# Quantum Key Distribution with Post-Processing Driven by Physical Unclonable Functions
## 2 Results and Discussion
### Integration of PUFs in Point-to-Point QKD Links  
The manufacturer of the QKD devices associates a PUF with each of the QKD boxes (sender or receiver). For instance, a PUF tag is attached to each QKD box in a fashion similar to the barcodes or QR codes that accompany various products on the market. In contrast to these codes, however, as mentioned above, the PUF tags are technologically hard to copy, and they serve as unique fingerprints for the boxes they are attached to. Alternatively, we can assume that the PUF token associated with a QKD device is given to the owner of the device, e.g., in the form of a smart card [34].  
We will first consider a point-to-point communication scenario, with a pair of QKD boxes intended for [PERSON] (sender) and [PERSON] (receiver). A pair PUF tokens/tags is associated with them. Each token is interrogated by a number of challenges \(\{c_{1},c_{2},\ldots\}\), and the corresponding keys \(\{\mathbf{k}_{1}^{(u)},\mathbf{k}_{2}^{(u)},\ldots\}\) are recorded, where \(u=\{\text{A},\text{B}\}\) is the label of the user. One of the honest users, say [PERSON], keeps a database of the challenge-response pairs (CRPs) in the following form [34; 35]  
\[\begin{array}{c|c}c_{1}&\mathbf{k}_{1}^{(\text{A})}\oplus\mathbf{k}_{1}^{(\text{B}) }\\ c_{2}&\mathbf{k}_{2}^{(\text{A})}\oplus\mathbf{k}_{2}^{(\text{B})}\\ \vdots&\vdots\\ c_{j}&\mathbf{k}_{j}^{(\text{A})}\oplus\mathbf{k}_{j}^{(\text{B})}\\ \vdots&\vdots\end{array} \tag{1}\]  
A schematic representation of the process is shown in Figure 3(a). As will be discussed in detail below, the particular form of storage protects the individual keys against an adversary who obtains undetected access to the database.  
A question arises here: who creates and who has access to this database? There are two options. One possibility is that the manufacturer creates the database and gives it to either of the two honest users during the delivery of the QKD boxes. Alternatively, one of the honest users (say [PERSON]), has access to both boxes (and thus to both PUFs) simultaneously, and she creates the database before she gives one of the boxes to [PERSON]. In both of these scenarios, only trusted parties are involved, in the sense that by definition [PERSON], [PERSON], and the manufacturer of the QKD devices are honest. In Figure 4, we assume that [PERSON] possesses the database and hence there is no need for including an additional trusted third party. As will be discussed in the next subsection, however, the inclusion of a third party is inevitable in the case of larger QKD networks.  
As discussed in the introduction, before [PERSON] and [PERSON] operate their QKD boxes for the first time, they must generate a common secret key, which will be used for post-processing purposes until a sufficiently large number of secret bits has been generated from the QKD sessions. To this end, [PERSON] chooses at random one of the available challenges in the database, say the \(j\)th one, and sends it to [PERSON] (see Figure 3(b)) over a classical channel which may not be authenticated (see related discussion in Section 2.4). The two users run their PUFs independently in order to recover their individual keys \(\mathbf{k}_{j}^{(\text{A})}\) and \(\mathbf{k}_{j}^{(\text{B})}\). [PERSON] adds her key to the joint key \(\mathbf{k}_{j}^{(\text{A})}\oplus\mathbf{k}_{j}^{(\text{B})}\) in order to recover [PERSON]'s key which will seed the first QKD session. The corresponding entry is permanently deleted from the database, while [PERSON] also keeps a blacklist of the used challenges so that they are not used again for the particular PUFs.  
Under normal conditions, the key material in the corresponding pools of [PERSON] and [PERSON] will grow through the operation of QKD sessions, and there will be no need for the users to execute the above procedure again. However, if for any reason, at any time, QKD alone cannot support the needs for keys and additional key material is needed, the procedure can be repeated again.