# Wide Area Key Distribution Network Based on a Quantum Key Distribution System
## 4 The Security of the Public-XOR-Key Scheme
### Comparison of the Security of the Public-XOR-Key Scheme and Re-Encryption Scheme
Since the security of the re-encryption scheme is equivalent to that of public-XOR-key scheme, we only analyze one of them. In the simplified model of re-encryption scheme with parameters \((S,C,QK,\ E^{\prime\prime},D^{\prime\prime})\), the encryption algorithm is the simplest XOR, i.e., \(E_{Qk_{i}}^{\prime\prime}(s)=s\oplus Qk_{i}=c_{i}\). In the model of [PERSON]'s ciphertext-only attack model, the simplest encryption algorithm is \(E_{k}(m_{i})=m_{i}\oplus k=c_{i}\). Therefore, the local random key \(s\) could be treated as the key in [PERSON]'s model, the QKD keys \(Qk_{i}\) can be treated as the plaintext in [PERSON]'s model. The unicity distance \(N_{0}^{\prime}\) is the number of ciphertext required to obtain the local random key \(s\), according to Equation (8),  
\[N_{0}^{\prime}\approx\frac{H(S)}{R_{L}}=\frac{1}{R_{L}}. \tag{43}\]  
The adversary [PERSON] attacks each point-to-point QKD system. Assume the information about the value of \(Qk_{i}\) that [PERSON] obtains from each point-to-point QKD system is the same, and that it is equal to \(I_{0}=1-H(p)\), where \(H(p)\) is the entropy of the QKD key in each point-to-point QKD system. It seems that the physical interpretation of \(H(p)\) and \(H_{L}\), \(I_{0}\) and \(R_{L}\) are equivalent. When \(n\) is sufficiently large, according to Equation (4), the relationship between \(H(p)\) and the quantum keys with the length of \(n\) is  
\[H(K^{n})\approx nH(p). \tag{44}\]The unicity distance \(N_{0}^{\prime}\) of the relay QKD system is  
\[N_{0}^{\prime}\approx\frac{1}{I_{0}}=\frac{1}{1-H(p)}, \tag{45}\]  
which means that if [PERSON] attacks \(N_{0}^{\prime}\) point-to-point QKD systems and gets \(N_{0}^{\prime}\) ciphertext, she can obtain the random key \(s\). The contrast between the parameters of [PERSON]'s model and those of the model of the QKD network is shown in Table 1.  
However, in Sections 4 and 5 we show that the conditional entropy \(H(S|C)\) cannot be null as long as \(0<p<1\), which reflects that [PERSON] cannot obtain the exact key \(s\) no matter how many ciphertexts she has in the real world. This result conflicts with the unicity distance that was analyzed above. We hold the view that there are two reasons for the difference. Firstly, although \(H(p)\) and \(H_{L}\), \(I_{0}\) and \(R_{L}\) have very similar physical interpretation, actually they are not equivalent. In [PERSON]'s model, \(H_{L}\) denotes the rate of each word in language \(L\), which is an average value with a sufficiently large \(n\). In the model of QKD network, \(H(p)\) is the real entropy of the QKD key in each point-to-point QKD system rather than an average value. Since each QKD key encrypts the same random key \(s\), with the known \(c_{i}\) each point-to-point QKD system is not completely independent. Suppose the rate of each point-to-point QKD system is \(H_{K}\),  
\[H_{K}=\lim_{n\rightarrow\infty}\frac{H(K^{n})}{n}\
eq H(p). \tag{46}\]  
The second reason is that the unicity distance \(N_{0}\) is an approximate and minimum value in theory. In the derivation of the value of unicity distance, there are some approximations and inequalities. When \(n\) is sufficiently large, Equation (4) holds. In practical QKD network, \(n\) cannot be large enough, the value of which is usually just several dozens. Equation (8), denoting the approximation of \(N_{0}\), actually is its minimum value. Even if [PERSON] gets the ciphertext with the length of \(H(K)/R_{L}\log_{2}|M|\), there still exist spurious keys and she cannot get the real key. Through the above analysis, we find the reasons why the unicity distance of the practical QKD network is different from that in theory. It indicates that the theoretical value of unicity distance has a certain gap with the practical system. In addition, the unicity distance of the relay QKD system is infinity, which indicates the adversary in the model can never obtain the entire secret message.