# Wide Area Key Distribution Network Based on a Quantum Key Distribution System
## 4 The Security of the Public-XOR-Key Scheme
### The Security Analysis of the Public-XOR-Key Scheme  
Threat model: we model the capacity of the adversary, [PERSON]. Assume the destruction of the original QKD keys in the relay nodes is secure and [PERSON] cannot access the original QKD keys even if she compromises the relay nodes. Assume the relay nodes never play the role as the internal attacker. QKD protocols have been proved to be unconditionally secure in theory. However, limited by the development of technology, there are attacks on QKD system in practice [28; 29; 30; 31; 32]. As a result of this defense, [PERSON] cannot get all the information about QKD keys. However, there still exists some leaked information. In the chain network with \(n\) point-to-point QKD systems, the amount of leaked information may be large. Assume leaked information about each point-to-point QKD system is the same, which is denoted as \(I_{0}\). The information obtained by [PERSON] in the point-to-point QKD system is  
\[I_{0}\equiv 1-H(p), \tag{10}\]  
where \(H(p)\) is the entropy of QKD key \(QK_{i}\) in each point-to-point QKD system. For \(Qk_{i}\in\{0,1\}\), [PERSON] knows that it has bias \"0\" or \"1\" with the probability of \(p\). To simplify the following calculating, assume \(p(Qk_{i}=0)=p\) for each \(i=1,2,...,n\), where \(0<p<1\). The amount of information about the shared key \(Qk_{1}\) obtained by [PERSON] is  
\[I_{key}=1-H(Qk_{1}|a_{i}), \tag{11}\]  
where \(a_{i}\) is the public XOR value. A new parameter \(b_{i}\in\{0,1\}\) is defined from the public \(a_{i}\),  
\[b_{i}\equiv a_{1}\oplus a_{2}\oplus...\oplus a_{i}=Qk_{1}\oplus Qk_{i+1},\ \ i=1,2,..,n-1. \tag{12}\]  
The number of elements \(b_{i}\) is \(n-1\) and they form a Boolean vector \(b\). The random variable of \(b_{i}\) is defined as \(B_{i}\), the random variable of \(b\equiv(b_{1}b_{2}...b_{n-1})\) is \(B\equiv(B_{1}B_{2}...B_{n-1})\), and the random variable of \(Qk_{i}\) is \(QK_{i}\). \(H(Qk_{1}|a_{1})\) can be treated as \(H(QK_{1}|B)\) for more obvious analysis. That is, the information obtained by [PERSON] is \(I_{key}=1-H(QK_{1}|B)\). From the definition of \(b_{i}\), it can be seen that the QKD key \(Qk_{1}\) is encrypted by other different QKD keys \(n-1\) times, which is similar to the random key \(s\) encrypted by QKD keys in the re-encryption scheme. Analyzing the security of the public-XOR-key scheme is equivalent to calculating how much information [PERSON] obtains. We first analyze the conditional entropy of \(QK_{1}\) in the threat model. **Theorem 1**. : _In the assumption model of key distribution network using public-XOR-key scheme, the value of the conditional entropy \(H\left(QK_{1}|B\right)\) is_  
\[H(QK_{1}|B)=\sum_{w=0}^{n-1}\left\{C_{n-1}^{w}\left[p^{n-w}(1-p)^{w}+(1-p)^{n-w }p^{w}\right]H\left[\frac{p^{n-w}(1-p)^{w}}{p^{n-w}(1-p)^{w}+(1-p)^{n-w}p^{w}} \right]\right\}. \tag{13}\]  
_where \(p\) is the probability of \(Qk_{i}=0\) for all \(i=1,2,...,n\), and \(C_{n-1}^{w}\) is the binomial coefficient._  
Proof of Theorem 1.: According to the definition of conditional entropy,  
\[ \begin{split}& H(QK_{1}|B)\\ =&\sum_{b}p(B=b)H(QK_{1}|B=b)\\ &=-\sum_{b}\left[p(B=b)\sum_{Qk_{1}}p(QK_{1}=Qk_{1}|B=b)\log p( QK_{1}=Qk_{1}|B=b)\right].\end{split}  \tag{14}\]  
Then we analyze the properties of the terms in the sum. For \(Qk_{1}\in\{0,1\}\), the corresponding random variable satisfies that  
\[p(QK_{1}=0)=p,\ \ p(QK_{1}=1)=1-p. \tag{15}\]  
For \(B\in\{0,1\}^{n-1}\), there are \(2^{n-1}\) values of \(B\). Consider classifying \(B\) by the number of zeros or ones. This kind of classification is exactly the hamming weight of the \(B\), which is creative in cryptanalysis. Then Equation (14) becomes  
\[ \begin{split}& H(QK_{1}|B)\\ =&-\sum_{b}\left[p(B=b)\sum_{Qk_{1}}p(QK_{1}=Qk_{1}|B=b) \log p(QK_{1}=Qk_{1}|B=b)\right]\\ =&-\sum_{w=0}^{n-1}\left[C_{n-1}^{w}p(B=b_{w})\sum_{ Qk_{1}}p(QK_{1}=Qk_{1}|B=b_{w})\log p(QK_{1}=Qk_{1}|B=b_{w})\right],\end{split}  \tag{16}\]  
where \(b_{w}\) denotes a particular vector with hamming weight \(w\).