# Quantum Key Distribution with Post-Processing Driven by Physical Unclonable Functions
## 2 Results and Discussion
### QKD Device Authentication  
Message authentication is what prevents a man-in-the-middle attack against QKD systems, and the ideas discussed in the previous subsections facilitate the generation and the distribution of pre-shared secret keys to this end. Entity authentication (also known as identification) is a different and very important cryptographic task, which allows the identity of a user or device to be confirmed [12; 13; 14; 15]. By means of entity authentication, one can control which users or devices have access to certain physical or virtual resources. Entity authentication should not be confused with message authentication. They are different cryptographic tasks with distinct goals, and one cannot replace the other. A fundamental difference between the two is that an identification scheme provides real-time evidence about the identity of a user or a device, whereas MACs (and signature schemes) allow data origin authentication, which can be performed any time after the relevant message has been tagged or signed.  
The integration of PUFs in QKD networks allows the KDC to confirm the identity of the QKD devices that are connected to the network at any time, thereby preventing the connection of counterfeit or unauthorized devices through which an attacker may try to connect to the KDC or to other users in the network in order to access databases or to sabotage the operation of the network. Moreover, an honest user can confirm the authenticity of a purchased QKD device. A PUF tag that is attached to a QKD device serves as a unique fingerprint and protects against counterfeiting.  
Let us consider a scenario where a new user, [PERSON], joins the network, and that the KDC wants to authenticate his QKD device. The procedure is outlined in Figure 8. As in the previous subsections, we will assume that [PERSON]'s QKD device is associated with PUF\({}_{\text{C}}\). The related database of CRPs is generated by the manufacturer, and it is available to the KDC. Moreover, we will assume that each user (or QKD device) is uniquely identified by a binary string (a serial number). Given that [PERSON] is a new user who does not share a secret key with the KDC, the key manager randomly chooses one of the available challenges from the database of CRPs associated with PUF\({}_{\text{C}}\). Moreover, the manager generates a random bit string \(\mathbf{s}\), and they send it to [PERSON] together with a challenge chosen at random \(c_{j}\). [PERSON] obtains the response \(\mathbf{k}_{j}^{C}\) of PUF\({}_{\text{C}}\) to challenge \(c_{j}\), whereas the manager recovers the same response after they add the response of PUF\({}_{\text{MC}}\) to the same challenge to the joint key. [PERSON] passes the concatenation of his identification string ID\({}_{\text{C}}\) with \(\mathbf{s}\) through a MAC with key \(k_{j}^{C}\), and the resulting tag, \(\tau=h_{\mathbf{k}_{j}^{C}}(\text{ID}_{\text{C}}||\mathbf{s})\), is sent to the KDC. The key manager computes the tag for the same message and they accept the QKD device as authentic only if this agrees with the tag received from [PERSON].  
In the protocol outlined in Figure 8, we have assumed that the user does not share a common secret key with the KDC and it has to be generated locally through their PUFs. If the user shares a secret key with the KDC, then the procedure in the shaded region of Figure 8 can be omitted, and the entity authentication can rely on the existing key material. Moreover, the protocol can be easily extended to mutual entity authentication by adding a second round of authentication, where the user chooses at random another binary string, which is sent to the KDC [12; 14].