# Quantum Key Distribution with Post-Processing Driven by Physical Unclonable Functions
## 2 Results and Discussion
### Security Considerations
Let us turn now to the entity authentication protocol in Figure 8. One can readily show that it is information-theoretically secure if an \(l\)-time \(\varepsilon\)-secure MAC is used [12; 14; 43] with \(l\ll 2^{|\mathbf{s}|}\) (see also appendix). In particular, the probability that the KDC uses the same random string \(\mathbf{s}\) in the \(i\)th session is \((i-1)/2^{|\mathbf{s}|}\). Hence, the probability for a repeat in any of the \(l\) sessions is \(l(l-1)/2^{|\mathbf{s}|+1}\). The same result can be obtained through the birthday bound for \(l\ll 2^{|\mathbf{s}|}\). On the other hand, there is a probability of at most \(\varepsilon\) for an adversary to construct the correct tag. Hence, the overall probability for an adversary to deceive the KDC is at most \(l(l-1)/2^{|\mathbf{s}|+1}+\varepsilon\). Of course, one should not forget here that unconditionally secure \(l\)-time \(\varepsilon\)-secure MACs require a uniform truly random key. Hence, from the previous discussion, the quality of the keys that are produced from PUFs and the security of the databases also affect the security of the entity authentication protocol in Figure 8.  
Another issue that deserves our attention is the communication of the randomly chosen challenge \(c_{j}\) in the procedures outlined in Figures 4b, 6b, and 8. The challenge is sent in plain text over a public, possibly unauthenticated channel. An adversary who learns the challenge and does not have access to the PUF of the sender or the receiver cannot use it to their advantage, because, as previously discussed, the PUFs operate as PRNGs, and their output to a given challenge cannot be predicted with a probability much better than random guessing. Even if the adversary has access to the database of CRPs, they cannot deduce the individual keys from the joint key by virtue of the OTP encryption. Finally, given that the entry pertaining to the communicated challenge is deleted from the database of CRPs and is added to a blacklist, an adversary cannot repeat it so as to fool either of the two users. The adversary can launch a type of DoS attack by changing the challenge. In this case, the two users will essentially not share the same key, as required for successful realization of a QKD session, and it is almost certain that the different keys will make the QKD protocol abort, and the users will have to start all over again. We have a similar situation in Figure 7, where [PERSON]'s request for communication with [PERSON] is also sent in plain text, and its origin is not verified by the receiver. In principle, an attacker can send multiple such requests to the KDC, thereby enforcing the manager to consume keys without reason and depleting the relevant databases and key pools. In all of these scenarios, the attacks are possible because the classical communication is not authenticated. However, none of these attacks threaten the security of the QKD network; rather, they target the resources of the QKD network. For this reason, there is no need for ITS message authentication, and they can be prevented by means of computationally secure MACs [12; 13; 14; 44] or public key cryptosystems [12; 15; 36; 37]. Finally, throughout this work we have assumed that the manager of the KDC uses a different PUF for each user participating in the network, namely, \(\text{PUF}_{\text{MA}}\), \(\text{PUF}_{\text{MB}}\), \(\text{PUF}_{\text{MC}}\), etc. In this way, we have added an additional level of security in the sense that if, for any reason, a database of CRPs is compromised, the security of the other databases is not affected, as long as different PUFs produce independent random keys.