# Synthesis of Sources of Common Randomness Based on Keystream Generators with Shared Secret Keys
## 4 Information-Theoretic Analysis of the Source of Common Randomness Based on KSG(Kg)
The corresponding definition of the normalized admissible region \(\widetilde{D}\Big{(}\epsilon,\tilde{\Delta}_{K_{G}},\widetilde{K}_{G}, \widetilde{t},\;\widetilde{K}_{S}\Big{)}\) is given by the following set of constraints  
\[\sum_{i=1}^{n_{p}}H(K_{G}\mid S_{i})=H\Big{(}K_{G}\mid S_{1},\ S_{2},\ \ldots,\ S_{n_{p}}\Big{)}-\big{(}n_{p}-1\big{)}H(K_{G}). \tag{28}\]3  
\[\sum_{i=1}^{n_{p}}H(K_{G}\mid S_{i})=H\Big{(}K_{G}\mid S_{1},\ S_{2},\ \ldots,\ S_{n_{p}}\Big{)}-\big{(}n_{p}-1\big{)}H(K_{G}). \tag{28}\]4  
\[\sum_{i=1}^{n_{p}}H(K_{G}\mid S_{i})=H\Big{(}K_{G}\mid S_{1},\ S_{2},\ \ldots,\ S_{n_{p}}\Big{)}-\big{(}n_{p}-1\big{)}H(K_{G}). \tag{28}\]5  
\[\sum_{i=1}^{n_{p}}H(K_{G}\mid S_{i})=H\Big{(}K_{G}\mid S_{1},\ S_{2},\ \ldots,\ S_{n_{p}}\Big{)}-\big{(}n_{p}-1\big{)}H(K_{G}). \tag{28}\]6  
\[\sum_{i=1}^{n_{p}}H(K_{G}\mid S_{i})=H\Big{(}K_{G}\mid S_{1},\ S_{2},\ \ldots,\ S_{n_{p}}\Big{)}-\big{(}n_{p}-1\big{)}H(K_{G}). \tag{28}\]7  
\[\sum_{i=1}^{n_{p}}H(K_{G}\mid S_{i})=H\Big{(}K_{G}\mid S_{1},\ S_{2},\ \ldots,\ S_{n_{p}}\Big{)}-\big{(}n_{p}-1\big{)}H(K_{G}). \tag{28}\]8  
It is particularly convenient to represent the admissible region \(\widetilde{D}\) in the \((\mathit{Rates},\;p_{IR0})\) coordinates (see Figure 4) where \(p_{IR0}\) denotes the initial BER, \(p_{AB}\), between [PERSON]'s and [PERSON]'s sequence at the beginning of the IR protocol. Theorem 4.1 provides the lower and upper bounds of the admissible region \(\widetilde{D}\) in \((\mathit{Rates},\;p_{IR0})\) coordinates in the general case. Let the set of information available to Eve over the public channel during the IR phase of a given SKD protocol be denoted by \(S=\{S_{i}\}\), \(\big{|}S\big{|}=n_{p}\), where each \(S_{i}\) is given by equation (18), and \(m_{i}\) denotes the binary mask vector associated with each \(S_{i}\), as defined in equation (19). Let \(n_{IR0}\) denote the initial sequence length and \(p_{IR0}\) the initial BER between [PERSON]'s and [PERSON]'s sequences. Then, the admissible region \(\widetilde{D}\) is bounded with upper  
\[\sum_{i=1}^{n_{p}}H(K_{G}\mid S_{i})=H\Big{(}K_{G}\mid S_{1},\ S_{2},\ \ldots,\ S_{n_{p}}\Big{)}-\big{(}n_{p}-1\big{)}H(K_{G}). \tag{28}\]9  
and lower bound  
\[H\Big{(}K_{G}\mid S_{1},S_{2},\ldots,S_{n_{p}}\Big{)}=H(K_{G})+\sum_{i=1}^{n_{p}} h_{b}(\varepsilon_{i})-\sum_{i=1}^{n_{p}}H(S_{i}). \tag{29}\]0_where \(\mu_{IR}\) is data remaining efficiency of the applied IR protocol._  
Proof of Theorem 2.: For each fixed \(p_{IR0}\), the upper bound \(\Psi_{U}(p_{IR0},\ \mu_{IR})\) corresponds with the maximum achievable rate of the distilled key, i.e.,  
\[H\Big{(}K_{G}\mid S_{1},S_{2},\ldots,S_{n_{p}}\Big{)}=H(K_{G})+\sum_{i=1}^{n_{p}} h_{b}(\varepsilon_{i})-\sum_{i=1}^{n_{p}}H(S_{i}). \tag{29}\]1  
Based on constraints (43) and (44), we conclude that the following must hold simultaneously  
\[H\Big{(}K_{G}\mid S_{1},S_{2},\ldots,S_{n_{p}}\Big{)}=H(K_{G})+\sum_{i=1}^{n_{p}} h_{b}(\varepsilon_{i})-\sum_{i=1}^{n_{p}}H(S_{i}). \tag{29}\]2  
from which it follows that  
\[H\Big{(}K_{G}\mid S_{1},S_{2},\ldots,S_{n_{p}}\Big{)}=H(K_{G})+\sum_{i=1}^{n_{p}} h_{b}(\varepsilon_{i})-\sum_{i=1}^{n_{p}}H(S_{i}). \tag{29}\]3  
The lower bound is equal to the minimum achievable rate of the distilled key that guarantees system autonomy and the specified lower bound on the secret key equivocation (41) for a given \(p_{IR0}\), i.e.,  
\[H\Big{(}K_{G}\mid S_{1},S_{2},\ldots,S_{n_{p}}\Big{)}=H(K_{G})+\sum_{i=1}^{n_{p}} h_{b}(\varepsilon_{i})-\sum_{i=1}^{n_{p}}H(S_{i}). \tag{29}\]4  
\[H\Big{(}K_{G}\mid S_{1},S_{2},\ldots,S_{n_{p}}\Big{)}=H(K_{G})+\sum_{i=1}^{n_{p}} h_{b}(\varepsilon_{i})-\sum_{i=1}^{n_{p}}H(S_{i}). \tag{29}\]5 Normalized admissible region \(\widetilde{D}\) as a function of the initial bit error rate \(p_{IR0}\) between [PERSON] and [PERSON]’s sequence at the start of the IR protocol.