ + ñ]w[ℓ], ℓ = 0, ..., L -1, (2.5)
where w[ℓ] is the Hamming window centered at ⌊L/2⌋ and equal to 0 outside 0, ..., L -1. In such a case, the prediction algorithm aims at minimizing the residual energy over the interval:

E ñ = L-1+p ℓ=0 s ñ[ℓ] - p k=1 α k s ñ[ℓ -k] 2 .
(2.6)

The minimization of E ñ has a unique solution. Taking the partial derivatives ∂E ñ/∂α i for i = 1, ..., p, and equating them to 0 gives p linear equations with p unknowns:

L-1+p ℓ=0 s ñ[ℓ -i]s ñ[ℓ] = p k=1 α k L-1+p ℓ=0 s ñ[ℓ -i]s ñ[ℓ -k], 1 ≤ i ≤ p. (2.7)
Equations 2.7 can be efficiently solved by the Levinson-Durbin algorithm [Makhoul, 1975].

With the H(z) finally obtained, the signal residual e[n] is further processed to compute the gain G and estimate the harmonicity ratio (voicing). When the signal is sufficiently harmonic, the speech encoder estimates the pitch period. Otherwise, the excitation is replaced with white noise.

The two-level excitation model is sufficient for typical vocal sounds. For instance, Figures 2.7 and 2.8 present residual signals obtained from LPC analysis of the real vowel /e/ and the fricative /s/ recordings. It can be noticed that the residual of the voiced vowel is similar to a pulse train and the residual of the unvoiced fricative resembles noise. Figure 2.9 displays the LPC filter frequency response obtained from a linear predictive analysis of vowel /e/. The filter phase response is highly nonlinear, whereas magnitude has distinguishable resonances corresponding to the vowel's formants.

Despite its simplicity, linear predictive coding achieves satisfactory results in representing speech signals at medium bitrates (4-16 kbps). In consequence, LPC became a popular technique in voice communication systems, including cellular networks and VoIP. For this reason, it seems natural that the encrypted pseudo-speech used in secure communication must fit into the sourcefilter speech model and be robust against LPC processing. For example, linear filtering is likely to change the complex spectral profile of the transmitted signal. The crucial question is how a particular voice channel corrupts unvoiced residuals. When the coder replaces unvoiced sounds with synthetic white noise, information encoded into an encrypted signal can be irreversibly lost.

Fortunately, a majority of voice coders adopted in digital communications do not replace noisy residuals entirely. Instead, coders often apply sophisticated encoding techniques in order to represent the residual faithfully. In practice, the encoding method of the residual determines the distortion characteristics introduced by the voice channel.

A more detailed characterization of LPC-based voice channels and some strategies for producing conforming pseudo-speech signal is covered in Chapter 3.

Psychoacoustics and perceptual speech coding

An alternative method to encode speech relies on the psychoacoustic properties of the human auditory system. Unlike source-filter modeling, which simulates the voice production, perceptual speech coding aims at preserving signal information relevant for the listener. This approach is the one underlying general audio coding as done in MPEG- The basilar membrane may be seen like a bank of non-linear filters transforming the timedomain signal into its short-time spectral representation [START_REF] Rabiner | Theory and applications of digital speech processing[END_REF], Chap. 4, Gold et al., 2011, Chap. 14, Fastl and Zwicker, 2006]. The frequency response of the membrane is often compared to a set of intensity-sensitive, overlapping bands. The number and widths of the filters have been estimated experimentally [START_REF] Kiang | Tails of tuning curves of auditorynerve fibers[END_REF], leading to the idealized concept of 24 critical bands [START_REF] Fastl | Psychoacoustics: facts and models[END_REF]] that covers the audible band in average adults. According to the model, the bands are approximately constant below 500 Hz and are logarithmically widening at higher frequencies. The non-linear band distribution is usually represented in the Bark scale, which numbers center frequencies of bands by integers from 1 to 24 (Table 2.3). The Bark scale approximates the octave-based perception of notes [Kallman, 1982].

The auditory filter-bank model is extensively used in perceptual speech coding for representing the short-time speech spectrum. To improve encoding efficiency, speech perception models consider non-linear sound perception and temporal/frequency masking [Lyon, 1982, Kubin andKleijn, 1999]. Perceptual speech coding proved to be very useful in speech recognition [Huang et al., 2001, Chap. 9, Rabiner andSchafer, 2011, Chap. 14], voice transformation [Benesty et al., 2008, Chap. 24] and speech synthesis [Kondoz, 2004,Milner and Shao, 2006,Juvela et al., 2018]. However, speech coders relying solely on auditory models provide lower voice quality than source-filter coders at the same compression rate. It is because source-filter coding makes stronger assumptions about the encoded speech signal, enabling sparser representation [Bäckström, 2017, Benesty et al., 2008, Chap. 18].

The physiological properties of the auditory system enable the listener to distinguish three components of a vocal (or a musical) sound: loudness, pitch, and timbre [Huang et al., 2001, Chap. 2]. Although sound perception varies among listeners, a considerable effort has been undertaken to relate sound perception with objective signal properties [Stevens, 1956, Von Békésy and Wever, 1960, Goldstein, 1973]. The studies revealed that these perceptual qualities can be roughly related to three signal characteristics: signal intensity, fundamental frequency, and spectral envelope, as listed in Table 2.4. Moreover, it can be assumed that these components are roughly independent of each other, i.e., a modification of one physical parameter changes only the corresponding perceptual component. Speech loudness is perceptually related to sound intensity, which is defined as the ratio between the average flow of the energy through a unit area I and the accepted referential threshold of hearing I 0 = 10 -12 W/m 2 . Sound intensity is usually represented in the logarithmic scale:

IL = 10 log 10 I I 0 dB. (2.8)
Sound intensity of a natural speech varies usually between 20 dB -80 dB [Rabiner and Schafer, 2011, Chap. 4].

The sensitivity of the auditory system to sound intensity varies in frequency. Figure 2.11 presents the equal-loudness curves [START_REF] Fletcher | Loudness, Its Definition, Measurement and Calculation[END_REF], indicating the sound intensity levels perceived by an average listener as equally loud. The highest sensitivity to sound intensity is located between 500 Hz and 5 kHz, and largely overlaps with the speech spectrum between 150 Hz and 7 kHz [Rabiner and Schafer, 2011, Chap. 4]. Subband speech and audio coders often exploit the nonlinear sound perception by optimizing the quantization of frequency bands [Benesty et al., 2008, Chap. 18].

Pitch, expressed in mel units, is a perceptual quantity describing the frequency of a tone. The nonlinear relation between the pitch and the true frequency is fitted by the following formula:

pitch = 1127 log 10 1 + f 700 mel, (2.9)
where f is the tone frequency in Hz [Stevens et al., 1937, Rabiner andSchafer, 2011, Chap. 4]. As suggested by Figure 2.12, the listener's ability to discriminate two similar tones decreases when the frequency of the lower tone goes up. This observation agrees with the critical band theory because two close tones are more likely to fall into the same spectral band at higher frequencies than at lower frequencies [START_REF] Fastl | Psychoacoustics: facts and models[END_REF].

The third perceptual component, timbre (the color of sound), is sometimes described as a quality distinctive from pitch and loudness [ANSI, 1994]. The research on describing timbre perception is still ongoing (for a relevant discussion, see [Sethares, 2004, Aucouturier and Bigand, 2012, Siedenburg et al., 2016]). Nevertheless, it is generally agreed that timbre is a multidimensional property describing spectro-temporal characteristic of a sound. In the case of voice, timbre is usually associated with formants or spectral envelope [Huang et al., 2001, Chap. 2]. Such an interpretation links timbre with the vocal tract's shape, contrarily to pitch and loudness related to excitation.

Compared to pitch and loudness, an efficient parametrization of timbre appears troublesome. There are many propositions for approximate spectral envelope representations, such as Perceptual Linear Prediction (PLP) model or LPC filter frequency response [Rabiner and Schafer, CHAPTER 2 -Speech processing and voice communications 2011, Chap. 8]. One efficient representation of timbre in the speech recognition domain are Mel-Frequency Cepstral Coefficients (MFCC) [START_REF] Davis | Comparison of parametric representations for monosyllabic word recognition in continuously spoken sentences[END_REF]. MFCC are defined as the discrete-cosine transform (DCT) of the logarithm of the mel-spectrum of a speech frame:

MFCC[n] = 1 R R r=1 log 10 (MF[r]) cos 2π R r + 1 2 n ,
where MF is the mel-spectrum of the speech frame computed based upon a filter bank of R ≥ n weighting functions (Figure 2.13) that approximate the critical band spacing: This somehow unobvious MFCC definition reflects the nonlinearity of timbre perception. The filter distribution roughly corresponds to critical bands, whereas the logarithm of windowed energies approximates loudness perception. Finally, DCT decomposes the filtered spectrum into orthogonal elements. Since the speech energy tends to concentrate in the first 13-19 coefficients, computed MFCC are often truncated [Benesty et al., 2008, Chap. 9, Rabiner andSchafer, 2011, Chap. 8].

MF[r] = Ur k=Lr |W r [k]X[k]| 2 Ur k=Lr |W r [k]| 2 , r = 1, 2, ...,
C0 = 1 C1 = 1 C2 = 1 C3 = 1 C4 = 1
The popularity of MFCC in the speech recognition domain comes from their ability to extract relevant features from spectral envelopes. There had been even an interesting attempt to introduce MFCC as an objective timbre measure [START_REF] Terasawa | In Search of a Perceptual Metric for Timbre: Dissimilarity Judgments among Synthetic Sounds with MFCC-Derived Spectral Envelopes[END_REF],Terasawa et al., 2005]. Nevertheless, provided that many MFCC-based speech synthesizers perform rather poorly [START_REF] Chazan | Speech reconstruction from mel frequency cepstral coefficients and pitch frequency[END_REF], Milner and Shao, 2006, Yoon et al., 2007, Boucheron et al., 2011, Juvela et al., 2018], it seems that the transformation removes some salient information from a signal.

Speech parametrization using the signal energy, the fundamental frequency, and the spectral envelope works especially well for voiced sounds. As an example, Figure 2.14 presents the spectral magnitude of the same vowel /e/ as in Figure 2.7. It can be noticed that the mentioned parameters accurately describe the magnitude of the harmonic signal. However, the representation almost entirely ignores the phases of harmonics. Discarding the phase information is motivated by partial agnosticism of the auditory system to signal phase, especially above 1 kHz [Benesty et al., 2008, Chap. 4]. This effect could be caused by a roll-off of firing synchrony in auditory nerves above 2 kHz [START_REF] Alves-Pinto | Perception and coding of high-frequency spectral notches: potential implications for sound localization[END_REF].

Several speech encoding techniques used in vocal communication originate from major studies on sound perception, i.e., signal pre-emphasis, frequency masking of weak tones, nonlinear quantization, and noise shaping [Bäckström, 2017, Chap. 4]. Consequently, the pseudo-speech signal used in secure communication should be robust against perceptually-oriented processing in the spectral domain, not only against source-filter coding.

Voice coders

Digital voice communication systems send encoded speech as binary data and re-synthesize signal at the reception side. The paramount role of voice codecs, or vocoders, is to reduce the transmission bitrate without a significant perceptual quality degradation of decoded voice. Concurrently, voice coding algorithms have to meet several operational goals, such as a small computational delay, low computational and memory requirements, and finally, robustness to channel imperfections (e.g., lost frames, bit errors) [Benesty et al., 2008, Chap. 14].

Figure 2.15 illustrates a simplified diagram of a generic speech codec. The encoder's input is a low-passed speech signal sampled typically at 8 kHz (narrowband speech) or 16 kHz (wideband speech). Low-pass filtering is done in accordance with the Nyquist-Shannon sampling theorem which states that the highest signal's frequency component should be at most half the sampling rate. The reduction of the signal bandwidth from 20 kHz to 4 kHz or 8 kHz significantly lowers the data rate for sending. On the other hand, reduced bandwidth degrades speech quality.

The speech samples are modeled as representing stationary signal segments (frames), usually of some fixed or variable duration between 5 ms -20 ms. Voice encoders map these input speech frames into a set of parameters linked to the selected speech model and a distortion measure. The speech model implemented in a voice coder determines the characteristics of the distortion caused by compression. As an example, Figure 2.16 illustrates the same speech waveform compressed by three different vocoders. Despite the perceptual similarity, the obtained waveforms significantly differ. This result seems to question the possibility of designing a genuinely universal and efficient method for sending data over arbitrary voice channels. Voice coders can be roughly grouped into four major families: waveform coders, source-filter coders, perceptual coders, and parametric coders [Benesty et al., 2008, Chap. 14]. As will be briefly described later in the section, some speech models attract attention as candidates for speech encryption and pseudo-speech synthesis. These models are implemented in low-bitrate parametric coders with a simple structure that is easy to encode, manipulate, and randomize. On the other hand, some coders seem to be suitable for data transmission due to the small or compensable distortion they introduce.

Waveform coders

Waveform coders directly encode the time-domain speech signal without strong assumptions regarding signal characteristics. The most straightforward waveform coding is adopted in the standard G.711, which describes the Pulse Code Modulation (PCM) with fixed µ-law or A-law pseudologarithmic quantization [ITU-T, 1988f]. The µ-law quantization reflects the nonlinear intensity perception and improves the perceptual speech quality compared to linear quantization. The encoded signal is sampled at 8 kHz with 8-bit resolution, giving a constant bitrate of 64 kbps.

A modified version of PCM, referred Adaptive Differential PCM (ADPCM), is standardized by G.726 [ITU-T, 1990]. Unlike the generic PCM coding, ADPCM encodes adaptively differences between speech samples and reduces the bitrate of the 64 kbps PCM down to 40, 32, 24, or 16 kbps. Adaptive encoding does not degrade much the perceptual speech quality because consecutive speech samples tend to be highly correlated. A similar approach to G.726 is adopted in wideband G.722 [ITU-T, 2012a]. Additionally, the G.722 coder splits the signal bandwidth into lower (0-4 kHz) and higher (4-8 kHz) parts, encoded separately using ADPCM. The subband separation enables more efficient bit allocation in the lower frequency band, which is perceptually more important than the higher band.

Waveform coders are suitable for encoding signals which are not necessarily speech-like and are closer to traditional modulated signals. This characteristic may underlie efficient data transmission. For example, a series of International Telecommunication Union (ITU) standards describes modem data transmission over digital telephony network [ITU-T, 1988c, ITU-T, 1988a, ITU-T, 1988b, ITU-T, 1988d, ITU-T, 1988e, ITU-T, 1998]. Some of the standardized modems are listed in Table 2.5. The dominant technique used in these modems is amplitude and phase modulation (QAM) of a single carrier. The modems take advantage of frequency division and trellis-coded modulation at higher bitrates to efficiently use the available voice bandwidth.

While voice channels equipped with waveform coders seem to be the most universal for transmission of encrypted pseudo-speech, their high bitrates exceeding 16 kbps are not appropriate for use in speech encryption.

LPC coders

Linear source-filter coders form a large family of algorithms that rely on the simplified Kelly-Lochbaum (KL) speech production model [START_REF] Kelly | Speech synthesis[END_REF]. The KL model approximates vocal tract by lossless acoustic tubes represented as a digital ladder filter. Vocal tract approximation by LPC coders is done similarly in every coder, using linear prediction analysis. The fundamental difference characterizing source-filter coders is the way they encode the excitation. The most well-known technique used in LPC coders is Code Excited Linear Prediction (CELP) [START_REF] Schroeder | Code-excited linear prediction (CELP): High-quality speech at very low bit rates[END_REF]. Instead of a simple switch between the voiced pulse train and the white noise generator, as earlier described in Figure 2.5, CELP coders utilize a codebook of predefined excitation signals. Given the residual of the prediction analysis, the coder searches the closest CHAPTER 2 -Speech processing and voice communications codebook vector (or the sum of vectors) by minimizing a Mean Squared (Weighted) Error (MSE) [Benesty et al., 2008, Chap. 17]. Popular examples of CELP coders are Speex [START_REF] Herlein | RTP Payload Format for the Speex Codec[END_REF], Opus-Silk [START_REF] Valin | Definition of the Opus Audio Codec[END_REF] and iLBC [START_REF] Duric | Real-time Transport Protocol (RTP) Payload Format for internet Low Bit Rate Codec (iLBC) Speech[END_REF], all of them used in VoIP.

There are many CELP variants, depending on how the excitation codebook is structured and exploited. Examples such as Algebraic CELP (ACELP) [START_REF] Adoul | Fast CELP coding based on algebraic codes[END_REF], 3GPP, 2018a], Vector Sum CELP (VSELP) [START_REF] Gerson | [END_REF]Jasiuk, 1990, ETSI, 2000] or Conjugate Structure CELP (CS-CELP) [START_REF] Salami | Design and description of CS-ACELP: a toll quality 8 kb/s speech coder[END_REF], ITU-T, 2012b] have been standardized and adopted in the industry. Figure 2.17 depicts a simplified model of an adaptive ACELP speech synthesizer. The excitation signal is formed from two sources: an adaptive dictionary built upon the past excitation signal and a sparse algebraic codebook that encodes a difference between the previous and the current frame. The codebook gains and the sparse algebraic excitation are estimated during the encoding stage by minimizing the MSE. The best-known example of an ACELP coder is Adaptive Multi-Rate (AMR) codec implemented in cellular networks. The codec is available in narrowband (AMR-NB) [3GPP, 2018a] and wideband (AMR-WB) [ITU-T, 2012c] versions and compresses sampled speech signals respectively to 4.75 -12.2 kbps and 6.6 -23.85 kbps. AMR performs linear prediction analysis on 20 ms frames and computes LPC filters with 10 (AMR-NB) or 16 (AMR-WB) taps encoded as line spectral pairs (LSP) [START_REF] Soong | Line spectrum pair (LSP) and speech data compression[END_REF].

The specificity of AMR is its sparse algebraic excitation encoder. The codebook search is performed on 5 ms subframes, which in the narrowband scenario results in processing vectors of 40 samples. In the 12.2 kbps mode of AMR-NB, all positions in a subframe are grouped into five tracks, where each track contains two pulses with amplitude -1 or +1 (Table 2.6). The encoder chooses positions for ten non-zero pulses so that the combined output from the algebraic and adaptive dictionaries gives the closest representation of excitation. As more subframes are encoded, the adaptive dictionary builds a refined model of excitation.

The construction of adaptive ACELP coders is motivated by the observation that excitation and the vocal tract change slowly in time [Gay et al., 1974, Edwards andChang, 2013]. Adaptive ACELP coders can represent complex excitation signals with high perceptual quality, given a 2.5 -2.5.3 Perceptual coders sufficiently large portion of a stationary speech signal. This valuable property in speech encoding becomes an obstacle in pseudo-speech transmission over voice channels with ACELP compression. A highly variable encrypted signal is very likely to be smoothed during compression, and many information-carrying signal details could be discarded. Therefore, a robust pseudo-speech signal should fit into the general source-filter speech model and be adapted to the ACELP excitation encoder.

Perceptual coders

In contrast to LPC coders, perceptual coders aim to encode general audio signals with speech and background music. This flexibility of audio coders encourages their use in speech-related applications in place of LPC coders. In the past years, a big limitation of general audio coders was their large algorithmic delay. For example, AAC [ISO/IEC, 2006] at a 24 kHz sampling rate and a 24 kbps bitrate introduced delay of about 100 ms, too high for use in natural speech conversation that requires end-to-end transmission delay no larger than 150 ms [Benesty et al., 2008, Chap. 18].

Gradual algorithmic optimizations introduced in recent coders opened new possibilities in many real-time audio applications.

Perceptual coders rely on filterbank-based audio coding. The first processing step involves transforming the signal to a spectral representation using analysis filterbanks, such as the Modified Discrete Cosine Transform (MDCT) [START_REF] Princen | Subband/transform coding using filter bank designs based on time domain aliasing cancellation[END_REF], polyphase filterbanks [Rothweiler, 1983], or hybrid structures [START_REF] Brandenburg | Comparison of filterbanks for high quality audio coding[END_REF]. In the next step, the transformed signal is analyzed following a perceptual model, e.g., hearing thresholds, temporal and frequency masking, and masking between tonal and noise signals [Hellman, 1972]. The perceptual analysis gives information for optimum quantization and bit allocation.

The examples of general audio coders for real-time applications are Low-Delay Advanced Audio Coder (AAC-LD) [ISO/ IEC, 2006] used in Apple's VoIP application FaceTime, and Opus' Constrained Energy Lapped Transform (Opus-CELT) [START_REF] Valin | Definition of the Opus Audio Codec[END_REF] used for real-time audio streaming and in-chat gaming. Both coders are based on MDCT with partially overlapping windows and perceptually-weighted spectrum quantization. Low algorithmic latency (20 ms and below) compared to classical audio coders has been achieved by shortened frames, reduced lookahead in the filterbank analysis, and introducing several computational optimizations. However, the data rates characterizing these coders, 32-64 kbps for AAC-LD and 48-128 kbps for CELT, are very high. Consequently, they cannot be considered as good speech models for speech encryption. CHAPTER 2 -Speech processing and voice communications

Low-bitrate parametric coders

At bitrates below 4 kbps, high quality speech encoding is very hard to obtain. Instead, parametric coders capture only the key perceptual features of speech, preserving speech intelligibility at an acceptable perceptual quality. A common characteristic of parametric coders is the use of simplistic speech models that enable efficient compression at expense of lower speech fidelity. Due to significant quality degradation, parametric speech coders are used in critically constrained environments, such as satellite and military communications [Benesty et al., 2008, Chap. 16]. Examples of parametric coding techniques are Mixed Excitation Linear Prediction (MELP) [START_REF] Mccree | A 2.4 kbit/s MELP coder candidate for the new US Federal Standard[END_REF], Multiband Excited coding (MBE) [START_REF] Griffin | Multiband excitation vocoder[END_REF], Sinusoidal Transform Coding (STC) [START_REF] Mcaulay | Speech analysis/synthesis based on a sinusoidal representation[END_REF] and Waveform Interpolation (WI) [Kleijn, 1991].

Sinusoidal coders model a continuous-time speech signal locally as a sum of N equally-spaced sine waves:

s(t) = N -1 k=1 A k sin(kω 0 • t + ϕ k ), (2.10)
where ω 0 is the fundamental angular frequency, and A k and ϕ k are the amplitudes and the phases of harmonics. While the harmonic model is accurate for voiced sounds, it can also satisfactorily represent unvoiced speech [START_REF] Mcaulay | Speech analysis/synthesis based on a sinusoidal representation[END_REF]. The principle of sinusoidal coding is thus to estimate the harmonic parameters for each speech frame. During synthesis, the mismatch between consecutive frames is mitigated using sine interpolation or the overlap-add technique.

Probably the most popular sinusoidal coder is the open-source Codec2 1 designed by Rowe, which offers speech compression rates 0.7 -3.2 kbps and full speech intelligibility. In Codec2, each speech frame of 20 ms or 40 ms is parametrized by its fundamental frequency, energy, spectral envelope (amplitudes of harmonics), and voicing. The phase information in the compressed signal is discarded and regenerated by the decoder.

Another model is used in MBE coders, where a speech frame in the spectral domain S(ω) is represented as the product of the spectral envelope H(ω) and the excitation spectrum |E(ω)|:

S(ω) = H(ω)|E(ω)|.
(2.11)

The MBE coder subdivides the excitation spectrum into several bands (20 or more) and classifies each band as voiced/unvoiced. Consequently, the coder parametrizes speech signals by the fundamental frequency, the spectral envelope, and a sequence of voicing decisions. The decoder synthesizes all voiced bands using the sinusoidal model and reconstructs unvoiced bands with white noise shaping. The improved version of MBE (IMBE) operating at 6.4 kbps is implemented in satellite communications [START_REF] Hardwick | The application of the IMBE speech coder to mobile communications[END_REF].

Although the most significant progress in source-filter and parametric coding took place in the 80s and 90s, it still inspires new speech synthesis techniques. Recently, Jean-Marc Valin (Mozilla) and Jan Skoglund (Google LLC) proposed a new architecture of a speech coder, named LPC-Net [Valin andSkoglund, 2019, Valin andSkoglund, 2019]. The mathematical model of speech synthesis implemented in LPCNet is similar to all other LPC coders representing discrete-time 2.6 -2.5.4 Low-bitrate parametric coders 29 speech signal s[n] as the linear combination of past samples p[n] and a residual (an excitation) e[n]:

s[n] = p[n] + e[n]
(2.12) .13) Unlike in traditional coders, however, the excitation signal e[n] is modeled by using a trained neural network.

p[n] = 16 k=1 α k s[n -k] . ( 2
The block diagram of the synthesis part of LPCNet is illustrated in Figure 2.18. The coder operates on 10 ms speech frames sampled at 16 kHz. The frames are encoded using 20 (quantized) features: a pitch period, a soft voicing, and 18 Bark-scale cepstral coefficients similar to previously described MFCC. During speech synthesis, these 18 cepstral coefficients are transformed into linear prediction coefficients α 1 , ..., α 16 . Figure 2.18 -LPCNet architecture [Valin and Skoglund, 2019].

The speech synthesizer consists of two neural networks. The first network takes as an input the 20-dimensional feature vector and once per 10 ms outputs a conditioning vector f used by the second so-called sample-rate neural network. The role of the sample-rate network is to predict a probability distribution of the excitation Pr(e[n]) at the time n, given four inputs: the previous excitation sample e[n -1], the past synthesized speech sample s[n -1], the current prediction p[n] and the computed conditioning vector f . The excitation e[n] is obtained by sampling from the predicted distribution. This last feature distinguishes LPCNet from deterministic speech coders.

LPCNet achieves remarkable results in producing near-natural wideband speech and compressing speech signals down to 1600 bps. Additionally, the optimized architecture of the coder makes its implementation on low-power devices an achievable goal. However, LPCNet requires a considerable amount of data and time to train the networks. Nevertheless, after extensive training, the coder's performance shows how little information is needed to produce intelligible speech in real-time and that speech quality can be enhanced using synthetic-only excitation.

Parametric coders rely heavily on Vector Quantization (VQ) [Gray, 1984] and other codebookbased techniques, providing significant compression gains [START_REF] Ramasubramanian | Ultra Low Bit-Rate Speech Coding[END_REF]. In combination with a simplified structure of speech models, low-bitrate parametric coders are desirable candidates for use in speech encryption. On the other hand, data transmission over a voice channel with parametric speech coding is significantly constrained by the implemented speech model. Unless the pseudo-speech signal structure is adapted to a particular channel, the achievable data rate would be prohibitively low.

CHAPTER 2 -Speech processing and voice communications

Digital voice channels

Voice channels cannot be analyzed apart from the infrastructure that enables long-distance communication. The system parameters (e.g., transmission delay, drop-out probability, available bandwidth, handheld devices used) significantly impact the voice channel properties. Furthermore, a recorded speech signal is usually subject to quality-enhancing processing, such as background noise suppression or echo cancellation. While these algorithms considerably improve the user's experience of speech perception, they also add more complexity upon standard voice compression.

This section outlines two popular mobile voice communication systems: wireless cellular networks (GSM/UMTS) and VoIP. The description focuses on a few selected elements of the analyzed systems, which detail important voice channel properties and may impact the encrypted pseudospeech transmission.

Cellular networks of the second and the third generation (GSM/UMTS) are circuit-switched systems for mobile voice communication [START_REF] Holma | WCDMA for UMTS: Radio access for Third Generation Mobile Communications[END_REF], Chap. 2, Schwartz, 2005, Chap. 8, Eberspächer et al., 2008]. Figure 2.19 depicts a simplified schematic of the established vocal connection between two users equipped with proper mobile phones and registered to different cellular base stations (BS). In the presented situation, one-way voice transmission over cellular networks consists of three stages. The speech is firstly encoded on the mobile phone by the AMR coder and sent as data signal from the mobile device up to the BS. Afterward, the station decompresses the encoded bits into 8 kHz PCM speech samples at the 64 kbps bitrate [ITU-T, 1988f] and forwards the signal to the destined BS through the public switched telephone network (PSTN), or the integrated services digital network (ISDN) [ITU-T, 1993]. Upon reception of the PCM samples, the receiving BS encodes the speech again with AMR and sends the data to the recipient.

The operation of cellular networks reveals that the sent voice can be processed twice by two different vocoders. Provided that AMR coder strongly compresses speech signals, the mean opinion score (MOS) [ITU-T, 1996a, ITU-T, 2016a] of the perceptual speech quality in cellular communication is unsurprisingly mediocre [ETSI, 2018c]. On the other hand, circuit-switched vocal links in cellular networks have to meet very stringent requirements for the Quality of Service (QoS). More specifically, the transmission delay between two mobile phones should not exceed 100 ms for the 95th percentile of the delay distribution, and mobile phones are granted the minimum bandwidth enabling a smooth conversation [3GPP, 2018c]. Unlike cellular networks, VoIP does not guarantee any QoS. According to the International Standardization Organization (ISO) recommendation G.114, the maximum transmission delay should stay below 150 ms [ITU-T, 2003a]. These proposed guidelines often cannot be met, especially in large-distance communication with the communication latency as large as 300 ms and above [ITU-T, 2003a]. Moreover, the quality of transmitted speech depends on the available network throughput and reliability. Excessive average latency, jitter, and lost packet probability of a poorly performing network may significantly lower the user's experience [Benesty et al., 2008, Chap. 15]. In order to counteract the quality degradation, several techniques have been adopted in VoIP technology, such as traffic prioritization, dynamic bandwidth allocation, half-duplexing, lost packet concealment, and discontinuous transmission (DTX). However, given excellent network conditions, VoIP offers a high voice quality with up to 4.5 MOS score [START_REF] Goudarzi | Modelling speech quality for NB and WB SILK codec for VoIP applications[END_REF].

It is worth noticing that cellular networks and VoIP pose different challenges to the secure voice communication system under study. Cellular networks offer reliability and stability, which is an advantage for maintaining pseudo-speech synchronization. Nonetheless, strong voice compression significantly limits the available throughput for encrypted speech signals and prevents decent voice quality after signal decryption.

On the contrary, mild signal compression and the high throughput available in VoIP applications enable sending more encrypted data in the audio signal. However, the high probability of lost and delayed packets may deteriorate communication. From the operational standpoint, the encrypted voice data included in delayed packets is irreversibly lost. Moreover, lost-packet concealment in VoIP that fills missing fragments of the signal using some synthetic signal generator may hinder systems' synchronization.

Apart from network traffic management, modern voice communications systems apply a variety of speech-enhancing algorithms on the recorded voice. The most popular among these techniques are Voice Activity Detection (VAD) [Bäckström, 2017, Chap. 13, ITU-T, 2012b], Echo Cancellation (EC) [ITU-T, 2015], Adaptive Gain Control (AGC) [START_REF] Heitkamper | Adaptive gain control for speech quality improvement and echo suppression[END_REF], Noise Suppression (NS) [ETSI, 2018b] and Comfort Noise Generation (CNG) [ITU-T, 2012b, ETSI, 2018a].

Voice Activity Detection performs real-time speech analysis to classify voice frames as speech-like or containing either silence or background noise. The classification is made by a specialized unit based on the range of temporal and spectral features (e.g., tonality, spectral envelope, signal intensity, zero-crossing rate) [Bäckström, 2017, Chap. 13]. Depending on the classifier's decision, the analyzed speech frames may be passed through the channel or rejected. Since in natural conversation speakers talk for less than 40% of the time [START_REF] Freeman | The voice activity detector for the Pan-European digital cellular mobile telephone service[END_REF], silent frame suppression improves network bandwidth allocation and saves some phone energy.

Some detectors are paired with the speech encoder. For example, Figure 2.20 illustrates a diagram of the VAD classifier cooperating with AMR [3GPP, 2018b]. The classifier performs filterbank analysis of speech frames and re-uses intermediate parameters from the AMR pitch analysis (pitch period, autocorrelation values) and the long-term linear prediction (complex signal autocorrelation vector). Given the inputs, the algorithm compares the estimated background noise level with the filterbank analysis result and calculates the noise-to-signal energy ratio. The classifier raises the VAD flag when the computed ratio stays above an adaptive threshold for some time.

Another negative phenomenon is an echo that causes an annoying sensation of hearing one's own voice with a delay larger than 40 ms [ITU-T, 2003b]. The speech echo often occurs due to a cross-talk between transmission cables or when a loudspeaker's output is again captured by the device's microphone [START_REF] Lin | Frequency-domain adaptive algorithm for network echo cancellation in VoIP[END_REF]. Canceling the echo is usually done using adaptive filtering CHAPTER 2 -Speech processing and voice communications Figure 2.20 -Diagram of the Option 1 VAD included in the AMR encoder [3GPP, 2018b].

[ ITU-T, 2015, Benesty et al., 2008, Chap. 45]. The echo cancellation unit models the echo in real-time and subtracts the modeled signal from the recorded speech.

Although some VAD and speech enhancing algorithms can be found in various recommendations and specifications, their exact implementations are often proprietary solutions unavailable to a broad public. Since phone manufacturers, VoIP application developers, and network providers may incorporate dedicated speech enhancing techniques, accurate voice channel modeling is often intractable. Instead of reverse-engineering these algorithms, it is usually more practical to search for techniques that could reset VAD's counters and consequently block VAD's activation. For instance, Figure 2.21 illustrates the signal sent over the WhatsApp application between the same phones as in the first example presented in Figure 2.1. A sensible manipulation of frequency bands and silence insertions successfully prevented signal suppression. Nevertheless, it is still worth considering the most fundamental properties of speech-enhancing algorithms to understand the principal properties of a good synthetic signal suitable for encrypted data transmission.

Summary

This chapter described the principles underlying the operation of voice channels in cellular networks and VoIP. The chapter explained the speech production and auditory mechanism, and gave some hints on the idea behind source-filter coding and perceptual coding. Finally, the chapter presented some selected speech coders and speech processing techniques.

A diversity of speech coding techniques adopted in modern communications suggests that designing a universal technique for sending encrypted speech over arbitrary voice channels in realtime would be extremely difficult. Moreover, secure voice communication over voice channels is possible only when the channel capacity is sufficiently large for sending speech data in real-time. Instead, it may be worthwhile to target specific types of voice channels, depending on a usage scenario. Since cellular networks and many prominent VoIP applications rely on source-filter and waveform coding, it may seem reasonable to make encrypted signals compatible with generic LPC coders. Nevertheless, the pseudo-speech signal must be tuned to a particular voice channel due to implementation differences that modify channel's characteristics. That includes a dedicated strategy for countering the VAD algorithm.

Furthermore, data encoding onto pseudo-speech must be robust against perceptual processing in the spectral domain. Thus, the attractive idea is to relate encoded data with parameters of vowel-like sounds that are compatible with source-filter, perceptual, and waveform coders. The principles of voiced sounds have been exploited in Chapter 3 describing a novel technique for data transmission over voice channels. However, despite the high robustness of the produced signal, we discovered that error-less data transfer over real voice channels cannot be guaranteed. This communication characteristic appeared troublesome because traditional cryptographic algorithms require perfect data reception for decryption. In order to overcome this limitation, we designed a dedicated distortion-tolerant cryptographic scheme that can decrypt data approximately. The distortion-tolerant speech encryption scheme is introduced and described in Chapters 4 and 5.

Due to a limited bandwidth available for communication over digital voice channels, it is impossible to encrypt and send a complete speech signal. Instead, it is necessary to compress speech before encryption, preferably using one of the low-bitrate parametric speech coders. The most suitable coders are those using a simple speech model with a clear relation between the model parameters and the perceptual speech qualities (pitch, loudness, timbre). For example, the sinusoidal speech model and the Multiband Excited (MBE) model are good candidates. However, a common disadvantage of parametric coders is their low quality of decoded speech. The new generation of synthesizers using trained neural networks, such as LPCNet, may significantly improve perceptual speech quality at a very low bitrate.

Chapter 3 introduces a technique for sending data over channels with LPC coders. The technique relies on short harmonic waveforms that mimic the structure of harmonic vowel signals. The method is compatible with cellular networks and many VoIP applications, and is robust against some VAD algorithms.

CHAPTER 3

Data transmission over voice channels

Motivation

Secure data transmission over voice channels (telephone lines) dates back to the early 40s, and the development of the probably first secret telephony system for use during World War II, nicknamed SIGSALY or 'Green Hornet' [Bennett, 1983]. However, the term modem ('modulatordemodulator') in context of a device converting data into the format suitable for transmission originated in the late 50s when referring to Bell 101 modem developed by Bell Labs. The modems were part of SAGE (Semi-Automatic Ground Environment), the largest computer-aided information system of that time [Hellige, 1994]. Their role was to transmit digital radar pictures over telephone wires using frequency-shift keying (FSK) modulation, initially at 750 bps and later at 1.3 kbps and 2.1 kbps. In the following years, the rapid progress in modem technology contributed to creating the digital subscriber line (DSL) with data rates over 10 kbps [START_REF] Golden | Fundamentals of DSL technology[END_REF].

A bit surprisingly, the possibility of exploiting cellular vocal networks for data transmission went unnoticed until the seminal work of Katugampala, Vilette, and[START_REF] Katugampala | Secure voice over GSM and other low bit rate systems[END_REF], in which the authors suggested sending encrypted bits of compressed voice between two cellular phones. Since then, cellular vocal networks have attracted attention as a potential high-priority, low-bandwidth data communication channel with errors. The work on Data over Voice (DoV) technology in cellular networks enabled new applications, such as emergency call system eCall [START_REF] Werner | Cellular In-Band Modem Solution for eCall Emergency Data Transmission[END_REF], messaging over voice [START_REF] Dhananjay | Hermes: data transmission over unknown voice channels[END_REF], point of sell (POS) financial transactions [START_REF] Mezgec | Implementation of PCCD-OFDM-ASK robust data transmission over GSM speech channel[END_REF], automatic network address translator (NAT) traversal [START_REF] Patro | A system for audio signalling based NAT Traversal[END_REF], and secure data and voice communications [Katugampala et al., 2005, Chen andGuo, 2011].

With the quickly expanding data-driven 4G networks and the deployment of 5G networks, the use of voice channels for sending data diminishes. Nevertheless, DoV techniques are still crucial in secure voice communications, for example, provided by Crypto Phones or other specialized devices [START_REF] Krasnowski | Introducing a Verified Authenticated Key Exchange Protocol over Voice Channels for Secure Voice Communication[END_REF]. On the other hand, voice channels can be maliciously used for extruding private data or in Advanced Persistent Threat (APT) attacks [START_REF] Lee | The Vulnerability Exploitation Conveying Digital Data Over Mobile Voice Call Channels[END_REF].

The crucial challenges related to DoV are a consequence of principles underlying digital voice channels. Namely, voice channels aim at preserving speech intelligibility and quality while reducing the perceptually redundant information. In contrast to classical data channels, voice channels significantly distort the sent signal due to transcodings and audio processing. Moreover, modern digital voice channels are selective to signal parameters conforming to the speech model adopted in a particular system. To mitigate signal degradation caused by voice channels, several authors proposed DoV techniques based on encoding the data signal into speech-like parameters, codebook training, or optimized modulation techniques. [START_REF] Katugampala | Secure voice over GSM and other low bit rate systems[END_REF] proposed a system that uses predefined codebooks to map bits into vocal parameters: energy, pitch, and spectral envelope (encoded as line spectral pairs, LSP [START_REF] Soong | Line spectrum pair (LSP) and speech data compression[END_REF]). The encoded parameters are transformed into a pseudo-speech signal adapted to transmission over a cellular network. Data extraction is done by a paired speech analyzer, which restores vocal parameters from the signal and decodes codebook indices. The system enabled transmission over a real GSM voice channel at the rate of 3000 bps with 2.9% BER [START_REF] Katugampala | Real-time end-to-end secure voice communications over GSM voice channel[END_REF]. Similar techniques were presented by Ozkan et al. [Özkan and Örs, 2015], and Rashidi et al. [START_REF] Rashidi | A Harmonic Approach to Data Transmission over GSM Voice Channel[END_REF], who achieved respectively transmission rates of 1600 bps and 2000 bps in a simulation environment. [START_REF] Ladue | A Data Modem for GSM Voice Channel[END_REF], and Sapozhnykov and Fienberg [START_REF] Sapozhnykov | A low-rate data transfer technique for compressed voice channels[END_REF]] investigated genetic and pattern matching algorithms to construct codebooks of short CHAPTER 3 -Data transmission over voice channels speech-like waveforms. Instead of synthesizing pseudo-speech, the authors proposed encoding bitstream directly into a sequence of symbols selected from a trained wavetable. Upon reception, received symbols were decoded with a bank of matched filters. The technique achieved the remarkable 4000 bps with 2.3 % BER over enhanced full rate (EFR) voice channel. Unfortunately, the training process was time-consuming and required considerable computational resources. Moreover, the obtained wavetable was compatible with a unique channel model and hence impractical in real communication.

The problem of long and heavy computations has been tackled by [START_REF] Shahbazi | A novel speech-like symbol design for data transmission through GSM voice channel[END_REF], and Boloursaz et al. [START_REF] Boloursaz | A data modem for GSM Adaptive Multi Rate voice channel[END_REF], who simplified the codebook construction by limiting the search to signals from the TIMIT speech database [START_REF] Zue | Compare_RA( h(< $A, ~NA, 'g' ^~ekA, ~RA >), h(< $A, ~NA, 'g' ^~ekA, ~RA >) ) , Commit[END_REF]. Parallelly, [START_REF] Kazemi | Modem based on sphere packing techniques in high-dimensional Euclidian sub-space for efficient data over voice communication through mobile voice channels[END_REF] proposed an exciting idea to exploit sphere packing techniques to construct waveforms with a large minimum distance and an improved detection rate.

Finally, there exists a range of DoV techniques based on well-established, classical signal modulation. Zhan Xu [Xu, 2017], [START_REF] Chmayssani | Data transmission over voice dedicated channels using digital modulations[END_REF] tested by simulations phase shift keying modulation (PSK) and quadrature amplitude modulation (QAM), and achieved bitrates within the range 1 -3 kbps. [START_REF] Ali | Data transmission over mobile voice channel based on M-FSK modulation[END_REF] exploited M-ary frequency shift keying (M-FSK), whereas Dhananjay et al. [START_REF] Dhananjay | Hermes: data transmission over unknown voice channels[END_REF] introduced a modified binary FSK (BFSK) tolerant to a small frequency deviation. Chen and Guo [START_REF] Chen | An OFDM-based secure data communicating scheme in GSM voice channel[END_REF]] reported a solution using orthogonal frequency division multiplexing (OFDM) modulation combined with PSK.

An inspiring technique based on Amplitude Shift Keying (ASK), named PCCD-OFDM-ASK, has been presented by [START_REF] Mezgec | Implementation of PCCD-OFDM-ASK robust data transmission over GSM speech channel[END_REF]. Phase-Continuity and Context Dependency (PCCD) refers to techniques providing phase continuity of the modulated signal. In PCCD-OFDM-ASK, blocks of 8-bit sequences are encoded onto eight orthogonal harmonics, numbered from 1 to 8. In contrast to classical OFDM, each bit in the 8-bit block is represented by the presence or absence of an orthogonal carrier. For instance, the binary 8-bit sequence '10001010' is mapped to a symbol with harmonics present only at positions 1, 5, and 7. The scheme offers robust transmission up to 500 bps over real cellular voice channels.

This chapter introduces a new DoV codebook-based modulation over cellular networks and VoIP for the needs of secure voice communication. The novelty comes from our simplified and universal codebook design process compared with the usual extensive codebook training on a selected voice model. Nevertheless, the method can be adapted to a particular channel, avoiding codebook over-tuning in the presence of fluctuating channel characteristics. Modulation parameters are easily adjustable in order to balance the transmission bitrate and the robustness to errors.

The proposed technique was thoroughly tested with real voice calls. The scheme achieves up to 6.4 kbps over VoIP voice channels using 4G wireless network and 2.4 kbps over 3G cellular calls (see Section 3.5.3). It also enables safe voice transmission with an effective binary error rate significantly below 1%. This chapter is organized as follows. Section 3.2 outlines challenges related to sending data over voice channels with LPC-based speech compression. Section 3.3 investigates signal distortion introduced by three selected LPC coders: AMR, Speex, and Opus-Silk. Section 3.4 describes the novel DoV technique, including codebook construction, signal generation, and demodulation. Section 3.5 presents performance results obtained by simulations and real-world experiments, and Section 3.6 proposes a secure voice communication scheme using DoV. Finally, Section 3.7 concludes the chapter.

Digital voice channels

This section introduces crucial challenges related to data transmission over voice channels. It outlines the specific behavior of voice channels, very different compared to classical communication channels, and highlights the desired properties of DoV signals.

Voice channel characteristics

In real-world implementations, a complete voice channel is typically the concatenation of algorithms that transform a speech signal into binary data suitable for transmission over the network. Despite the lossy nature of speech processing, the received binary information is sufficient to resynthesize a speech perceptually similar to the initial. However, from a DoV perspective, it is more convenient to consider voice channels as communication channels with particular constraints and signal distortion characteristics.

The core elements of any digital voice channel are voice codecs, which compress and encode sampled speech waveform exploiting principles of speech production and perception [START_REF] Rabiner | Theory and applications of digital speech processing[END_REF]. Real-time voice coders usually process speech on a frame basis by mapping portions of a speech waveform into sets of vocal parameters. These algorithms may perform highpass filtering, differential encoding, and adaptive quantization to improve the compression ratio depending on the available network throughput. Unfortunately, such operations add memory and latency to a voice channel, and make it non-linear and non-stationary.

In addition to voice compression, modern voice communication systems apply techniques such as Voice Activity Detection (VAD) [Bäckström, 2017], Adaptive Gain Control (AGC) [Heitkamper, 1995] or Noise Suppression (NS) [START_REF] Tsoukalas | Speech Enhancement Based on Audible Noise Suppression[END_REF]. In opposition to voice coders, the implementation of these algorithms is rarely public and their impact on the DoV cannot be fully predicted.

Combining all the mentioned elements of real voice channels, achieving an analytic model of signal distortion is usually intractable. Nevertheless, it is still worthwhile to consider the most fundamental properties of voice channels and construct the DoV scheme agnostic to small variations of the voice channel characteristics.

LPC coders

Most of the voice coders operating in the upper-middle bitrate range (10 kbps -16 kbps) listed in ITU, IETF and 3GPP standards, and which are widely adopted in cellular and VoIP systems, rely on Linear Predictive Coding (LPC). LPC coders take their inspiration from the simplified speech production model, often referred to as a source-filter model [Fant, 1960, Lochbaum andKelly, 1962]. According to the model, voice sound originates from a single source e(t) and is filtered by a vocal tract with an impulse response v(t). Such a simplification is justified for voiced and stationary sounds, which can be approximately represented by the buzzing excitation produced in the glottis and shaped when passing through the pharynx and between tongue, teeth, and lips. The resulting signal has the form s(t) = e(t) * v(t), where * denotes the convolution product.

However, considering voice as the convolution of excitation and vocal tract shaping would be of little practical value without effective methods for separating these components. The excitation and vocal tract characteristics can be well approximated during LPC analysis (hence LPC coders). The outputs of LPC analysis consist of a linear prediction filter describing the vocal tract's filtering effect and a residual that can be viewed as an excitation signal. As an example, Figures 3.1(a) and 3.1(b) present 100 ms of a real recording of vowel /a/ in the time and the frequency domain. It can be noticed that this spectrum has a harmonic structure and could be accurately parameterized by its energy, spectral envelope, and fundamental frequency. The dashed line in Figure 3.1(b), which coincides with the spectral envelope of a vowel, represents the frequency response of the estimated LPC filter. On the other hand, the peaks of the residual signal in Figure 3.1(c) correspond to a buzzing excitation from the glottis. Finally, the frequency spectrum of a residual in Figure 3.1(d) has less different formants (acoustic harmonic resonances), compared to the initial spectrum in Figure 3.1(a). Thus, we can reach the intuitive conclusion that LPC analysis separates the spectral envelope from the harmonic content of the signal.

Source-filter separation emphasizes the relevant vocal information, which is advantageous in signal compression. Figure 3.2 depicts a simplified diagram of speech analysis and synthesis by a generic LPC coder. The encoder estimates LPC coefficients and calculates the residual of a small portion of speech (typically 5ms -20ms). Lossy encoding of the residual puts stress on preserving the harmonic content of the speech, whereas LPC filters are often weighted to boost formants, taking advantage of the human auditory system's specificities and information redundancy. From this point, it is understandable that vocal parameters in a waveform are usually well preserved during compression, while the less speech-like are removed. The output waveform is also smoothed in the time and spectral domains to remove ringing effects caused by frame-based processing. Linear Predictive Coding achieves remarkable results in representing and compressing smoothly varying voiced sounds but often struggles with encoding short and noisy plosives (like /p/ or /t/), which do not fit into the source-filter speech model. To improve the robustness for noisy sounds, LPC coders incorporate more flexibility into the excitation encoder. This observation suggests that the potential performance of the DoV technique would mostly depend on the accuracy and reaction time of residual encoding.

Despite preserving core speech intelligibility, time-domain LPC coding destroys the fine timestructure of compressed signals. Thus, it is not obvious how voice channels equipped with LPC coders modify the sent signal. In Section 3.3, we describe a simplified framework that will allow us to evaluate the typical distortion introduced by LPC voice channels.

Data over LPC voice coders

This section presents a novel DoV technique based on codebooks of phase-modulated harmonic waveforms. The proposed solution is the result of extensive simulation experiments with three representative LPC narrow-band coders: AMR [3GPP, 2018a], Speex v1.2 [START_REF] Herlein | RTP Payload Format for the Speex Codec[END_REF] and Opus-Silk v1.3.1 [START_REF] Valin | Definition of the Opus Audio Codec[END_REF].

The section begins with a thorough analysis of signal distortion characteristics caused by selected voice compression algorithms. The investigation leads to a significant improvement in harmonic signal demodulation. Finally, the section proposes a simplified codebook design approach.

Multi-tone modulation over LPC voice coders

By their construction optimized to vowel sounds, LPC coders are suitable for synthesizing multitone signals. On the other hand, the versatility of residual encoding allows easy manipulation of phase information, which above 2 kHz typically plays a lesser role in speech intelligibility [Rabiner andSchafer, 2011, Alves-Pinto et al., 2014]. Combining phase modulation with multiple subcarriers is particularly interesting, as it opens the possibility of applying spectrally-efficient orthogonal frequency-division multiplexing (OFDM) modulation [START_REF] Nee | OFDM for Wireless Multimedia Communications[END_REF]. The OFDM approach has been already analyzed in the context of DoV in [START_REF] Chen | An OFDM-based secure data communicating scheme in GSM voice channel[END_REF]. Their solution is based on 27 independently modulated carriers and achieved a high bitrate of 2.4 kbps over the (now obsolete) RPE-LTP GSM voice coder at an acceptably low error rate.

Figure 3.3 presents the signal-to-noise ratios (SNR) of a multi-tone signal compressed by AMR, Speex, and Opus-Silk at different compression rates. It may be noticed that the distortions introduced by the different coders are roughly similar. However, the large amount of distortion poses a big challenge for reliable data transmission, especially at compression bitrates below 10 kbps. Thus, a better understanding of the characteristics of signal distortion would help designing a more robust communication scheme. For the sake of consistency, the following experiments were made only for fixed compression bitrates: AMR 12.2 kbs, Speex 11 kbps, and Opus-Silk 12 kbps. Since LPC coders process the signal jointly, it is not clear how the presence of other harmonics affects the distortion of each component. The distortion introduced by each studied coder has a similar nature, as presented in Figure 3.4. Apart from random noise-like distortion, all samples are subject to constant phase shift (this effect was also observed in [START_REF] Lee | The Vulnerability Exploitation Conveying Digital Data Over Mobile Voice Call Channels[END_REF], Xu, 2017]). The phase shift depends on the frequency and the specific LPC coder, but not on symbol duration. The phase shift is probably introduced during speech synthesis by the LPC reconstruction filter with a non-uniform phase response.

Figure 3.5 presents the energy-normalized variance of spectral distortion and related error rates of phase detection in multi-tone signals compressed by a selection of LPC coders. It can be noticed, that there is a direct relation between the variance of distortion and the error rate. In addition, as Figure 3.5 -The average energy-normalized variance of distortion and related error rates of phase detection in multi-tone signals compressed by a selection of LPC coders. The averaged variance was measured over the in-phase/quadrature (I/Q) representation for the four symbols constellation. The four variances are computed along radial lines from the origin to the sample mean of the received decoded symbols (see Figure 3.4). The initial multi-tone signal consisted of four independently phase-modulated harmonics at frequencies 400 Hz, 800 Hz, 1200 Hz, and 1600 Hz, with a modulation order 4 and a modulation rate of 200 baud. Then, the set of carriers was expanded by adding harmonics at 2000 Hz, 2400 Hz, ..., 3200 Hz with a 400 Hz step. Colored bars denote the lowest and highest values among harmonics, and bullets indicate the average. the cardinality of harmonics in the multi-tone signal goes up, the variability of error rates rises. Nevertheless, harmonics are not distorted uniformly, which is especially noticeable for Silk. It is because the codec puts a more significant emphasis on preserving lower frequencies [START_REF] Valin | Definition of the Opus Audio Codec[END_REF], especially important for the auditory perception of voice [START_REF] Gold | Speech and Audio Signal Processing: Processing and Perception of Speech and Music[END_REF].

The sample density distributions of this noise-like distortion are approximately Gaussian, like those presented in Figure 3.6. As the frequency goes up, the width (i.e., variance) is getting larger. This observation supports the intuition that the harmonics at lower frequencies are generally less distorted by compression.

Figures 3.7(a) and 3.7(b) present Mardia's bivariate skewness and kurtosis of a noise-like distortion. Mardia's skewness and kurtosis of a p-variate random sample x 1 , ..., x n whose sample mean vector x and sample covariance S are defined as [Mardia, 1970]:

skewness = 1 n 2 n k=1 n ℓ=1 (x k -x)S -1 (x ℓ -x) 3 , (3.1) kurtosis = 1 n n k=1 (x k -x)S -1 (x k -x) 2 . (3.2)
For a sample taken from a p-variate normal distribution, the statistics simplify to: It can be noticed that in the case of AMR and Speex (and to some extent Silk), the computed Mardia's skewness and kurtosis are close respectively to 0 and 8, which are the values characterizing symmetric bivariate normal distribution [Mardia, 1974]. Crucially, distortion is not significantly correlated both in time and between harmonics (Figures 3.7(c) and 3.7(d)). As a result, there is some evidence to treat the noise-like distortion as independent and memoryless. It can be seen as an advantage for demodulation but is also quite surprising because the analyzed coders are deterministic and non-linear. It suggests that distortion characteristics depend not only on LPC coders but also on statistical properties of the modulated signal.

An open question remains, though, for other LPC coders at similar compression rates. Precisely, LPC coding's basic principles do not imply the independence of distortion in the time and the frequency domain. On the other hand, it is arguable that such properties of the proposed modulation, like harmonicity and constant spectral amplitude, are compatible with LPC coding's fundamental properties. Therefore, it should be suitable for the vast majority of LPC coders.

Proposed DoV technique

Figure 3.8 depicts the typical diagram of a data transmission system over voice channel, which uses a codebook of M pre-defined discrete-time audio waveforms. Signal generation is a two-step procedure that firstly encodes the binary input into a sequence of indices (m 0 , m 1 , ...) and then maps these indices into a concatenation of codebook symbols s = (s m 0 , s m 1 , ...). Finally, the resulting discrete-time audio signal s is played to the (digital) audio input of a voice channel.

On the reception side, the demodulator splits the received sampled audio signal r = (r m 0 , r m 1 , ...) into short chunks of fixed length corresponding to the symbol duration, and then performs symbol-by-symbol matched-filtering with all codebook entries. In the last steps, the demodulator extracts the indices of the codebook symbols giving the highest correlation value and decodes the binary information.

In the proposed DoV technique, a codebook symbol is a vector of waveform samples s m = [s m [0], ..., s m [N -1]] sampled at 8 kHz and of duration between 2.5-10 ms. Each symbol consists of some small number K (between 7-10) of orthogonal harmonics modulated by quadrature phaseshift keying (4-PSK):

s m [n] = ℜ K-1 k=0 C m,k exp j(k + k 0 )ω 0 n N , n = 0, 1, ..., N -1, (3.4)
where 0 ≤ m < M is the symbol index, ω 0 denotes the fundamental angular frequency and k 0 is the subband of the lowest harmonic. Finally, C m = {C m,k | 0 ≤ k < K} denotes a sequence of K complex PSK symbols over the phase-amplitude plane:

C m,k = A • exp(j2πφ m,k /4), k = 0, ..., K -1, (3.5)
where A is the amplitude and The symbol structure is equivalent to the discrete-time base-band representation of 4PSK-OFDM modulation [START_REF] Nee | OFDM for Wireless Multimedia Communications[END_REF]. Therefore, the received symbols can be processed in a similar manner using subband de-multiplexing. Let C = { Ck | 0 ≤ k < K} be the sequence of PSK symbols obtained from some received codebook symbol. Assuming a typical AWGN (Additive White Gaussian Noise) channel, the maximum likelihood OFDM symbol detection can be expressed by the L2 norm minimization in the complex plane [START_REF] Schulze | Theory and Applications of OFDM and CDMA: Wideband Wireless Communications[END_REF]:

Φ m = {2πφ m,k /4 | 0 ≤ k < K, φ m,k ∈ Z 4 }
3.4 -Proposed DoV technique 47 m = arg min m K-1 k=0 Ck -A exp (j2πφ m,k /4) 2 .
(3.6)

However, the experiments in Section 3.3.1 indicated that compression by the selected LPC coders causes group delay in the processed signal and alters each harmonic with a distortion of different variance. The estimated phase shift φk and the variance of distortion σ2 k respective to each harmonic can be computed using a training sequence and the following estimators for sample mean and sample variance [START_REF] Witte | Statisticss[END_REF]:

μk = |μ k | exp j φk = 1 L L-1 ℓ=0 Cm ℓ ,k exp(-j2πφ m ℓ ,k /4), (3.7) σ2 k = 1 L -1 L-1 ℓ=0 Cm ℓ ,k exp(-j2πφ m ℓ ,k /4) -μk 2 , (3.8)
where

Cm ℓ = { Cm ℓ ,k | 0 ≤ k < K} denotes the ℓ -th sequence of PSK symbols measured at the reception side and Φ m ℓ = {2πφ m ℓ ,k /4 | 0 ≤ k < K, φ m ℓ ,k ∈ Z 4 }
m = arg min m K-1 k=0 Ck exp(-j φk ) -A exp (j2πφ m,k /4) 2 /σ 2 k . (3.9)
Finally, rewriting (3.9) and removing the constant terms gives a more convenient demodulation rule, which is maximizing the real part of a complex dot product [START_REF] Schulze | Theory and Applications of OFDM and CDMA: Wideband Wireless Communications[END_REF]:

m = arg max m ℜ K-1 k=0 Ck • A σ2 k exp -j2πφ m,k /4 -j φk . (3.10)
In contrast to time-domain matched-filtering, the proposed demodulation rule enables phase and variance correction in the channel distortion. Secondly, it becomes more efficient when the codebook size grows. Instead of performing M matched-filtering operations on a symbol of length N , this demodulator needs to compute the in-phase/quadrature (I/Q) representations of K < N PSK symbols and to correlate them with M different phase sequences. As an example, given the triple (K, M, N ) = (8, 256, 40), matched filtering in the time domain requires at least 256 • 40 = 10240 real-value multiplications. On the other hand, demodulation using Equation 3.10 involves computing the complex PSK symbols (2 • 8 • 40 = 640 real-value multiplications) and comparing the obtained sequence with all phase combinations in the codebook (8 • 256 = 2048 complex multiplications, or at least 4096 real-value multiplications).

Despite the computational improvement, the codebook's preferable size ranges between 64 and 256 elements and should not overreach 4096 elements. These values would make the realtime demodulation computationally practical on portable devices, especially if the codebook has a symmetric structure that enables further computational optimizations.

Another factor in the process of selecting the codebook size is the transmission bitrate. Full 4PSK-OFDM modulation offers transmission up to 2K = log 2 (4 K ) information bits per symbol. However, the modulation is susceptible to excessive distortion or attenuation of some harmonics in spectrally selective voice channels. Instead, it is advisable to choose only a subset of all possible OFDM phase combinations to enlarge the minimum distance between symbols. This approach makes a transmission over voice channels more robust to spectrally selective distortion, as a large distortion of some harmonics would be compensated by a moderate distortion of the others. On the other hand, smaller modulation order M < 4 K decreases the bitrate.

Codebook design

Construction of a suitable DoV codebook relies on finding (or training) a subset of harmonic symbols with a large minimum distance. However, this task becomes challenging as the number of symbol combinations increases. This subsection gives a proposition of a suboptimal codebook design method, which produces a set of harmonic waveforms sufficiently different from each other.

For

x 1 , x 2 ∈ C K , let d E (x 1 , x 2 )
be the Euclidean metric over the complex space and for

y 1 , y 2 ∈ Z K 4 , let d L (y 1 , y 2 ) be the Lee metric over Z K 4 : d L (y 1 , y 2 ) = K-1 k=0 min(|y 1,k -y 2,k |, 4 -|y 1,k -y 2,k |).
In addition, let us define the bijective function f :

C K → Z K 4 which takes the phase indices φ m,k of every 4-PSK sequence C m = {A • exp(j2πφ m,k /4) | 0 ≤ k < K, φ m,k ∈ Z 4 }, and maps to a quaternary codeword f (C m ) = {φ m,k | 0 ≤ k < K} over Z K 4 .
For any two 4-PSK sequences C m 1 and C m 2 , we get an isometric property:

2A 2 d L (f (C m 1 ), f (C m 2 )) = d 2 E (C m 1 , C m 2 ).
It can be noticed that the same relation holds for the minimum distance between all PSK sequences in the OFDM codebook and elements of the associated quaternary codewords. The selection of the most distinct OFDM symbols could be thus replaced by the construction of a quaternary code C ⊂ Z K 4 (not necessarily a subgroup), that maximizes the minimum Lee distance. In the perspective of non-binary codes with a defined minimum distance, these OFDM symbols can be seen as error correcting codes encoded in the spectral domain [START_REF] Wilkinson | Minimisation of the Peak to Mean Envelope Power Ratio of Multicarrier Transmission Schemes by Block Coding[END_REF]. In consequence, quaternary codes provide a new degree of freedom in the DoV codebook design. By some sensible manipulation of the number of harmonics K, the symbol duration N , and the minimum distance between codebook symbols d, it is possible to find a codebook providing the required bitrate and maintaining sufficient robustness to distortion. Moreover, the codebook generation is computationally constrained mostly by finding quaternary codes, which is a much faster process compared to training a full codebook of waveforms. Finally, quaternary codes can be reused to produce waveforms of different duration and harmonic frequencies. It is also worth noticing that the above motivation for exploiting non-binary codes is slightly different from other works focusing mainly on reducing the peak-to-mean energy ratio of the OFDM signal [START_REF] Davis | Peak-to-mean power control in OFDM, Golay complementary sequences, and Reed-Muller codes[END_REF], Chen and Liang, 2007, Ginige et al., 2001, Hisojo et al., 2014].

Due to some rotational symmetries of quaternary codes, there is no unique codebook with a largest minimum distance. It gives more flexibility in the fine-tuning of the codes to make them more suitable in real operation. It is advisable to select a codebook with a possibly uniform distribution of phase values and remove symbols with the highest maximum amplitude. Table 3.1 presents the minimum distance of several quaternary codes found by a greedy algorithm coined CodebookSearch. The subroutine ChooseInitial inserts a random or some pre-defined initial codeword into the codebook, while the subroutine SelectCodeword iteratively selects a codeword to remain within the uniform distribution of phase values in the expanded set.

To improve the computational demodulation efficiency, one may exploit the reflection symmetry of the codebook produced by the algorithm. Since for any 0 ≤ 2m < M we have s 2m = -s 2m+1 , it is sufficient to correlate the received PSK sequence only with codebook symbols having the even indices and then to check the sign of computation.

Table 3.1 -Minimum Lee distance of additive quaternary codes of length n = 7, 8, 9 and 10, found by Algorithm 1. Parameter k denotes the number of (quaternary) information bits of the code. From the perspective of OFDM symbols, value n is related to the cardinality of harmonics, while k describes the codebook size equal to 4 k . n \ k 2.0 2.5 3.0 3.5 4.0 4.5 5.0 5.5 6.0 6.5 7.0 7.5 8.0

7
c 0 ←-ChooseInitial(C); Cb ←-Cb ∪ {c 0 , -c 0 }; for i ← 1 to ⌊M/2⌋ -1 do // select codewords in C with // a maximum Lee distance from Cb S ←-MaxLeeDistance(C, Cb); // select a codeword from S respective // to uniform distribution c 2i ←-ChooseCodeword(S, Cb); Cb ←-Cb ∪ {c 2i , -c 2i }; end

Experiments

This section presents the performance results of the DoV scheme described in Section 3.4. Simulations are followed by experimental tests over 3G calls (based on AMR) and selected VoIP applications (Skype, WhatsApp, and Signal exploiting Opus-Silk and FaceTime using AAC-LD). Examples of some DoV signals recorded during tests are available online.1

Channel estimation

Efficient detection of received DoV symbols, described by Equation 3.10 in Section 3.3, requires voice channel characterization using the training sequence. Intuitively, the larger number of symbols in the sequence, the more accurate is the estimation. We estimated the standard error SE of the phase shift φk (t) and the variance of distortion σ2 k (t) as a function of training duration t, using Monte Carlo simulations and the following formulas:

SE 2 φk (t) = 1 L L ℓ=1 φk,ℓ (t) -φk 2 , (3.11) SE 2 σ2 k (t)/σ 2 k = 1 L L ℓ=1 σ2 k,ℓ (t) -σ2 k 2 /σ 2 k , (3.12)
where L is the number of Monte Carlo runs, φk,ℓ (t) and σ2 k,ℓ (t) denote respectively the estimated phase shifts and the variances of distortion in the ℓ -th Monte Carlo run, and the reference values φk and σ2 k were obtained from a sequence of 50000 DoV symbols (250 seconds of a signal). Figure 3.10 depicts the maximum standard error of φk (t) and σ2 k (t)/σ 2 k taken over all harmonics k and for every t between 0.5 and 2.5 seconds with a 0.05 second step. It can be observed that 2 seconds of training period should give a sufficiently accurate channel characterization.

Simulations

The symbol error rate primarily depends on the distortion variance and the minimum distance between codebook symbols. For example, it can be noticed in Figure 3.11(a) that compressing by AMR leads to significantly lower error rates when compared to compression using the Silk codec. This result agrees with the experimental outcomes shown in Figure 3.5 in Section 3.3. Nevertheless, when the voice channel's capacity goes up, the amount of distortion, and thus the error rate gradually decreases, as indicated by 3.1). Thus, the symbol error rates obtained can be viewed as the approximated probability of the signal distortion exceeding the distance d/2. Consequently, it is generally advantageous to design the codebook with a larger number of orthogonal harmonics, leading to increased minimum distance and improved robustness.

Despite its simplicity, the presented scheme suffers from the large size of the codebooks used, especially at higher bitrates. The exponentially growing number of correlations becomes a major practical limitation for real-time signal demodulation. The problem can be tackled by scaling down the symbol duration at the expense of higher relative distortion and a smaller number of orthogonal frequency slots. As shown by Figure 3.11(c), a modulation based on smaller codebooks of shorter symbols provides similar performance at a much lower computational cost.

Real-world tests

The DoV technique has been tested over a real voice channel between mobile phones, using pre-computed DoV signals. The selected phones for experiments were two iPhones 6 running iOS 12 and a Huawei P8 Lite running Android 8, each registered to a different major French mobile network operator. The DoV performance over 3G calls is displayed in Table 3.2, and the performance over VoIP calls using 4G wireless network is shown in Table 3.3. The duration of the training period was extended to 4 seconds to ensure the reliability of the experiments. In the case of the 3G connection, the overall symbol error rates given in Table 3.2 are higher compared to the simulation results presented in Figure 3.11. Additional signal distortion is possibly caused by several signal processing stages in the phones and also by multiple voice compression in the network [START_REF] Katugampala | Secure voice over GSM and other low bit rate systems[END_REF]. Nevertheless, the DoV signal based on faster modulation and smaller codebook sizes again demonstrated lower error rates. Finally, the results emphasize the importance of voice channel estimation, which significantly improves the symbol error rate. Figure 3.12 displays the small fragment of the DoV signal sent over the 3G channel.

.0 kbps < 1.0 • 10 -4 < 1.0 • 10 -4 1.2 kbps < 1.0 • 10 -4 < 1.0 • 10 -4 1.4 kbps 1.2 • 10 -4 2.9 • 10 -4 1.6 kbps 2.6 • 10 -4 4.8 • 10 -4 1.8 kbps 6.0 • 10 -4 1.5 • 10 -3 2.0 kbps 1.2 • 10 -3 2.6 • 10 -3 2.2 kbps 9.4 • 10 -3 1.4 • 10 -2 2.4 kbps 1.6 • 10 -2 2.
.2 kbps < 1.0 • 10 -3 < 1.0 • 10 -3 1.6 kbps < 1.0 • 10 -3 1.3 • 10 -3 2.0 kbps 1.2 • 10 -3 3.5 • 10 -3 2.4 kbps 1.3 • 10 -2 2.6 • 10 -2 2.8 kbps 3.4 • 10 -2 6.6 • 10 -2 3.2 kbps 1.0 • 10 -1 1.3 • 10 -1 3.6 kbps 1.2 • 10 -1 1.9 • 10 -1 4.0 kbps 2.0 • 10 -1 2.6 • 10 -1
.0 kbps < 1.0 • 10 -4 < 1.0 • 10 -4 1.0 • 10 -4 9.6 • 10 -4 4.8 kbps < 1.0 • 10 -4 1.0 • 10 -4 9.3 • 10 -4 5.1 • 10 -3 5.6 kbps < 1.0 • 10 -4 1.2 • 10 -4 4.4 • 10 -3 1.7 • 10 -2 6.4 kbps 6.7 • 10 -4 3.0 • 10 -3 6.2 • 10 -2 8.
Contrary to 3G, VoIP enables very high DoV bitrates, up to full OFDM narrowband transmission at 6.4 kbps. The improved results provided in Table 3.3 are achieved due to mild signal distortion given by high throughput and network stability. However, since VoIP is a packet-based system without any guarantee of Quality of Service (QoS), short interruptions in the network connection may cause many packet dropouts. The negative impact of dropouts is typically mitigated by the re-synthesis of lost frames by VoIP application, leading to non-recoverable damages to the DoV signal and hindering the system's re-synchronization. Figure 3.12 -DoV signal at the bitrate 2.8 kbps, before (black line) and after (red line) transmission over the 3G network. The fragment displays eight consecutive DoV symbols of duration 2.5 ms consisting of 8 harmonics at frequencies 400 Hz, 800 Hz, ..., 3200 Hz, with a 400 Hz step.

Secure voice communication

This section provides a detailed proposition of a scheme for secure voice communication over 3G and VoIP, using small portable devices with limited battery capacity. The system has been successfully tested in a controlled, real-world environment and with pre-computed DoV signals. The performance results are followed by a short discussion on security and computational complexity.

Communication system

Figure 3.13 presents a simplified diagram of a system for secure voice communication over a voice channel, which transforms consecutive portions of speech into DoV frames of the same duration. The scheme substantially resembles a classical digital communication system: it consists of speech encoding, followed by encryption, error correction, and data modulation blocks. Although the input and output signals of the processing chain are analog, all internal processing is performed digitally.

Figure 3.13 -Encrypted speech over voice channel scheme.

The system settings should be a trade-off between operational constraints (restricted bandwidth, real-time processing, synchronization) and the desired security level against eavesdroppers and active attackers from within the network. Depending on the voice channel type, two modes of operation may be considered: a low mode designed for 3G cellular calls and a high mode for VoIP. The system parameters selected in the following experiments are presented in Table 3.4 and are used only for illustration. [START_REF] Erhardt | An Open-Source Speech Codec at 450 bit/s with Pseudo-Wideband Mode[END_REF]. In the next step, the encoded voice frames are enciphered by AES in the counter mode of operation and with a secret key of 256 bits with a random initial value (IV).

-3.6.1 Communication system 55

The encrypted binary stream is protected against channel errors by shortened Reed-Solomon (RS) codes with erasures [Lin andCostello, 2001, Neubauer et al., 2007] and 6-bit symbols. The error correction capabilities of RS codes depend only on the redundancy length, which is not the case for Turbo and LDPC codes [START_REF] Tahir | BER comparison between convolutional, Turbo, LDPC, and Polar codes[END_REF]. Moreover, non-binary symbol processing of RS codewords seems suitable for symbol-to-symbol demodulation of the DoV signal. In particular, one or more RS symbols can be represented by a single DoV symbol.

Erasure decoding improves correction capabilities of RS codes, provided that the localization of errors are known. The demodulator may try to guess the erroneous symbols, using a straightforward metric that considers symbol energy and its distance to the closest codebook symbol. Thus, when the first decoding attempt fails, the decoder may reiterate decoding with new estimated erasure positions until the 8-bit control checksum (8-CRC) matches.

.7 • 10 -3 < 1.0 • 10 -4 < 1.0 • 10 -4 < 1.0 • 10 -4 7.8 • 10 -4 effective FER: 1.9 • 10 -2 < 1.0 • 10 -3 < 1.0 • 10 -3 < 1.0 • 10 -3 2.1 • 10 -3
In the proposed scheme, each RS codeword is directly encoded into one DoV frame, as described in Figure 3.14. A constant header and a counter (CTR) enable decoding and decryption of DoV frames independently from each other, simplifying the re-synchronization in the presence of signal dropouts. Extensive experiments have shown that a 10-ms header is usually sufficiently long to keep signal synchronization or detect a DoV frame after signal restoration. In addition, the 16-bit counter permits re-synchronization after more than one hour of lost connection.

The duration of a DoV frame is equal to the portion of speech encoded by this frame, which is a valid requirement for real-time communication. Selected voice compression rates, 1.2 kbps, and 2.4 kbps depending on the mode, are low enough to append error correction redundancy at the end of each DoV frame.

The system was tested over cellular and VoIP calls. Table 3.5 presents the decoding results of several minutes of speech recording sent through using the 4G mobile data connectivity between two iPhones 6 registered to different network operators. The effective bit error rates (BER) and frame error rates (FER) take into account errors due to system de-synchronizations and dropouts.

Figure 3.15 shows the consecutive waveforms of a signal processed by a 3G network. The initial speech waveform presented in Figure 3.15(a) is compressed, encrypted, and encoded into the DoV signal of equal duration in Figure 3.15(b). The received signal displayed in Figure 3.15(c) is strongly attenuated after less than two seconds of transmission, classified by the Voice Activity Detector (VAD) as non-speech-like. However, correct decoding is still possible as long as the harmonic structure of the signal is preserved, as shown in Figure 3.15(d).

The distortion of the received signal varies depending on the network type and the phones used for communication. To counteract the blockage of stationary signals by VAD and Noise Suppression, several authors suggest to alternate two DoV codebooks defined over two non-overlapping bandwidths [Shahbazi et al., 2010,Sapozhnykov andFienberg, 2012]. This work proposes another complementary technique: periodic silence insertion in place of some DoV frames, as depicted in Figure 3.16. It was observed that depending on the chosen rate of silence insertion and the type of connection, these silences significantly postpone or even prevent signal suppression. On the reception side, these inserted silences can be classified as lost frames and re-synthesized.

Security discussion

Introducing a dedicated system for voice communication is a response to an increased risk of being intercepted. Thus, a cryptographic scheme should reflect higher requirements for secrecy and authentication. A major risk is the recording and off-line cryptanalysis of the network traffic by passive eavesdroppers. Securing the communication against eavesdroppers is especially important because the encrypted and non-speech signal can be easily detected by some advanced Data Leakage Prevention (DLP) and Content Monitoring and Filtering (CMF) systems protecting against unauthorized data extrusion [ [START_REF] Chae | A privacy data leakage prevention method in P2P networks[END_REF], Hauer, 2015, Lee et al., 2017]. Active attackers controlling the network are more likely to block or distort the fragile DoV signal, which is technically very simple. However, a malicious attacker who can synthesize a compatible DoV signal in real-time may modify the signal or insert its own.

The chosen AES cipher in the counter mode of operation, if implemented correctly, is believed to provide security against passive eavesdroppers [START_REF] Lipmaa | CTR-mode encryption[END_REF], Jonsson, 2003]. On the other hand, enciphering in counter mode does not guarantee data integrity [START_REF] Katz | Introduction to modern cryptography[END_REF], giving some space for adversarial manipulations. Therefore, the common practice is to combine the AES in counter mode with a cryptographic message authentication function [Housley, 2004]. Unfortunately, due to severe bandwidth limitations appending the authentication check is not viable. Instead, it would be possible to randomly shuffle the positions of encrypted bits within one DoV frame [Morris et al., 2009, Stefanov and[START_REF] Stefanov | [END_REF]. The motivation for this is to prevent malicious attackers from intentional modifications of the transmitted content. While still capable of replacing several DoV symbols, the attacker should not benefit from distorting the transmitted signals.

Finally, it is assumed that both users share a common secret cryptographic key used for encryption. Secure key exchange can become challenging when the voice channel is the only available communication channel. With decentralized implementations of the proposed system, there would be no practical possibility to add the Trusted Third Party for user's authentication. A few protocols overcome this limitation by using vocal verification [Pasini and Vaudenay, 2006, Callas et al., 58 CHAPTER 3 -Data transmission over voice channels 2011, [START_REF] Krasnowski | Introducing a Verified Authenticated Key Exchange Protocol over Voice Channels for Secure Voice Communication[END_REF]. In such a scenario, users compare freshly generated random strings vocally while challenging another speaker's voice profile.

Computational complexity

The goal of real-time operation on small portable devices puts a big emphasis on computational optimization of the proposed system. It can be noticed that PSK-OFDM modulation [3GPP, 2020], AES-CTR encryption [Housley, 2004, Park et al., 2011], Reed-Solomon error correction [Biard andNoguet, 2008,3GPP, 2017] and the speech encoding [Wisayataksin, 2019] algorithms mentioned in this work have been already widely adopted in wireless communication with mobile phones or in the computationally constrained environment, including real-time applications. However, the presented system was implemented in GNU Octave environment, 3 serving as a proof-of-concept only. There is still considerable work to be done to efficiently integrate all these elements into a single system operating on a device with limited resources, like mid-range smartphones.

Summary

This chapter has detailed a new and versatile Data over Voice technique for secure voice communications over LPC-based voice channels, like cellular networks and VoIP. Based on codebooks with harmonic symbols, the proposed solution is well-grounded on the fundamental principles of LPC coding.

A thorough analysis of OFDM signals compressed by some prominent voice coders revealed that the distortion is statistically close to a symmetric bivariate Gaussian distribution over the complex phase-amplitude plane. However, this distortion is not uniformly distributed in the spectral domain. Thus, we proposed an optimized demodulation metric based on spectrally weighted Euclidean distance with phase shift correction.

The tedious design process of DoV codebooks has been considerably simplified by using quaternary error correction codes. With OFDM symbols being treated as codes over a quaternary ring, codebook construction reduces to finding a set of quaternary codes that maximizes the minimum Lee distance.

The performance of our DoV technique has been evaluated through simulations and real-world tests over real voice connections between two mobile phones. A bitrate of 2.4 kbps over 3G call and 6.4 kbps over VoIP have been achieved with acceptably low symbol error rates. These tests highlight the need to properly characterize the channel distortion before transmission properly.

Finally, the work described a scheme for secure voice communications over voice channels in high and low bitrate modes of operation. The system has been practically validated for real-time voice transmission over cellular networks and VoIP with small effective bit error rates. To mitigate the negative impact of VAD, we also proposed a new method based on the insertion of repetitive silences.

The promising results presented in this work suggest some further investigation of the proposed DoV technique. A big emphasis has to be put on signal synchronization on the reception side and reducing the computational cost of signal demodulation. Additionally, sensible codebook structuring, combined with the exploitation of phase symmetries, may significantly lower the number of correlations in a demodulator.

3. https://www.gnu.org/software/octave/ 3.7 -Summary 59 Chapter 4 introduces a new enciphering scheme adapted to communication over channels with errors. In contrast to the DoV technique described in this section, the scheme is tolerant to transmission error. The method enciphers spherical data using random rotations from a commutative group of orthogonal matrices and is particularly suitable for transmitting perceptually-oriented data, such as multidimensional speech timbre.

CHAPTER 4

Distortion-tolerant encryption of vectors on N-spheres

This chapter presents a distortion-tolerant encryption scheme for scrambling unit vectors on hyperspheres, using rotations from a group of orthogonal matrices, and a nonbinary pseudo-random number generator (PRNG) with a fresh secret seed. The method gives indistinguishable encryptions in the presence of an eavesdropper and is robust against channel errors. This makes the encryption scheme suitable in secure voice communications over voice channels, for example by scrambling a multi-dimensional vocal timbre representation.

The technique has been successfully tested on a toy example. In the test, we scrambled the colors in an image by performing pseudo-random rotations, and later corrupted the enciphered data with Gaussian noise. The descrambled image exhibited a gracefully progressive quality degradation depending on the distortion intensity, while the informative content of the image remained well preserved.

G i orthogonal matrix i from G T ξ flat torus in R 2n associated with a positive unit vector ξ ∈ R n Φ ξ (•) torus mapping R n → R 2n associated with ξ ∈ R n (see Section 4.3.2) γ n (x) function S n → R n which
0.5 √ n/2 checkerboard lattice D n 1/ √ 2 1 (n = 3) or √ n/2 ( n > 3 ) Gosset lattice Γ 8 1/ √ 2 1

Motivation

The investigation on speech coding and voice channels carried in Chapter 2 and Chapter 3 revealed that achieving error-less data transmission over real voice channels was very unlikely. This pessimistic outcome undermines the usefulness of many prominent cryptographic algorithms in speech encryption. The reason is their non-compliance to transmission error that prevents adversarial data manipulation and guarantees exact message decryption. In contrast, successful operation of voice channels equipped with speech coders proves that a good enough approximation of vocal parameters is sufficient to reconstruct intelligible speech. Consequently, some imperfect data decryption in secure voice communication is acceptable if the lower decryption accuracy is somehow compensated by the higher robustness against errors. Designing a secure cryptographic scheme that operates correctly despite encrypted data distortion could be achieved using unconventional enciphering techniques. The desired property of such a scheme would be some kind of resilience of ciphertexts that would increase the robustness to distortion without compromising the secrecy of encrypted data. A similar problem confronted providers of cloud-based solutions who want to extract useful statistical information from the stored data without violating data privacy. The proposed remedies were new encrypting techniques, such as homomorphic [Gentry, 2009], order-preserving [START_REF] Agrawal | Order Preserving Encryption for Numeric Data[END_REF] and distance-preserving [START_REF] Tex | Towards meaningful distancepreserving encryption[END_REF] encryptions.

Intuitively speaking, an encryption scheme is distance-preserving when the distance between any two pieces of encrypted data is the same after decryption. The technique has been applied in distance-based clustering on encrypted data [START_REF] Yin | PPK-Means: Achieving Privacy-Preserving Clustering Over Encrypted Multi-Dimensional Cloud Data[END_REF] and distance calculation on spherical geophysical coordinates [START_REF] Šeděnka | [END_REF]Gasti, 2014, Zhou et al., 2018]. However, the distancepreserving property is also useful for protecting audio media streams in real-time applications. For example, when the enciphered vocal parameters are degraded by some small channel error, the original signal could still be approximately decrypted without disrupting the communication.

Applying distance-preserving encryption technique directly on speech parameters is far from being straightforward. Naively, we could scramble three perceptual speech components: pitch, loudness, and timbre. Pitch and loudness are associated with fundamental frequency and signal energy, both of them scalars. However, timbre is a multi-dimensional signal loosely related to spectral envelope, and with many possible representations. For instance, in the speech recognition domain a spectral envelope is usually encoded by 13-19 Mel-Frequency Cepstral Coefficients (MFCC) [START_REF] Davis | Comparison of parametric representations for monosyllabic word recognition in continuously spoken sentences[END_REF], Benesty et al., 2008, Chap. 9, Rabiner and Schafer, 2011, Chap. 8].

In this chapter, we propose an encryption scheme that is robust against channel errors, decrypts approximately, and is suitable for enciphering the spectral envelopes of speech signals (how it is done will be detailed in Chapter 5). The technique scrambles unit vectors on a hypersphere using a secure Pseudo-Random Number Generator (PRNG), a commutative (abelian) group of orthogonal matrices, and a spherical group code of equal footing. Despite the fact that spherical group codes where known at least since the late 60s from the seminal work of Slepian [Slepian, 1968], useful literature on using these codes for enciphering remains scarce. The encryption scheme is thoroughly detailed, with an emphasis on the security aspects and robustness to channel error. The scheme is proven to produce indistinguishable encryptions in the presence of an eavesdropper when the enciphering algorithm takes as input a secure pseudo-random sequence. Furthermore, the chapter introduces an extension of the notion of distance-preserving encryption, named distortion-tolerant 4.2 -Lattices and lattice packings 65 encryption, that is better suited for describing the robustness of encryption schemes against channel errors.

This chapter is organized as follows. Section 4.2 reviews some basic lattice theory and details some important lattices. Section 4.3 describes spherical commutative group codes and shows the explicit construction of spherical codes from pairs of nested lattices, as described in [START_REF] Costa | Lattices Applied to Coding for Reliable and Secure Communications[END_REF]. Section 4.4 recalls the fundamental definitions of indistinguishability of encryptions in the presence of an eavesdropper and of non-binary pseudo-random number generators. Section 4.5 details the notion of distortion-tolerant encryption and briefly describes its fundamental properties. Section 4.6 presents the distortion-tolerant encryption scheme. Section 4.7 provides for illustration a toy example of distortion-tolerant color scrambling in an image. Section 4.8 summarizes this work.

Lattices and lattice packings

This section recalls some basic theory related to lattices and describes some special lattices of high density and with efficient decoding algorithms. The interested reader may get more details from [START_REF] Conway | Sphere packings, lattices and groups -3rd Edition[END_REF].

Lattices and lattice packings

A lattice in R n is a subgroup of the additive group R n that is defined by all integer linear combinations of some independent vectors. For any lattice Λ, there is an infinite family of bases and their associated generator matrices. Theorem 4.2.1 describes the relation between all generator matrices spanning Λ.

Theorem 4.2.1. [Costa et al., 2017, Chap. 2] Two matrices B and C generate the same lattice Λ if and only if there exists a unimodular matrix U (a matrix with integer entries and whose determinant is either 1 or -1) such that C = BU .

A subset Λ ′ ⊂ Λ is said to be a sublattice of the lattice Λ if and only if Λ ′ is an additive subgroup of Λ. Let B and B ′ be the respective generator matrices of Λ and Λ ′ . If Λ ′ is fullrank, there exists a square integer matrix H with a non-zero determinant such that B ′ = BH. Moreover, the matrix H can be decomposed into its Smith normal form H = P DQ where P and Q are unimodular matrices, and [Cohen, 1993, Sec. 2.4].

D is a diagonal matrix such that diag(D) = [d 1 , d 2 , ..., d n ] T , d i ∈ N and d i divides d i+1 for i = 1, ..., n -1
Since P and Q -1 are unimodular as in Theorem 4.2.1, the matrix

C := BP = [v 1 , v 2 , ..., v n ] is a generator of Λ and C ′ := B ′ Q -1 = [w 1 , w 2 , ..., w n ] is a generator of Λ ′ . We obtain C ′ = CD,
meaning that the new basis vectors of Λ ′ are integer multiples of the new basis vectors of the lattice Λ: w i = d i v i for i = 1, ..., n. These new basis representations show that the quotient group Λ/Λ ′ is isomorphic to Z d k 0 ⊕ ... ⊕ Z dn , where d k 0 is the first element of diag(D) larger than 1 [Lavor and Gomes, 2018, p. 108-109].

Every full-rank lattice Λ can be characterized by its volume V(Λ), which is the volume of the fundamental parallelotope determined by the set of neighbor lattice points. The lattice volume is independent of the selected generator matrix B and is equal to:

V(Λ) = det(B T B) = |det(B)|. (4.2)
The space containing the lattice points can be decomposed into Voronoi cells [START_REF] Okabe | Spatial Tessellations: Concepts and Applications of Voronoi Diagrams[END_REF]. Let ∥ • ∥ denote some metric in R n . The Voronoi region associated with a lattice point x ∈ Λ is the set of points in R n closer to x than to any other point of lattice Λ with respect to the chosen metric:

V Λ (x) = {y ∈ R n : ∥x -y∥ ≤ ∥z -y∥, for all z ∈ Λ}. (4.3)
If ∥ • ∥ is the Euclidean distance measure, we have the volume of the Voronoi cell associated with 0 equal to V(Λ): vol(V Λ (0)) = V(Λ) [Costa et al., 2017, Chap. 2]. Many practical problems in digital coding, computational geometry, and optimization often summarize to finding a dense sphere packing in a multidimensional Euclidean space, which can be intuitively understood as distributing some balls of a fixed radius. Some arrangements of balls can be called 'densest' in the space R n when there exists no other (non-equivalent) arrangement of balls that occupies a larger portion of that space.

If an arrangement of balls is regular, the center points of the balls form a lattice. Furthermore, the density of the arrangement is independent of the chosen lattice basis, making it a useful measure for comparing the densities of different lattices.

Definition 4.2.2. Let x min denote the shortest non-zero vector in Λ and let B n (r) denote the ndimensional ball of radius r around the origin: B n (r) = {x ∈ R n : ∥x∥ ≤ r}. The packing density of Λ is defined as:

∆(Λ) = vol(B n (ρ)) V(Λ) , ( 4.4)
where ρ = ∥x min ∥/2 is called the packing radius.

The dual problem to sphere packing is the sphere covering problem, linked to the covering density of Λ. As opposed to the previous measure, the covering density describes the smallest volume of balls covering the whole space R n , in relation to V(Λ). Because the balls may overlap, the covering density is never smaller than 1.

Definition 4.2.3. The covering density of Λ is defined as:

Θ(Λ) = vol(B n (µ)) V(Λ) , (4.5)
where the covering radius µ is the smallest positive value such that the union of all the translates of the ball B n (µ) by vectors in Λ cover R n :

x∈Λ (B n (µ) + x) = R n . (4.6)
In the rest of this chapter, if not stated otherwise, ∥ • ∥ will denote the Euclidean norm. Given a random lattice and a target vector, the closest vector problem (CVP) is proved to be NP-hard [START_REF] Micciancio | Complexity of lattice problems: a cryptographic perspective[END_REF]. For certain classes of lattices, however, there exist very efficient ways of finding the closest or approximately closest vectors.

The cubic lattice Z n is the lattice with all points being n-tuples of integers. It has the packing radius ρ = 0.5 and the covering radius µ = √ n/2. The regular structure of Z n enables a very efficient procedure for finding closest lattice points. Let g(z) be the function which rounds z ∈ R to one closest integer. If the result is not unique, g(z) outputs the integer with the smallest absolute value. Then, for any vector z = [z 1 , ..., z n ] T , the closest vector in Z n is g(z) = [g(z 1 ), ..., g(z n )] T [Conway and Sloane, 1999, Chap. 4].

The checkerboard lattice D n is the lattice with elements having integer coordinates summing up to an even number:

D n = {[z 1 , ..., z n ] T ∈ Z n : z 1 + ... + z n ≡ 0 mod 2}, n ≥ 3 . (4.8)
The packing radius of D n is ρ = 1/ √ 2, and the covering radius is µ = ρ √ 2 (n = 3) or µ = ρ n/2 ( n > 3 ). The lattice D n is the densest lattice in dimensions n = 3, 4 and 5.

Due to the explicit relation between point coordinates in D n , CVP in the Euclidean metric is nearly as simple as in the cubic lattice Z n [START_REF] Conway | Fast quantizing and decoding and algorithms for lattice quantizers and codes[END_REF]. Let h(z) be defined similarly to the function g(z) with the only difference that the component of z farthest from the integer is rounded the other way (for example, h([0.2, 1.7]) = [0, 1]). Clearly, one of the points g(z) or h(z) has an even sum of coordinates. Thus, a point belonging to D n is also the closest lattice point to z.

The Gosset lattice Γ 8 was recently proven to be (up to an isomorphism) the densest lattice in dimension 8 [Viazovska, 2017]. It is defined as:

Γ 8 = z = [z 1 , ..., z 8 ] T ∈ Z 8 ∪ (Z + 1/2) 8 : 8 i=1 z i ≡ 0 mod 2 , (4.9)
and its generator matrix is given by:

B =               2 -1 0 0 0 0 0 1/2 0 1 -1 0 0 0 0 1/2 0 0 1 -1 0 0 0 1/2 0 0 0 1 -1 0 0 1/2 0 0 0 0 1 -1 0 1/2 0 0 0 0 0 1 -1 1/2 0 0 0 0 0 0 1 1/2 0 0 0 0 0 0 0 1/2              
.

CHAPTER 4 -Distortion-tolerant encryption of vectors on N-spheres

The Gosset lattice has packing density ρ = 1/ √ 2 and covering density µ = 1. It can be noticed that Γ 8 = D 8 ∪ (D 8 + 1

2 ), where (D 8 + 1 2 ) denotes the lattice D n translated by [ 1 2 , 1 2 ] T . This observation is useful in CVP: for any z ∈ R 8 , the closest vector of Γ 8 is one of the four vectors g(z), h(z), g(z -1

2 ) + 1 2 , h(z -1 2 ) + 1 2 [START_REF] Conway | Fast quantizing and decoding and algorithms for lattice quantizers and codes[END_REF].

Spherical commutative group codes from lattices

In the digital communications domain, spherical codes are used in source and channel coding [Adoul et al., 1984, Hamkins and[START_REF] Hamkins | [END_REF], coded signal modulation [Burr, 1989] and MIMO space-time coding [START_REF] Utkovski | On The Construction of Noncoherent Space Time Codes from High-dimensional Spherical Codes[END_REF]]. However, the available literature on exploiting spherical codes for data scrambling is very scarce if existing. This section describes some spherical commutative group codes associated with dense lattices that will be the building block of the presented enciphering scheme. The section starts by recalling the basic definitions and some theorems related to spherical group codes. The theory linking spherical group codes and lattices owes a lot to the work of Costa and his research group [START_REF] Costa | Lattices Applied to Coding for Reliable and Secure Communications[END_REF].

Spherical commutative group codes

A spherical commutative (abelian) group code on the unit hypersphere S n-1 ⊂ R n is a set of unit vectors closed under matrix multiplication from some orthogonal matrix group G. These spherical commutative group codes were introduced in [Slepian, 1968] as a new encoding method for sending information over the Gaussian channel.

Definition 4.3.1. [Slepian, 1968] A spherical commutative group code C of order M is a set of M unit vectors C = {Gσ : G ∈ G}, where σ lies on the unit hypersphere S n-1 ⊂ R n and G is a finite group of order M of n × n orthogonal matrices.

Commutative spherical group codes are geometrically uniform, i.e., for any u, v ∈ C , there exists an isometry f u,v such that f u,v (u) = v and f u,v (C ) = C [Forney, 1991]. Moreover, they have congruent Voronoi regions, the same detection probability in the presence of transmission noise, and a distribution of codewords invariant to multiplication by matrices from G. Although spherical commutative group codes do not offer packing densities as high as general spherical codes, this shortcoming is compensated by their simple structure and the easiness of encoding and decoding [Costa et al., 2017, p. 81]. Examples 4.3.1 and 4.3.2 in Section 4.3.3 show two instances of spherical codes.

Every element in G can be uniquely represented as a product of powers of generator matrices Cohen, 1993, Sec. 2.4]. We can thus conveniently index G ∈ G (and

{G 1 , ..., G k }, such that G i ∈ G for i = 1, ..., k, and G i generate G: G = {G w 1 1 • G w 2 2 • ... • G w k k : 0 ≤ w i ≤ d i -1, i = 1, ..., k} . Furthermore, G is isomorphic to Z d 1 ⊕ ... ⊕ Z d k where d 1 • d 2 • ... • d k = M and d i divides d i+1 for i = 1, ..., k -1 [
Gσ ∈ C ) by a vector [w 1 , ..., w k ] T ∈ Z d 1 ⊕ ... ⊕ Z d k .
The elements of G can also be viewed as a composition of rotations and reflections mapping points on the hypersphere into other codewords in C . It is the consequence of Theorem 4.3.1 which states that we can orthogonally transform G into a new group with rotation and reflection parts separated.

-4.3.2 Torus mapping 69

Theorem 4.3.1. [Gantmakher, 1959, p. 292] In every finite group G of n×n orthogonal matrices, every element G i ∈ G for i = 1, ..., M can be mapped by one and only one real orthogonal transformation Q into a block-diagonal form:

QG i Q T =                 Rot 2πa i,1 M 0 ... ... 0 0 . . . . . . . . . Rot 2πa i,q M b i,2q+1 . . . . . . . . . 0 0 ... ... 0 b i,n                
where a i,j ∈ {0, ..., M } for j = 1, ..., q and b i,j = ±1 for j = (2q + 1), ..., n and Rot(x) are 2 × 2 rotation matrices:

Rot(x) = cos(x) -sin(x) sin(x) cos(x) .
We say, that G is free from reflection blocks, when 2q = n [Costa et al., 2017, p. 79]. Such a group of matrices can be transformed into a group that contains only spherical rotations.

Torus mapping

A flat torus mapping makes the link between spherical group codes on the unit sphere in R 2n and lattices in R n . This connection is used to construct spherical codes from dense lattices with a simple structure.

For each unit vector [ξ 1 , ..., ξ n ] T = ξ ∈ S n-1 with positive coordinates ξ i > 0, and for every [u 1 , ..., u n ] T = u ∈ R n , let the mapping Φ ξ : R n → R 2n be defined as:

Φ ξ (u) = [ξ 1 cos(u 1 /ξ 1 ), ξ 1 sin(u 1 /ξ 1 ), ..., ξ n cos(u n /ξ n ), ξ n sin(u n /ξ n )] T .
(4.10)

The image of Φ ξ describes a flat torus T ξ contained on the surface of a unit hypersphere S 2n-1 ⊂ R 2n . Moreover, the same flat torus can be injectively mapped to a bounded box in R n , as depicted in Figure 4.1:

P ξ = {u ∈ R n : 0 ≤ u i ≤ 2πξ i , 1 ≤ i ≤ n}. (4.11)
The whole family of flat tori with ∥ξ∥ = 1 and ξ i ≥ 0 foliates the hypersphere S 2n-1 , meaning that every point on the sphere belongs to one and only one flat torus [Lawson Jr, 1974, Candel and[START_REF] Candel | [END_REF].

The Euclidean distance between two points on the flat torus associated with the vector ξ = [ξ 1 , ..., ξ n ] T is given by [START_REF] Torezzan | Constructive Spherical Codes on Layers of Flat Tori[END_REF]:

∥Φ ξ (u) -Φ ξ (v)∥ = 2 n i=1 ξ 2 i sin 2 u i -v i 2ξ i , (4.12)
and is bounded by [START_REF] Torezzan | Optimum commutative group codes[END_REF]: Besides, the red and black dots combined form another lattice Λ α such that Λ β ⊂ Λ α . It can be noticed, that the quotient Λ α /Λ β of order 4 can be mapped by Φ ξ to some spherical code C on S 3 ∈ R 4 . Moreover, since Λ α /Λ β is closed under translation by a single basis vector (the blue arrow), the code should be closed under an associated rotation on S 3 . Consequently, the code C is a commutative group code of order 4 with a single generator matrix. As will be detailed in Corollary 4.3.2, there is an isomorphism between some spherical group codes in even dimensions larger than 2 (hence, C ⊂ R 2n , n > 1) and quotients of associated lattices. Conversely, Corollary 4.3.3 presents an explicit construction of a spherical code from a pair of nested lattices.

2 π ∥u-v∥ ≤ 2ξ min sin ∥u -v∥ 2ξ min ≤ ∥Φ ξ (u)-Φ ξ (v)∥ ≤ 2 sin ∥u -v∥ 2

Spherical commutative group codes from lattices

Corollary 4.3.2. [Siqueira and Costa, 2008, p. 113] Let C = Gσ ⊂ R 2n be a spherical commutative group code of order M , where G is a group of orthogonal matrices free from reflection blocks, and σ = [ξ 1 , 0, ξ 2 , 0, ..., ξ n , 0] T , ξ i ≥ 0, is the initial vector with unit norm. Then, the inverse image of the code Φ -1 ξ (C ) is the full rank lattice Λ α generated by the set:

{α i : α i = [2πa i,1 /M, ..., 2πa i,n /M ] T , 0 ≤ a i,j < M, a i,j ∈ Z, j = 1, ..., n, i = 1, ...,
(D) = [d 1 , d 2 , ..., d n ] T , d i ∈ N and d i divides d i+1 for i = 1, ..., n -1. Let us define b i = ∥β i ∥, b = n j=1 ∥β j ∥ 2 , ξ i = b i /b , ξ = [ξ 1 , ξ 2 , ..., ξ n ]
T and the torus mapping Φ ξ . Then, the quotient of the normalized nested lattices (2πb -1 Λ α )/(2πb -1 Λ β ) is associated with a spherical code C ⊂ S 2n-1 with the initial vector σ = [ξ 1 , 0, ξ 2 , 0, ..., ξ n , 0] T , and a generator group of matrices determined by the Smith normal decomposition of H. Discussion Corollary 4.3.3 states that for a given pair of nested lattices Λ β ⊂ Λ α , Λ β being orthogonal, and an integer matrix H such that A β = A α H, with the Smith normal form H = P DQ, one can easily get generator matrices of G. Indeed, since P and Q are unimodular,

B α = A α P = [v 1 , v 2 , ..., v n ] and B β = A β Q -1 = [w 1 , w 2 , ..., w n ]
are also respective generator matrices of lattices Λ α and Λ β . We get

B β = B α D (w i = d i v i ) and Λ α /Λ β ∼ = Z d k 0 ⊕ ... ⊕ Z dn
where d k 0 is the first element of Diag(D) larger than 1. Thus, we can associate the quotient Λ α /Λ β with some orthogonal 2n×2n matrix group

G ∼ = Z d k 0 ⊕...⊕Z dn of order det (H) = d 1 •d 2 •...•d n .
Furthermore, the basis vectors v k 0 , ..., v n can be associated with a direction of rotations. However, these vectors should be expressed in terms of the old orthogonal basis A β which determines the rectangular frame defined as pre-image of the flat torus. As a result, we may express the generator matrices {G 1 , G 2 , ..., G k } in block-diagonal form:

G j =       Rot(2πr j+k 0 ,1 ) 0 ... 0 0 Rot(2πr j+k 0 ,2 ) ... 0 . . . . . . . . . . . . 0 0 ... Rot(2πr j+k 0 ,n )       2n×2n
where k is the number of elements in Diag(D) larger than 1, k 0 = n -k, j = 1, ..., k and r j+k 0 ,i are elements of the matrix R = A -1 β A α P . It can be noticed that performing basic rotations on the codewords of C is equivalent to translating points in the pre-image of the flat torus. Thus, we can impose some design rules that improve the properties of the constructed spherical code.

Firstly, from the bounds given by Equation 4.13 we get that for any u, v ∈ (2πb -1 Λ α )/(2πb -1 Λ β ) the distance ∥Φ ξ (u) -Φ ξ (v)∥ is larger than 2∥u -v∥/π. Consequently, the maximization of the minimum distance between vectors of (2πb -1 Λ α ) results in the improvement of distance distribution between codewords on the hypersphere S 2n-1 . In particular, selecting dense lattices like the checkerboard lattice D n or the Gosset lattice Γ 8 in the construction will lead to a larger minimum distance between codewords in C .

The distribution of codewords on the hypersphere S 2n-1 can be further improved by selecting a proper vector ξ = [ξ 1 , ..., ξ n ] T . Provided that 2ξ min sin(∥u -v∥/(2ξ min )) ≤ ∥Φ ξ (u) -Φ ξ (v)∥, we should maximize the minimum nonnegative component ξ min . This is achieved by taking ξ such that ξ 1 = ξ 2 = ... = ξ n .

A α = 2 0 0 1 A β = 2 6 3 -4 .
We have Λ β ⊂ Λ α and Λ β is orthogonal, as seen in Figure 4.3. The matrix H with the Smith normal form:

H = 1 3 3 -4 = 1 0 3 -1 1 0 0 13 1 3 0 1 .
Thus, G ∼ = Λ α /Λ β ∼ = Z 13 is of order 13 and has one generator matrix. The new basis of Λ α is B α = A α P with two vectors [2,3] T and [0, -1] T , where only the second contributes to spherical rotations in G (it can be verified on the picture, that indeed this vector generates a code of order 13).

Finally, the vector [0, -1] T should be expressed in the basis A β , giving a vector [-3/13, 1/13] T . The 4 × 4 generator matrix of the spherical commutative group G is given by: Rot(2π(-3/13)) 0 0

Rot(2π(1/13)) .

Finally, the initial vector of the spherical code is σ = [ 13/65, 0, 52/65, 0] T .

Example 4.3.2 -Let the lattices Λ α = Γ 8 and Λ β have the following generator matrices:

A α =               2 -1 0 0 0 0 0 1/2 0 1 -1 0 0 0 0 1/2 0 0 1 -1 0 0 0 1/2 0 0 0 1 -1 0 0 1/2 0 0 0 0 1 -1 0 1/2 0 0 0 0 0 1 -1 1/2 0 0 0 0 0 0 1 1/2 0 0 0 0 0 0 0 1/2               A β =              
2k 0 0 0 0 0 0 0 0 2k 0 0 0 0 0 0 0 0 2k 0 0 0 0 0 0 0 0 2k 0 0 0 0 0 0 0 0 2k 0 0 0 0 0 0 0 0 2k 0 0 0 0 0 0 0 0 2k 0 0 0 0 0 0 0 0 2k

             
,

where k ∈ N. Matrix H, such that A β = A α H, is of the form:

H =               k k k k k k k -7k 0
2k 2k 2k 2k 2k 2k -12k 0 0 2k 2k 2k 2k 2k -10k 0 0 0 2k 2k 2k 2k -8k 0 0 0 0 2k 2k 2k -6k 0 0 0 0 0 2k 2k -4k 0 0 0 0 0 0 2k -2k 0 0 0 0 0 0 0 4k

              ,
and can be decomposed into its Smith normal form H = P DQ:

             
1 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1

                           
k 0 0 0 0 0 0 0 0 2k 0 0 0 0 0 0 0 0 2k 0 0 0 0 0 0 0 0 2k 0 0 0 0 0 0 0 0 2k 0 0 0 0 0 0 0 0 2k 0 0 0 0 0 0 0 0 2k 0 0 0 0 0 0 0 0 4k

                            1 1 1 1 1 1 -7 0 1 1 1 1 1 -6 0 0 1 1 1 1 -5 0 0 0 1 1 1 -4 0 0 0 0 1 1 -3 0 0 0 0 0 1 -2 0 0 0 0 0 0 -1 0 0 0 0 0 0 1              
.

The form of the matrix D indicates that the spherical code is of order M = k(2k) 6 (4k), and is isomorphic to

Z 6 2 ⊕ Z 4 when k = 1 or isomorphic to Z k ⊕ Z 6 2k ⊕ Z 4k when k > 1.
From the Smith normal decomposition we obtain 8 generator matrices (7 when k = 1) generating the spherical code C = Gσ ⊂ S 15 . The columns of the following matrix define angles of rotations in the generator matrices {G 1 , G 2 , ..., G 8 } of the group G:

2πA -1 β A α P =               2π/k -2π/2k 0 0 0 0 0 2π/4k 0 2π/2k -2π/2k 0 0 0 0 2π/4k 0 0 2π/2k -2π/2k 0 0 0 2π/4k 0 0 0 2π/2k -2π/2k 0 0 2π/4k 0 0 0 0 2π/2k -2π/2k 0 2π/4k 0 0 0 0 0 2π/2k -2π/2k 2π/4k 0 0 0 0 0 0 2π/2k 2π/4k 0 0 0 0 0 0 0 2π/4k              
.

The initial vector of the spherical code is σ = [1, 0, ..., 1, 0] T / √ 8 ∈ S 15 . Finally, the pre-image of the spherical code Φ -1 ξ (C ) is the scaled Gosset lattice:

2π 2k √ 8 Γ 8 .

Asymptotic secrecy of pseudo-random generators

The following definitions recall the fundamental secrecy concepts related to symmetric-key encryption schemes and pseudo-random generators. The theory starts with defining a secret-key encryption scheme and the notion of perfect secrecy, and is followed by a more realistic approach when the eavesdropper running in probabilistic polynomial time (PPT) is given some small advantage in breaking the security of the scheme. For every security parameter λ, every key k ∈ K and every message m ∈ M it holds that Dec k (Enc k (m)) = m. If messages cannot be longer than a fixed and predefined value, we say that Π is a fixed-length private-key encryption scheme.

In cryptography and security analysis, we often work with probabilities rather than with particular instantiations. Thus, all the keys k, plaintext messages m, and ciphertexts c are chosen or computed with some probabilistic distribution. Usually, these distributions are being related to random variables K,M and C, so that for example Pr(K = k) denotes the probability of selecting k ∈ K. Additionally, random variables K and M are assumed to be independent. Definition 4.4.2. [Katz and Lindell, 2015, Chap. 2] An encryption scheme Π = (KeyGen, Enc, Dec) with a message space M is perfectly secret if for every probability distribution over M, every message m ∈ M, and every ciphertext c ∈ C such that Pr(C = c) > 0, we have:

Pr(M = m | C = c) = Pr(M = m).
4.4 -Asymptotic secrecy of pseudo-random generators 75 Definition 4.4.2 states that the encryption scheme Π is perfectly secret if no algorithm with unbounded computational power can get any information about the message m out of the ciphertext c. In practice, it is more convenient to use the notion of indistinguishability in experiment called the adversarial indistinguishability challenge. In the experiment, a stateful algorithm A (an adversary) specifies two arbitrary messages m 0 , m 1 ∈ M, and then is given uniformly at random one of the ciphertexts Enc k (m 0 ), Enc k (m 1 ) encrypted with a random key. The adversary's goal is to correctly guess if he received the encryption of m 0 or m 1 .

Definition 4.4.3. [Katz and Lindell, 2015, Chap. 3] The adversarial indistinguishability challenge PrivK eav A,Π (λ) is defined as: 1. The adversary A is given input 1 λ , and he chooses a pair of distinct messages m 0 , m 1 of equal length. Lemma 4.4.1. [Katz and Lindell, 2015, Chap. 2] Encryption scheme Π = (KeyGen, Enc, Dec) with a message space M is perfectly secret if and only if it is perfectly indistinguishable, i.e., for every adversary A it holds:

Pr(PrivK eav A,Π (λ) = 1) = 1 2 .
Perfectly secret encryption schemes are non-practical because the size of the key space K should be at least as large as the message space M, |K| ≥ |M| [Shannon, 1949]. For this reason, we often relax secrecy requirements and grant the adversary A with limited computational power with a small probabilistic chance of breaking the scheme, i.e., to obtain an advantage in the indistinguishability challenge:

Pr(PrivK eav A,Π (λ) = 1) > 1 2 .
In return, the size of the key space may become far smaller than the size of the message space.

Definition 4.4.4. [Katz and Lindell, 2015, Chap. 3] A function f : N → R + ∪ {0} is negligible if for every positive polynomial p there is an integer N such that for all integers n > N it holds that Katz and Lindell, 2015, Chap. 3] Let negl 1 and negl 2 be negligible functions. We have:

f (n) < 1 p(n) . Proposition 4.4.2. [
1. The function negl 3 (n) = negl 1 (n) + negl 2 (n) is negligible.

For any positive polynomial p, the function negl

4 (n) = p(n) • negl 1 (n) is negligible.
In the asymptotic approach, we let all PPT adversaries to get at most negligible advantage over the scheme, given some integer-valued security parameter λ. In the indistinguishability challenge, the advantage Adv(A(1 λ )) is defined as the absolute difference between the success probability achieved by A compared to a random guess. Definition 4.4.5. [Katz and Lindell, 2015, Chap. 3] A symmetric encryption scheme Π = (KeyGen, Enc, Dec) has indistinguishable encryptions in the presence of an eavesdropper, if for all PPT adversaries A there is a negligible function negl such that for all λ it holds:

Adv(A(1 λ )) = Pr(PrivK eav A,Π (λ) = 1) - 1 2 ≤ negl(λ),
where the probability is taken over the randomness used by A and the randomness used in the challenge.

Finally, we recall the definition of a non-binary pseudorandom generator, as a function {0, 1} l(λ) → {0, 1, ..., q -1} L(λ) , l(λ) < L(λ) polynomials, which given a perfectly binary random seed s ∈ {0, 1} l(λ) , outputs a string of L(λ) integers modulo q with a distribution indistinguishable from the uniform by any PPT statistical test (distinguisher). The test returns 1 when it distinguishes an input string's distribution from the uniform distribution and returns 0 otherwise. Pseudo-random generators can be viewed as instantiations of stream cipher keys, widely adopted in modern cryptography. The generators can output discrete values different from only 0 and 1. Definition 4.4.6. Based on [Katz and Lindell, 2015, Chap. 3]. Let L and l be polynomials and let G q be a polynomial-time algorithm such that q ∈ N and for any λ and input s ∈ {0, 1} l(λ) the output of G q (s) is w ∈ {0, 1, ..., q -1} L (λ) . We say that G q is a pseudo-random generator, if the following conditions hold:

1. For every λ it holds that L(λ) > l(λ).

2. For any PPT distinguisher D, there is a negligible function negl such that

Adv(D(1 λ )) = |Pr(D(G q (s)) = 1) -Pr(D(r) = 1)| ≤ negl(λ),
where the first probability is taken over uniform choices of s ∈ {0, 1} l(λ) and randomness of D, and the second probability is taken over uniform choices of r ∈ {0, 1, ..., q -1} L(λ) and randomness of D.

Distortion-tolerant encryption

In its primary sense, a distortion-tolerant property denotes the capability to decipher ciphertexts distorted by a transmission channel. Traditionally, encrypted data are protected by error correction coding with a predefined correction capability. In this work, we consider encryption schemes that output an approximation of the initial message, given a distorted ciphertext.

The distortion-tolerant property takes inspiration from the notion of distance-preserving encryption described in Definition 4.5.1. Definition 4.5.1. [START_REF] Tex | Towards meaningful distancepreserving encryption[END_REF] Let M be a data set, K be a key space, d be a distance measure and Enc be an encryption algorithm for data items in M. Then, Enc is d-distance preserving if:

∀m 0 , m 1 ∈ M and ∀k ∈ K : d(Enc k (m 0 ), Enc k (m 1 )) = d(m 1 , m 2 ).
When considering encryption of databases, Definition 4.5.1 cannot be relaxed without introducing inaccuracies in the result of queries on encrypted data [START_REF] Tex | Towards meaningful distancepreserving encryption[END_REF]. However, in the case of perceptual audio-visual data, small inaccuracies are usually acceptable or perceptually irrelevant. It is especially true in real-time applications that prioritize robustness and efficiency over the quality of representation. 4.6 -Enciphering using spherical codes 77 Definition 4.5.2. Let d M and d C denote distance measures over the plaintext space M and the ciphertext space C, respectively. We say that the encryption scheme Π = (KeyGen, Enc, Dec) is distortion-tolerant with respect to these measures, if for every key k ∈ K, any two ciphertexts c 1 , c 2 ∈ C, and δ > 0 not too large, there is τ > 0 such that:

1. d C (c 1 , c 2 ) < δ =⇒ d M (Dec k (c 1 ), Dec k (c 2 )) < τ δ. 2. τ δ ≪ max c i ,c j ∈C d M (Dec k (c i ), Dec k (c j )).
The notion of distortion-tolerant encryption introduced here is considerably relaxed compared to the notion of distance-preserving encryption. Firstly, we use two different metrics over the message and the ciphertext spaces. Furthermore, we allow some distance expansion τ between the decrypted plaintexts Dec k (c 1 ) and Dec k (c 2 ), which is still small compared to the maximum distance between plaintexts. Finally, the distortion-tolerant property applies locally in a ciphertext neighborhood.

Every encryption scheme with a distortion-tolerant property is malleable by design.1 Without additional data-integrity mechanisms, an active attacker can modify the decrypted plaintext by carefully changing the encrypted data. Moreover, given a pair (m, Enc k (m)), the attacker may easily guess or approximate the decryption result of all ciphertexts close to Enc k (m). On the other hand, the malleability does not necessarily compromise the secrecy of encryptions if the enciphering algorithm uses a fresh cryptographic key k ∈ K for every encryption.

Enciphering using spherical codes

This section introduces a lossy enciphering technique for scrambling a sequence of points on the unit hypersphere S n , n > 1. The encryption scheme encodes the spherical points to codewords of a spherical commutative group code C ⊂ S 2n-1 and performs pseudo-random rotations from a group of orthogonal matrices G. The result of this enciphering is a randomly-looking sequence of codewords from C with a distribution indistinguishable from the uniform distribution.

This enciphering of codewords using rotations from G satisfies the distance-preserving property because the spherical group code is geometrically uniform and also closed under rotations from G. It turns out to be very useful if we consider the transmission of scrambled sequences of codewords over a noisy channel. Provided that the channel noise level is not too high, this noise would map into the decrypted plaintext without introducing much error.

Overview of the encryption scheme

The enciphering procedure scrambles a fixed-length sequence of spherical points X = (x 1 , ..., x L(λ) ), x ℓ ∈ S n , into a sequence of spherical codewords U = (u 1 , ..., u L(λ) ), u ℓ ∈ C , where λ is an integer-valued security parameter and L is a polynomial. The spherical code C lies on the flat torus T ξ and is associated with the quotient of two full rank lattices Λ β ⊂ Λ α ⊂ R n through a flat torus mapping Φ ξ , ξ = [ξ 1 , ..., ξ n ] T . Furthermore, the code has initial vector σ = [ξ 1 , 0, ..., ξ n , 0] T and is generated by a group G of 2n × 2n orthogonal matrices with k generator matrices {G

1 , ..., G k } isomorphic to Z d 1 ⊕ ... ⊕ Z d k , where d 1 • .... • d k = M is the order of the group.
The diagram illustrating the enciphering scheme is shown in Figure 4.4. The scheme consists of six procedures (KeyGen, RandGen, Encode, Decode, Encrypt, Decrypt):

1. KeyGen(1 λ ): for a given integer-valued security parameter λ (preferably λ = 256, and no less than 128), KeyGen(1 λ ) outputs a secret seed s chosen uniformly from {0, 1} l(λ) , where l is a polynomial such that l(λ) < L(λ).

2. RandGen(s): for a given secret seed s, RandGen(s) generates a sequence of L(λ) randomly-looking, positive modulo integers r = (r 1 , ..., r L(λ) ), 1 ≤ r ℓ ≤ M .

3. Encode(X): for a given sequence of spherical points X = (x 1 , ..., x L(λ) ), x ℓ ∈ S n , the algorithm encodes every x ℓ into a codeword p ℓ ∈ C and outputs a sequence of spherical codewords P = (p 1 , ..., p L(λ) ).

4. Decode(Q): for a given sequence Q = (q 1 , ..., q L(λ) ) of points on the flat torus T ξ , the algorithm maps every q ℓ into a point y ℓ ∈ S n and outputs a sequence Y = (y 1 , ..., y L(λ) ) of points on S n . 5. Encrypt r (P ): for a given sequence of positive integers r = (r 1 , ..., r L(λ) ), r ℓ ≤ M , and a sequence of codewords P = (p 1 , ..., p L(λ) ), p ℓ ∈ C , the enciphering procedure transforms every codeword p ℓ into another codeword u ℓ and outputs a sequence U = (u 1 , ..., u L(λ) ) depending upon r.

6. Decrypt r (V ): for a given sequence of positive integers r = (r 1 , ..., r L(λ) ), r ℓ ≤ M , and a sequence V = (v 1 , ..., v L(λ) ) of points on the flat torus T ξ , the deciphering procedure outputs a sequence Q = (q 1 , ..., q L(λ) ) of points on T ξ depending upon r.

Encoding

The encoding procedure Encode(X), X = (x 1 , ..., x L(λ) ) is performed by blocks, i.e., Encode(X) = (Encode(x 1 ), ..., Encode(x L(λ) )). Encoding of every x ℓ consists of two consecutive actions: mapping x ℓ on the flat torus T ξ and then searching a close codeword p ℓ ∈ C to that mapped point.

4.6 -4.6.2 Encoding 79 Let γ n be a function which maps any point x ∈ S n to a vector φ = [φ 1 , ..., φ n ] T , where φ 1 , ..., φ n-1 ∈ [0, π) and φ n ∈ [0, 2π) are the spherical coordinates of x = [x 1 , ..., x n+1 ] T such that:

                   x 1 = cos(φ 1 ), x 2
= sin(φ 1 ) cos(φ 2 ), . . .

x n = sin(φ 1 ) • ... • sin(φ n-1 ) cos(φ n ), x n+1 = sin(φ 1 ) • ... • sin(φ n-1 ) sin(φ n ).
The point ξ ⊙ φ, where ⊙ denotes the Hadamard product, 2 lies inside the hyperbox n i=1 [0, 2πξ i ) and can be mapped to a new point Φ ξ (ξ ⊙ φ) on the flat torus T ξ .

The second step is to find a codeword p ∈ C close to Φ ξ (ξ ⊙ φ) in terms of Euclidean distance in a process which can be viewed as quantization. The higher is the order of the code, the smaller the quantization error gets. Other factors contributing to the quantization error are the density of the lattice Λ α , and the selection process of a vector ξ which determines the geometrical distribution of codewords on the sphere S 2n-1 .

The search can be considerably simplified by taking advantage of the isomorphism between the group G and the quotient Λ α /Λ β . Instead of comparing distances between Φ ξ (ξ ⊙ φ) and the codewords in C , one may find the closest lattice point z ∈ Λ α to ξ ⊙ φ and map this point to p = Φ ξ (z). Unfortunately, the closest lattice vector problem can become quite challenging unless the lattice Λ α has a special structure. For this reason, it is advisable to construct a spherical code C associated with a lattice Λ α isomorphic to one of the special lattices with efficient decoding procedures (i.e., Z n , D n or Γ 8 ).

Although z is the closest lattice point to ξ ⊙ φ, the point Φ ξ (z) may be not the closest to Φ ξ (ξ ⊙ φ). Lemma 4.6.1 demonstrates that the maximum distance of Φ ξ (z) from the true closest point c ∈ C does not exceed 2µ, where µ is the covering radius of Λ α . Thus, provided a sufficiently dense lattice Λ α with a small covering radius, the overall quantization error is reduced.

Lemma 4.6.1. Let x ∈ R n and let C be a commutative group code in R 2n associated with a lattice Λ in R n through an inverse image Φ -1 ξ (C ). Let z be the closest point of Λ to x in terms of Euclidean metric. Then, the distance between Φ ξ (z) and the closest code of C to Φ ξ (x) gets no larger than 2µ, where µ is the covering radius of Λ.

Proof.

Let Q z = {q ∈ Λ : V(q) ∩ V(z) ̸ = ∅} be the set containing z and its closest lattice neighbors in terms of Euclidean metric, and let F(Φ ξ (Q z )) be the smallest convex polytope on the surface of S 2n-1 that contains Φ ξ (Q z ) (without loss of generality, we can assume that such a polytope exists). We have Φ ξ (x) ∈ F(Φ ξ (Q z )). In addition, F(Φ ξ (Q z )) lies on the union of all the Voronoi regions of Φ ξ (q) ∈ Φ ξ (Q z ). Thus, the closest codeword c ∈ C to Φ ξ (x) also belongs to F(Φ ξ (Q z )). Finally:

∥Φ ξ (c) -Φ ξ (x)∥ ≤ ∥Φ ξ (c) -Φ ξ (z)∥ ≤ max q∈Qz ∥Φ ξ (q) -Φ ξ (z)∥ ≤ max q∈Qz ∥q -z∥ ≤ 2µ . □ 2. For two matrices A and B of size n × m, A ⊙ B is the n × m matrix C such that Cij = AijBij.
We can notice, that the quantization on S n is non-uniform. Since the encoding process involves quantizing spherical coordinates φ 1 , ..., φ n-1 using a dense lattice, the finest quantization resolution concentrates near the poles of S n and the coarsest close to the equator. This characteristic must be taken into account when constructing a sufficiently dense encoding that minimizes the maximum quantization error on S n .

Decoding

In essence, the procedure Decode reverses the operations of the procedure Encode, i.e., it maps a sequence Q = (q 1 , ..., q L(λ) ) of points on T ξ back to a sequence Y = (y 1 , ..., y L(λ) ) of points on the hypersphere S n .

For every q ∈ T ξ , let z = Φ -1 ξ (q) be restricted to the hyperbox n i=1 [0, 2πξ j ). Then, the rescaled version of z defined as

z ′ = [z 1 /ξ 1 , ..., z n /ξ n ] T belongs to n j=1 [0, 2π). For i = 1, ..., n -1, if the i -th coordinate of z ′ = [z ′ 1 , ..., z ′ n ]
T is larger or equal to π, we substitute z ′ i by 2π -z ′ i . Finally, we apply the inverse y = γ -1 n (z ′ ) ∈ S n .

Encryption

The enciphering procedure Encrypt scrambles the input sequence of spherical codewords P = (p 1 , ..., p L(λ) ) by performing orthogonal matrix multiplications. The rotation matrices are selected from the group G with regard to a pseudo-random sequence of positive integers r = (r 1 , ..., r L(λ) ), r ℓ ≤ M from the output of RandGen. The procedure can be expressed as:

Encrypt r (P ) = (Select G (r 1 ) • p 1 , Select G (r 2 ) • p 2 , ..., Select G (r L(λ) ) • p L(λ) ), (4.14)
where Select G (r ℓ ) is some deterministic and injective function which chooses one of the M matrices from G. The selection of matrices from the group G can be realized efficiently by taking advantage of the isomorphism between G and the cubic lattice

Z d 1 ⊕...⊕Z d k , where d 1 •....•d k = M .
The principle of the procedure Encrypt is analogous to enciphering using a binary stream cipher. The only substantial difference is the cardinality of possible values in the pseudo-random sequence. Consequently, the secrecy of the procedure in the presence of an eavesdropper should depend only on the quality of the pseudo-random generator. The well-known secrecy properties of enciphering by binary stream ciphers [START_REF] Katz | Introduction to modern cryptography[END_REF] are extended to non-binary ciphers in Lemmas 4.6.2 and 4.6.3. Furthermore, Lemma 4.6.4 demonstrates that an eavesdropper cannot get any partial information from the ciphertext (i.e., to approximate the plaintext value).

Lemma 4.6.2. Let C = Gσ be a spherical commutative group code of order M with the initial vector σ ∈ S 2n-1 , and associated with a commutative group of orthogonal matrices G. Moreover, let TrueRandGen(λ) be a function which outputs true random entropy r $ ← -{1, ..., M } L (λ) obtained by an entropy collector, where $ ←denotes a uniformly distributed probabilistic process assignment. Then, the encryption scheme Π = (TrueRandGen, Encrypt, Decrypt) with messages of fixed length L(λ) is perfectly secret.

Proof.

Let P be a random variable such that Pr(P = P ) is the probability of selecting the vector of plaintext codewords P , and let U be a random variable such that Pr(U = U ) denotes the probability of obtaining the encrypted vector of codewords U = Encrypt r (P ). Recalling Definition 4.4.2, the scheme Π would be perfectly secure if for every vector of codewords P chosen with any probability distribution, and every vector of encrypted codewords U , it holds that:

Pr(P = P | U = U ) = Pr(P = P ).

We will firstly prove that given a uniformly random vector r $ ← -TrueRandGen(λ), each u ℓ ∈ U can be any codeword of C with uniform probability. Then, we will show the mutual independence of u 1 , ..., u L(λ) , resulting in U being a vector of uniformly random codewords from C for any distribution of P. Finally, we will prove the perfect secrecy of Π.

Let Select G (r ℓ ) = G r ℓ . Since p ℓ , u ℓ ∈ C , there exists G w ℓ ∈ G such that p ℓ = G w ℓ σ and u ℓ = G r ℓ G w ℓ σ. It is enough to show, that G enc,ℓ = G r ℓ G w ℓ
can be any element of G with uniform probability. The group of orthogonal matrices G with multiplication operation is isomorphic to Z = Z d 1 ⊕ ...⊕Z d j with addition operation, where d i ∈ N and d 1 •....•d j = M . Therefore, G w ℓ , G r ℓ , G enc,ℓ can be isomorphically mapped to s w ℓ , s r ℓ , s enc,ℓ ∈ Z, where s r ℓ + s w ℓ = s enc,ℓ . Let X ℓ : Ω X ℓ → Z and Y ℓ : Ω Y ℓ → Z be independent random variables such that X ℓ has a uniform distribution over Z and Y ℓ has the same probability distribution as P. We have:

Pr(Encrypt r ℓ (p ℓ ) = G enc,ℓ σ) = Pr(X ℓ + Y ℓ = s enc,ℓ ) = M m=1 sn∈An-sm Pr(X ℓ = s m ) Pr(Y ℓ = s n ) = M m=1 sn∈An-sm 1 M Pr(Y ℓ = s n ) = 1 M M m=1 sn∈An-sm Pr(Y ℓ = s n ) = 1 M ,
where A n -s m = {s n ∈ Z : s n + s m = s enc,ℓ }.

We have yet to show the statistical independence. For X ℓ , Y ℓ defined as before, let Z ℓ = X ℓ +Y ℓ . Z ℓ are mutually independent if and only if:

Pr[Z ℓ = s k ℓ | (Z 1 = s k 1 )∧...∧(Z ℓ-1 = s k ℓ-1 )∧(Z ℓ+1 = s k ℓ+1 )∧...∧(Z L(λ) = s k L(λ) )] = Pr(Z ℓ = s k ℓ ). Let [(Z 1 = s k 1 ) ∧ ... ∧ (Z ℓ-1 = s k ℓ-1 ) ∧ (Z ℓ+1 = s k ℓ+1 ) ∧ ... ∧ (Z L(λ) = s k L(λ)
)] be denoted by B ℓ,k . Then, for any 1 ≤ ℓ ≤ L(λ) we have:

Pr(Z ℓ = s k ℓ | B ℓ,k ) = Pr(X ℓ + Y ℓ = s k ℓ | B ℓ,k ) = M m=1 sn∈An-sm Pr(X ℓ = s m | B ℓ,k ) Pr(Y ℓ = s n | B ℓ,k ) = M m=1 sn∈An-sm Pr(X ℓ = s m ) Pr(Y ℓ = s n | B ℓ,k ) = M m=1 sn∈An-sm 1 M Pr(Y ℓ = s n | B ℓ,k ) = 1 M = Pr(Z ℓ = s k ℓ ),
where A n -s m is defined as before. Finally, we get:

Pr(P = P | U = U ) = Pr(U = U | P = P ) • Pr(P = P ) Pr(U = U ) = Pr(Encrypt r (P ) = U ) • Pr(P = P ) Pr(U = U ) = M -L(λ) • Pr(P = P ) M -L(λ)
= Pr(P = P ).

□

The consequence of Lemma 4.6.2 is that every PPT adversary A has no advantage in the indistinguishability challenge if the matrices from G are selected uniformly at random:

Pr(PrivK eav A, Π(λ) = 1) = 1 2 .
Lemma 4.6.3. Let r = RandGen(s), where RandGen is a pseudo-random generator, s is chosen uniformly at random from {0, 1} l(λ) and r ∈ {1, ..., M } L(λ) . In addition, let C be a spherical commutative group code of order M with the initial vector σ ∈ S 2n-1 and associated with a commutative group of orthogonal matrices G. Then, for any sequence P = (p 1 , ..., p L(λ) ) of codewords p ℓ ∈ C chosen independently from s, the procedure Encrypt r (P ) gives indistinguishable encryptions in the presence of an eavesdropper.

Proof.

Let Π = (RandGen, Encrypt, Decrypt) and Π = (TrueRandGen, Encrypt, Decrypt), where TrueRandGen is a function which outputs true random entropy over {1, ..., M } L(λ) obtained by an entropy collector. We will show that the existence of any PPT adversary gaining a non-negligible advantage in the indistinguishability challenge over the encryption scheme Π implies the existence of a PPT distinguisher that differentiates RandGen from TrueRandGen.

Let A be a PPT adversary who gets a non-negligible advantage in the indistinguishability challenge PrivK eav A,Π and let f be a non-negligible function such that:

Pr(PrivK eav A,Π (λ) = 1) > 1 2 + f (λ).
Moreover, let D be an algorithm which tries to distinguish the outputs of RandGen from TrueRandGen by emulating the indistinguishability challenge with A. The behavior of D is described as follows:

1. D is given a vector r of length L(λ) generated by RandGen or by TrueRandGen.

The algorithm asks

A(1 λ ) to produce two vectors of codewords U 0 = [u 0,1 , ..., u 0,L(λ) ] and

U 1 = [u 1,1 , ..., u 1,L(λ) ],
where u 0,ℓ , u 1,ℓ ∈ C for ℓ = 1, ..., L(λ).

Π(λ) = 1) < 1 2 + f (λ) - 1 2 = f (λ),
what means that D efficiently distinguishes output of RandGen from TrueRandGen, contradicting the pseudo-randomness of RandGen.

□

Lemma 4.6.3 states that the eavesdropper is unable to determine the exact value of any p ℓ ∈ P from the sequence Encrypt r (P ) with a probability significantly higher than a random guess. However, in the case of voice encryption, the attacker is usually satisfied with obtaining the approximation of p ℓ . Lemma 4.6.4 extends the result of Lemma 4.6.3 to a situation where the attacker tries to determine if p ℓ belongs to some subset B ⊂ C of codewords.

Lemma 4.6.4. Let r = RandGen(s), where RandGen is a pseudo-random generator, s is chosen uniformly at random from {0, 1} l(λ) , and r ∈ {1, ..., M } L(λ) . In addition, let C be a spherical commutative group code of order M with the initial vector σ ∈ S 2n-1 and associated with a commutative group of orthogonal matrices G. Then, for any sequence P = (p 1 , ..., p L(λ) ) of codewords p ℓ ∈ C chosen independently from s, for any 0 < ℓ ≤ L(λ), and for any PPT adversary A, there is a negligible function negl such that:

Pr(A(1 λ , p ℓ ∈ B | Encrypt r (P )) = 1) ≤ |B| M + negl(λ),
where B is any subset of C with cardinality |B|, and the probability is taken over uniform choice of s ∈ {0, 1} l(λ) and the randomness of A.

Proof.

Let us assume a PPT adversary A who can efficiently estimate p ℓ for some fixed ℓ, i.e., there exists a non-negligible function f such that:

Pr(A(1 λ , p ℓ ∈ B | Encrypt r (P )) = 1) > |B| M + f (λ),
We will show that we can construct an adversary A * who violates the indistiguishability of encryptions of the scheme Π = (RandGen, Encrypt, Decrypt). Let I B , I C /B be the sets of all vectors of codewords in C of length L(λ) whose ℓ -th codeword belongs respectively to B or to C /B. Then, let us define the behavior of A * playing the indistiguishability challenge:

1. A * chooses at random P 0 from I B and P 1 from I C /B .

Upon reception of the encrypted vector

U , A * invokes A(1 λ , p ℓ ∈ B | U ) 3. A * forwards the output of A as b ′ .
The adversary A is PPT, hence A * is also PPT. In addition, A * succeeds if and only if A outputs b. Therefore, we obtain:

Pr[PrivK eav A,Π (λ) = 1] = Pr[A(1 λ , p ℓ ∈ B | Encrypt r (P b )) = b] = = 1 2 Pr P 0 ←I B [A(1 λ , p ℓ ∈ B | Encrypt r (P 0 )) = 1] + 1 2 Pr P 1 ←I C /B [A(1 λ , p ℓ ∈ B | Encrypt r (P 1 )) = 0] > > 1 2 |B| M + f (λ) + 1 2 M -|B| M + f (λ) = 1 2 + f (λ).
It follows that A * efficiently breaks the scheme Π, contradicting indistinguishability of Π.

□

Decryption

The procedure Decrypt is similar to enciphering with the only difference that we take the transpose of the selected matrices before performing the rotation:

Decrypt r (V ) = (Select G (r 1 ) T • v 1 , Select G (r 2 ) T • v 2 , ..., Select G (r L(λ) ) T • v L(λ) ), (4.15) where V = (v 1 , ..., v L(λ)
) is a sequence of points on the flat torus T ξ (not necessarily codewords).

Lemma 4.6.5.

Let v 1 , v 2 ∈ T ξ . We have ∥v 1 -v 2 ∥ = ∥Decrypt r (v 1 ) -Decrypt r (v 2 )∥
, where ∥ • ∥ denotes the Euclidean metric.

Proof.

Let Decrypt r (v 1 ) = q 1 and Decrypt r (v 2 ) = q 2 . There exist

G d ∈ G such that v 2 = G d v 1
and q 2 = G d q 1 , and two matrices G v , G q ∈ G such that v 1 = G v σ and q 1 = G q σ. We have:

∥v 1 -v 2 ∥ = ∥G v σ -G d G v σ∥ = ∥σ -G d σ∥ = ∥G q σ -G d G q σ∥ = ∥q 1 -q 2 ∥.

□

The deciphering procedure is distance-preserving in the Euclidean metric, as demonstrated by Lemma 4.6.5. However, we are often more concerned about the distance relations resulting from the composition of the procedures Decrypt and Decode.

Let

p, q ∈ Π n-1 i=1 [0, πξ i ) × [0, 2πξ n ) and let γ ξ,n (z) = γ n (z ⊙ ξ). The Euclidean distance ∥γ -1 ξ,n (p) -γ -1 ξ,n (q)∥ is bounded by: 0 ≤ ∥γ -1 ξ,n (p) -γ -1 ξ,n (q)∥ = (4.16) = 2 -2 n i=1 cos(u i ) cos(v i ) i-1 j=1 sin(u j ) sin(v j ) -2 n i=1 sin(u i ) sin(v i ) ≤ (4.17) ≤ ∥p -q∥ ξ min . (4.18)
The above bounds relate the metric in the hyperbox Π n-1 i=1 [0, πξ i ) × [0, 2πξ n ) with the metric on the hypersphere S n . We already know from Equation 4.13, that: ∥Encrypt r (Φ ξ (p)) -Encrypt r (Φ ξ (q))∥ < δ =⇒ ∥Decode(p) -Decode(q)∥ < π 2ξ min δ for δ > 0 not too large. On the other hand, from (4.17) we get that the distance ∥γ -1 ξ,n (u)-γ -1 ξ,n (v)∥ goes down to 0 when approaching the poles of the hypersphere S n . Consequently, we may notice that the vectors near the poles of S n should be relatively less distorted by a transmission channel than the vectors close to the equator.

2 π ∥p -q∥ ≤ ∥Φ ξ (p) -Φ ξ (q)∥ ≤ ∥p -q∥,

Transmission over the Gaussian channel

Spherical commutative group codes described in this chapter can be viewed as equal-energy block codes with constant average power, and used as error-correction codes adapted for transmission over noisy channels [Slepian, 1968]. In this work, we want to investigate the impact of channel noise on reception error and symbol decoding. In contrast to classical digital communications, some detection error is acceptable. In the optimal scenario, a growing noise level should gradually increase the level of detection errors. However, a significant noise may break this desired continuity between transmission and detection errors, severely disrupting the communication.

Let u ∈ C be an encrypted codeword sent over the Gaussian channel. Upon reception, the recipient observes v = u + n, where n represents channel noise sampled from Gaussian distribution with zero mean. Provided that the enciphered vector u can be any codeword of C with equal probability, the maximum likelihood detector selects the closest codeword in C in terms of the Euclidean metric. Moreover, due to the uniform geometrical distribution of codewords on the sphere, the error probability of the optimal detector is the same for every sent codeword. This property turns out to be very useful in the context of this work because the deciphering error caused by Gaussian noise is statistically independent of the ciphertext.

Before decryption, the received codeword v = [v 1 , ..., v2n ] should be projected to v = Gσ on the flat torus T ξ . The rotation matrix G is of the form:

      Rot(α 1 ) 0 ... 0 0 Rot(α 2 ) ... 0 . . . . . . . . . . . . 0 0 ... Rot(α n )       2n×2n
where α 1 , α 2 , ..., α n are some unknown rotation angles. Assuming a Gaussian noise, the vector v = [v 1 , ..., v 2n ] T can be found by projecting the coordinates of v onto the respective circles of

radius σ 2 2i-1 + σ 2 2i : [v 2i-1 , v 2i ] T = [v 2i-1 , v2i ] T σ 2 2i-1 + σ 2 2i v2 2i-1 + v2 2i , i = 1, ..., n. (4.19)
The projection of v onto v is an additional source of error which is difficult to tackle. When the noise level is small, however, the overall distortion caused by the operation is limited. Another situation may occur, when the distance ∥v -u∥ overreaches ξ min . In such a case, v may be projected on the opposite side of the torus T ξ , leading to a high error as illustrated in Figure 4.5. A possible solution to this problem is to increase the energy of the transmitted vectors.

Scrambling of image colors

The enciphering scheme described in this chapter is designed for audio-visual data represented using spherical coordinates. This section presents a simple distortion-tolerant encryption model for scrambling colors in an image to illustrate the encoding scheme detailed in the previous sections.

Color of an image pixel is usually represented in the RGB model as a sum of additive primary colors: red, green, and blue. In computer graphics and related domains, alternative representations of the RGB model may be more suitable for encoding and color-related transformations. For example, one may consider a modification of the popular HCL (hue, chroma, lightness) representation [START_REF] Zeileis | Escaping RGBland: Selecting colors for statistical graphics[END_REF]:

L = max(R, G, B) + min(R, G, B) -1, (4.20) C = max(R, G, B) 2 -min(R, G, B) 2 , (4.21) H ′ =              0 if C = 0 G-B C mod 6 if max(R, G, B) = R, B-R C + 2 if max(R, G, B) = G, R-G C + 4 if max(R, G, B) = B, (4.22)
where R, G, B ∈ [0, 1]. The colorspace in the (L, C, π/3H ′ ) representation can be illustrated as a 3D ball of radius one centered at the origin (Fig. 4.6). The north and the south poles of the sphere represent respectively white and black, whereas the equator contains all the colors with maximum chroma C. Moreover, as we approach the center of the sphere, the intensity of all the colors fade to grey. Since the proposed enciphering scheme requires spherical data, the (L, C, H ′ ) representation may be expressed in spherical coordinates: In the following toy example, we will scramble the angular coordinates (Υ, H) of pixels in an image of size L = 384 × 512 pixels presented in Figure 4.7a, and transmit these enciphered codewords over a Gaussian channel. We will assume the parameter I is sent unencrypted over a secret channel without errors for the simplicity of the example.

I = L 2 + C 2 , (4.23) Υ =    0 if C = 0, arctan L C + π
Let X = (x 1 , ..., x L ) be a sequence obtained by reading the image pixels by rows and discarding the modulus I. Pixels are represented in the Cartesian coordinate system by Finally, we map the quantized vectors using a torus map Φ ξ , where ξ = [1, 1] T / √ 2. We obtain a sequence P = Encode(X) of codewords from a spherical group code C = Gσ of order 2 31 , where σ = [1, 0, 1, 0] T / √ 2 is the initial codeword, and G is a group of rotations associated with the quotient Λ/(2πZ 2 ). The group G is isomorphic to Z 2 15 ⊕ Z 2 16 and has two 4 × 4 generator matrices:

x ℓ = [cos(Υ ℓ ), sin(Υ ℓ ) cos(H ℓ ), sin(Υ ℓ ) sin(H ℓ )] T ∈ S 2
G 1 = Rot(2π/2 15 ) 0 0 Rot(0) and G 2 = Rot(2π/2 16 ) 0 0 Rot(2π/2 16
) .

The sequence P = [p 1 , ..., p L ] T is scrambled using two independent generators PRNG A and PRNG B with different seeds s A and s B , which were instantiated in our toy example by a builtin NumPy 3 random integer sequence generator. The first generator outputs numbers in the range {1, ..., 2 15 } and the second in the range {1, ..., 2 16 }, resulting in 31 bits of random data. Given some pairs of random numbers (r A,ℓ , r B,ℓ ) produced by the generators, the scrambling procedure is described by

u ℓ = G r A,ℓ 1 G r B,ℓ
2 p ℓ . All scrambling operations are summarized in Algorithm 2. Figure 4.7b depicts the scrambled image obtained by performing the procedure Decode on the enciphered sequence U and restoring the initial modulus I. Despite the seemingly random colors of the pixels, a careful observer may notice some intensity leakage from I, which apparently keeps some shape information in the encrypted image.

3. https://numpy.org/ Figure 4.8 illustrates several images restored from scrambled codewords U distorted by Gaussian noise with signal-to-noise ratio (SNR) equal to 20 dB and 10 dB. The inserted noise introduces granularity into the deciphered image, similar to salt-and-pepper noise or speckle-noise in synthetic aperture radar (SAR) images [Lee, 1981]. Nonetheless, even at high noise intensity, a traditional Korean building, a tree, and three persons shown in the picture are easily recognizable. The quality of a descrambled image is directly related to the error introduced by noise. Let U = (u 1 , ..., u L ) be a sequence of scrambled spherical codewords representing the angular coordinates (Υ, H) of image pixels, V = (v 1 , ..., v L ) be a sequence of received spherical points projected onto the flat torus T ξ , and Y = (y 1 , ..., y L ) be a sequence of descrambled spherical points in R 3 . Figure 4.9 displays the errors ∥x ℓ -y ℓ ∥ and ∥u ℓ -v ℓ ∥ of first 100 codewords, caused by Gaussian noise at SNR = 15 dB. It can be noticed that ∥x ℓ -y ℓ ∥ is usually slightly larger than ∥u ℓ -v ℓ ∥.

Figure 4.10 displays the sample root mean square error (RMSE) of X and U caused by Gaussian noise at SNR between 5 dB and 25 dB with a 0.5 dB step. The statistics are defined as:

RMSE X = L ℓ=1 ∥x ℓ -y ℓ ∥ 2 L , (4.27) RMSE U = L ℓ=1 ∥u ℓ -v ℓ ∥ 2 L . ( 4
(r A,ℓ , r B,ℓ ) ←-(PRNG A (s A ), PRNG B (s B )); u ℓ ←-G r A,ℓ 1 G r B,ℓ
2 p ℓ ; // append the enciphered codeword to U U ←-append(U, u ℓ ); end

Summary

This chapter presented a novel technique for scrambling spherical points on S n , using a spherical code on a flat torus. Enciphering is done by performing random rotations from a commutative group of 2n × 2n orthogonal matrices isomorphic to quotients of nested lattices with efficient decoding algorithms.

The use of geometrically uniform spherical codes and commutative rotations makes encrypted data particularly suitable for transmission over a communication channel. Moreover, robust deciphering of ciphertexts distorted by the channel may be advantageous when a small inconsistency between the initial and decrypted information is acceptable.

The encryption scheme gives indistinguishable encryptions in the presence of an eavesdropper when rotation matrices are chosen based on the output of a non-binary pseudo-random generator with a fresh secret seed. However, the ciphertexts are malleable by design, and the scheme does not offer any data integrity.

The technique has been illustrated by scrambling colors in an image. The introduction of Gaussian noise with varying intensity to the ciphertext caused a gracefully progressive degradation of the decrypted image quality. Nevertheless, the main content of the image remained well preserved even in the presence of significant noise. These promising results suggest that the presented scheme would be suitable in other audio-visual applications that prioritize information content over quality (i.e., speech intelligibility versus speech quality).

Some further investigation of the encryption scheme would be beneficial. Firstly, the quantization of spherical points on S n is non-uniform, with the finest resolution near the hypersphere's poles and the coarsest resolution near the equator. This non-uniformity leads to a suboptimal allocation of bits used for the representation of vectors on the hypersphere. Furthermore, a more balanced codeword distribution could reduce the amount of randomness required by the enciphering block and help to predict the impact of channel noise on decryption error.

Another goal to pursue would be the construction of spherical codes with high density and a simple structure in any selected dimensions. The use of dense lattices in the construction does not necessarily imply high density for the associated spherical codes.

Finally, it would be worthwhile to propose some data-integrity mechanism that allows the recipient to detect unacceptable ciphertext modifications from a malicious attacker in the presence of channel distortion. Despite the lack of strong security guarantees, such a mechanism could be useful in real-time or near real-time applications when the attacker has little time to carry any sophisticated attack.

Chapter 5 presents an experimental speech encryption scheme for secure voice communications, which enciphers data using spherical commutative group codes. The scheme scrambles independently three parameters of speech signals: energy, pitch and spectral envelope, and produces a speech-like signal adapted for transmission over voice channels. The system is capable of decrypting vocal parameters distorted by voice channels. The reconstruction of the initial speech is achieved by a vocoder with trained neural networks.

CHAPTER 5

Distortion-tolerant speech encryption

This chapter presents an experimental distortion-tolerant speech encryption scheme for secure voice communications over voice channels that combines the robustness of speech scramblers and a higher security level offered by digital ciphers. The system scrambles vocal parameters of a speech signal (energy, pitch, spectral envelope) using the spherical commutative group codes described in Chapter 4, and outputs a pseudo-speech signal robust against channel distortion or signal compression. Initial speech is reconstructed using a synthesizer based on the LPCNet architecture. The decrypted speech quality depends on channel distortion without experiencing cliff effects with a sudden loss of digital signal reception, which is typical in the digital domain. The encryption scheme is thoroughly detailed, emphasizing design constraints, operational characteristics, security, robustness against distortion, and computational complexity. The simulations are supported by real-world experiments. The encrypted signal was successfully transmitted over FaceTime between two mobile phones, and a group of about 40 listeners evaluated the perceptual quality and intelligibility of decrypted speech. The results are thoroughly described and analyzed.

92

CHAPTER 5 -Distortion-tolerant speech encryption Notation -enciphering and deciphering v scrambling vector of length 10 ρ (init) , ρ (dec) integers representing initial and deciphered frame energies ρ (enc) , ρ (rec) integers representing enciphered and received frame energies κ (init) , κ (dec) integers representing initial and deciphered pitch periods κ (enc) , κ (rec) integers representing enciphered and received pitch periods χ (init) , χ (dec) vectors in R 8 representing initial and deciphered spectral envelopes χ (enc) , χ (rec) vectors in R 8 representing enciphered and received spectral envelopes ρ low , ρ high bounds of ρ (init) and ρ (dec) κ low , κ high bounds of κ (init) and κ (dec)

Motivation

Early systems for secure voice communication relied on analog signal scrambling in time and frequency domains. Their role was to obscure a conversation by making the speech signal unintelligible for interceptors [Kak, 1983, MacKinnon, 1980]. Although unsecure [Goldburg et al., 1993, Zhao et al., 2007], analog-domain techniques had two crucial advantages over emerging digital systems based on enciphering compressed speech. Firstly, they offered high speech quality at the receiving end, compared with suboptimal low-bitrate digital voice compression and synthesis. Secondly, the scrambled speech signal was exceptionally robust against distortion introduced by telephone lines because transmission noise was linearly added to the reconstructed speech.

In the late 70s and the early 80s, researchers attempted to combine the robustness of analog scrambling and the security offered by rigorous digital enciphering. The result was a new class of transform-domain scramblers that performed digital scrambling of linearly transformed speech samples [Kak, 1983]. Since all transformations done on speech samples were norm-preserving, the noise energy introduced into the ciphertext did not expand after decryption. The first transformdomain scrambler that was exploiting approximately band-limited prolate spheroidal sequences [START_REF] Slepian | Prolate spheroidal wave functions, Fourier analysis and uncertainty-I[END_REF] was presented by Wyner [Wyner, 1979, Kaliski, 1984], and inspired new speech scrambling techniques [Lin-Shan Lee et al., 1984, Goldburg et al., 1993].

This chapter presents an experimental joint source-cryptographic enciphering scheme for secure voice communications over voice channels, which to some extent enjoys the similar distortion-tolerant property of speech scramblers. The lossy enciphering unit scrambles the perceptual speech parameters (loudness, pitch, timbre) of a recorded speech signal using the distancepreserving techniques described in Chapter 4, and produces a synthetic signal adapted for transmission over a voice channel. Upon reception, a recipient who owns a valid cryptographic key restores distorted copies of the original speech parameters and decodes the speech signal with the help of a trained neural vocoder.

The system architecture and its operation is thoroughly detailed, emphasizing security aspects, computational complexity, and robustness to distortion. The scheme operates on speech frames and produces an enciphered signal of equal duration, what can be seen as a strong advantage for making the system working real-time. Moreover, it is justified that encrypted speech is computationally indistinguishable from random when enciphering is done using a secure pseudo-random number generator (PRNG) with a secret seed of a sufficient length.

Simulations and real-world experiments follow the system description. Simulations confirmed the scheme's capability to decode mildly distorted signals. Furthermore, the encrypted speech signal was transmitted over FaceTime between two mobile phones and successfully decrypted. A speech quality assessment with about 40 listeners showed that the proposed encryption scheme produces intelligible speech and is robust against Gaussian noise at SNR = 15 dB and voice compression at bitrate 48 kbps with the Opus-Silk speech coder. Finally, the preliminary computational analysis suggests that the optimized system implementation may run on high-end portable devices. The experimental code used in simulations and speech samples evaluated in the speech quality assessment are available online.1

This chapter is organized as follows. Section 5.2 introduces and details the speech encryption algorithm. Section 5.3 discusses the system's operation and security, and Section 5.4 presents the evaluation results. Finally, Section 5.5 concludes the work and gives future prospects.

Speech encryption scheme

Figure 5.1 illustrates a simplified model of distortion-tolerant speech encryption scheme, consisting of a speech enciphering unit and a complementary deciphering unit. The enciphering unit takes as input a binary key-stream produced by a pseudo-random number generator (PRNG) with a secret seed s of length at least 128 bits, and samples of a narrowband speech signal. In the first processing step, the speech encoder maps 20 ms speech frames indexed by ℓ = 0, 1, 2, ... into a sequence of vocal parameters (ε (init),ℓ , p (init),ℓ , D (init),ℓ ), where ε (init),ℓ corresponds to the frame's energy, p (init),ℓ is a pitch period, and D (init),ℓ is a vector representing the shape of a spectral envelope.

The encoding process is followed by enciphering using randomness produced by the PRNG. Vocal parameters of every frame are independently scrambled into a new set of parameters (ε (enc),ℓ , p(enc),ℓ , D(enc),ℓ ) defined over a new space of pseudo-speech parameters (tagged by a tilde). Finally, the scrambled sequence is forwarded to the pseudo-speech synthesizer, which produces a harmonic, wideband signal resembling pseudo-speech. The synthetic signal is a concatenation of 25 ms frames with a 5 ms overlap, where every frame carries one set of enciphered parameters. Consequently, the encrypted signal duration is the same as the duration of the initial speech, which is an essential requirement in real-time operation. Due to the speech-like properties of the synthetic signal, it can be transmitted over a wideband digital voice channel without much risk of suppression by a Voice Activity Detector (VAD). Upon reception of the signal samples, the paired deciphering unit extracts distorted copies of the sent parameters (ε (rec),ℓ , p(rec),ℓ , D(rec),ℓ ) and performs descrambling using the same binary key-stream produced by its PRNG. In the last step, restored parameters (ε (dec),ℓ , p (dec),ℓ , D (dec),ℓ ) are decoded into narrowband speech, perceptually similar to the input speech signal.

The crucial property of the presented speech encryption system is its ability to descramble enciphered parameters (ε (rec),ℓ , p(rec),ℓ , D(rec),ℓ ) distorted by a voice channel. As the amount of channel distortion goes up, so does the distortion of the resynthesized speech. As a result, we obtain a progressive and controlled speech quality degradation without significant loss of intelligibility. Preservation of intelligibility comes from the remarkable human tolerance to distorted speech signals.

5.2 -5.2.1 Speech encoding 97

Speech encoding

The speech encoder in the presented encryption scheme is essentially a harmonic speech encoder that models speech signals as a combination of amplitude-modulated harmonics. The perceived fundamental frequency of a harmonic speech signal is usually referred to as pitch, perceived signal energy as loudness, whereas the spectral envelope is related to speech timbre.

The encoder operates sequentially on 20 ms speech frames of 160 samples with a 10 ms look-ahead. Every frame is processed in the same manner, so we skip the frame indexation ℓ for simplicity. A speech frame is firstly pre-emphasized with a first-order filter I(z) = 1 -0.85z -1 to boost high-frequency signal components. It is then encoded into a set of 10 basic parameters: a pitch period and an approximation of the spectral envelope expressed by 9 coefficients. The pitch period expressed in samples per cycle is defined as:

p (init) := f s f 0 , (5.1)
where f 0 is the estimated fundamental frequency of the harmonic structure of the speech signal with f s = 8000 Hz being the sampling frequency. The spectral envelope is obtained from the Power Spectral Density (PSD) on a moving window of 40 ms of speech signal with 20-ms offset and 50% overlap. The PSD is windowed using 9 mel-scaled triangular filters shown in Figure 5.2, resulting in 9 band-limited energies E 1 , ..., E 9 such that their sum is close enough to the frame energy:

ε (init) := 9 i=1 E i . (5.2)
It may be noticed that the vector of square roots of energy coefficients [ √ E 1 , ..., √ E 9 ] T can be seen as a point on the non-negative part of the 9-dimensional hypersphere centered at 0. The radius √ ε (init) of the 8-sphere is related to the frame energy, whereas the normalized vector:

D (init) := E 1 /ε (init) , ..., E 9 /ε (init) T (5.3)
corresponds to the shape of the spectral envelope, i.e., speech timbre. Since a typical spectral envelope consists of about 4 formants [START_REF] Rabiner | Theory and applications of digital speech processing[END_REF], it is a reasonable assumption that D (init) should capture the most relevant features in the speech spectrum.

The enciphering procedure requires the encoded pitch period and the signal energy to be bounded by some predefined intervals [p min , p max ] and [ε min , ε max ]. Thus, if p (init) or ε (init) exceed these intervals, they are thresholded to the closest bound. A selection of bounds is a compromise between the dynamic range required for proper speech representation and its sensitivity to distortion. Moreover, the lower energy bound ε min is slightly larger than 0, meaning that the scheme could be unable to register some very low-amplitude sounds.

Enciphering

A blockwise scrambling is applied on the input parameters (p (init) , ε (init) , D (init) ) defined over the space of speech parameters into a new set (p (enc) , ε(enc) , D(enc) ) defined over the space of pseudo-speech parameters. Each of these parameters is critical for maintaining speech intelligibility [Huang et al., 2001, Chap. 2], and hence contains information that could be exploited by a The enciphering of each frame requires a vector of 10 freshly-generated random integers ν = [ν 1 , ... ν 10 ] T , where ν 3 belongs to the additive ring Z 2 15 with 2 15 elements, ν 10 belongs to Z 2 17 , and the remaining coefficients belong to Z 2 16 . These non-uniform ranges of values determine the quantization resolution of the input parameters: p (init) and ε (init) are quantized using 2 16 levels, and the vector D (init) is encoded by one of the 2 128 possible values. Consequently, we obtain a 16-bit quantization per encoded coefficient, which is a reasonable resolution for encoding vocal parameters. The vector ν can be efficiently computed from a sequence of 160 bits produced by the PRNG. Given the random bits, the scrambling block splits the binary sequence into chunks of length 15, 16 and 17 bits, and reads them as unsigned integers. Step 3: κ (enc) and ϱ (enc) are linearly scaled to ε(enc) and p(enc) defined over the space of pseudospeech parameters.

Enciphering of pitch and energy is illustrated in Figure 5.3. The input pitch period p (init) is linearly scaled into an interval [κ low , κ high ] such that 0 < κ low < κ high < 2 16 -1, and rounded to the closest integer κ (init) ∈ Z 2 16 . Similarly, the frame energy in logarithmic scale log 10 (ε (init) ) is transformed to ϱ (init) ∈ [ϱ low , ϱ high ]. Then, the obtained integers κ (init) and ϱ (init) are translated respectively by ν 1 and ν 2 over the additive ring Z 2 16 : κ (enc) = (κ (init) + ν 1 ) mod 2 16(5.4) (5.6) where k = 15 is the scaling factor. The quotient of nested lattices Λ/(2πZ 8 / √ 8) is associated through the torus mapping Φ ξ to a spherical code C = Gσ ⊂ S 15 , where G is isomorphic to

ϱ (enc) = (ϱ (init) + ν 2 )
Λ = 2π 2 k+1 √ 8 Γ 8 ,
Z 2 15 ⊕ Z 6 2 16 ⊕ Z 2 17 and σ = 1/ √ 8[1, 0, ... 1, 0] T ∈ R 16 is the initial codeword in C . Let χ (init)
∈ Λ be the closest lattice vector to 2γ ξ (D (init) ). The vector χ (init) is translated by a random vector:

χ (enc) = χ (init) + ν 3 β 1 + ... + ν 10 β 8 , (5.7)
where β 1 , ..., β 8 are the column vectors of the generator matrix B Λ : is derived from the randomness of the PRNG. Finally, the enciphered vector is mapped to the flat torus D(enc) = Φ ξ (χ (enc) ).

B Λ =               2π/2 15 -
The secrecy properties of D (init) enciphering presented in Chapter 4 remain unchanged due to the equivalence between performing rotations on the flat torus T ξ and translations in the pre-image P ξ , and the isomorphism between the group G and the quotient of lattices Λ/(2πZ 8 / √ 8).

Pseudo-speech synthesis

The last stage of speech encryption involves the synthesis of a 'well-formed' audio signal. The role of audio synthesis is to enable an efficient transmission of the enciphered values (p (enc) , ε(enc) , D(enc) ) over a digital voice channel, and to prevent signal blockage by a VAD. Robust operation requires finding a tradeoff between producing a signal sufficiently speech-like yet simple to encode and decode. Furthermore, the encoding procedure should comply with a typical signal distortion characteristic introduced by a particular channel to benefit from distortion-tolerant enciphering.

Since p(enc) , ε(enc) and D(enc) represent the enciphered pitch period, the energy and the spectral envelope of a speech frame, the natural approach is to relate these values with some homologous parameters of an encrypted signal. Then, a perceptual distortion of the signal would be proportionally mapped to the deciphered speech, to some extent reflecting the quality of the voice channel used for transmission.

Every 25 ms frame of a pseudo-speech signal consists of three segments. The first and the last 5 ms of a frame play the role of guard periods. The remaining 15 ms is where the enciphered parameters are encoded. Once a frame is synthesized, it is windowed by a trapezoidal window and concatenated in an overlap-then-add manner, as illustrated in Figure 5.5.

A 25 ms signal frame y t sampled at f s = 16 kHz contains the samples of a harmonic waveform: ..., 399, (5.8) where ω 0 is the fundamental frequency, A k are the amplitudes of harmonics, η is a real-valued energy scaling factor, (ϕ k -kω 0 /f s • 80) are the initial phases and K (ω 0 ) is the number of harmonics depending on ω 0 . Given the harmonicity of y t , the encoding of p(enc) , ε(enc) and D(enc) essentially reduces to a careful manipulation of ω 0 , A k and ϕ k . In addition, only the middle samples y[80], ..., y[319] are involved in the encoding process. Once the harmonic parameters of the frame are determined, the remaining part of y t is reproduced. The encoding of enciphered parameters into y t is performed sequentially, starting from the pitch, then the shape of the spectral envelope, and finally the energy. The most natural approach for encoding the pitch is to assign ω 0 := 2πf s /p (enc) . Then, one may apply a classical open-loop cross-correlation method [Rabiner andSchafer, 2011, Chap. 10, Gold et al., 2011, Chap. 31] to extract p(enc) back from the received signal. In order to benefit from some off-the-shelf pitch detectors, the value p(enc) should lie within the natural range of pitch values (50 Hz -300 Hz). Spectral shaping involves finding a proper relation between the amplitudes A k and the initial phases ϕ k . Finally, the spectrally shaped frame is scaled to match the desired frame energy ε(enc) = 319 n=80 y 2 [n].

y[n] = K (ω 0 ) k=1 ηA k cos(kω 0 /f s • n + ϕ k -kω 0 /f s • 80), n = 0, 1,
Compared to encoding the pitch and the energy, mapping the vector D(enc) of length 16 into the spectrum of y t seems to be less straightforward. It may be noticed that the fixed pitch and 5. 2 -5.2.3 energy put many constraints on the spectral envelope of the frame and the values ω 0 , A k , and ϕ k . Despite this fact, it is desirable to keep the encoding and the decoding procedures of D(enc) possibly independent from processing the pitch and the energy. Furthermore, it is required that a proper data extraction from y t is possible for any combination of p(enc) , ε(enc) and D(enc) .

In order to overcome these limitations, we propose a slightly modified framework for encoding D(enc) . The encoding process relies on a bank of 16 adjacent spectral windows, illustrated in Figure 5.6. The main idea of using these spectral windows is to encode each coordinate of D(enc) into a frequency band associated to its respective spectral window. Unlike in speech encoding, the windows are square-shaped, and linearly distributed between the 300-6700 Hz range. The proposed selection of spectral windows aims to improve transmission robustness over a voice channel rather than to capture the perceptually relevant spectral features. As a result, the proposed framework is similar to using Frequency Division Multiplexing (FDM) [START_REF] Weinstein | Data transmission by frequency-division multiplexing using the discrete fourier transform[END_REF] for mitigating frequency fading.

Another difference is related to how the spectral windows are applied. Instead of windowing the signal PSD as is the case in speech analysis, the windows are directly applied on the Discrete Fourier Transform (DFT) of sampled y t . As will be explained later in the section, this change significantly simplifies the encoding process. Besides, it seems better suited for data transmission over channels with an additive, independent noise such as AWGN because distortion would linearly map to D(enc) .

Shaping the spectrum of the harmonic frame y t can be achieved by a simultaneous manipulation of the amplitudes and the initial phases of the harmonics. Thus, it is advantageous to consider a complex-domain rewriting of y t , in which the amplitude A k and the initial phase ϕ k are merged into a single complex term Ǎk = A k exp(jϕ k ):

z[n] = K (ω 0 ) k=1 Ǎk exp(n • jkω 0 /f s ), n = 0, 1, ..., 239.
(5.9)

The Let Z be the column vector representing the DFT of samples z[0], ..., z[239]. The vector Z is a sum of harmonic components: (5.10) where B (ω 0 ),k is a row vector representing the DFT of complex sinusoidal samples exp(j2πnω 0 /f s ) for n = 0, 1, ..., 239. The goal of the encoding process is to find Z = [Z 1 , ..., Z 240 ] T such that: ..., 16, (5.11) where

Z = K (ω 0 ) k=1 Ǎk B T (ω 0 ),k ,
D(enc),k • e j 2π 16 k = 240 n=1 Z n H k,n , k = 1,
H k = [H k,1 , ..., H k,240
] is a row vector representing the k-th spectral window sampled at frequencies n 240 • f s for n = 0, 1, ..., 239. As a result, each element of D(enc) is represented by a complex sum of windowed DFT samples. The predefined component exp(j2kπ/16) is inserted to prevent the result of summation from being purely real and improve the time-domain waveform shape of the synthesized pseudo-speech frame.

The summations in 5.10 and 5.11 can be expressed conveniently in a matrix form: (5.12) where W 16 = [e j 2π 16 1 , e j 2π 16 2 , ..., e j 2π 16 16 ] T is the vector of the 16 roots of unity, H is a 16 × 240 matrix representing 16 spectral windows sampled over the frequency domain of Z, B (ω 0 ) is a 240 × K (ω 0 ) matrix with columns B (ω 0 ),k , Ǎ is the column vector of K (ω 0 ) complex amplitudes Ǎk as defined by (5.9), and ⊙ denotes the Hadamard product. As a result, we obtain a simple, linear relation between D(enc) and the amplitudes of harmonics:

D(enc) ⊙ W 16 = HZ and Z = B (ω 0 ) Ǎ,
D(enc) ⊙ W 16 = HB (ω 0 ) Ǎ (5.13)
The problem of finding Ǎ such that Equation 5.13 holds is under-determined, because K (ω 0 ) is larger than 16 by design. Instead, we can compute the least-square solution using the Moore-Penrose pseudo-inverse: Ȃ = (HB ω 0 ) † ( D(enc) ⊙ W 16 ) (5.14) 5. 2 -5.2.4 Signal transmission and analysis 103 where (•) † denotes the pseudo-inverse operation. In order to improve computational efficiency, the pseudo-inverse matrix (HB ω 0 ) † can be pre-computed and kept in a look-up table.

The least-square solutions obtained by the Moore-Penrose pseudo-inverse imply that the computed magnitudes | Ȃk | are small. It has a positive impact on the time-domain waveform shape, minimizing the risk of producing high-amplitude peaks that are likely to be clipped during transmission. Another advantage of the pseudo-inverse is its fast computation, suitable for real-time processing.

Finally, we assign A k := | Ȃk | and ϕ k := Arg( Ȃk ), and set the energy scaling factor η in Equation 5.8 to match the desired energy ε(enc) .

The remaining issue is extracting D(enc) from y t . The previously described encoding process involved complex samples z[0], ..., z[239], where y[80 + n] = ηℜ (z[n]) and η is the previously computed scaling factor. Let Y be a column vector representing the DFT of samples y[80], ..., y[319] computed over 240 points. From the general properties of Discrete Fourier Transform we have: ..., 240, (5.15) where Z241-n denotes the complex conjugate of Z 241-n . Provided that Z is a sum of complex sinusoids of frequency no larger than 6700 Hz, the values Z n for n > 120 are close to zero. As a result, we can approximate the vector Y as:

Y n = η 2 (Z n + Z241-n ), n = 1,
Y ≈ η 2 • Z n , for n = 1, ..., 120, η 2 • Z241-n , for n = 121, ..., 240.
(5.16)

Finally, the enciphered vector can be approximately retrieved by taking:

D(enc) ⊙ W 16 ≈ 2 η HY.
(5.17)

We estimated the root mean squared error (RMSE) of D(enc) ⊙ W 16 approximations by simulating a sequence of L = 10000 pseudo-speech frames from parameters (p (enc) , ε(enc) , D(enc) ) selected randomly in every frame. We used the following formula:

RMSE D = L ℓ=1 ∥ D(enc),ℓ ⊙ W 16 -2η -1 ℓ HY ℓ ∥ 2 L ,
where D(enc),ℓ is the ℓ-th encoded vector, Y ℓ is a vector representing the DFT of the ℓ-th produced pseudo-speech frame, and η ℓ is the respective scaling factor. The obtained error was 0.011, far lower than an anticipated distortion introduced by the voice channel.

Signal transmission and analysis

Successful decoding of a synthetic signal produced by the pseudo-speech synthesizer requires a high-precision, nearly sample-wise synchronization. Consequently, the presented speech encryption scheme is foremost suited for digital data storage and transmission over fully digital voice communication systems like VoIP, in which a high level of synchronization can be maintained. Upon reception, the signal analyzer processes sequentially the received signal frames and retrieves enciphered parameters. The vector D(rec) is retrieved from Ŷ in two steps. Firstly, we compute the normalized realvalued sum of the windowed DFT: .20) where W16 = [e -j 2π 16 1 , e -j 2π 16 2 , ..., e -j 2π 16 16 ] T and ℜ(2H Ŷ ⊙ W16 ) is the real component of 2H Ŷ⊙ W16 . Then, the vector D(rec) is projected to D(rec) on the flat torus T ξ using Formula 4.19 in Section 4.6.6.

D(rec) := ℜ 2H Ŷ ⊙ W16 ℜ 2H Ŷ ⊙ W16 , ( 5

Deciphering

Given the set of received parameters (p (rec) , ε(rec) , D(rec) ), the descrambling algorithm reverses enciphering operations using the same vector ν = [ν 1 , ..., ν 10 ] T of random integers produced by the PRNG. The values p(rec) and log 10 (ε (rec) ) are firstly linearly scaled to κ (rec) and ϱ (rec) over the interval [0, 2 16 -1]. Unlike in the enciphering stage, these values are not quantized. In the next step, κ (rec) and ϱ (rec) are deciphered by respective translations -ν 1 and -ν 2 modulo 2 16 : κ (dec) = (κ (rec) -ν 1 ) mod 2 16 (5.21)

ϱ (dec) = (ϱ (rec) -ν 2 ) mod 2 16 , ( 5
χ (dec) = χ (rec) -ν 3 β 1 -... -ν 10 β 8 mod 2π √ 8 , ( 5.23)
where β 1 , ..., β 8 are the columns of B Λ , [ν 3 , ..., ν 10 ] T is a random vector obtained from the PRNG, and the modulo operation is done element-wise. Let φ (dec) = √ 8χ (dec) /2. If any of the angles is φ (dec) = [φ (dec),1 , ..., φ (dec),7 ] is larger than π/2, it is replaced by φ (dec),i := π/2 -φ (dec),i . The deciphered spectral envelope vector is D (dec) = γ -1 8 (φ (dec) ).

Speech resynthesis

The output of the descrambling process is a sequence (p (dec),ℓ , ε (dec),ℓ , D (dec),ℓ ) representing harmonic parameters of 20 ms speech frames. The final speech resynthesis is possible with any adapted speech synthesizer supporting harmonic speech parametrization. An example of a suitable narrowband harmonic speech synthesizer is Codec2. 2 Unfortunately, although parametric sinusoidal speech coders succeed in producing intelligible speech, they often struggle to maintain satisfactory speech quality. In this work, we improve upon harmonic speech synthesis by using our own modification of the LPCNet, a Machine Learning (ML) based synthesizer introduced by Jean-Marc Valin (Mozilla) and Jan Skoglund (Google LLC) [Valin and Skoglund, 2019]. Unlike the original LPCNet which operates on wideband speech signals sampled at 16 kHz, our modified synthesizer produces narrowband speech signal sampled at 8 kHz. We also modified the input of the LPCNet to make it compatible with the vocal parameters that we use in our speech encryption algorithm. Finally, we extended the training procedure of neural networks in order to improve the robustness of the LPCNet against distortion introduced by a voice channel.

The narrowband LPCNet recreates the samples of a speech signal s[n] from a sum of the linear prediction s[n] and the excitation e[n]:

s[n] = s[n] + e[n]
(5.24)

s[n] = 12 k=1 α k s[n -k],
(5.25)

where α 1 , ..., α 12 are the 12-th order linear prediction coefficients (LPC) for the current frame.

The excitation samples e[n] are produced by two concatenated neural networks that model an excitation signal from the input vocal parameters. Figure 5.7 depicts a simplified diagram of the modified narrowband LPCNet algorithm. The speech synthesizer combines two recurrent neural networks: a frame-rate network processing 20 ms speech frames (160 samples) and a sample-rate network operating at 8 kHz. Network architectures are presented in Figure 5.8. The frame-rate network takes as input the sequence of feature vectors computed from (p (dec),ℓ , ε (dec),ℓ , D (dec),ℓ ) and produces a sequence of frame-rate conditioning vectors f ℓ of length 128. Vectors f ℓ are sequentially forwarded to the sample-rate network and padded with last value to get a frame with 160 samples.

The role of the sample-rate network is to predict the multinomial probability distribution of the current excitation sample Pr(e[n]), given the current conditioning vector f ℓ , the previous signal sample s [n-1], the previous excitation sample e [n-1] and the current prediction s[n]. The current excitation sample e[n] is obtained by randomly generating a single sample from Pr(e[n]). The synthesis output of the narrowband LPCNet are pre-emphasized speech samples s

[n] = s[n]+e[n],
filtered with a de-emphasis filter J(z) = 1 1-0.85z -1 . The operation of the narrowband LPCNet algorithm stops when the last feature vector is processed, and the sample-rate network synthesizes the last speech frame.

Computing a feature vector from a set of vocal parameters (p (dec),ℓ , ε (dec),ℓ , D (dec),ℓ ) requires few steps. Let E ℓ = ε (dec),ℓ •D (dec),ℓ ⊙D (dec),ℓ be a vector representing 9 band-limited energies of the ℓ-th encoded speech frame. Then, the ℓ-th feature vector has the form [C ℓ,0 , C ℓ,1 , ..., C ℓ,8 , ρ ℓ ] T , where C ℓ,0 , C ℓ,1 , ..., C ℓ,8 is the discrete cosine transform (DCT-II) of the sequence log 10 (E ℓ,1 ), ..., log 10 (E ℓ,9 ), and where ρ ℓ = (p (dec),ℓ -100)/50 is the scaled pitch period. Taking into consideration the mel-scaled distribution of spectral windows used in the speech encoder, the coefficients C ℓ,0 , C ℓ,1 , ..., C ℓ,8 can be viewed as 9-band Mel-Frequency Cepstral Coefficients (MFCC).

The prediction samples s[n] are computed from the predictor coefficients α1 , ..., α12 obtained from E ℓ and updated for every frame. The mel-scaled windowed energies in E ℓ are firstly interpolated into a linear-frequency PSD and then converted to an autocorrelation using an inverse FFT. The LPC coefficients are obtained from the autocorrelation using the Levinson-Durbin algorithm [Makhoul, 1975].

Figure 5.8 -Architectures of the frame-rate (left) and the sample-rate (right) networks. The frame network consists of two convolutional layers with a filter of size 3, followed by two fullyconnected layers. The output of the convolutional layers is added to an input connection. The sample-rate network firstly concatenates four inputs and passes the resulted combination to two gated recurrent units (GRU A of size 384 and GRU B of size 16), followed by a dual fully connected layer [Valin and Skoglund, 2019]. The output of the last layer is used with a soft-max activation.

-Discussion

107

Obtaining αk from the low-resolution bands is different than in the classical approach, in which the autocorrelation and the predictor α k are computed directly from speech samples [Rabiner and Schafer, 2011, Chap. 9]. Figure 5.9 displays a frequency response of two predictors obtained from the same pre-emphasized speech frame using both estimation methods. Despite a substantial difference between the responses, the sample-rate network in the narrowband LPCNet learns to compensate, as pointed out in [Valin and Skoglund, 2019]. 0.0 1.0 2.0 3.0 4.0 0 1 2 frequency (kHz) Figure 5.9 -Frequency response of a 12-th order predictor α k derived from the autocorrelation of 160 pre-emphasized speech samples (blue line) and a frequency response of a 12-th order predictor αk derived from the mel-scaled energy bands of the same speech frame by the narrowband LPCNet (red line). Despite the significant difference between the two spectra, the sample-rate network of the narrowband LPCNet is trained to compensate the difference without degrading the speech quality.

Discussion

This section discusses several aspects associated with system security, tolerance to channel distortion, selection of system parameters, and the training the neural networks in the speech synthesizer.

Security considerations

The security of the proposed speech encryption scheme cannot be rigorously proved without an in-depth specification, which may significantly differ in particular implementations. Instead, we provide an informal justification for the asymptotic indistinguishability of encryptions in an experiment comparable with the classical adversarial indistinguishability challenge presented in Definition 4.4.3 in Section 4.4. The encryptions are indistinguishable when a secure binary pseudorandom number generator with a fresh seed taken uniformly at random is adequately implemented.

Let L and l be polynomials, λ be an integer-valued security parameter, x t be an arbitrary speech signal of finite duration t ∈ [0, 320L(λ)), RandGen be a binary pseudo-random number generator and s ∈ {0, 1} l(λ) be a random seed. In addition, let Π = (RandGen, Enc, Dec) be the speech encryption scheme described in Section 5.2, where Enc takes as an input the speech signal x t and a vector r ← RandGen(s) such that r ∈ {0, 1} 160L(λ) , and outputs a synthetic signal y t = Enc r (x t ) of the same duration as x t . Furthermore, let us define an adversarial indistinguishability challenge PrivK eav A,Π (λ):

Definition 5.3.1. The adversarial indistinguishability challenge PrivK eav A,Π (λ) is defined as: 1. The adversary A is given input 1 λ , and he chooses a pair of distinct signals x 0,t , x 1,t of finite duration t ∈ [0, 320L(λ)).

2. A random seed s is chosen and a sequence r is generated by running RandGen(s). The challenge y t = Enc r (x b,t ) is given to A, where b ∈ {0, 1} is chosen uniformly at random. Below we present a proposition for the indistinguishability of encryptions in the presence of an eavesdropper and provide the sketch of the proof.

Proposition 5.3.1. Let Π = (RandGen, Enc, Dec) be the speech encryption scheme described in Section 5.2. There is a negligible function negl such that for any PPT adversary A it holds:

Adv(A(1 λ )) = Pr(PrivK eav A,Π (λ) = 1) - 1 2 ≤ negl(λ).

Sketch of Proof.

Firstly, we can observe that the security of the speech encryption scheme does depend neither on the speech analysis nor the pseudo-speech synthesis algorithms. Indeed, the single output of the speech encoder is a sequence of parameters

{(ε (init),ℓ , p (init),ℓ , D (init),ℓ )} L(λ) ℓ=1 , which is forwarded to the scrambling block. The result of enciphering is a new sequence {(ε (enc),ℓ , p(enc),ℓ , D(enc),ℓ )} L(λ)
ℓ=1 , being the single input of the pseudo-speech synthesizer. In consequence, the indistinguishability of the synthetic pseudo-speech signal y t reduces to the indistinguishability of the enciphered sequence from any sequence taken uniformly at random.

The enciphering of the initial speech parameters is done using a sequence of scrambling vec-

tors {ν ℓ } L(λ) ℓ=1 , where ν ℓ ∈ Z 2 16 ⊕ Z 15 ⊕ Z 6 16 ⊕ Z 17 and {v ℓ } L(λ)
ℓ=1 produced from r by sequentially reading short bitstrings as unsigned integers. We can easily show that if the binary pseudo-random generator RandGen is secure, then the resulting sequence

{v ℓ } L(λ) ℓ=1 is indistinguishable from any sequence {v * ℓ } L(λ)
ℓ=1 produced from a random binary sequence r * ∈ {0, 1} 160L(λ) output by the true entropy collector TrueRandGen.

The rest of the proof essentially repeats the reasoning from Lemma 4.6.2 and Lemma 4.6.3. Let Π = (TrueRandGen, Enc, Dec) be a new encryption scheme. In a first step, we may prove that the result of enciphering

{(ε * (enc),ℓ , p * (enc),ℓ , D * (enc),ℓ )} L(λ) ℓ=1 with a random se- quence {ν * ℓ } L(λ)
ℓ=1 obtained from TrueRandGen is perfectly secure, i.e., the enciphered values {ε * (enc),1 , p * (enc),1 , D * (enc),1 , ε * (enc),2 , ..., D * (enc),L(λ) } are generated independently from uniform distributions over their respective discrete domains. Consequently, we get:

Pr(PrivK eav A, Π(λ) = 1) = 1 2 .
Then, we can show the indistinguishability of the sequence {(ε (enc),ℓ , p(enc),ℓ , D(enc),ℓ )}

L(λ)
ℓ=1 by contradiction: the existence of a PPT adversary A who distinguishes the sequence from purely random with a non-negligible advantage implies the existence of a PPT distinguisher D breaking the security of RandGen. From this, we conclude that there is a negligible function negl such that the advantage of any PPT adversary A participating in the experiment PrivK eav A,Π is at most Adv(A(1 λ )) < 0.5 + negl(λ). 5.3 -5.3.2 Tolerance to signal distortion and large deciphering errors 109 Proposition 5.3.1 states that the encryption scheme produces indistinguishable encryptions in the presence of an eavesdropper, provided that every speech signal is enciphered using a secure pseudo-random bit generator with a fresh and uniformly distributed random seed. However, selecting a proper binary pseudo-random generator is far from being trivial and should be done very carefully. In particular, it is not evident if a 'good' bit generator can always be adequately transformed into a non-binary generator and vice-versa. For instance, in [START_REF] Baigneres | Linear cryptanalysis of non binary ciphers[END_REF] it is shown that a poorly designed non-binary sequence expanded into a bitstream could pass a randomness test by some bit-oriented distinguishers. Some statistical test suitable for checking the randomness of non-binary ciphers can be found in [START_REF] Baigneres | Linear cryptanalysis of non binary ciphers[END_REF], Epishkina, 2018] The selection of a suitable pseudo-random number generator is out of the scope of this work. Nevertheless, some promising candidates of binary pseudo-random number generators can be found in the NIST Special Publication 800-90A [START_REF] Barker | Recommendation for Random Number Generation Using Deterministic Random Bit Generators[END_REF]. Crucially, the presented generators are evaluated for their potential use as non-binary number generators over integer rings Z 2 n , n ∈ N. An example of such a generator uses Advanced Encryption Standard (AES) in the CTR mode of operation and a secret 256-bit seed. The generator is claimed to securely produce up to 2 48 bitstrings of length 2 19 if the input seed is taken uniformly at random. Furthermore, the input seed is updated after every request for backtracking resistance. The maximum bitstring length 2 19 in a unique request is sufficient to encipher more than one minute of one-way voice communication. Finally, a parallelization of bitstring generation provided by the CTR mode is an advantage in real-time operation.

An obvious weakness of the presented scheme is the lack of mechanisms providing data integrity. Since the enciphered speech signal does not include any side information, the recipient cannot verify the source and received data correctness. Moreover, it is not clear whether a reliable data integrity mechanism even exists in this lossy framework, given that the received signal is likely to differ from the initial signal and that malleability-by-design is one of the basic features of the presented speech encryption scheme. Instead, it is important to ensure the proper authentication of the users and secure exchange of cryptographic keys (or secret seeds) before the session starts [START_REF] Canetti | [END_REF]Krawczyk, 2001, Katz andLindell, 2015, Chap. 10]. Some solutions include mutual authentication using public certificates or symmetric pre-shared keys [Rescorla, 2018,Barker, 2020]. This problem is covered in more detail in Chapter 6.

Despite the absence of data integrity in real-time communication, an adversarial manipulation on encrypted speech giving a meaningful deciphered speech is technically challenging. Synthetic signal fragility and high synchronization requirements between the legitimate users suggest that the attacker is more likely to interrupt the communication. However, such an interruption is effectively not much different from signal blockage by a VAD.

If the enciphered speech signal is stored, a binary representation of the signal in PCM or a compressed form should be accompanied by a message authentication code (MAC) [Katz and Lindell, 2015, Chap. 5] computed with a dedicated authentication key.

Tolerance to signal distortion and large deciphering errors

Let y t be an encrypted speech signal sent over a voice channel, and ŷt be the signal received by the recipient. Due to channel distortion, parameters (ε (rec),ℓ , p(rec),ℓ , D(rec),ℓ ) extracted from ŷt usually diverge from the enciphered sequence (ε (enc),ℓ , p(enc),ℓ , D(enc),ℓ ). The transmission error propagates during descrambling, causing a deciphering error between the initial (ε (init),ℓ , p (init),ℓ , D (init),ℓ ) and deciphered (ε (dec),ℓ , p (dec),ℓ , D (dec),ℓ ) values.

CHAPTER 5 -Distortion-tolerant speech encryption

When the distortion is low, transmission and deciphering errors are related by inequalities:

log 10 ε (init),ℓ ε (dec),ℓ ≤ 2 16 ϱ high -ϱ low log 10 (ε max /ε min ) log 10 (ε max /ε min )
• log 10 ε(enc),ℓ ε(rec),ℓ (5.26)

p (init),ℓ -p (dec),ℓ ≤ 2 16 κ high -κ low p max -p min pmax -pmin • p(enc),ℓ -p(rec),ℓ (5.27)
D (init),ℓ -D (dec),ℓ ≤ π √ 2 • D(enc),ℓ -D(rec),ℓ , (5.28)
where | • | is the modulus and ∥ • ∥ denotes the Euclidean norm. In consequence, the deciphering procedure is distortion-tolerant with respect to parameters log 10 (ε (enc),ℓ ), p(enc),ℓ and D(enc),ℓ , with three independent expansion factors.

The distortion-tolerant property with respect to pseudo-speech parameters holds unless the amount of distortion in the received signal ŷt becomes too large. When the values | log 10 (ε (enc),ℓ /ε (rec),ℓ )|, |p (enc),ℓ -p(rec),ℓ | and ∥ D(enc),ℓ -D(rec),ℓ ∥ exceed some specific thresholds, there is a risk of a deciphering error much larger than indicated by the bounds. These large deciphering errors are perceived by the listener as unpleasant flutter degrading the overall perceived speech quality, and should be avoided.

A strong perceptual speech degradation is usually related to large deciphering errors of energy or pitch. In the example depicted in Figure 5.10, a silent speech frame with the energy ε (init) = ε min is enciphered to ε(enc) and sent over a noisy channel in a form of a pseudo-speech frame. Upon reception, the recipient observes ε(rec) such that | log 10 (ε (rec) /ε (enc) )| > ϱ low /2 16 . However, the result of deciphering is ε (dec) = ε max , the exact opposite of the initial value.

It may be noticed that deciphering error making a silent frame maximally loud is more damaging for perceptual quality than suppressing a loud frame into silence. A varying perceptual impact of deciphering errors is the main justification for fine-tuning the guard bounds for pitch and energy. Nevertheless, in order to maintain a robust operation of the enciphering scheme, it is important to ensure experimentally that the values | log 10 (ε (rec),ℓ /ε (enc),ℓ )| and |p (rec),ℓ -p(enc),ℓ | stay within the guard limits with the high probability. When the channel distortion is sub-proportional to the logarithm of signal energy, the risk of a projection going on the wrong side of the torus can be mitigated by increasing the minimum pseudo-speech frame energy εmin . It is because the norm in the denominator of Equation 5.20 goes up when εmin is increased, making the error ∥ D(enc),ℓ -D(rec),ℓ ∥ relatively smaller.

Selection of bounds for the signal parameters

A selection of good bounds for the speech parameters [p min , p max ], [ε min , ε max ], pseudo-speech parameters [p min , pmax ], [ε min , εmax ], and guards [κ low , κ high ], [ϱ low , ϱ high ] is a tradeoff between a sufficient dynamic range for the encoding and a good robustness to channel distortion. When channel distortion is insignificant, the risk of large deciphering errors is nearly negligible. Then, in compliance with Inequalities 5.26-5.28, it is advantageous to enlarge [p min , pmax ] and [ε min , εmax ], and reduce the guard regions. As the distortion goes up, the guard regions and εmin should be adequately increased, and the intervals [p min , p max ], [ε min , ε max ] slightly limited. This can be done adaptively depending on fluctuating channel characteristics.

Another factor is pitch detection accuracy in the pseudo-speech analyzer. Voice-oriented pitch estimators analyze the signal assuming small pitch variation over time [Szczerba andCzyzewski, 2005, Rabiner andSchafer, 2011, Chapter 10]. However, the assumption is not valid in an encrypted signal for which the pitch period changes randomly every 20 ms.

The two most common types of pitch estimation errors in noisy signals are transient errors, and octave errors [START_REF] Beauchamp | Detection of Musical Pitch from Recorded Solo Performances[END_REF]. A transient error occurs when an abrupt change of fundamental frequency within a speech frame violates the stationarity assumption. An octave error describes a situation when the predictor incorrectly outputs a multiple kω 0 or a fraction 1/kω 0 (k ∈ N) of the correct fundamental frequency ω 0 . These errors are mitigated by pitch tracking [Benesty et al., 2008, Chap. 10]. However, since the pitch period in the encrypted signal is uncorrelated in time, pitch tracking seems redundant if not harmful in our case as it would smooth the received values. Instead, it is essential to maintain frame synchronization and ensure that neither the adjacent frames nor the guard periods damage the pitch estimation.

Octave errors usually exceed guard intervals, leading to performance loss. Thus, it may be worth selecting the limits [p min , pmax ] such that pmax ≤ 2p min . For example, [p min , pmax ] = [80, 160] ([ω min , ωmax ] = [100 Hz, 200 Hz]) seems to be a reasonable tradeoff between the range of possible pitch values and the robustness against octave errors.

The narrowband LPCNet training data

The quality of synthesized speech strongly depends on the capability of the narrowband LPCNet algorithm to operate in more imperfect conditions than during the training [Valin and Skoglund, 2019]. As suggested in [START_REF] Oord | Wavenet: A generative model for raw audio[END_REF], it is possible to improve the robustness of the network by adding noise during the training stage.

In our speech encryption scheme, there exist two independent sources of imperfections. The first source is the lower quality of real-world speech recordings taken for encryption, and the second source is channel distortion. Motivated by this fact, the training process of the narrowband LPCNet was divided into two stages. During the two-step training, the ML networks consecutively learn to cope with the non-idealities of speech signals and the transmission channel. Splitting the training overcomes several typical problems with learning convergence as when the network cannot effectively compensate for both kinds of distortion at the same time. Moreover, it seems to be more practical if one considers re-training the network to different channel conditions.

The first training stage is identical to the training process described in [Valin and Skoglund, 2019]. During the training, the network learns to predict the excitation sequence e[n], using as input the previous excitation samples e[n -1], the previous signal samples s[n -1], the current prediction samples s[n] and the frame-rate speech features (9-band Bark-scale cepstral coefficients, pitch). A diagram for producing the training data is shown in Figure 5.12. Except for the frame features, the input data is µ-law quantized by the Q block [ITU-T, 1988f]. The input noise is injected into the speech signal in the µ-law domain to make it proportional to signal amplitude. Noise distribution varies across the training data from no noise to a uniform distribution in the [-3,3] range. This injected noise results in a -10 dB to 30 dB SNR in the speech signals used for training. It can be noticed that the injected noise propagates to all sample-rate input data and thus prevents the undesirable situation when the LPCNet models noise with the same shape as the LPC synthesis filter. Therefore, the training process with injected noise helps the network learn to insert a proper dither noise into a synthesized signal [Jayant andRabiner, 1972, Zorila et al., 2012].

After the first training stage, the network can produce intelligible speech signals from noiseless feature vectors. However, the output of the speech encryption scheme is likely to be distorted. The second stage of the training simulates a scenario when the frame-rate features are transmitted in encrypted form over a voice channel. The input speech signal is fully encrypted with a given random sequence to y t , as illustrated in Figure 5.13. The injected distortion simulates a typical error introduced by a particular voice channel (i.e., Gaussian noise or speech compression). Finally, a distorted signal ŷt is decrypted, and distorted parameters are fed into the network.

-5.3.4 The narrowband LPCNet training data 113

The major issue with the distortion injection model in Figure 5.13 is its computational cost associated with processing the training data. Since channel distortion is independent of the input signal, and the reception error linearly propagates to deciphered values, it is possible to inject distortion directly into the speech parameters, as in Figure 5.14. The distribution of injected distortion simulates channel distortion statistics obtained by simulations or measurements.

The two-stage training of the networks on a GPU card Nvidia Quadro RTX 4000 and using one hour of training speech takes approximately five days. Furthermore, we experimented with the speech quality produced by the synthesizer trained to English or Japanese3 language. The results obtained suggest that the synthesizer should be trained to the language used later for secure communication.

Evaluation

This section presents the test results from some experiments with our speech enciphering algorithm. The tests verify the scheme's capability to decrypt distorted pseudo-speech signals. Furthermore, the section investigates a scenario when the receiver is not fully synchronized in time and amplitude with the sender. The simulations are validated by real-world experiments.

Based on some measurements of a signal distortion introduced by FaceTime and Skype in the audio mode, we estimated the SNR in a typical VoIP-based voice channel to be between 10 dB and 15 dB. On the other hand, similar experiments with 3G networks revealed that signal distortion in cellular networks is much higher, and gives SNR values closer to 3-5 dB. Due to excessive distortion in cellular networks and erratic speech quality, we decided to evaluate our encryption scheme for its compatibility with VoIP-based applications. The robustness of deciphering was evaluated by inserting additive white Gaussian noise (AWGN) into an encrypted signal or compressing the encrypted signal with Opus-Silk 1.3.1 [START_REF] Valin | Definition of the Opus Audio Codec[END_REF]. Opus-Silk was chosen for experimentation because, unlike AMR or Speex, its compression rate can be easily adjusted.

The precomputed encrypted signal was successfully sent over FaceTime between two iPhones 6 running iOS 12 connected to the same domestic WiFi network and decrypted offline. The use of FaceTime on WiFi is justified by high connection stability (limited drop-outs, constant delay) which greatly simplifies signal synchronization at the receiving end. Additionally, the selected speech excerpts reconstructed from encrypted signals were evaluated in a speech quality/intelligibility assessment on a large group of about 40 participants.

The section concludes with computational analysis in Section 5.4.4. The system's computational complexity was estimated by measuring all floating-point operations performed during running our experimental software. The measurements suggest that the computationally optimized encryption algorithm may operate in real-time on high-end portable devices.

Selected initial, encrypted, distorted, and decrypted speech samples are available online. The speech encryption and decryption algorithms were implemented mainly in Python. The speech encoder and the speech synthesizer were obtained from the LPCNet repository 6 and adapted to the scheme. The pitch prediction with tracking for speech was based on open-loop cross-correlation search [Rabiner and Schafer, 2011, Chapter 10], whereas prediction for pseudospeech relies on a more accurate maximum-likelihood estimator 7 without tracking [START_REF] Nielsen | Fast fundamental frequency estimation: Making a statistically efficient estimator computationally efficient[END_REF],Nielsen et al., 2014]. In the simulations, the enciphering stage takes as input a given pseudorandom bitstring produced by a built-in NumPy 8 PCG-64 generator, a 128-bit implementation of Melissa O'Neill's permutation congruential algorithm [O'Neill, 2014]. The narrowband LPCNet was trained in two steps on one hour of speech from the multispeaker TSP English corpus (12 male and 12 female speakers). In the second step of the training, inserted distortion simulated a white Gaussian noise at SNR = 20 dB. Each network was trained for 100 epochs per training step, with a batch consisting of 64 speech sequences of 300 ms. The training was performed on a GPU card Nvidia Quadro RTX 4000 with Keras 9 and Tensorflow 10 using the CuDNN GRU implementation. The selected optimization method was AMSGrad [START_REF] Reddi | On the Convergence of Adam and Beyond[END_REF] with a step size α = α 0 1+δ•b , where α 0 = 0.001, δ = 5×10 -5 and b is the batch number.

Simulations

The first experiment tested the encryption and decryption operations, assuming noise-less transmission. In the example in Figure 5.15, the time-domain envelopes of the initial and the reconstructed speech sentence are very similar. A high degree of similarity can also be observed in the spectrograms presented in Figure 5.16. It may be noticed that the trained speech synthesizer faithfully reconstructs the fundamental frequency and the formants of the initial speech. On the other hand, the encrypted signal in the time and the frequency domains resembles band-limited noise.

Adding distortion into the encrypted signal degrades the decrypted speech. The time-domain envelope of the decrypted speech sentence in Figure 5.17 is still similar to the initial speech but not identical anymore. It may be observed that pseudo-speech decryption has a denoising effect on low-amplitude speech and silence.

The reception and deciphering errors of the same speech sentence are depicted in Figure 5.18. As can be seen, the errors on energy and timbre are non-negligible. However, in contrast to the error |ϱ (init),ℓ -ϱ (dec),ℓ |, the impact of the error ∥D (init),ℓ -D (dec),ℓ ∥ on decrypted speech perception is more unpredictable. Unlike energy and timbre, pitch is very well preserved.

The scheme's robustness has been tested against AWGN at SNR between 5-25 dB and Opus-Silk v1.3.1 compression at bitrates between 28-64 kbps. In each case, the error of received and deciphered parameters were expressed in terms of the RMSE defined as: As shown in Figure 5. 19,RMSE ε,(dec) and RMSE D,(dec) gradually rise when the signal distortion goes up. However, the nearly perfect alignment of RMSE ε,(rec) and RMSE ε,(dec) suggests that the impact of large deciphering errors on energy is statistically negligible. In consequence, the guard bounds (ϱ low , ϱ high ) could be relaxed. Additionally, it can be noticed that the error RMSE D,(rec) is smaller than RMSE D,(dec) . It is because the spherical angles

RMSE ε,(rec) = L ℓ=1 |ϱ (enc),ℓ -ϱ (rec),ℓ | 2 L , RMSE ε,(dec) = L ℓ=1 |ϱ (init),ℓ -ϱ (dec),ℓ | 2
D (dec) = γ -1 8 ( √ 8χ (
dec) /2) are divided by 2 in the decoding stage. The error RMSE p,(dec) remains small for every analyzed distortion. The rarely occurring errors on pitch are usually significant and easy to detect. The observation suggests that a simple pitch tracker added at the output of the descrambling block would overperform guard bounds (κ low , κ high ) as an error correction mechanism.

In a realistic scenario, the receiver is not always perfectly synchronized in time with the sender. Moreover, some voice channels equipped with adaptive gain control (AGC) may modify the signal amplitude. As suggested by Figure 5.20, the deciphering unit is, to some extent, tolerant of energy mismatch in the encrypted signal caused by AGC. Provided that the mismatch is no larger than the energy guard intervals, a modified signal is decrypted into an energy-scaled speech. On the other hand, the deciphering unit is very vulnerable to synchronization error. As shown in Figure 5.21, the error in deciphered timbre rises dramatically when the mismatch exceeds 0.3 ms. Finally, the scheme's robustness was checked over FaceTime on WiFi between two iPhones 6 running iOS 12. The precomputed pseudo-speech excerpts of total duration 120 seconds and enciphered with a predefined pseudo-random sequence were uploaded on one of the phones, sent over FaceTime in chunks about 10-20 second long, and recorded on the second device. Figure 5.22 illustrates an example of the recorded signal and the decrypted speech. Table 5.3 lists the RMSE of received and deciphered parameters retrieved from 120 seconds of a recorded signal.

Speech quality evaluation

As reported in [START_REF] Kleijn | Wavenet Based Low Rate Speech Coding[END_REF], objective measures of speech quality (i.e., PESQ [ITU-T, 2001] and POLQA [ITU-T, 2018]) are suboptimal for evaluating Machine Learning based, nonwaveform vocoders. Consequently, we conducted a subjective listening test on a large number of anonymous volunteers. The tests consisted of two parts. The first part checked the subjective intelligibility of decrypted speech in perfect transmission conditions. The second part assessed the subjective quality of speech restored from an encrypted signal with different distortion types. The subset of speech samples used in the listening test has been selected from the LibriSpeech corpus [START_REF] Panayotov | Librispeech: An ASR corpus based on public domain audio books[END_REF] and is available online. 11

The intelligibility experiment was inspired by the speech intelligibility rating (SIR) [START_REF] Cox | Development of the Speech Intelligibility Rating (SIR) test for hearing aid comparisons[END_REF]. During the test, the participants listened to 10 English sentences (4 female and 4 male speakers) of about 10 seconds each. In the first round, the speech utterances were consecutively encrypted and decrypted, without distorting. In the second round, listeners were given the initial sentences sampled at 8 kHz, which served as the reference. After listening to each speech sample, the participants were asked to estimate the percentage of recognized words in the sen-11. https://github.com/PiotrKrasnowski/Speech_Encryption 5.4 -5.4.3 Speech quality evaluation 123 tence. The ratings were defined as numbers between 0 and 100, where 0 denoted no recognized word and 100 denoted that all words were recognized (Fig. 5.23). As opposed to rigorous, oneword or vowel/consonant intelligibility tests [ITU-T, 2016b], testing the word intelligibility of a sentence allows listeners to take advantage of the context. Because the participants were anticipated to be mostly non-native English speakers, they were allowed to listen to the sentences multiple times.

Figure 5.23 -Rating scale used in the perceptual speech intelligibility test.

The quality assessment followed a MUSHRA methodology [ITU-R, 2015] adapted for perceptual evaluation of medium quality speech signals. The method is believed to provide more reliable and reproducible results than the Mean Opinion Score (MOS) measure [ITU-T, 2016a], although it is not immune to biases either [START_REF] Zielinski | Potential Biases in MUSHRA Listening Tests[END_REF]. In the MUSHRA test, a participant is given several test audio files (called excerpts) which represent the same speech utterance processed by different algorithms. To allow the participant a thorough and unbiased evaluation, these excerpts are given simultaneously and in randomized order. Among these randomized excerpts, some represent the actual speech samples under test, whereas the remaining excerpts are a hidden reference, a low-quality anchor, and a mid-quality anchor. During the quality test, the listeners were asked to rate the subjective speech quality (i.e., naturalness, fidelity) against the reference, as a number between 0 and 100 (Figure 5.24). The value 100 denoted 'Excellent' quality, meaning that the perceived quality of the test excerpt was identical to the reference. The MUSHRA tests were conducted in two rounds. The first round aimed at evaluating the quality of sentences that were consecutively encrypted by our algorithm, distorted by AWGN of varying intensity, and decrypted. In the second round, encrypted signals were compressed by Opus-Silk at varying compression rate. In addition, the test excerpts in the second round included speech utterances decrypted from the signal sent over FaceTime and recorded on iPhone 6. In both rounds, the participants had to rate 6 different sentences (3 female and 3 male) of about 10 seconds each. The reference was a wideband signal sampled at 16 kHz, the mid-anchor was a narrowband signal sampled at 8 kHz, and the low-anchor was a narrowband speech signal sampled at 8kHz and with the MNRU distortion at SNR = 15 dB [ITU-T, 1996b]. In contrast to the reference signal, the mid-anchor may serve as a good benchmark to our tested signals due to the same speech bandwidth. The systems tested in the speech quality assessment are summarized in Table 5.4.

The assessment was carried out entirely online using webMUSHRA, the framework for Webbased listening tests [START_REF] Schoeffler | Towards the next generation of web-based experiments: A case study assessing basic audio quality following the ITU-R recommendation BS. 1534 (MUSHRA)[END_REF], Schoeffler et al., 2018]. The URL of the assessment was publicly available and widely distributed using social media. The participants were anonymous volunteers and their speech quality evaluation was not supervised by us. However, we assume that the listeners were mostly non-native English speakers with unreported hearing impairments. Table 5.5 lists the number of participants taking part in each test. The participants were asked to wear headphones or earphones and were allowed to adjust the sound volume. Few participants were excluded from aggregated responses because of rating the hidden reference below 90 more than once in a single test (mostly accidentally). 4 listeners excluded for reference underrating * * 3 listeners excluded for reference underrating Table 5.6 presents sample mean and sample standard deviation of the intelligibility test. On average, the participants recognized about 12% fewer words in synthesized speech samples than in the reference. The average rating of particular sentences varied slightly from 82% to 89%. On the other hand, a speaker-level average ranged from 58% to 99%. This high variability of average ratings given by the listeners explains a considerable standard deviation of aggregated responses.

The results of the MUSHRA-based quality assessment are depicted in Figures 5.25 and 5.26. In both test rounds, the hidden reference was rated correctly as 'Excellent.' The average rating of the mid-anchors given by the participants was about 75% ('Good'), and the average rating of the low-anchors was about 30% ('Poor').

-5.4.3 Speech quality evaluation 125

The average rating of test excerpts labeled 'no distortion' was 64% ('Good'/'Fair'). Compared with the average rating of mid-anchors, our algorithm reduced the speech quality by about 10%. It may be noticed that this difference in speech quality between the mid-anchors and the excerpts labeled 'no distortion' is similar to the intelligibility loss in the SIR-based intelligibility assessment.

The introduction of distortion into encrypted signals resulted in degraded speech quality. Gaussian noise at SNR equal to 20 dB, 15 dB, and 10 dB lowered the average ratings of speech quality respectively to 59% ('Fair'), 46% ('Fair'), and 19% ('Poor'/'Bad'). It can be noticed that a small channel distortion, like the one introduced by AWGN at SNR = 20 dB, has a relatively minor impact on perceived speech quality. On the contrary, the quality becomes bad when SNR reaches 10 dB. A similar observation can be made in the case of signal compression by Opus-Silk. The compression of encrypted signals at 64 kbps, 48 kbps, and 32 kbps reduces the rated speech quality respectively to 59% ('Fair'), 52% ('Fair'), and 28% ('Poor'). The excerpts decrypted from signals sent over FaceTime were rated at 49% ('Fair'). The statistical similarity of given ratings was evaluated by the non-parametric Kruskall-Wallis test [START_REF] Kruskal | Use of Ranks in One-Criterion Variance Analysis[END_REF], which is more suitable for ordinal scales [START_REF] Mendonça | Statistical Tests with MUSHRA Data[END_REF]. The ratings of speech signals labeled 'no noise' come from the same statistical distribution as speech signals labeled 'SNR = 20 dB' with the 0.09 confidence. Additionally, the ratings of speech labeled 'Silk 48 kbps' are similar to speech labeled 'FaceTime' with 0.25 confidence, and the ratings of speech labeled 'Silk 32 kbps' come from the same distribution as the low-anchor with 0.59 confidence. The ratings of the remaining systems were similar, with the confidence much lower than 0.05.

The obtained results suggest that the speech encryption scheme described in this study can produce intelligible speech. Moreover, the average speech quality of excerpts labeled 'FaceTime' hints about the possibility of making our system compatible with VoIP. However, high variability in listeners' responses indicates that the quality of decrypted speech is insufficient for having a casual conversation. Thus, some progress has to be made to improve the system's robustness to distortion and the quality of speech synthesis.

Algorithmic latency and computational complexity

The minimum algorithmic latency in our encryption scheme is the sum of delays introduced respectively by the enciphering and deciphering algorithms. The speech encoder introduces 30 ms of delay (20 ms frame and 10 ms look-ahead), and the pseudo-speech analyzer introduces an additional 20 ms delay. Finally, two 1x3 convolutional layers in the speech synthesizer use a 40 ms look-ahead (2 frames). The combined 90 ms of the minimum algorithmic latency is significant and may reduce the perceived quality of conversation. A possible solution is to reduce the analysis look-ahead to 5 ms, and the synthesis look-ahead to 20 ms, like in the wideband LPCNet [Valin and Skoglund, 2019].

The speech encoder implemented in the encryption scheme is reported to have a complexity of 16 MFLOPS, where about 8 MFLOPS are used for pitch prediction [Valin and Skoglund, 2019]. Moreover, the authors hint at the possibility of significant optimizations. These given values relate to the scenario when a speech signal is sampled at 16 kHz. Thus, we roughly estimate our 8 kHz speech encoder's complexity to about 8 MFLOPS, including torus mapping transformations.

Enciphering (and deciphering) is relatively lightweight, as it requires only ten additions modulo per 20 ms frame. However, a higher computational load is associated with producing secure bitstrings by the pseudo-random generator at a rate 8 kbps. For this reason, it is especially important to select a PRNG based on well-established ciphers adapted for real-time applications, such as AES-CTR [Käsper andSchwabe, 2009, Park and[START_REF] Park | [END_REF].

Pseudo-speech synthesis consists of two steps: computing the harmonic parameters of a frame and producing the signal samples. The complexity of the first step is dominated by deriving the complex amplitudes of harmonics Ǎ of length K using Equation 5.14, where K is the number of harmonics in a particular frame. Provided that all complex matrices (H Bω 0 ) † are precomputed and stored in the memory, the vector Ǎ can be obtained by searching the appropriate matrix from the look-up table, by element-wise complex vector multiplication, and finally by one complex matrix 16 × K multiplication. On the other hand, frame synthesis requires O(400K) floatingpoint operations, where 400 is the number of samples within a frame with two guard periods.

-5.4.4 Algorithmic latency and computational complexity 127

The pseudo-speech analyzer is mostly occupied by estimating the received fundamental frequency. The maximum-likelihood estimator implemented in the scheme has complexity O(N log N ) + O(N K), where N = 2 16 is the number of possible pitch values [START_REF] Nielsen | Fast fundamental frequency estimation: Making a statistically efficient estimator computationally efficient[END_REF]. Consequently, lowering the resolution of estimations or replacing the pitch predictor with a more efficient version will give considerable computational gains.

The most computationally involving element in the encryption scheme is the final speech reconstruction. The LPCNet model implemented in the scheme has complexity: (5.30) where

C = (3dN 2 A + 3N B (N A + N B ) + 2N B Q) • 2f s ,
N A = 384, N B = 16, d = 10%, Q = 256
is the number of µ-law levels, and f s is the sampling frequency. For f s = 16 kHz, the estimated complexity of the synthesizer is 3 GFLOPS [Valin and Skoglund, 2019]. Additionally, it is reported that a C implementation of the synthesizer requires 20% computing power of a 2.4 GHz Intel Broadwell core, 68% of a 2.5 GHz Snapdragon 845 core (Google Pixel 3), and 31% of a 2.84 GHz Snapdragon 855 core. From this, we estimate that the complexity of the lightweight, narrowband implementation of LPCNet is about 2 GFLOPS, and it could operate in real-time on portable devices. Table 5.7 lists the computational complexity of various parts of our algorithm estimated using PyPaPi 12 library [START_REF] Terpstra | Collecting Performance Data with PAPI-C[END_REF] when processing 60 minutes of a recorded speech in Python. The measurements were done under Ubuntu kernel 5.8.0-25 and using Intel Core i7 2.9 GHz without multi-threading. The pseudo-random bitstring used for enciphering and deciphering was precomputed and stored in the memory.

The listed results suggest that every tested part has a complexity low enough to be carried by a portable device, especially if one considers migrating the experimental Python code to a compiled code. Moreover, a replacement of the pitch predictor in the pseudo-speech analyzer would lead to significant optimization gains. On the other hand, the computational analysis does not include other essential elements of the system, such as keeping signal synchronization or adaptive energy equalization. [Valin and Skoglund, 2019] 12. https://flozz.github.io/pypapi/

Summary

In this chapter, we proposed a new speech encryption scheme for secure voice communications over voice channels. The lossy speech encoding technique implemented in the system preserves and protects only basic vocal parameters: fundamental frequency (pitch), energy (loudness), and spectral envelope (timbre). The vocal parameters are enciphered using spherical group codes and then encoded to a synthetic audio signal adapted for transmission over wideband voice channels. Speech is reconstructed by the narrowband vocoder based on the LPCNet architecture.

Enciphering of vocal parameters is done using norm-preserving techniques: pitch and fundamental frequency are enciphered by translations, whereas spectral envelope by rotations on the hypersphere in 16 dimensions. These techniques enable successful decryption of signals distorted by moderate transmission noise, like AWGN, or processed by some wideband VoIP applications such as FaceTime. However, the enciphering mechanism does not provide any data integrity. Instead, it is critical to ensure strong identity authentication in the initial cryptographic key exchange. Authenticated key exchange over voice channels is covered in Chapter 6.

The robustness of the speech encryption scheme against channel distortion was verified experimentally. Simulations showed that the system could correctly decrypt pseudo-speech with additive Gaussian noise at SNR = 15 dB or compressed by the Opus-Silk codec at the 48 kbps rate. On the other hand, an encrypted signal is sensitive to synchronization error larger than 0.3 milliseconds. Furthermore, the results of the speech quality assessment indicated that the proposed encryption scheme could produce intelligible speech with the quality depending on channel distortion.

The preliminary complexity evaluation and the successful transmission of encrypted signals between two mobile phones hint that the proposed encryption scheme may work in real-time on high-end portable devices. However, secure communication is susceptible to short signal dropouts or de-synchronization. Consequently, robust communication is possible only over a stable vocal link between the users. Additionally, adaptive voice-enhancing algorithms implemented in commercial mobile phones (such as voice detection and noise suppression) usually lead to considerable degradation of the speech quality. This problem can be tackled using dedicated CryptoPhones or stand-alone devices connected with mobile phones in tandem, as described in the next chapter.

The presented experimental scheme requires further investigation. Firstly, speech quality could be improved by replacing our narrowband speech synthesizer with the 4 kHz bandwidth with a synthesizer with the 8 kHz bandwidth. The biggest challenge is to find a new representation for the spectral envelope, which is compatible with the enciphering technique. The presented solution uses 9 mel-scaled frequency windows that are insufficient for encoding the wideband spectrum. A possible solution is to increase the number of mel-scaled windows to 18 and apply a dimensionality reduction technique, such as Principal Component Analysis (PCA) [START_REF] Wold | Principal component analysis[END_REF] or autoencoding [Kramer, 1991]. Dimensionality reduction may increase encoding efficiency because the coefficients within a single speech frame tend to be highly correlated.

Other improvements can be obtained in the pseudo-speech synthesis. The proposed synthesis technique, while computationally efficient, is very phase-sensitive and not enough speech-like. Instead of encoding the enciphered vector D(enc) into the real part of the complex frame spectrum, it would be advantageous to encode D(enc) into the power spectral density (PSD). The main limitation is that the vector D(enc) contains both positive and negative values, whereas PSD is always non-negative. For this reason, envelope encoding could be performed in the cepstral domain.

-Summary 129

Furthermore, it may be worth adding a correction unit at the deciphering output for detecting and smoothing deciphering errors. Since the vocal parameters in natural speech do not change quickly over time, the detection of large errors should be relatively straightforward. For example, the correction unit could use machine learning techniques to correct errors on a particular channel. A clear separation between the correction unit and the speech synthesizer could improve the quality of synthesized speech and simplify the two-step network training.

Communication performance strongly depends on the stability of a vocal link. The problem with fading channels could be mitigated by combining distortion-tolerant speech encryption and multiple description coding (MDC) [Goyal, 2001, Venkataramani et al., 2003, Wah and Dong Lin, 2005]. Multiple description coding is a technique that fragments one media stream into several substreams. Each substream is decodable into the initial stream, and decoding more substreams improves the quality. The MDC could be used to split encrypted speech into multiple audio streams and increase communication reliability.

In Chapter 6, we investigate authenticated key exchange over fading voice channels between two speakers. Secure voice communication is possible only with a secret cryptographic key shared by both parties. However, key authentication becomes very challenging without Public Key Infrastructure (PKI) or reliable data-driven side channels. The next chapter proposes a robust Diffie-Hellman key exchange authenticated by digital signatures and vocal verification. The exchange requires data transmission over a voice channel, for example, using the DoV technique described in Chapter 3.

CHAPTER 6

Key exchange over voice channels

Secure communication over voice channels requires a prior exchange of cryptographic keys over voice channels, without reliance on any Public Key Infrastructure (PKI). This chapter describes our formally verified and authenticated key exchange (AKE) over voice channels for secure voice communications, firstly introduced in [START_REF] Krasnowski | Introducing a Verified Authenticated Key Exchange Protocol over Voice Channels for Secure Voice Communication[END_REF]] and presented at ICISSP 2020. It outlines the operational principles of the novel communication system and enlists its security requirements. The voice channel characteristics in the context of AKE protocol execution are thoroughly explained, emphasizing differences to classical store-and-forward data channels. Namely, a robust protocol has been designed specifically for voice channels with double authentication based on signatures, and Short Authentication Strings (SAS) compared vocally by the users. The protocol is detailed and analyzed in terms of fundamental security properties and successfully verified in a symbolic model using Tamarin Prover. In such a setting, voice encryption is performed outside of the phone, protecting against audiorecording malware. To limit the system corruption risk, the Crypto Box has only analog input/output interfaces to the headset and the phone. However, it is necessary for security reasons that other analog inputs of the phone (particularly the built-in microphones) should be blocked by a special casing or removed.

From the system perspective, two Crypto Boxes are the end-points of a secured voice domain. Everything in between, including mobile phones themselves, is a communication infrastructure that enables voice transmission. The framework adds a new layer of security, protecting against spying malware installed on the phone. Since all communications between encrypting devices are done purely in the analog domain, selecting the specific voice communication technology is, 1. https://signal.org, https://core.telegram.org 6.2 -System requirements 135 therefore, a secondary issue. Compatibility with most vocal communication methods, like VoIP applications or 2G-4G networks, significantly widens the range of usability scenarios. The described setting, which is not intended for a daily-usage, is of great interest for business, diplomatic and military services, who require secure communications in unreliable environments and without access to confidential communication infrastructure.

The major motivation in our approach is to secure voice communications even with untrusted phones. Consequently, the phones should not be actively involved in the setup of a secure connection or sensitive data storage. The open framework enables various hardware solutions, including combining the phone and the Crypto Box into a single device.

Secure speech enciphering requires a prior exchange of session keys between the Crypto Boxes. Due to system requirements, the key exchange can only be made through the same pointto-point voice channel using Data over Voice (DoV) technique like the one described in Chapter 3. Consequently, there is no practical possibility of adding an online trusted third party (TTP) or a certificate authority (CA). Such a limitation is a big concern for users' authentication.

Research on secure key exchange between two honest parties without any TTP led to the creation of standards suitable for VoIP applications, like the extension of the Real-Time Transport Protocol (RTTP), called ZRTP [START_REF] Callas | ZRTP: Media path key agreement for unicast secure RTP[END_REF], and Multimedia Internet KEYing (MIKEY) protocol [START_REF] Arkko | Mikey: Multimedia Internet KEYing (RFC3830)[END_REF]. Especially ZRTP is interesting in the context of this work because it provides an authentication mechanism in the absence of any Public Key Infrastructure (PKI) or a pre-shared secret. In these situations, authentication is based on vocally comparing Short Authentication Strings (SAS). Unfortunately, with three modes of operation and extensive negotiation signaling, even ZRTP seems overly complicated for communication over voice channels. Moreover, none of the protocols put a sufficient emphasis on resistance to strong message distortion or desynchronization in a low-bandwidth environment.

System requirements

The need for hardware-based voice encryption is a response to an increased risk of being intercepted. Thus, a cryptographic scheme should reflect higher requirements for secrecy and authentication. The primary threat is recording and analyzing the network traffic by omnipresent passive eavesdroppers. Active attackers controlling the network are more likely to block or distort communications, which is technically very simple. However, a powerful and knowledgeable attacker who is able to analyze and synthesize a compatible pseudo-speech may try to modify a message or insert his own. Finally, in critical situations, the encrypting device could be hijacked in order to extract long-term keys. On the other hand, in our work, we assume that the encryption device does not allow any intrusion into its internal memory during the operation, so all ephemeral data stored on the device (and deleted after each protocol run) should be considered secure.

The design process of the protocol is motivated by an anticipated user experience. However, due to the severe constraints of the voice channel characteristics, the most significant challenges are protocol complexity, synchronization, and robustness. A major bottleneck is a large message round-trip time, around 2 seconds long, making the whole protocol run-time prohibitively long even in simple protocols. Another limitation is the limited bandwidth implying a reduction of the message size. Moreover, the protocol must be robust against fading and signal distortion, requiring signalization simplification and strong error correction mechanisms. Finally, in order to reduce battery power consumption, the cryptographic operations should be relatively lightweight and optimized. When implementing, relying on popular and verified network security libraries, like OpenSSL, NaCL, or Mbed TLS, could be a practical advantage.

Adaptation to hardware and channel constraints should not lead to any significant relaxation of the security level. It will be detailed that the key exchange protocol provides strong mutual agreement on the parameters used for the computation of the session key. Moreover, it aims at preventing Man-In-The-Middle (MITM) attacks and achieving Perfect Forward Secrecy (PFS). The protocol enables users' authentication, no matter if they share a common secret or not.

A successful and fast key exchange is an indicator of sufficiently good channel conditions that offers comfortable communication. Every received message can be used to estimate the channel characteristics effectively and to improve the decoding efficiency.

Key exchange protocols and symbolic security verification

Designing security protocols is prone to errors, which resulted in the publication of several flawed protocols [START_REF] Just | Authenticated multiparty key agreement[END_REF], Lowe, 1996, Lauter and Mityagin, 2006, Farrell, 2009, Tsay and Mjølsnes, 2012]. Therefore, every protocol design ought to be thoroughly scrutinized by some formal security verification. The verification should focus on the security of the ciphers used in the protocol by eliminating logical flaws in the protocol's messages.

At the high level, the cryptographic algorithms can be validated in the computational model by showing the equivalence between the protocol's security and some computationally hard problems, e.g., integer factorization. The formalization often uses the indistinguishability approach [START_REF] Canetti | [END_REF]Krawczyk, 2001, Katz and[START_REF] Katz | [END_REF], in which the adversary with finite power tries to distinguish the generated key from an independent random string with fixed length.

Proving the protocol's computational security provides clear advantages such as concrete bounds on the probability of successful attack and the required keying material. However, it is often a laborious and manual task. Moreover, it is difficult to show that a particular protocol is free from logical flaws, or in other words, if its security cannot be compromised using only intended protocol interactions.

The presence of logical flaws in the protocol is particularly important in communication over channels controlled by the attacker. For instance, apart from interception, the attacker may block and replay messages or insert his own versions. Furthermore, it is often assumed that the attacker may concurrently communicate with many legitimate participants and replay messages.

The risk of logical flaws in the protocol can be mitigated or eliminated in the symbolic model, using some formalization of the protocol execution. In contrast to the computational model, the protocol messages in a symbolic model are sets of symbolic terms representing the algorithms used to construct a particular message. Additionally, the cryptographic primitives and algorithms are assumed perfect, meaning that they can be considered secure if checked in the computational model. Formal symbolic verification is the first step of a protocol analysis, paving the way to computational model verification [Goldwasser andMicali, 1984, Blanchet, 2012].

The protocol simplification offered by a symbolic formalism enables the automatic construction of symbolic security proofs. This task can be undertaken by many tools, such as AVISPA [START_REF] Armando | The AVISPA Tool for the Automated Validation of Internet Security Protocols and Applications[END_REF], Scyther [Cremers, 2008], ProVerif [Blanchet, 2001] or Tamarin Prover [START_REF] Meier | The TAMARIN prover for the symbolic analysis of security protocols[END_REF]. Though, proving the security of a protocol is in general NP-complete for a bounded number of sessions [START_REF] Rusinowitch | Protocol insecurity with a finite number of sessions and composed keys is NP-complete[END_REF] and becomes undecidable for an unbounded number of sessions [START_REF] Durgin | Multiset Rewriting and the Complexity of Bounded Security Protocols[END_REF]. As a result, the automatic verification tools rely on 6.3 -6.3.1 Simple example of a protocol verification using Tamarin 137 heuristics and provide solutions for some classes of protocols. Some especially advanced proving techniques are implemented in Tamarin and ProVerif, capable of constructing efficiently security proofs even for an unbounded number of threads. Crucially, the heuristics applied during verification does not affect the results' soundness (the properties that are proved are always true).

ProVerif represents cryptographic protocols by a set of Horn rules (clauses) [Gupta, 1999]. Thus, security proving boils down to deriving facts in a Horn logic theory [Blanchet, 2009]. Horn formalism enables the modeling of many cryptographic protocol verification problems, including Diffie-Hellman exponentiation and signing. However, the approximations taken during the proving process may give some false alarms, which should be eliminated manually. To reduce the chance of non-termination resulting from undecidability, ProVerif uses a specialized resolution prover and several reduction techniques.

Unfortunately, the reduction to Horn theory prevents modeling protocols with non-monotonic state, i.e., protocols that intentionally reveal some secret during their execution. The possible workarounds, such as process replication with new names, may raise more false-alarms.

The problem mentioned above can be partially avoided in Tamarin,2 a powerful and increasingly popular automatic verification tool designed at ETH Zürich. Tamarin models protocols as multiset rewriting (MSR) systems that specify security properties in a guarded fragment of firstorder logic. The tool supports generic Diffie-Hellman group operations and many cryptographic primitives like signatures or hashes [START_REF] Schmidt | Automated Analysis of Diffie-Hellman Protocols and Advanced Security Properties[END_REF], Schmidt et al., 2014].

In Tamarin, the protocol's execution can be viewed as a labeled transition system representing the evolving adversarial knowledge, the messages sent over the network, freshly generated values, and the protocol state. Thus, a single protocol realization takes the form of a time-stamped trace, and the security properties are modeled as trace properties. Consequently, the verification (or falsification) of the protocol's security reduces to exploring the possible traces that may violate the specified security property.

From the user's perspective, the protocol verification can be done in two ways: using a heuristic-based fully automated mode and an interactive mode. The verification result is bringing some counterexample or the proof of correctness in the unbounded number of sessions and fresh values. Nonetheless, because of undecidability, Tamarin may also not terminate.

Tamarin's clear advantage is a user-friendly browser-based interface, which simplifies the analysis of the verification output. When a counterexample is found, a diagram of the protocol execution is displayed. Moreover, Tamarin offers an impressive database of examples that makes the tool suitable for protocol evaluation.

Simple example of a protocol verification using Tamarin

Tamarin's operation can be better understood using a simple example of KE protocol, which involves sending Diffie-Hellman public keys authenticated by signatures. The protocol, presented in Figure 6.2, consists of three messages exchanged between Alice and Bob, who share the signature verification keys. The protocol execution starts with Alice sending her identification number ID A and the public key g x . Bob responds by sending his identifier ID B , public key g y , and the signature signed with key S B . The last message is the signature of Alice signed with S A . The protocol finishes by computing the session key K S . The set Z * q denotes the integer ring Z q without the zero element, ∥ denotes concatenation, and ←$ denotes a uniformly distributed probabilistic process assignment [START_REF] Katz | Introduction to modern cryptography[END_REF].

Rules are defined by four elements: their name, left-hand side facts (inputs), transition facts (actions), and right-hand side facts (outputs). As an example, the rule Initiator_2 takes as input the state Initiator_State from the rule Initiator_1, the fact Sign_Key representing the Initiator's signing key, the fact Verif_Key representing the Responder's verification key and the In-fact denoting the message assumed to be sent by the Responder. Furthermore, the expected message is the concatenation of the Responder's ID_B, her public key 'g'ˆBprivkey, and her signature signB. The transition fact Session_Initiator binds the constants representing the users' identifiers with the generated session key symbol, whereas Verify_Signature_Initiator links the received signature with the signature expected by the Initiator. Finally, the rule Initiator_2 generates the Out-fact with the Initiator's signature.

The adversary would need to be granted some appropriate capabilities and access to specific knowledge to make the protocol model more realistic. The fact types used in the rules put specific limitations to adversarial manipulations. The In-fact representing the message received from the network can accept messages from a legitimate user and the adversary. The Out-facts, once generated, can be replayed and manipulated. On the other hand, the constants generated by Fr-facts (from Fr-esh) are unique and unguessable by definition.

Similar properties can also characterize constants. The dollar sign $ next to the symbol means that the symbol is known globally (like the user's identifier). The tilde ∼ denotes a random value, unguessable before being revealed.

The cryptographic primitives used in the model are assumed to be secure in the computational model. For instance, the adversary cannot extract the secret key from the group exponents or forge the signatures. However, the adversary is capable of generating his public keys and signatures. Therefore the protocol rules must permit the reception of invalid input and provide some method for its verification. Security properties: In the next step, one may specify the protocol's desired properties to be verified by Tamarin. These properties are defined as trace properties, called lemmas. They may relate to the protocol's secrecy, authentication, or resistance to some malicious manipulations (i.e., replay attacks, desynchronization).

To verify the secrecy of the session key, we may specify the lemma Session_Key_Secrecy_1, listed in Figure 6.4. The lemma states that if any responder accepts the key secret_key and establishes the session with any legitimate initiator at some arbitrary time-point i, it implies that there is no time-point (in the past nor in the future) when the adversary may learn that key.

However, Tamarin disproves the lemma and presents a counterexample shown in Figure 6.5. It can be observed that the adversary simulates the initiator and sends his signature. Interestingly, the adversary also injects an insecure public key 'g' (instead of some 'g'ˆAprivkey). As a result, the Responder accepts the session key of the form 'g'ˆBprivkey, which is her public key. The attack on the protocol security was possible because the model does not enforce the Responder's signature verification. This shortcoming, while realistic, should be taken into account in the specification of the lemma. The new proposition for the lemma can be found in Figure 6.6. In addition to previous requirements, the Responder accepts only the expected signature signed by the Initiator. Tamarin validates this new security property. The presented example underscores the need for a careful evaluation of the protocol model constructed in relation to the anticipated adversarial power and protocol handling by legitimate users. For instance, one may notice that the example is still not realistic because secret keys cannot be revealed to the adversary (accidentally or intentionally). Thus, to mitigate the risk of missing out on some dangerous forms of attacks, there is a common practice to grant the adversary more considerable capabilities and knowledge than in reality. If the protocol withstands powerful adversarial manipulations, it could be suitable for implementation.

6.4 -Protocol description 141

Protocol description

This section presents the symbolic model of the authenticated key exchange protocol over voice channels and provides a brief discussion.

Preliminaries

Let us describe the key exchange between honest users Alice and Bob, who know each other, without any legitimate trusted third-party participating. The operational framework requires that Alice and Bob must establish a non-encrypted voice connection with a preferred voice application before initiating secure communication. The system model assumes that identity information used to make a call (i.e., phone number, user account, credentials) is independent of the authentic user identity and the identification number of the voice encryption hardware. Only one running session at a time is possible since each device cannot process more than one message simultaneously. Therefore, several kinds of Denial-of-Service (DoS) attacks, when the attacker tries to send multiple messages to a recipient, are not effectively different from distorting or blocking the channel.

In highly unreliable channels like voice channels, Alice and Bob are never sure of message delivery. Thus, several synchronization techniques are needed, i.e., repeat requests, retransmissions, and time-outs. For simplicity and space limitations, most details on synchronization will be omitted here. Additionally, thanks to strong error-detection coding, users can detect random channel errors and discriminate them from intentional malicious manipulations.

Symbolic model of the protocol

The proposed protocol presented in Figure 6.7 relies on Ephemeral (Elliptic-Curve) Diffie-Hellman (EC)DHE exchange [START_REF] Hankerson | Guide to elliptic curve cryptography[END_REF], authenticated by signatures (existentially unforgeable and deterministic) or Short Authentication Strings. An example of a signature algorithm suitable for use is ECDSA with the SHA256 function [ANSI, 2005]. The output of the hash function can be truncated depending on the needs [Quynh, 2012]. Before the protocol starts, Alice and Bob agree on the elliptic curve, and the lengths of keys and nonces. Public verification keys should be provided to the recipients in some authenticated way before the communication starts and stored in the Crypto Box address book. However, in many real scenarios, it is not possible to adequately provide such a verification key. If the recipient cannot verify the signature, the protocol offers vocal verification as an alternative, authenticating the speakers and the parameters used to derive the current session key.

The protocol interaction consists of several steps: the setup, the key exchange and authentication, the protocol acknowledgment, and the optional vocal verification. Table 1 contains the glossary of terms used in the protocol specification, along with their bit-lengths.

Setup: The negotiation stage has been considerably simplified. Participants have to agree on starting the key exchange procedure mutually. Therefore the actual key exchange protocol is preceded only by fast and automatic role negotiation to prevent mutual interference or logjams. Then, both Alice and Bob choose a random private integer d, a random and unique nonce N , a random value R and compute a public key Q. Unique nonce guarantees the uniqueness of the triple (ID, Q, N ).

Key exchange and authentication:

In this stage, Alice and Bob exchange the values that are used to obtain the Session Key (K S ) and the SAS. Alice sends her public ID, the nonce, the ephemeral public key, and the hash, with her R A included. Bob responds with his values, appends R B , and additionally sends his signature over all sent parameters required for K S calculation. Alice answers with her signature over the same data and finally reveals R A . It is worth noticing that the protocol permits a situation when the signature cannot be verified. If any of the recipients did not obtain a verification key corresponding to the sender's ID, the signature is checked against channel errors but not processed further.

Protocol acknowledgment: When all cryptographic parameters are exchanged, voice encryption can be started. Encryption is initiated after the reception of Bob's acknowledgment by Alice. The acknowledgment is a confirmation of error-less message reception so that it can be non-encrypted.

Short Authentication String comparison: Each participant can request a check of vocally challenging SAS equality with the peer. SAS comparison is obligatory if any of the users were not able to verify the signature. It is assumed that the comparison process is authenticated meaning that the users are able to recognize the voice characteristics of the peer (e.g., personal info,timbre, tempo). The SAS is displayed on the Crypto Box as a short string of digits or words to be vocally uttered by the users.

Formal verification

This section presents the results of the protocol verification done with Tamarin Prover.

Protocol modeling

Verification by Tamarin implies providing an abstract protocol model that tries to express relevant information from a security perspective faithfully, but still within the analysis's feasibility. The protocol model code can be found in Annex A and online.3 Several protocol restrictions were relaxed to make them compatible with the channel's characteristics, allowing users to run multiple protocol instantiations at the same time and to 'forget' the verification key of the peer. SAS verification is performed by a separate non-obligatory protocol rule simulating a realistic case when users simply ignore it. Vocal challenging is modeled as communicating over an authenticated (not secret) channel, which the adversary can intercept but not modify. The last ACK is skipped. Symbols:

: N

A ←$ Z * 32 A/B role ← ------------------------→ negotiation N B ←$ Z * 32 2 : d A ←$ Z * 256 d B ←$ Z * 256 3 : Q A = d A G Q B = d B G 4 : R A ←$ Z * 128 R B ←$ Z *

:

ID A , N A , Q A ---------------------------→ h128(ID A ∥N A ∥Q A ∥R A ) 6 : ID B , N B , Q B , R B ← --------------------------- Sign S B ('B'∥ID A ∥N A ∥Q A ∥ID B ∥N B ∥Q B ) 7 : Z = d A Q B R A ---------------------------→ Sign S A ('A'∥ID B ∥N B ∥Q B ∥ID A ∥N A ∥Q A ) Z = d B Q A 8 : K S = h 256 (Z∥•) K S =
• ≡ ID A ∥N A ∥ID B ∥N B ⋆ ≡ R A ∥R B ∥ID B ∥Q B ∥N B Figure 6
.7 -Key exchange protocol over voice channels.

Security properties and verification results

The protocol model was checked against the Dolev-Yao adversary [START_REF] Dolev | On the security of public key protocols[END_REF], having full control over the network and the power to reveal the long-term secret key of any user (ephemeral data is considered secure). The evaluation was done in four authentication configurations: mutual signature authentication between two honest users, unilateral signature authentication (when only one user can verify the peer's signature), vocal verification, or no authentication. Verification focused on most critical security properties: (perfect forward) secrecy and a mutual injective agreement [Lowe, 1997] on the Session Key. The protocol was also verified for resilience to reflection attacks (a user cannot accept her own identity as a peer) and signing key compromise impersonation (adversary can impersonate only corrupted users). The descriptions of the properties used in specifying the security lemmas (some informally) are listed below.

Session Key Secrecy: whenever A sets up a session key, apparently with B, then the adversary cannot learn the session key unless the long-term key of A or B has been revealed.

Perfect Forward Secrecy (PFS): whenever A sets up a session key, apparently with B, then the adversary cannot learn the session key unless the long-term key of A or B has been revealed before the setup.

Non-injective Agreement: whenever A (acting as an initiator) completes a run of the protocol, apparently with responder B, then B has previously been running the protocol, apparently with A, and B was acting as responder in his run, and the two agents agreed on the data values corresponding to all the variables in some set of data items S.

Injective Agreement: same as non-injective agreement, plus that each run of A corresponds to a unique run of B.

Reflection Attack Resilience: whenever A completes a run of the protocol, apparently with B, then B is different than A.

Key Compromise Impersonation (KCI) Resilience: whenever the adversary corrupts a party A and reveals her long-term key, the adversary cannot impersonate another uncorrupted party.

The protocol verification results can be found in Table 6.2. The protocol configurations involving signature authentication or authenticated SAS comparison were proven to provide perfect forward secrecy and injective agreement. Unilateral signature authentication between two honest users who know each other guarantees the same security as mutual signature authentication. Surprisingly, vocal verification does not protect against reflection attack because the user can trivially compare SAS with herself. The results in Table 6.2 indicate the importance of authentication: none of the properties were verified if no authentication was performed. Crucially, the security of SAS-based authentication and unilateral signature authentication is valid only under the assumption that the peers can truly identify each other by voice.

Security considerations

This section explains in more detail some protocol characteristics, providing several justifications and practical recommendations. It starts from an overview of fundamental protocol elements: the choice of public-based cryptography, the role of signatures, and Short Authentication Strings.

Later, the section enlists potential protocol weaknesses and some possible fixes.

Discussion

Public key agreement versus symmetric cryptography: In exceptionally constrained resource devices, such as IoT sensors or RFID cards, the pursue for ultra-lightweight key exchange protocols led to some shift from the public key encryption towards symmetric encryption techniques [START_REF] Lee | A lightweight authentication protocol for Internet of Things[END_REF], Echevarria et al., 2016, Baashirah and Abuzneid, 2018]. Even the ZRTP protocol offers a possibility of key exchange in a lightweight preshared mode. In this configuration, two entities share a secret used to encrypt or refresh the keying material for a new session.

To achieve Perfect Forward Secrecy, the long-term secret should be regularly updated, desirably after each successful key exchange run. The update decision has to be mutual, otherwise risking one-side update and user desynchronization. Unfortunately, such a risk cannot be eliminated in voice channels because the last update confirmation message may not be delivered. Decreasing the chance of desynchronization by sending more confirmation messages would negatively affect the protocol run-time. Another solution, based on on-the-fly resynchronization mechanisms, requires an online server keeping track of all key updates or a costly and potentially insecure 'guessing' of the long-term parameters until decryption is successful [START_REF] Baashirah | Survey on prominent RFID authentication protocols for passive tags[END_REF]. Finally, as was emphasized before, in some scenarios, the exchange of long-term secret is impossible, limiting the usability of symmetric cryptography. In light of the reasons mentioned above and relatively smaller hardware restrictions compared to IoT sensors, a public-based key exchange scheme seems adequate.

Role of Short Authentication Strings: If the key exchange is not interfered with by a third party, both participants obtain the same Short Authentication String. Challenging SAS vocally between honest users has a twofold role. Firstly, it enables the authentication of users based on voice identification. Secondly, the inequality of codes may indicate the presence of an active MITM attacker. However, MITM manipulations would remain undetected if the attacker can somehow influence or precompute the SAS value before the users. The code computation depends on seed values R A and R B chosen randomly by honest users. Importantly, Alice and Bob are forced to select seeds before knowing the value of their respective peer: Alice by sending the hash of R A in the first message and Bob by revealing his R B before R A . Such a construction, inspired by [START_REF] Pasini | SAS-Based Authenticated Key Agreement[END_REF], prevents adaptive selection of seeds by each party. The same rule applies to the attacker who cannot predict the SAS value until it is too late. The only hope for him is a random guess with a low probability of success or an extraction of R A from the hash sent in the first message by brute force search. For this last reason, the length of R A should be considerably larger than R B . On the other hand, the difference of lengths is partially compensated by taking Q B ∥N B as an additional input of the hash function. It is worth noticing that the SAS value does not have to be confidential since it plays only an authentication role and cannot be modified without detection.

In practice, the security of vocal verification also depends on how users abide by it. The SAS could be represented by a smaller number of simple pictographs or easily pronounceable words, the same way as in the ZRTP, which has the PGP Word List incorporated into its framework [Zimmermann, 1996, Callas et al., 2011]. The device should encourage the mutual SAS comparison by indicating a part of the SAS value to pronounce and a part to hear from the peer.

Signature-based authentication: Signatures enable device authentication and message integrity, similarly to message authentication codes (MAC) which are simpler and easier to compute. Indeed, in some scenarios choosing hash-based MAC instead of signatures would be sufficient. However, signatures give wider flexibility, justifying their higher computational cost. The natural advantage of signatures is that they do not require mutual agreement and secure exchange of a long-term secret between two parties. Moreover, each user keeps in memory only one private signing key, used regardless of the receiver's identity. Consequently, if the user is corrupted, the attacker should be able to impersonate only that person.

When one user cannot obtain a verification key due to an insecure environment, it is still possible to achieve unilateral authentication [START_REF] Boyd | Protocols for authentication and key establishment[END_REF], Maurer et al., 2013, Dodis and Fiore, 2017]. One-side authentication prevents MITM attacks, leaving only two possibilities: honest users securely exchange a secret, or the attacker is an authenticator [START_REF] Maurer | Key Exchange with Unilateral Authentication: Composable Security Definition and Modular Protocol Design[END_REF]. It naturally implies that if the users want to communicate and they know they can perform unilateral authentication, the attacker cannot interfere undetected in another way than preventing the successful exchange. However, the user who failed to authenticate the peer is still compelled to challenge the SAS because, from her perspective, it is the only formal way to verify the absence of the MITM manipulations.

Due to a lack of any PKI infrastructure, a signature key management policy has a crucial impact on system security and usability. We will point out two possible schemes, decentralized and fully centralized, which can be chosen depending on the needs. In a centralized system, the keys are managed by an offline central authority, keeping track of all records and being responsible for key distribution and update. In a decentralized case, each user is entitled to generate her key pair and distribute public keys to specific users authentically. As in the PGP model, sharing the key can be performed remotely based on speaker identification and vocal authentication. Thus, the proposed protocol with SAS comparison gives the possibility to authenticate the exchange of signature verification keys.

Possible attacks and threats

Many protocol vulnerabilities focus on selecting specific cryptographic algorithms, their implementation, and compliance with the protocol rules. The biggest threat is posed by not respecting the obligation of SAS comparison by real users, opening a space for MITM attacks.

The capabilities of modern speech synthesizers which exploit AI techniques to impersonate a speaker's voice [START_REF] Gao | Voice impersonation using generative adversarial networks[END_REF] question the level of authentication provided by voice recognition. Instead of breaking the SAS security, the attacker may simulate or replay the speaker pronouncing the code [START_REF] Shirvanian | Short voice imitation man-in-the-middle attacks on Crypto Phones: Defeating humans and machines[END_REF]. The risk is amplified because the voice sent is highly compressed and thus significantly differs from its real characteristics. For this reason, it is recommended to extend the sequence comparison by contextual questions (like describing the last watched movie) or to share personal information known only by the peer but not by the attacker. 6.6 -6.6.2 Possible attacks and threats 147 If honest users can verify signatures of each other and achieve strong authentication, the attacker may try a downgrade-attack. It can be done simply by modifying users' ID and imposing vocal verification. The problem may be partially solved by displaying the IDs along the SAS. However, the real solution would be to force signature verification by default.

Finally, the proposed protocol cannot protect against the consequences of a device being stolen or misused, giving the manufacturer the responsibility to provide strong enough password or biometric protection. The device should be protected against physical tampering, making reverse engineering very difficult, and minimizing the negative consequences of theft.

:

N A1 , Q A -------------------→ h128(N A1 ∥Q A ∥R A ) Z = d B Q A 7 : Z = d A Q B N B1 , Q B ,

Protocol with identity protection

In many situations, protecting the user's identity is as crucial as securing the speech content. However, calling anybody with a civilian communication network is always associated with revealing user metadata (i.e., phone number, user credentials, location). Even if the metadata is publicly known, it may be advantageous to hide the identity of the encrypting device from passive eavesdroppers.

It is possible to redesign the proposed protocol to attain identity anonymity without the change of any other substantial protocol property mentioned in Section 6.5.2. The modified protocol is presented in Figure 6.8 and verified in Tamarin. The IDs and the signatures of Alice and Bob are sent encrypted with the key derived from a DH secret exchanged during first message roundtrip, similarly to the Initial Exchange of IKEv2 standard [START_REF] Kaufman | Internet Key Exchange Protocol Version 2 (IKEv2) (RFC7296)[END_REF]. The protocol includes one more message, which is required for confirming the reception of Alice's ID by Bob. On the other hand, there is no verbal agreement on the protocol initialization over an unsecured call to prevent the leakage of the speaker's identity by his or her voice profile. Instead, protocol initialization is done automatically when the call starts. Unfortunately, the proposed protocol does not protect the identity against the curious attacker who may initiate the protocol execution and break the connection once the Responder's identity is revealed in the second message.

The complexity of a protocol providing anonymity would increase since it will require additional data encryption, i.e., using AES. It is also important to carefully evaluate how the encryption key is derived and how it is related to the session key, giving no foothold for cryptanalysis. In the proposed protocol, each encrypted message is encrypted with a different key (hence K B1 and K B2 ). In addition, the session key derivation uses two additional nonces N A2 and N B2 , sent encrypted. The Tamarin code modeling the protocol and security lemmas is listed in Annex B and is available online.4

Summary

This work attempts to bring a solution to the problem of a cryptographic key exchange over voice channels for cryptographically secure voice communications. It also introduces challenges related to secure communications over voice channels like limited available bandwidth, no guarantee of message delivery, and the issue of battery consumption. The paper lists the security requirements posed to the system, like protecting against interception and MITM attacks, emphasizing user authentication in the absence of a trusted server. All these concerns and limitations justify the need for a dedicated protocol instead of relying entirely on standardized solutions.

We proposed a simplified key exchange protocol between two honest parties based on the ephemeral elliptic curve Diffie-Hellman (ECDHE) protocol. The protocol offers two ways of authentication: signatures and Short Authentication Strings. A symbolic model of the protocol was analyzed using Tamarin Prover to verify the crucial security properties as Perfect Forward Secrecy and mutual agreement on the Session Key. The verification process was explained, pointing out the limitations of the symbolic analysis, such as model simplifications and perfect cryptography assumption.

Formal verification was followed by discussing the protocol properties, like unilateral authentication provided by one-side signature verification or the role of vocal comparison in preventing 6.7 -Summary 149 MITM attacks. The analysis led to the observation that all analyzed techniques do not provide perfect authentication per se. Thus, some informal identity authentication methods had to be introduced.

Potential vulnerabilities and attacks on the system were also covered in this work. Several propositions and practical solutions regarding key management, proper SAS comparison, or identity protection can guide engineers working on exchange protocols over voice channels or in similar scenarios.

The presented verification is just the first step in designing a secure protocol implementation. In a future work, it is necessary to specify the algorithms involved in the exchange and prove the protocol's security in the computational model. In the next step, the protocol should be implemented on some portable devices and tested over real-voice channels.

CHAPTER 7

Conclusion and Perspectives

This thesis addressed the problem of secure voice communications via digital voice channels. The goal of the study was to propose, investigate, and validate some new real-time speech encryption schemes adapted to error-prone transmission in the audio domain. The thesis also targeted many practical aspects of secure voice communications that would make the investigated schemes compatible with real-world voice channels.

Modern voice communication systems, such as cellular networks and VoIP, process speech signal with several adaptive algorithms that remove background noise and compress the signal before sending it. These operations are non-linear, implementation-dependent, and often unavailable to scrutiny. Consequently, sending encrypted voice as pseudo-speech over real-world voice channels remains a big challenge. The investigation of voice channels that we carried in this study helped us to identify four research problems: (1) data transmission over real voice channels, (2) distortion-tolerant enciphering of multi-dimensional data, (3) joint speech compression and encryption robust against transmission error, and (4) authenticated cryptographic key exchange over fading channels.

Secure systems rely on provably secure ciphers, verifiable cryptographic protocol models, and correct implementations. This study addressed the first two challenges by proposing a speech encryption scheme with provable security (albeit with strong assumptions on the security of pseudorandom generators and seeds) and describing a key exchange protocol verified by Tamarin Prover. Nevertheless, we tried not to miss the primary objective that is a successful deployment on real devices. Limitations of real-world voice communication systems and anticipated user experience considerably influenced the solutions proposed.

Contributions Data over Voice (DoV) technique

The review of existing voice communication systems revealed that cellular networks and many VoIP applications rely on the classical source-filter speech model and Linear Predictive Coding (LPC). For this reason, we proposed a robust and versatile DoV technique inspired by harmonic vowels and thus compatible with LPC-based voice channels. The technique is based on codebooks of short (2.5 -5 ms) waveforms consisting of 7-10 phase-modulated harmonics. The codebook design process is significantly simplified and boils down to constructing quaternary codes to maximize the minimum Lee distance.

CHAPTER 7 -Conclusion and Perspectives

The technique's robustness was initially verified by compressing produced DoV signals by three prominent LPC-based voice coders: Speex and Opus-Silk used in VoIP, and AMR adopted in cellular networks. The tests revealed that compression causes group delay in the phase-modulated harmonics, which could be efficiently compensated at the reception side.

A simple structure of DoV symbols inherited from quaternary codes gives control over the transmission rate and robustness against channel distortion. This property is crucial when considering data transmission over a real voice channel with fluctuating characteristics. An available bitrate ranging from 1 kbps to 6.4 kbps is sufficient for sending the encrypted bits of compressed speech or side information needed to establish a secure connection (e.g., cryptographic key exchange).

The technique has been successfully validated by sending synthetic DoV signals between mobile phones over 3G networks, FaceTime, Skype, WhatsApp, and Signal Messenger. The achieved transmission bitrates varied from 2.4 kbps in 3G networks up to 6.4 kbps in VoIP, with a bit error rate lower than 1%. However, correct signal synchronization is mandatory for correct signal demodulation. Furthermore, it is crucial to prevent the triggering of Voice Activity Detection (VAD). Frequency band alternation and repetitive silence insertion are possible remedies.

We also presented an experimental system for secure voice communication based on the DoV technique in high and low operation modes. The system uses Codec2 for speech compression, AES-256 encryption in the CTR mode, and shortened Reed-Solomon codes for encrypted data protection. The encrypted data are transmitted using the DoV technique at 2.4 kbps or 4.8 kbps rate, depending on the operation mode. Some tests with mobile phones and real-voice channels confirmed that the proposed system could secure voice communications over voice channels. The recordings used in the experiments are available online. 1

Distortion-tolerant enciphering of vectors on spheres

The investigation of robust data transmission over real voice channels concluded by an observation that transmission errors could not be fully eliminated. This characteristic of voice channels undermines the usefulness of many well-established cryptographic schemes that are intolerant to error. This study introduced a notion of distortion-tolerant encryption describing the cryptographic scheme's capability to decrypt enciphered data approximately despite data distortion. The new notion is a relaxation of distance-preserving encryption designed for protecting remote databases. Due to their robustness against channel distortion, distortion-tolerant encryption schemes are suitable for sending encrypted data over voice channels. However, they are also susceptible to adversarial manipulations because it is hard to differentiate intentional data modification from random noise.

We presented a distortion-tolerant scheme for enciphering vectors on spheres, which can be used to scramble high-dimensional vectors representing vocal timbre. The proposed scheme encodes unit vectors to codewords of a dense spherical commutative group code constructed from a pair of nested lattices. Data enciphering is done by performing rotations selected from an associated group of orthogonal matrices, and relying on the output of a Pseudo-Random Number Generator (PRNG) with a secret seed of length at least 128 bits. All rotations in the group are commutative and reversible. Consequently, small transmission errors are still mapped to plaintext during decryption, which makes the system distortion-tolerant.

-153

The encryption scheme gives indistinguishable encryptions in the presence of an eavesdropper when the source of randomness is a secure non-binary PRNG with a fresh seed. In real implementations, it is essential to ensure high-quality entropy to obtain the seed. Furthermore, the selected deterministic non-binary sequence generator must give unpredictable output up to the instantiated security strength determined by the seed. A possible solution is to construct a dedicated generator that outputs non-binary numbers. Such a dedicated generator must be carefully evaluated by well-designed statistical tests, which seems to be more challenging for non-binary sequences than binary sequences [START_REF] Baigneres | Linear cryptanalysis of non binary ciphers[END_REF], Epishkina, 2018]. For instance, we attempted to measure the randomness of scrambled data using the Statistical Tests Suites (STS) known as diehard2 tests developed by Prof. G. Marsaglia from FSU, USA, and dieharder3 tests developed by Prof. R. Brown from Duke, USA. These statistical evaluations were inconclusive due to the inadequacy of binary statistical tests for non-binary sequences. Another idea is to use a trusted binary sequence generator and sequentially read its output as unsigned integers.

The toy example of color scrambling developed in that part suggests that our encryption scheme may be useful in applications different from voice encryption. However, it is mandatory to find a suitable data representation as unit vectors on spheres. The idea is to link distances on the hypersphere with perceptual similarities of encoded data. With such an approach, quantization and channel errors would have a limited impact on decrypted data perception. Consequently, distortion-tolerant encryption is applicable whenever robustness against distortion is prioritized over fidelity.

Distortion-tolerant speech encryption

We proposed an experimental speech encryption scheme for secure voice communication over voice channels. This scheme is distortion-tolerant and could operate close to real-time. The encryption algorithm encodes speech frames into energy, fundamental frequency, and the spectral envelope shape. These three parameters correspond to perceptual speech qualities: loudness, pitch, and timbre, and are crucial for preserving speech intelligibility. The sequence of energy and pitch values are scrambled using a pseudo-random sequence of translations. In contrast, the spectral envelope shapes are firstly represented as unit vectors on the hypersphere S 8 , encoded to codewords of a spherical group code on S 15 using a flat torus mapping, and finally, rotated by elements from a commutative group of 16 × 16 orthogonal matrices.

The encryption unit encodes scrambled parameters into a wideband speech-like signal robust to voice channel distortion. Upon reception of the signal at the receiving side, the decryption unit extracts distorted copies of the vocal parameters and tries to reconstruct the original narrowband speech. The speech synthesizer is a narrowband modification of the LPCNet algorithm with framerate and sample-rate neural networks, and is trained to compensate for imperfections in speech recordings and voice channel distortions.

The encryption scheme gives indistinguishable encryptions in the presence of an eavesdropper when translations and rotations are selected according to the output of a secure binary PRNG with a fresh seed. The relation between the scheme's security and the PRNG underscores the need for a trusted random bitstream generator convertible to a non-binary generator. This study points out a bitstream generator published by NIST SP 800-90A based on AES-256 in the counter mode of operation and a secret seed of 256 bits. Regardless of the selected generator, however, the encryption scheme does not provide data integrity. Instead, it is mandatory to ensure a strong user authentication level, for example, during the cryptographic key exchange.

The speech encryption scheme was experimentally implemented by using the Python programming language and tested by simulations. These tests confirmed that encrypted signal is robust against additive Gaussian noise at SNR = 15 dB and compression by Opus-Silk down to 48 kbps bitrate. On the other hand, synthetic pseudo-speech is sensitive to phase-shift and synchronization error larger than 0.3 milliseconds. As a result, precise synchronization in communication over real voice channels becomes a mandatory requirement.

The preliminary computational complexity evaluation conducted on the experimental Python implementation hints that speech encoding, enciphering, and speech synthesis may be carried on high-end mobile phones nearly in real-time. However, our investigation did not cover many elements of the whole communication system, such as maintaining synchronization and generating secure random sequences. Thus, a careful complexity evaluation and optimization must precede implementation of the scheme on portable devices.

The feasibility of secure voice communication using the proposed technique was validated by real-world experiments. The precomputed pseudo-speech signal was sent over FaceTime between two iPhones 6 connected to the same WiFi network. The received signal could be decrypted into intelligible speech. Finally, we conducted an online perceptual speech quality assessment with a group of about 40 non-native English speakers. The experiment showed that the quality of decrypted speech gradually decays with growing channel distortion. The recordings used in the speech quality assessment and the pseudo-speech signals recorded on the mobile phones are available online.4

Authenticated Key Exchange (AKE) protocol over voice channels

Secret voice communication over a voice channel must be preceded by computing and sharing session keys in a secure and authenticated way. In some real-world scenarios, the exchange could be performed only over the same voice channel and without access to a Public Key Infrastructure. For this reason, we complemented the Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) key exchange with a flexible authentication robust against channel fading. Our customized ECDHE protocol could be used together with a key derivation algorithm (e.g., PBKDF2 [Kaliski, 2000, Moriarty et al., 2017]) to produce all the necessary secret key material.

The protocol offers two ways of authentication, by cryptographic signatures (e.g., ECDSA with the SHA256 function) and by Short Authentication Strings (SAS) compared vocally (e.g., eight hexadecimal numbers displayed on the device). Both authentication mechanisms are combined into a single mode of operation, as it simplifies signaling and allows users flexible authentication such as unilateral signature authentication. The message exchange between both parties over the voice channel can be done using the introduced DoV technique.

Protocol properties such as Perfect Forward Secrecy (PFS) and injective agreement on the session key were verified in a symbolic model by Tamarin Prover. The code used for verification is available online.5 Formal verification in the symbolic model gives higher confidence in the protocol's security. Nevertheless, the symbolic analysis has some limitations and must be followed by verification using the computational model and then by implementation auditing.

-155

The protocol does not prevent the issue of the speakers skipping SAS verification. Moreover, it is unclear whether a highly compressed speech signal, as in the case studied for our speech encryption scheme, contains enough paralinguistic information to enable speaker identification. These problems may be partially solved by introducing visual or acoustic effects encouraging a proper comparison and adding informal contextual questions.

System limitations and conclusion of the study

This study did not cover several implementation aspects of the whole communication system, such as signal synchronization, automatic adaptation to fluctuating channel characteristics, computational complexity, and implementation security. Nonetheless, the investigation of real voice channels and experimental results presented in this thesis strongly suggest that secure voice communication over digital voice channels is technically viable. The requirement is a reliable connection between the speakers to enable encrypted data transmission without the risk of a signal blockage and a synchronization loss.

On the other hand, the variety of speech coding techniques and implicit algorithms implemented in voice channels cast doubt on whether a universal technique compatible with any arbitrary voice channel can be found. Instead, it may be beneficial to dedicate the security system to some selected types of channel, e.g., cellular networks, VoIP, and fixed IP-phones. Despite the narrower range of targeted voice channels, the secure system should remain flexible to adapt to a particular channel and fluctuating transmission conditions. The system's flexibility could be enhanced by robust resynchronization mechanisms, adaptive bitrate, energy equalization, and countering voice detectors.

In some scenarios, requirements for connection stability, high throughput, and low channel distortion cannot be met. Thus, initiating a secure voice connection should be preceded by channel estimation. An interesting idea is to combine channel estimation with cryptographic key exchange to reduce call setup duration. A successful key exchange followed by vocal verification could become a good indicator of favorable channel conditions. Another solution is using dedicated devices that do not alter recorded speech before forwarding the signal to the voice channel input.

The encountered limitations prevent the studied voice communication system from becoming compatible with every arbitrary communication infrastructure. Nevertheless, the system can still offer some autonomy relative to particular communication infrastructure and a stronger security against spying malware. In our opinion, these advantages make the system a valuable complementary technique and justify further investigation.

Perspectives

Future work should focus on improving and extending the proposed techniques to make the next steps towards a fully operational system implementation.

The flexibility of the proposed Data over Voice technique is not yet fully exploited. It is worth experimenting with the automatic adjustment of the signal parameters depending on the fluctuating channel characteristic. For example, the transmitter may adaptively modify the harmonic frequencies and the size of the codebook used to minimize channel distortion at the receiving end. Moreover, the transmitter may determine the best strategy for countering voice detectors by a sensible combination of bandwidth alternation, amplitude variation, or silence insertion. Signal adaptation methods should significantly improve communication robustness.

An interesting direction to pursue is finding a better representation of speech parameters in speech encryption, especially of timbre. The primary objective is to find a perceptually linear speech representation that approximates distance relations in the perceptual domain. New speech representations should be investigated together with pseudo-speech synthesis techniques, so that signal distortion introduced by a voice channel would change speech perception in a quasi-linear way. One of the propositions would be to represent timbre as Mel-Frequency Cepstral Coefficients (MFCC) throughout all the processing steps.

Another research area is the use of machine learning techniques in secure speech communications. The experiments conducted so far indicate that neural-based voice synthesis improves decrypted speech quality, helps to reduce the transmission data rate, and enables compensation of distortion introduced by a particular voice channel. The multiple roles of neural networks suggest that machine learning techniques may become an essential tool in future secure voice applications. Some progress could be made by investigating new adapted network architectures, or by reducing their computational complexity for use on portable devices. Besides, an exciting idea would be to allow users to modify their voice characteristics without altering the linguistic content.

The symbolic protocol model described in this study should be extended by adding suitable ciphers and detailing the protocol's parameters to meet computational security requirements. The complete protocol model could be combined with the introduced DoV technique and implemented on prototype devices. In the final step, it may be worth combining key exchange with channel estimation in the form of training sequences.

B Authenticated Key Exchange Protocol with Identity Protection

The code below is the Tamarin file 'AKE_over_Voice_with_Identity_Protection.spthy' describing the authenticated key exchange (AKE) protocol with identity protection illustrated in Figure 6.8 in Chapter 6. The code is also available online. 8Compared to the protocol model presented in Annex A, the Responder and the Initiator encipher their identifiers using a function senc(data, symmetric_key) that denotes encryption with a symmetric key. Furthermore, the participants generate two sets of random nonces NA1, NA2 and NB1, NB2 for deriving a temporary symmetric key and the Session Key. Finally, a new restriction Verify_hRA was added, which obliges the Responder to verify the received hash. The security lemmas remained unchanged.

The presented code can be directly loaded by Tamarin9 and verified. The verification process takes about 10 minutes under Ubuntu kernel 5.8.0-25 and using Intel Core i7 2.9 GHz without multi-threading.

  (a) Key exchange and authentication with short codes displayed on the devices. (b) Encrypted conversation.

Figure 1

 1 Figure 1.1 -Establishing a secure vocal link over a voice channel.

Figure 1 . 2 -

 12 Figure 1.2 -Separated processing chain in digital speech encryption.

Figure 1

 1 Figure 1.3 -Joint source-cryptographic-channel coding of speech.

Figure 1

 1 Figure 1.4 -Frequency inverter in which speech is band limited.

Figure 1

 1 Figure 1.5 -Bandsplitting, and band permutation with band inversions.

Figure 1 . 6 -

 16 Figure 1.6 -Speech masking.Figure1.7 -Digital speech enciphering.

Figure 1

 1 Figure 1.8 -Block diagram of a SIGSALY transmitter.

Figure 1

 1 Figure 1.9 -Flow diagram of the manuscript.

Figure 2

 2 Figure 2.1 -Received and recorded signal sent over the WhatsApp application presented in the time domain (left) and the time-frequency domain (right). The signal consisted of eight phase-modulated harmonics in the 0.4-3.2 kHz range and short repeated synchronization tones at 3.6 kHz. After a few seconds of the transmission, WhatsApp suppressed the phase-modulated part of the signal and amplified synchronization tones.

2. 2 -Figure 2 . 2 -

 222 Figure 2.2 -Diagram of speech production and perception.

Figure 2 .

 2 Figure 2.3 -Phonatory and articulatory systems. Krasnowski.

Figure 2 .

 2 Figure 2.4 -Spectrogram of the recorded speech signal.

  Figure 2.5 -Simplified discrete-time, source-filter model for speech synthesis.

Figure 2 . 6 -

 26 Figure 2.6 -Lossless acoustic tube model of a vocal tract. Krasnowski.

Figure 2 Figure 2

 22 Figure 2.7 -LPC analysis of vowel /e/: (left) time-domain waveform, (right) filtering residual obtained with the 12th order LPC filter.

Figure 2

 2 Figure 2.9 -Magnitude (blue line, left y-axis) and phase (red line, right y-axis) response of the LPC filter of order 12, obtained by the LPC analysis of vowel /e/.

2

 2 Audio Layer III (MP3) [ISO/IEC, 1998], and Advanced Audio Coding (AAC) [ISO/IEC, 2006]. Speech perception is determined primarily by the physiological processing of sound captured by the pinna. The processing starts at the eardrum, which transforms acoustic pressure waves into mechanical vibrations. Next, the vibrations are transduced by the adjoint auditory ossicles (malleus, incus, and stapes) and transmitted through the oval window to the cochlea. Inside this snail-shaped organ filled with fluid, the mechanical vibrations produce multiple resonances at different longitudinal locations corresponding to specific frequency components (Figure 2.10). Finally, the frequency-sensitive hair-cell sensors distributed along the basilar membrane detect the resonances and trigger the generation of electric pulses transmitted to the brain by the auditory nerve.

Figure 2 .

 2 Figure 2.10 -Simplified model of the cochlea and the cochlea longitudinal frequency distribution.

Figure 2 .Figure 2 .

 22 Figure2.11 -Equal-loudness curves as a function of frequency and for different values of the sound intensity[ISO, 2003]

  R,where X is the Discrete Fourier Transform (DFT) of the speech frame, and W r [k] is the weighting function of the r-th filter ranging over DFT indices L r to U r . The number R and the distribution of filters may slightly differ among various implementations.

Figure 2 .

 2  Weighting functions for mel-scale filtering and (right) smooth interpolation of the DFT spectra X obtained when looking for all MFCC forced to zero except a single one in {C 0 , ..., C 4 } equal to 1. The computation of these MFCC is done using the bank of weighting functions in the left figure.

Figure 2 .

 2 Figure 2.14 -LPC analysis of vowel /e/: (left) time-domain waveform and (right) spectrum of the waveform (blue solid line), frequency response of the 18th order LPC filter (red dashed line), and the mel cepstrum smoothing obtained using the MFCC analysis and truncating MFCC above n = 13 (green dashed line).

Figure 2 .

 2 Figure 2.15 -Block diagram of a generic speech encoder and decoder.

Figure 2 .

 2 Figure 2.16 -Recorded speech signal compressed by the selection of different voice coders. G.726 is an ADPCM coder, which directly compresses the waveform. Codec2 preserves the spectral envelope and energy of the signal but discards phase information. AMR, an LPC coder, tries to fit the signal waveform into the speech production model. Despite significant differences in their representation, the presented signals are perceptually similar.

Figure 2 .

 2 Figure 2.17 -Simplified diagram of an algebraic CELP synthesizer with an adaptive codebook.

Figure 2 .

 2 Figure 2.19 -Simplified model of a 2G/3G cellular voice connection.

Figure 2 .

 2 Figure 2.21 -Phase-modulated harmonic signal sent over the WhatsApp application. The frequent alternation of audio bands in the signal and silence insertions may counter adaptive noise suppression and voice activity detection algorithms in a voice channel.

  Figure 3.1 -LPC analysis of vowel /a/: (a) time domain waveform, (b) spectrum of the waveform (blue solid line) and frequency response of the 12th order LPC filter (red dashed line), (c) residual of LPC analysis (solid blue line) and excitation peaks (red dashed line), (d) frequency spectrum of a residual.

Figure 3 . 2 -

 32 Figure 3.2 -Simplified diagram of LPC encoder and decoder.

  Figure 3.3 -SNR of a multi-tone signal compressed by a selection of LPC coders. The multi-tone signal consisted of eight harmonics at frequencies 400 Hz, 800 Hz, ..., 3200 Hz with a 400 Hz step. The harmonics were independently phase-modulated with a modulation of order 4 and a modulation rate of 200 baud.

Figure 3

 3 Figure 3.4 -Scatter plots of a four-harmonic signal compressed by AMR. Each plot represents the distortion of one phase-modulated harmonic at 400 Hz, 800 Hz, 1200 Hz, and 1600 Hz, with a modulation rate of 200 baud. Blue points correspond to compressed symbols, red dots denote the initial phase constellation, whereas yellow dots denote the sample means of compressed four symbols. The angle of the phase shift (restricted by black rays) varies in frequency.

  Error rate of phase detection.

Figure 3 . 6 -

 36 Figure3.6 -The average sample probability density function of a distortion of two harmonics at frequencies 800 Hz and 1600 Hz, compressed by a selection of LPC coders. The compressed signal consisted of four independently phase-modulated carriers at frequencies 400 Hz, 800 Hz, 1200 Hz, and 1600 Hz, with a modulation order 4 and a modulation rate of 200 baud. The averaged sample probability density function was measured over the I/Q representation for the four symbols constellation. The four density functions along radial axes are computed along the lines from the origin to the sample mean of the received decoded symbols (see Figure3.4). The four transversal axes are perpendicular to the radial axes and intersect the sample mean of the received decoded symbols. The x-axes are normalized to the initial amplitude value of each harmonic.

Figure 3 . 7 -

 37 Figure 3.7 -Statistical parameters of spectral distortion in multi-tone signals compressed by a selection of LPC coders. The initial multi-tone signal consisted of four independently phasemodulated harmonics at frequencies 400 Hz, 800 Hz, 1200 Hz, and 1600 Hz, with a modulation order 4 and a modulation rate of 200 baud. Then, the set of carriers was expanded by adding harmonics at 2000 Hz, 2400 Hz, ..., 3200 Hz with a 400 Hz step. Colored bars denote the lowest and highest values among harmonics, and bullets indicate the average.

Figure 3

 3 Figure 3.8 -Modulation and demodulation of a discrete DoV signal using a codebook of M predefined discrete audio waveforms.

Figure 3

 3 Figure3.9 -Three discrete-time codebook waveforms (respectively blue, red and green dots) of duration 5 ms and consisting of 10 harmonics at frequencies 600 Hz, 800 Hz, ..., 2400 Hz, with a 200 Hz step.

  denotes the initial phases of the corresponding codebook symbols in the training sequence.With the estimated φk and σ2 k , one may apply the phase shift compensation and spectral weighting of distortion in the demodulation rule (3.6):

  Standard error of phase-shift estimation. Standard error of variance estimation.

Figure 3 .

 3 Figure 3.10 -Estimated standard error of the phase-shift φk and the normalized variance σ2 k /σ 2 k estimators of distortion introduced by a selection of coders. The graphs present the maximum standard error over all harmonics k, and for every t between 0.5 and 2.5 seconds with a 0.05 second step. Results obtained based on 1000 Monte Carlo runs. The reference values φk and σ2 k were computed from a sample of 50000 symbols. The DoV signal consisted of 8 harmonics at frequencies 400 Hz, 800 Hz, ..., 3200 Hz with a modulation rate of 200 baud.

  Figure 3.11(b). The characteristic staircase shape of the graphs in Figures 3.11(a) and 3.11(b) corresponds to the codebook minimum distance d in function of the codebook size (ref. Table

Figure 3 .

 3 Figure 3.14 -DoV frame structure in a low (up) and a high (bottom) mode of operation. The numbers indicate the lengths of frame sections, given as a cardinality of DoV symbols. In the high mode, one DoV symbol represents two RS symbols.

Figure 3

 3 Figure 3.15 -Consecutive stages of the signal in secure voice communication over a 3G call.From top to bottom: the initial speech, the sent DoV signal, the received DoV signal and the resynthesized speech. The received signal was fully decodable despite strong signal attenuation.

  Definition 4.2.1. Let b 1 , b 2 , ..., b m be linearly independent vectors in R n . A lattice Λ with basis {b 1 , b 2 , ..., b m } is defined as the set of all linear combinations of the basis vectors: Λ = {u 1 b 1 + u 2 b 2 + ... + u m b m : u 1 , ..., u m ∈ Z}. (4.1) A lattice may equivalently be viewed as the set of vector endpoints determined by linear combinations of the basis vectors. The number m of independent vectors in the basis is the rank of Λ. If m = n, the lattice Λ is called full rank. The basis vectors form a generator matrix B = [b 1 , b 2 , ..., b m ].

  ≤ ∥u-v∥, (4.13) where ξ min = min 1≤i≤n ξ i ̸ = 0 and assuming ∥u -v∥ ≤ ξ min . It may be noticed that the distance ∥Φ ξ (u) -Φ ξ (v)∥ approaches ∥u -v∥ when ∥u -v∥ tends to 0.

Figure 4

 4 Figure 4.1 -Illustration of a 2-dimensional flat torus T ξ in R 4 associated with Φ ξ : a) the point ξ on S 1 , b) the flat surface P ξ of the torus, c) the first folding of P ξ , d) the second folding of P ξ realizable only in R 4 . From [Costa et al., 2017].

Figure 4 .

 4 Figure 4.2 presents a simple example of two nested lattices in R 2 associated with a spherical group code in R 4 through a torus mapping. The red dots in the middle of the picture belong to an orthogonal lattice Λ β = 2πξ 1 Z × 2πξ 2 Z, where (ξ 1 , ξ) = (0.8, 0.6). Since ξ = [ξ 1 , ξ 2 ] T is nonnegative with a unit norm, the points of Λ β can be viewed as vertices of frames that are the pre-images of the flat torus T ξ through the map Φ ξ .Besides, the red and black dots combined form another lattice Λ α such that Λ β ⊂ Λ α . It can be noticed, that the quotient Λ α /Λ β of order 4 can be mapped by Φ ξ to some spherical code C on S 3 ∈ R 4 . Moreover, since Λ α /Λ β is closed under translation by a single basis vector (the blue arrow), the code should be closed under an associated rotation on S 3 . Consequently, the code C is a commutative group code of order 4 with a single generator matrix.

Figure 4 . 2 -

 42 Figure 4.2 -Division of the 2-dimensional plane into frames associated with the flat torus mapping Φ ξ , ξ = [0.8, 0.6] T , and the pair of nested lattices Λ β (red dots) and Λ α (black, red, and green dots) defined over the same plane. The image Φ ξ (Λ α ) is a spherical code of order 4 (green dots on the torus). The blue arrow is a basis vector of the quotient Λ α /Λ β , which can be associated with a basic rotation generating the spherical code on S 3 .

Figure 4

 4 Figure 4.3 -Example of a construction of a spherical code on S 3 . The red arrows are the basis vectors of the orthogonal lattice Λ β , whereas the blue arrows are the basis vectors of the lattice Λ α such that Λ β ⊂ Λ α . The points in 2π/ √ 65Λ β determine the frame associated with the pre-image of the flat torus mapping Φ ξ , where ξ = [ 13/65, 52/65] T . The points of Λ α can be mapped to a spherical code of order 13. The code has only one generator matrix, associated with the basis vector of the quotient Λ α /Λ β (the green arrow). Yellow points are the lattice points associated with the spherical code.

  Definition 4.4.1.[Katz and Lindell, 2015, §3.2 in Chap. 3] A symmetric encryption scheme is a tuple of probabilistic polynomial-time algorithms Π = (KeyGen, Enc, Dec) such that:1. The key-generation algorithm KeyGen takes as input 1 λ , and outputs a key k from the finite key space K. The parameter λ is called a security parameter. 2. The encryption algorithm Enc takes as input a key k ∈ K and a plaintext message m from the message space M, and outputs a ciphertext c from the ciphertext space C. 3. The decryption algorithm Dec takes as input a key k ∈ K and a ciphertext c ∈ C, and outputs a message m ∈ M or an error.

  2. A key k is generated by running KeyGen(1 λ ), and a bit b ∈ {0, 1} is chosen uniformly at random. Then, the computed challenge ciphertext c = Enc k (m b ) is given to A. 3. A outputs bit b ′ . 4. The output of the challenge is 1 if b = b ′ and 0 otherwise. If PrivK eav A,Π (λ) = 1, we say that A succeeds.

Figure 4 . 4 -

 44 Figure 4.4 -Simplified diagram of the encryption scheme for scrambling spherical data.

  3. D randomly chooses b ∈ {0, 1} and produces V = Encrypt r (U b ). 4. D provides V to A and then obtains b ′ . Finally, D outputs 1 if b ′ = b and 0 otherwise. D is PPT, because A is PPT. Moreover, D outputs 1 with exactly the same probability as A in the indistinguishability challenge: Pr(D(r ← TrueRandGen) = 1) = Pr(PrivK eav A, Π(λ) = 1) = 1 2 Pr(D(r ← RandGen(s)) = 1) = Pr(PrivK eav A,Π (λ) = 1) 1 λ )) = |Pr(D(r ← RandGen(s)) = 1) -Pr(D(r ← TrueRandGen) = 1)| = = Pr(PrivK eav A,Π (λ) = 1) -Pr(PrivK eav A,

  = 0 and assuming ∥p -q∥ ≤ ξ min . Thus, the procedure Decode may lead to a distance expansion by a factor up to τ = π/(2ξ min ):

Figure 4

 4 Figure 4.5 -Projection of vectors to the flat torus T ξ in presence of excessive noise. The initial vector u ∈ C on the orbit of radius ξ min is transmitted over a transmission channel and received as v = u+n. The vector v is projected to the vector v on the opposite side of the orbit, far from u.

  I denotes the modulus and Υ ∈ [0, π], H ∈ [0, 2π] are the spherical angles of a color.

Figure 4 . 6 -

 46 Figure 4.6 -RGB colors in the modified lightness-chroma-hue (LCH) representation.

  . The procedure Encode(X) is done in three steps. Firstly, we extract the angular coordinates of every pixel γ 2 (x ℓ ) = [Υ ℓ , H ℓ ] T . Then, we quantize the vector [Υ ℓ , H ℓ ] T / √ 2 with a budget of 31 bits by searching the closest vector in the scaled checkerboard lattice:

  (a) Initial image. (b) Scrambled and decoded image.

Figure 4 . 7 -

 47 Figure 4.7 -Scrambling of colors in the image of size 384 × 512. Pixel colors of the initial image were converted to (I, Υ, H) representation. In the next step, the angular coordinates (Υ, H) were scrambled using a spherical group code in R 4 , and decoded back to the initial domain. The parameter I remained unchanged.

Figure 4 . 8 -

 48 Figure 4.8 -Images restored from scrambled spherical codewords distorted by Gaussian noise.

Figure 4

 4 Figure 4.9 -Error between (blue) initial/deciphered and (red) sent/received spherical points. Error caused by Gaussian noise at SNR = 15 dB inserted into enciphered data.

Figure 5

 5 Figure 5.1 -Simplified diagram of the distortion-tolerant speech encryption scheme.

Figure 5 . 2 -

 52 Figure 5.2 -Nine mel-scaled triangular spectral windows used in speech encoding. The amplitude of two side filters is doubled to compensate their missing halves.

Figure 5

 5 Figure 5.3 -Enciphering of the frame pitch period p (init) and the frame energy ε (init) . From top to bottom: Step 1: p (init) and log 10 (ε (init) ) are linearly scaled and rounded to κ (init) and ϱ (init) in Z 2 16 . Step 2: κ (init) and ϱ (init) are translated by random ν 1 and ν 2 over Z 2 16 to κ (enc) and ϱ (enc) .Step 3: κ (enc) and ϱ (enc) are linearly scaled to ε(enc) and p(enc) defined over the space of pseudospeech parameters.

  mod 2 16 . (5.5) Finally, the enciphered integers κ (enc) and ϱ (enc) are linearly scaled to p(enc) ∈ [p min , pmax ] and ε(enc) ∈ [ε min , εmax ]. Enciphering of D (init) ∈ S 8 is based on the framework for scrambling spherical data described in Chapter 4. The only difference is that enciphering is performed over the pre-image P ξ ⊂ R 8 of the torus mapping Φ ξ , where ξ = 1/ √ 8[1, ..., 1] T ∈ R 8 . The result of enciphering is mapped to S 15 , as shown in Figure 5.4.

Figure 5

 5 Figure 5.4 -Enciphering of D (init) . The scaled spherical coordinates 2γ ξ (D (init) ) are quantized by searching the closest lattice vector from Λ. The obtained χ (init) ∈ Λ is randomly translated by a vector from the quotient Λ/(2πZ 8 / √ 8) over P ξ and mapped to D(enc) = Φ ξ (χ (enc) ) on S 15 .

  Figure5.5 -Three 25 ms frames of a pseudo-speech harmonic signal. Every colored portion of the waveform encodes a different set of enciphered parameters p(enc) , ε(enc) and D(enc) . The frames are windowed using a trapezoidal window and overlapped, forming 5 ms guard periods.

Figure 5 . 6 -

 56 Figure 5.6 -Sixteen square-shaped spectral windows distributed uniformly over 300-6700 Hz.

  Let ŷ[0], ..., ŷ[399] be the samples of some received pseudo-speech frame ŷt and let Ŷ be a column vector of length 240 with the DFT of the sequence ŷ[80], ..., ŷ[319]. The received parameters p(rec) and ε(rec) are defined as: the estimated fundamental frequency of the signal frame and f s = 16000 Hz is the sampling frequency. If any of the values p(rec) and ε(rec) exceed the intervals [p min , pmax ] and [ε min , εmax ], they are tresholded to the closest bound.

  .22) where ν 1 , ν 2 ∈ Z 2 16 are obtained from the PRNG. If the values κ (dec) and ϱ (dec) exceed the respective intervals [κ low , κ high ] and [ϱ low , ϱ high ], they are tresholded to the closest bound. In the last step, the values are transformed back into the intervals [p min , p max ] and [log 10 (ε min ), log 10 (ε max )] representing the domain of speech parameters. The deciphering of the unit vector D(rec) is done by translating χ (rec) = Φ -1 ξ ( D(rec) ):

  Figure 5.7 -Overview of the narrowband LPCNet architecture. The symbol z -1 denotes a onesample delay.

3.

  A outputs bit b ′ . 4. The output of the challenge is 1 if b = b ′ and 0 otherwise.

Figure 5 .

 5 Figure 5.10 -Large deciphering error of energy due to excessive distortion.

Figure 5 .

 5 Figure 5.11 -Projection of D(enc) to the opposite side of the flat torus T [ξ 1 ,ξ 2 ] along single dimension, seen as translation by πξ 2 in the pre-image of the torus.

Figure 5 .

 5 Figure 5.12 -Computing the training data with noise injection in the first training stage to simulate a noisy recording. The Q block denotes µ-law quantization and Q -1 denotes conversion from µlaw to the linear domain. The prediction filter s[n] = 12 k=1 ãk z -k is applied to the noisy and quantized input. The excitation samples e[n] are the difference between the clear speech samples s[n] and the predicted ones. The symbol z -1 denotes a one-sample delay.

Figure 5 .

 5 Figure 5.13 -Computing the training data with noise injection in the second training stage to simulate a voice channel with distortion (on the top) and a noisy reception (at the bottom). The diagram simulates encryption of speech parameters with the given random sequence and transmission over a voice channel with predefined distortion. The symbol z -1 denotes a one-sample delay.

Figure 5 .

 5 Figure 5.14 -Equivalent diagram for computing the training data with noise injection in the second training stage. The second distortion simulating a voice channel is injected directly into speech parameters. The distribution of distortion simulates distortion introduced by a transmission channel and can be obtained by simulations or experiments. The symbol z -1 denotes a one-sample delay.

  4

  5.2 present the encoding parameters of speech and pseudo-speech signals. The intervals [ε min , ε max ] and [p min , p max ] were obtained from the TSP English speech corpus. 5 The selection of the intervals [ε min , εmax ], [p min , pmax ] and the bounds [κ low , κ high ], [ϱ low , ϱ high ] was done based on simulations.

  ),ℓ -D (dec),ℓ ∥ 2 L .

Figure 5

 5 Figure 5.15 -Waveforms at different stages of signal encryption.

Figure 5 .

 5 Figure 5.16 -Consecutive stages of signal encryption, presented in the time-frequency domain. From top to bottom: initial speech, encrypted signal and resynthesized speech. The spectrograms were obtained using a 1024-point Hann window.

Figure 5

 5 Figure 5.17 -Waveforms at different stages of signal encryption with Gaussian noise at SNR = 15 dB added to encrypted pseudo-speech.

Figure 5 Figure 5

 55 Figure 5.18 -Distortion of received and deciphered parameters caused by adding Gaussian noise at SNR = 15 dB to encrypted speech.

Figure 5

 5 Figure 5.22 -Consecutive stages of signal encryption in communication over FaceTime between two iPhones 6. The recordings are available online at https://github.com/ PiotrKrasnowski/Speech_Encryption.

Figure 5 .

 5 Figure 5.24 -Rating scale used in the perceptual speech quality test.

Figure 5 Figure 5

 55 Figure 5.25 -Results of the MUSHRA-based subjective quality assessment of speech decrypted from signals with added Gaussian noise of different intensity. Bars mark standard deviation.

6. 1

 1 MotivationAn increasing concern of privacy violation in voice communications has motivated the development of secure voice over IP (VoIP) applications, with Telegram and Signal being the iconic examples. 1 However, these applications are inherently insecure against spying malware installed on the smart-phone[START_REF] Scott-Railton | Reckless Exploit: Mexican Journalists, Lawyers, and a Child Targeted with NSO Spyware[END_REF]. Parallelly, cryptographically secure applications requiring higher protection rely on dedicated hardware, most commonly Crypto Phones. These closed and unverifiable solutions suffer from high costs and low flexibility, as typically encrypted phones allow communications exclusively over a single kind of a voice channel, like GSM.The mentioned limitations encourage the search for open solutions complementary to Crypto Phones, combining flexibility and high protection provided by specialized hardware. A new idea, depicted in Figure6.1, is based on voice encryption in the audio domain. The speech is acquired by (a) the headset's microphone and then forwarded to (b) the encryption device (here called the Crypto Box). The Crypto Box processes the speech and enciphers vocal parameters of the signal. The encrypted speech in the form of a data stream shaped into a pseudo-speech audio signal (e.g., as proposed in Chapters 3 and 5) is transmitted by (c) the audio link to the audio input of (d) the phone and sent through 2G-4G networks or VoIP. Finally, the received pseudo-speech is deciphered by the paired Crypto Box on the other side of the channel.

Figure 6 .

 6 Figure 6.1 -Encrypted voice over voice channel scheme.

Figure 6 .

 6 Figure 6.4 -Tamarin code of the security lemma Session_Key_Secrecy_1.

Figure 6 .

 6 Figure 6.5 -Counterexample falsifying the lemma Session_Key_Secrecy_1. The green boxes represent the protocol rules. The specific inputs of the rules are connected with the outputs of former rules by arrows. The ellipses denote adversarial actions. In this counterexample, the adversary (a) creates invalid signature, (b) impersonates legitimate user $ID_A and inserts the invalid public key 'g', and (c) obtains the session key 'g'ˆBprivkey.

Figure 6 . 6 -

 66 Figure 6.6 -Tamarin code of the improved security lemma Session_Key_Secrecy_2.

  . . . . . . . . . . . . . . . . . . . . . Unsecured call initiation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

  32 . . . . . . . . . . . . . . . . . . . . Key exchange and authentication . . . . . . . . . . . . . . . . . . . .

  h 256 (Z∥•) . . . . . . . . . . . . . . . . . . . . . . . . . . . Acknowledgment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SAS comparison over Encrypted Channel . . . . . . . . . . . . . . . . 10 : SAS = h 32 (⋆) SAS vocal ← -------------------------→comparison SAS = h 32 (⋆)

  . . . . . . . . . . . . . . . . . . . . . . . . . . . Unsecured call initiation and Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1 : N A1 ←$ Z * 32 A/B role ← -----------------→ negotiation N B1 ←$ Z * 32 2 : N A2 ←$ Z * 128 N B2 ←$ Z * 128 3 : d A ←$ Z * 256 d B ←$ Z * 256 4 : Q A = d A G Q B = d B G 5 : R A ←$ Z * 128 R B ←$ Z *32 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Key exchange and authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

  Figure 6.8 -Key exchange protocol over voice channels with identity protection.

Table 2 .

 2 2 -The average 'curved' lengths (in millimeters) of lip, tongue blade, tongue dorsum, velum and pharynx in male, female and child speakers[START_REF] Fitch | Morphology and development of the human vocal tract: A study using magnetic resonance imaging[END_REF].

		Lip	Blade	Dorsum	Velum	Pharynx	Total
	Male	14.5	25.5	26.8	34.0	60.4	161.2
	Female	12.8	24.8	24.6	37.2	46.9	146.4
	Child (5-10)	13.5	20.0	22.6	27.5	35.7	119.5

Table 2 .

 2 3 -Bark scale critical bands[START_REF] Fastl | Psychoacoustics: facts and models[END_REF]].

	Bark Center Freq. (Hz) Bandwidth (Hz) Bark Center Freq. (Hz) Bandwidth (Hz)
	1	50	100	13	1850	280
	2	150	100	14	2150	320
	3	250	100	15	2500	380
	4	350	100	16	2900	450
	5	450	110	17	3400	550
	6	570	120	18	4000	700
	7	700	140	19	4800	900
	8	840	150	20	5800	1100
	9	1000	160	21	7000	1300
	10	1170	190	22	8500	1800
	11	1370	210	23	10500	2500
	12	1600	240	24	13500	3500

Table 2 .

 2 4 -Simplified relation between the perceptual and the physical qualities of speech signal.

	Perceptual Quality	Physical Quality
	loudness	signal intensity
	pitch	fundamental frequency
	timbre	spectral envelope

Table 2 .5 -Selected modems used in data transmission over telephony network

 2

	.

Table 2 .

 2

	6 -Possible positions of individual pulses in the algebraic codebook in the 12.2 kbps mode
	of the narrowband AMR.
	Track	Pulse	Positions
	1	i 0 , i 5	0, 5, 10, 15, 20, 25, 30, 35
	2	i 1 , i 6	1, 6, 11, 16, 21, 26, 31, 36
	3	i 2 , i 7	2, 7, 12, 17, 22, 27, 32, 37
	4	i 3 , i 8	3, 8, 13, 18, 23, 28, 33, 38
	5	i 4 , i 9	4, 9, 14, 19, 24, 29, 34, 39

  Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

	This chapter presents a novel Data over Voice (DoV) technique based on codebooks
	of short harmonic waveforms. The technique provides a sufficiently fast and reliable
	data transfer over cellular networks and many VoIP applications. The new method relies
	on general principles of Linear Predictive Coding for voice compression (LPC voice
	coding) and is more versatile compared to solutions trained on exact channel models.
	The technique gives a high control over the desired transmission rate and robustness
	to channel distortion. Furthermore, an efficient codebook design approach inspired by
	quaternary error-correcting codes is proposed.
	The proposed technique was thoroughly tested with real voice calls. These experiments
	have successfully validated the usability of the proposed DoV technique for secure voice
	communication over cellular networks and VoIP. The chapter details the system para-
	meters, emphasizing the system's security and technical challenges.
	3.1 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
	3.2 Digital voice channels . . . . . . . . . . . . . . . . . . . . . . . . 39
	3.2.1 Voice channel characteristics . . . . . . . . . . . . . . . . . 39
	3.2.2 LPC coders . . . . . . . . . . . . . . . . . . . . . . . . . . 39
	3.3 Data over LPC voice coders . . . . . . . . . . . . . . . . . . . . . 41
	3.3.1 Multi-tone modulation over LPC voice coders . . . . . . . 41
	3.4 Proposed DoV technique . . . . . . . . . . . . . . . . . . . . . . 45
	3.4.1 Codebook design . . . . . . . . . . . . . . . . . . . . . . . 48
	3.5 Experiments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
	3.5.1 Channel estimation . . . . . . . . . . . . . . . . . . . . . . 50
	3.5.2 Simulations . . . . . . . . . . . . . . . . . . . . . . . . . . 50
	3.5.3 Real-world tests . . . . . . . . . . . . . . . . . . . . . . . 51
	3.6 Secure voice communication . . . . . . . . . . . . . . . . . . . . 53
	3.6.1 Communication system . . . . . . . . . . . . . . . . . . . . 53
	3.6.2 Security discussion . . . . . . . . . . . . . . . . . . . . . . 57
	3.6.3 Computational complexity . . . . . . . . . . . . . . . . . . 58
	3.7

  Algorithm

		6	6	4	4	3	3	2	2	2	1	1	-	-
	8	8	8	6	6	4	4	4	4	2	2	2	2	1
	9	8	8	6	6	5	4	4	4	3	2	2	2	1
	10	10	9	7	6	6	5	5	4	4	3	3	2	2

1: CodebookSearch(C, M ) Data: the set of quaternary codewords C, an even size of codebook M ; Result: a set Cb of M quaternary codes ; Cb ←-∅; // select the first codeword (random or pre-defined)

Table 3 .

 3 2 -Symbol error rate of DoV signal over 3G call with and without channel estimation.

	10 harmonics, symbol duration 5 ms
	bitrate	4 s training period no training
	1

Table 3

 3

		.3 -Symbol error rate of DoV signal over VoIP.
		8 harmonics, symbol duration 2.5 ms, 4 s training period
	bitrate	Face Time	Skype	Signal Messenger WhatsApp
	4

Table 3 .

 3 4 -Selected parameters of the secure voice communication system.

	version:	low mode ( 3G )	high mode ( VoIP )
	DoV frame
	codebook size:	64	4096
	DoV symbol order:	6 bits	12 bits
	modulation rate:	400 baud	400 baud
	bitrate:	2400 bps	4800 bps
	frame duration:	80 ms	60 ms
	frame length:	32 symbols / 192 bits	24 symbols / 288 bits
	Reed-Solomon coding
	RS symbol order:	6 bits	6 bits
	message length:	20 symbols / 120 bits	28 symbols / 168 bits
	• encrypted speech:	96 bits	144 bits
	• frame counter:	16 bits	16 bits
	• control checksum:	8 bits	8 bits
	code length:	28 symbols / 168 bits	40 symbols / 240 bits
	redundancy:	8 symbols / 48 bits	12 symbols / 72 bits
	Voice enciphering	AES 256 (CTR mode) AES 256 (CTR mode)
	Voice compression	Codec2 1200 bps	Codec2 2400 bps
	The processing chain starts with low-bitrate speech compression. In this work, voice is en-
	coded by Codec2, an open-source algorithm developed by Rowe 2 and J.-M. Valin, which offers
	speech compression down to 450 bps

Table 3 .

 3 5 -Performance of encrypted voice transmission over cellular voice channels and VoIP.

	3G	Face Time	Skype	Signal Messenger WhatsApp
	effective BER: 3

  4.1 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.2 Lattices and lattice packings . . . . . . . . . . . . . . . . . . . . 4.2.1 Lattices and lattice packings . . . . . . . . . . . . . . . . . 4.2.2 Special lattices and finding the closest lattice points . . . . . 4.3 Spherical commutative group codes from lattices . . . . . . . . . 4.3.1 Spherical commutative group codes . . . . . . . . . . . . . 4.3.2 Torus mapping . . . . . . . . . . . . . . . . . . . . . . . . 4.3.3 Spherical commutative group codes from lattices . . . . . . 4.4 Asymptotic secrecy of pseudo-random generators . . . . . . . . 4.5 Distortion-tolerant encryption . . . . . . . . . . . . . . . . . . . 4.6 Enciphering using spherical codes . . . . . . . . . . . . . . . . . Scrambling of image colors . . . . . . . . . . . . . . . . . . . . . 4.8 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

	Glossary
	List of abbreviations
	CVP	Closest Vector Problem
	PPT	Probabilistic Polynomial Time
	PRNG	Pseudo-Random Number Generator
	RMSE	Root Mean Squared Error
	SNR	Signal-to-Noise Ratio
	Notation -lattices and spherical codes
	Λ, Λ α , Λ β	lattices
	S n	unit sphere in R n+1 centered at the origin
	C	spherical commutative group code
	σ	initial codeword of the code C
	G	commutative group of orthogonal matrices

4.6.1 Overview of the encryption scheme . . . . . . . . . . . . . 4.6.2 Encoding . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.6.3 Decoding . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.6.4 Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . 4.6.5 Decryption . . . . . . . . . . . . . . . . . . . . . . . . . . 4.6.6 Transmission over the Gaussian channel . . . . . . . . . . . 4.7

  4.2 -4.2.2 Special lattices and finding the closest lattice points 67 4.2.2 Special lattices and finding the closest lattice points Some lattices are characterized by some special structures and high densities which are of interest in this work. In particular, one of the desired properties is the simplicity of finding the closest lattice point v to any z ∈ R n :

	v = min w∈Λ	∥z -w∥ .	(4.7)

  M }, where 2πa i,j /M come from block-diagonalization of elements in G. The lattice Λ α has the sublattice Λ β = n j=1 2πξ j Z with an orthogonal basis, and G is isomorphic to the quotient Λ α /Λ β .Corollary 4.3.3.[Costa et al., 2017, p. 82] Let Λ β ⊂ Λ α be a pair of full rank lattices with generator matrices A β = [β 1 , β 2 , ..., β n ] and A α , respectively. Moreover, let the basis of Λ β be orthogonal. There exists an integer matrix H such that A

β = A α H. Matrix H has a Smith normal form H = P DQ where P and Q are unimodular matrices and D is a diagonal matrix with diag

  5.1 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.2 Speech encryption scheme . . . . . . . . . . . . . . . . . . . . . 5.2.1 Speech encoding . . . . . . . . . . . . . . . . . . . . . . . 5.2.2 Enciphering . . . . . . . . . . . . . . . . . . . . . . . . . . 5.2.3 Pseudo-speech synthesis . . . . . . . . . . . . . . . . . . . 5.2.4 Signal transmission and analysis . . . . . . . . . . . . . . . 5.2.5 Deciphering . . . . . . . . . . . . . . . . . . . . . . . . . . 5.2.6 Speech resynthesis . . . . . . . . . . . . . . . . . . . . . . 5.3 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.3.1 Security considerations . . . . . . . . . . . . . . . . . . . . 5.3.2 Tolerance to signal distortion and large deciphering errors . 5.3.3 Selection of bounds for the signal parameters . . . . . . . . 5.3.4 The narrowband LPCNet training data . . . . . . . . . . . . 5.4 Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.4.1 Experimental setup . . . . . . . . . . . . . . . . . . . . . . 5.4.2 Simulations . . . . . . . . . . . . . . . . . . . . . . . . . . 5.4.3 Speech quality evaluation . . . . . . . . . . . . . . . . . . 5.4.4 Algorithmic latency and computational complexity . . . . . 5.5 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

	94	CHAPTER 5 -Distortion-tolerant speech encryption
	Glossary
	List of abbreviations
	AWGN	Additive White Gaussian Noise
	LPC	Linear Prediction Coding
	MAC	Message Authentication Code
	MFCC	Mel-Frequency Cepstral Coefficients
	MNRU	Modulated Noise Reference Unit
	MOS	Mean Opinion Score
	MUSHRA	MUltiple Stimuli with Hidden Reference and Anchor
	PCM	Pulse Coded Modulation
	PPT	Probabilistic Polynomial Time
	PRNG	Pseudo-Random Number Generator
	PSD	Power Spectral Density
	RMSE	Root Mean Squared Error
	SNR	Signal-to-Noise Ratio
	VAD	Voice Activity Detection
	VoIP	Voice over Internet Protocol
	Notation -spherical codes and lattices
	S n	unit sphere in R n+1 centered at the origin
	C	spherical commutative group code (see Section 4.3)
	σ	initial codeword of the code C
	G	commutative group of orthogonal matrices
	G i	orthogonal matrix i from G
	T 3.2)
	P ξ	pre-image of the torus mapping Φ ξ
	γ n (x)	function S n → R n which outputs angular coordinates of x
	Γ 8	Gosset lattice in R 8
	Notation -speech and pseudo-speech
	ε (init) , ε (dec) initial and deciphered frame energies
	ε(enc) , ε(rec) enciphered and received frame energies (mark the tilde)
	p (init) , p (dec) initial and deciphered pitch periods
	p(enc) , p(rec) enciphered and received pitch periods (mark the tilde)
	D (init) , D (dec) initial and deciphered vectors on S 8 representing spectral envelopes
	D(enc) , D(rec) enciphered and received vectors on S 15 representing spectral envelopes
	p min , p max	minimum and maximum value of p (init) and p (dec)
	pmin , pmax	minimum and maximum value of p(enc) and p(rec)
	ε min , ε max	minimum and maximum value of ε (init) and ε (dec)
	εmin , εmax	minimum and maximum value of ε(enc) and ε(rec)

ξ flat torus in R 2n associated with a positive unit vector ξ ∈ R n Φ ξ

(•)

torus mapping R n → R 2n associated with ξ ∈ R n (see Section 4.

  , ..., ν 10 ] T ∈ Z 2 15 ⊕ Z 6 2 16 ⊕ Z 2 17

	100			CHAPTER 5 -Distortion-tolerant speech encryption
	and [ν 3
		2π/2 16	0	0	0	0	0	2π/2 17	
	0 0 0 0 0 0 0	2π/2 16 -2π/2 16 0 2π/2 16 -2π/2 16 0 0 0 2π/2 16 -2π/2 16 0 0 0 0 0 2π/2 16 -2π/2 16 0 0 0 0 0 0 0 2π/2 16 -2π/2 16 2π/2 17 0 2π/2 17 0 2π/2 17 0 2π/2 17 0 2π/2 17 0 0 0 0 0 2π/2 16 2π/2 17 0 0 0 0 0 0 2π/2 17	            

Table 5 .

 5 1 -Parameters used for speech encoding and synthesis.

	Parameter	Value
	frame length	20 ms
	sampling frequency	8 kHz
	sample representation	int16
	energy bounds (ε Table 5.2 -Parameters used for pseudo-speech encoding and synthesis.
	Parameter	Value
	frame length	25 ms
	guard period	5 ms
	sampling frequency	16 kHz
	sample representation	int16
	energy bounds	(ε min , εmax ) = (10 9 , 10 10 )
	pitch period bounds	(p min , pmax ) = (80, 160)

min , ε max ) = (10, 10 8 ) pitch period bounds (p min , p max ) = (16, 128) energy guard bounds (ϱ low , ϱ high ) = (

2

13 , 2 16 -2 13 -1) pitch guard bounds (κ low , κ high ) = (2 13 , 2 16 -2 13 -1)

Table 5 .

 5 3 -RMSE of received and deciphered values in communication over FaceTime between two iPhones 6. Results retrieved from 120 seconds of a recorded signal.

	RMSE ε,(dec) 1493.30	RMSE ε,(rec) 1644.73
	RMSE p,(dec)	525.70	RMSE p,(rec)	867.30
	RMSE D,(dec)	0.12	RMSE D,(rec)	0.16

Table 5 .

 5 4 -Hidden anchors and tested systems in the MUSHRA-based speech quality assessment.

		Reference and anchors
	Label		Description
	reference	wideband speech sampled at 16 kHz
	mid-anchor	narrowband speech sampled at 8 kHz
	low-anchor	8 kHz narrowband speech with MNRU at SNR = 15 dB
		Systems under test in the assessment 1
	Label		Description
	no distortion	decrypted speech from signal with no distortion
	20 dB SNR	decrypted speech from signal with AWGN at SNR = 20 dB
	15 dB SNR	decrypted speech from signal with AWGN at SNR = 15 dB
	10 dB SNR	decrypted speech from signal with AWGN at SNR = 10 dB
		Systems under test in the assessment 2
	Label		Description
	Silk 64 kbps decrypted speech from signal compressed with Silk at 64 kbps
	Silk 48 kbps decrypted speech from signal compressed with Silk at 48 kbps
	Silk 32 kbps decrypted speech from signal compressed with Silk at 32 kbps
	FaceTime	decrypted speech from signal sent over FaceTime
	Table 5.5 -Number of participants in the listening test.
		Test	Participants
		Intelligibility test	44
		Quality test 1	40 *
		Quality test 2	37 * *
		* 18 listeners rated 5 utterances instead of 6

Table 5 .

 5

		6 -Intelligibility test results.
	System	Sample mean Sample standard deviation
	Reference	97.5	6.6
	Decrypted	86.0	14.7
	reference mid-anchor	no dist.	SNR=20 dB SNR=15 dB SNR=10 dB low-anchor

Table 5

 5

	.7 -Estimated complexity using PyPaPi library.
	Process	MFLOPS
	speech encoding	8 *
	enciphering	2
	pseudo-speech synthesis	1032
	pseudo-speech analysis	2756
	• pitch prediction	2123
	• remaining	634
	deciphering	2
	speech synthesis	2000 *
	* from

Table 6 .

 6

		1 -Glossary.
	Acronyms Definitions	Bits
	ID U	fixed user identifier	32
	N U	random and unique nonce	32
	K S	Session Key	256
	SAS	Short Authentication String	32
	(R A , R B ) Short Authentication String seeds (128, 32)
	(d U , Q U ) secret/public ECDHE key pair	(256, 256)
	(S U , V U ) signing/verification key pair	(256, 256)
	Sign S U (•) signature (signed with S U )	256
	h X (•)	hash function with truncation	X

Table 6 .

 6 2 -Security properties verified by Tamarin in four authentication scenarios.

	Authentication	mutual signature	unilateral signature	SAS vocal	no authen-
	scenario:	authentication	authentication	verification	tication
	Session Key secrecy	✓	✓	✓	✗
	forward secrecy	✓	✓	✓	✗
	non-injective agreement	✓	✓	✓	✗
	injective agreement	✓	✓	✓	✗
	reflection attack	✓	✓	✗	✗
	key compromise impersonation	✓	✓	-	-

https://github.com/PiotrKrasnowski/Data_over_Voice

https://rowetel.com

An encryption algorithm is 'malleable' if it is possible to transform a ciphertext into another ciphertext which decrypts to a bona fide plaintext.

https://github.com/PiotrKrasnowski/Speech_Encryption

Japanese has a very simple phonology, that makes it particularly useful for experimenting with ML techniques.

https://tamarin-prover.github.io/

https://github.com/PiotrKrasnowski/AKE_over_Voice

https://github.com/PiotrKrasnowski/AKE_over_Voice

https://web.archive.org/web/20160125103112/http://stat.fsu.edu/pub/ diehard/

https://webhome.phy.duke.edu/~rgb/General/dieharder.php

https://github.com/PiotrKrasnowski/Speech_Encryption

https://github.com/PiotrKrasnowski/AKE_over_Voice

https://github.com/PiotrKrasnowski/AKE_over_Voice

https://tamarin-prover.github.io/

Acknowledgements

CHAPTER 6 -Key exchange over voice channels

Alice Bob

ID B , g y ← --------------Sign S B ( ID A ∥g x ∥g y )

3 : K S = g xy Sign S A (ID B ∥g y ∥g x ) --------------→K S = g xy Protocol modeling: The Tamarin code describing the protocol model is listed in Figure 6.3. The model consists of a key pair generation rule Generate_pk and four multiset rules which specify the protocol interactions. Each of the rules can be invoked an unlimited number of times and in any order.

Annexes

A Authenticated Key Exchange Protocol

The code below is the Tamarin file 'AKE_over_Voice.spthy' describing the authenticated key exchange (AKE) protocol illustrated in Figure 6.7 in Chapter 6. The code is also available online. 6 The first file section details special events. The rule Generate_pk generates a signature private/public key pair (!Ltk($U, ∼ ltk), !Pk($U, pk(∼ ltk))) for arbitrary user U. The rule Reveal_ltk compromises a user U and reveals her signing key ltk to the adversary. Finally, the rules VoiceChannelOut and VoiceChannelIn symbolize two ends of a channel used in vocal verification. In contrast to other rules, the output of VoiceChannelOut cannot be modified by the adversary without being revealed at the rule VoiceChannelIn.

The second file section describes the interaction between the Initiator (Alice) and the Responder (Bob). In the exchange, users share their identifiers, public keys, nonces, signatures, and hashes. The participants commit to all values and verify received hashes. A scenario when a user cannot verify the digital signature is solved by introducing alternative rules Alice_2_nosign and Bob_2_nosign. Mutual vocal verification is symbolized by the rule Compare_SAS. The correct protocol interaction can be checked by running lemmas executable1 and executable2.

In the third part, the code specifies security lemmas. The lemmas Non_Injective_Agreement and Injective_Agreement verify respectively non-injective and injective agreements between participants assuming signature or vocal authentication. The secrecy of the Session Key is checked by lemmas Session_Key_Secrecy and Perfect_Forward_Secrecy. The last lemmas Impersonation_with_signature, Reflection_with_signature, and Reflection_no_signature, test protocol's resilience against user impersonation and reflections.

The presented code can be directly loaded by Tamarin 7 and verified. The verification process takes about 10 minutes under Ubuntu kernel 5.8.0-25 and using Intel Core i7 2.9 GHz without multi-threading.

theory AKE_over_voice_channels begin builtins: diffie-hellman, signing, hashing // Generation of the key pair rule Generate_pk:

[

// user U1 playing a role 'role' // completed a run presumably with U2 Commit( role, U1, U2, sessKey, SAS ) @ i & not( U1 = U2 ) & CompareSAS( role, U1, U2, SAS, SAS ) @ j // then U2 was running the protocol with U1 // and both agreed on sessKey ==> ( Ex #k. Running( role, U1, U2, sessKey ) @ k & k < j // and there is a unique matching instance & not ( Ex U3 U4 #i2. Commit_S( role, U3, U4, sessKey, SAS )

exists-trace "not All role U1 U2 sessKey SAS #i. // user U1 playing a role 'role' // completed a run presumably with U2 Commit( role, U1, U2, sessKey, SAS ) @ i & not( U1 = U2 ) // but U2 was NOT running the protocol with U1 // or there is another matching instance ==> (Ex #k. Running( role, U1, U2, sessKey

, Running( 'A', $A, $B, < $A, $B, NA2, ~NB2, X ^~ekB >) , Commit_S( 'B', $B, $A, < $A, $B, NA2, ~NB2, X ^~ekB >, h(< RA, ~RB, ~NB1, 'g' ^~ekB >) ) , SessionKey( $B, $A, < $A, $B, NA2, ~NB2, X ^~ekB >, h(< RA, ~RB, ~NB1, 'g' ^~ekB >) ) ]-> [ Out( senc(< sign{ $A, NA2, X, $B, ~NB2, 'g' ^~ekB }ltkB >, h(< X ^~ekB, 'B2', ~NB1, NA1 >))) , Out_A( $B, $A, h(< RA, ~RB, ~NB1, 'g' ^~ekB >) ) ] rule Bob_2_nosign:

[ Bob_1( $B, ~NB1, ~NB2, NA1, ~ekB, X, ~RB, hRA ) , !Ltk( $B, ltkB ) , In(< RA, senc(< $A, NA2, sign{ $B, ~NB2, 'g' ^~ekB, $A, NA2,

// this restriction obliges Bob to verify the received hash restriction Verify_hRA: "All u1 u2 x y #i. ComparehRA( u1, u2, x, y ) @i ==> x = y" rule Compare_SAS:

lemma executable_signature : exists-trace "Ex A B sessKey SAS #i #j. Commit_S( 'A', A, B, sessKey, SAS ) @ i & Commit_S( 'B', B, A, sessKey, SAS ) @ j & not( A = B ) & not( Ex U #k . LtkReveal(U) @ k )" // authentication lemmas lemma Non_Injective_Agreement : " //signed ( All role U1 U2 sessKey SAS #i. // user U1 playing a role 'role' // completed a run presumably with U2 Commit_S( role, U1, U2, sessKey, SAS ) @ i // then U2 was running the protocol with U1 // and both agreed on sessKey ==> ( Ex #j. Running( role, U1, U2, sessKey ) @ j ) // or the adversary revealed a secret key of the user U2 "All role U1 U2 sessKey SAS #i. // user U1 playing a role 'role' // completed a run presumably with U2 Commit_S( role, U1, U2, sessKey, SAS ) @ i & not( U1 = U2 ) & // but U2 was NOT running the protocol // with U1 (adversary impersonated U2) not( Ex #j. Running( role, U1, U2, sessKey ) @ j & j < i ) // then the adversary revealed // a secret key of the user U2 earlier ==> Ex #r. LtkReveal(U2) @ r & r < i " 200 ANNEXES lemma Reflection_with_signature :

"All role U1 U2 sessKey SAS #i. // user U1 playing a role 'role' // completed a run presumably with U2 Commit_S( role, U1, U2, sessKey, SAS ) @ i & // and was not running the protocol as both roles at the same time // (this configuration is not possible in the analyzed case) // (moreover, U1 would be aware of the double role) not( Ex role2 #j. Running( role2, U1, U2, sessKey ) @ j & not( role = role2 ) ) ==> // then U1 is different than U2 not( U1 = U2 )" lemma Reflection_no_signature : exists-trace "not All role U1 U2 sessKey SAS #i #j. // user U1 playing a role 'role' completed a run presumably with U2 SessionKey( U1, U2, sessKey, SAS ) @ i & CompareSAS( role, U1, U2, SAS, SAS ) @ j & // and was not running the protocol as both roles at the same time // (this configuration is not possible in the analyzed case) // (moreover, U1 would be aware of the double role) not( Ex role2 #k. Running( role2, U1, U2, sessKey) @ k & not( role = role2 ) ) ==> // but U1 is U2 not( U1 = U2 )" end