# Synthesis of Sources of Common Randomness Based on Keystream Generators with Shared Secret Keys
## 9 Security Analysis and Practical Consideration  
Generic attacks on SKD systems are based on optimal eavesdropper strategies for estimating the sequence \(W_{i}\). Based on Theorem 6, we conclude that the proposed system is resistant to this type of attack. However, strategies for reconstructing the secret key \(K_{G}\) are the most critical for this class of systems. If [PERSON] is able to reconstruct \(K_{G}\), she obtains the same keystream \(C_{K}\) as [PERSON] and [PERSON]. In that case, [PERSON]'s optimal strategy consists of generating her own local binary noise \(X_{E}\sim B(\varepsilon)\) and tracking all steps of the IR and PA protocols executed by [PERSON] and [PERSON] [1]. In that case, based on Equation (15), we obtain that the secrecy capacity is  
\[C_{S}=min\{I(X_{A};X_{B}),\ I(X_{A};X_{B}|X_{E})\}=I(X_{A};X_{B}|X_{E})=h_{b}(P_ {AB})-h_{b}(P_{AE})=0\, \tag{108}\]  
given that  
\[P_{AB}=P_{AE}=2\varepsilon(1-\varepsilon)\, \tag{109}\]  
and assuming that the AD protocol is not applied, which could otherwise shift the advantage to [PERSON] and [PERSON] over [PERSON]. This type of attack is prevented in the CR KSG system by continuously maintaining the equivocation \(H(K_{G}|S)\) above a predefined threshold \(\Delta_{K_{G}}\). In practical terms, this means that in every operational cycle, the adversary is faced with \(2^{\Delta_{K_{G}}}\) equally likely hypotheses about the key \(K_{G}\), making the system ideally secure in the Shannon sense. As shown in Remark 10, within this mode of operation, referred to as the ideal security regime, it is possible to select appropriate parameters to ensure a desired trade-off between the secret key distillation rate and the lower bound on the key \(K_{G}\) equivocation. In Section 5, Theorem 7 demonstrates how the CR KSG system transitions into the regime of perfect secrecy by equalizing the equivocations of the distilled keys and the KSG secret key. When this regime is compared to the ideal security regime, it becomes  
Figure 14: Histogram of the generated perfectly secret key lengths across 1000 simulation runs (solid line). The vertical dashed line marks the theoretically expected value of the secret key rate \(\left|\widetilde{K}_{s}\right|_{max}=0.1051\). The low variance demonstrates the exceptional agreement between experimental and theoretical results. evident that the cost of achieving perfect secrecy is a reduction in the effective secret key distillation rate. The distribution of the initial value \(K_{G}\) can be carried out in several ways depending on the security environment of the system. (a) Within well-organized permanent protection systems, the policy of using cryptographic keys can ensure that previously distributed keys are never exhausted to the end. A predefined remainder can be saved for the initial \(K_{G}\) and the start of the autonomous CR KSG system. (b) In other cases, \(K_{G}\) can be distilled by a previous independent stage of SKD based on biometric sources of CR, such as, e.g., EEG or voice [13; 14; 56]. The proposed autonomous SKD system can always be implemented in practice, provided that the parties involved in the protocol have access to a public authenticated channel with sufficient capacity. To quantify this requirement, we introduce a measure of the load of the public channel per distilled secret key bit \(K_{S}\)  
\[E_{BC}=\frac{\left|\widetilde{K}_{s}\right|_{max}}{\bar{n}_{p}}=\frac{1}{\bar{ n}_{p}}\left(C_{2}-\frac{t}{n_{IR0}}-\frac{C_{1}}{1-r}\right)\,, \tag{110}\]  
or taking into account (85), we can express \(E_{BC}\) in equivalent form  
\[E_{BC}=\frac{1}{\bar{n}_{p}}\left(C_{2}-\frac{C_{1}}{1-r}\cdot\left(1+\frac{t }{\left|K_{G}\right|}\right)\right). \tag{111}\]  
Figure 15 shows the dependence given by (111) for different values of \(r\), when the system operates in the ideal secrecy mode.