# Synthesis of Sources of Common Randomness Based on Keystream Generators with Shared Secret Keys
## 4 Information-Theoretic Analysis of the Source of Common Randomness Based on KSG(Kg)
The figure highlights the optimal operating point \(p_{IR0}^{\ast}\in\ \widetilde{D}\) and the corresponding maximum achievable values for \(|\widetilde{K}_{S}|\), \(\tilde{A}_{K_{G}},|\widetilde{K}_{G}|\), and security margin \(\bar{I}\). The yellow line \(\Psi_{L}\) represents the lower bound on [PERSON]’s equivocation about the secret key \(K_{G}\) when she has access to all information available over the public channel. The green dotted line \(\mu_{IR}\) indicates the remaining data efficiency of the IR protocol, as defined in (38), and also serves as the upper bound for the secret key distillation capacity of the CR SKD system; see (48). Taking into account the security margin \(\bar{I}\), which ensures the predetermined key leakage level, this upper bound is reduced by \(\bar{I}\), as shown by the purple dotted line. Finally, the admissible region \(\widetilde{D}\) is further constrained by the condition that the input innovative entropy \(IE\) (magenta dotted line) must exceed the entropy of the distilled keys in each operational cycle of the system. From (42) and (31), after normalizing by \(n_{IR0}\), we obtain  
\[H\Big{(}K_{G}\mid S_{1},S_{2},\ldots,S_{n_{p}}\Big{)}=H(K_{G})+\sum_{i=1}^{n_{p}} h_{b}(\varepsilon_{i})-\sum_{i=1}^{n_{p}}H(S_{i}). \tag{29}\]6  
given that  
\[H\Big{(}K_{G}\mid S_{1},S_{2},\ldots,S_{n_{p}}\Big{)}=H(K_{G})+\sum_{i=1}^{n_{p}} h_{b}(\varepsilon_{i})-\sum_{i=1}^{n_{p}}H(S_{i}). \tag{29}\]7  
The right side of equation (52) reaches its minimum value for \(\tilde{\Delta}_{K_{G}}=0\) and \(\left|\widetilde{K}_{S}\right|=0\), giving  
\[H\Big{(}K_{G}\mid S_{1},S_{2},\ldots,S_{n_{p}}\Big{)}=H(K_{G})+\sum_{i=1}^{n_{p}} h_{b}(\varepsilon_{i})-\sum_{i=1}^{n_{p}}H(S_{i}). \tag{29}\]8  
Taking into account (25) and (7), we find that  
\[H\Big{(}K_{G}\mid S_{1},S_{2},\ldots,S_{n_{p}}\Big{)}=H(K_{G})+\sum_{i=1}^{n_{p}} h_{b}(\varepsilon_{i})-\sum_{i=1}^{n_{p}}H(S_{i}). \tag{29}\]9  
which into (54), results in (47). This completes the proof of the theorem. \(\square\)  
Based on Theorem 2, it immediately follows that for a given \(p_{IR0}=p_{IR0}^{*}\), where \(p_{IR0}^{*}\in\widetilde{D}\), the maximum rate of distilled keys is  
\[H\Big{(}K_{G}\mid S_{1},\ S_{2},\ldots,\ S_{n_{p}}\Big{)}\geq|K_{G}|+\sum_{i=1 }^{n_{p}}h_{b}(\varepsilon_{i})-n_{p}. \tag{30}\]0  
For a fixed \(\left|\widetilde{K}_{G}\right|\), given the condition (42), the maximum rate of the usable component of the distilled keys is given by  
\[H\Big{(}K_{G}\mid S_{1},\ S_{2},\ldots,\ S_{n_{p}}\Big{)}\geq|K_{G}|+\sum_{i=1 }^{n_{p}}h_{b}(\varepsilon_{i})-n_{p}. \tag{30}\]1  
The maximum possible equivocation for additionally fixed \(\left|\widetilde{K}_{S}\right|\), given the condition (52), is  
\[H\Big{(}K_{G}\mid S_{1},\ S_{2},\ldots,\ S_{n_{p}}\Big{)}\geq|K_{G}|+\sum_{i=1 }^{n_{p}}h_{b}(\varepsilon_{i})-n_{p}. \tag{30}\]2  
By combining (57) and (58), we obtain an alternative expression  
\[H\Big{(}K_{G}\mid S_{1},\ S_{2},\ldots,\ S_{n_{p}}\Big{)}\geq|K_{G}|+\sum_{i=1 }^{n_{p}}h_{b}(\varepsilon_{i})-n_{p}. \tag{30}\]3  
Finally, from (57) and (57), it follows that  
\[H\Big{(}K_{G}\mid S_{1},\ S_{2},\ldots,\ S_{n_{p}}\Big{)}\geq|K_{G}|+\sum_{i=1 }^{n_{p}}h_{b}(\varepsilon_{i})-n_{p}. \tag{30}\]4  
Figure 4 illustrates the relationships and interdependencies among the quantities \(\left|\widetilde{K}\right|_{max}\),\(\left|\widetilde{K}_{S}\right|_{max}\),\(\tilde{\Delta}_{K_{G}max}\), \(\Psi_{L}(p_{IR0}^{*},\mu_{IR})\) and \(\Psi_{U}(p_{IR0}^{*}\,\mu_{IR})\) for an arbitrarily chosen \(p_{IR0}^{*}\in\widetilde{D}\), given by relations (56-60). Since it makes sense to consider only the maximum values for the quantities \(\left|\widetilde{K}\right|\), \(\left|\widetilde{K}_{S}\right|\) and \(\tilde{\Delta}_{K_{G}}\), in the following text they will be denoted without explicitly indicating that these are maximum values. Based on (60), we can formulate the following theorem.