# Synthesis of Sources of Common Randomness Based on Keystream Generators with Shared Secret Keys
## 5 Optimal SKD System Based on CR KSG and Winnow IR Protocol
\begin{bmatrix}S_{H1}\\ S_{H2}\\ S_{H3}\end{bmatrix} =H_{3}\cdot[Y_{2},Y_{3},\ \ldots,\ Y_{8}]^{T}= \begin{bmatrix}1 &0&1&0&1&0&1\\ 0&1&1&0&0&1&1\\ 0&0&0&1&1&1\end{bmatrix} \cdot[Y_{2},Y_{3},\ \ldots,\ Y_{8}]^{T}. \tag{76}\]The \(S_{b}\) class is computed for each block and exchanged with the other party. In terms of Theorem 1, all masks corresponding to this class have a fixed length of 8 and contain eight ones, i.e.,  
\[m_{b}=[m_{b1},m_{b2},\ \ldots,\ m_{b8}]=[1,\ 1,\ \ldots,1]\,\ \sum_{j=1}^{8}m_{bj}=8. \tag{77}\]  
The \(S_{H}\) class is computed for each block in which [PERSON]'s and [PERSON]'s parity bits \(S_{b}\) differ. The matrix \(H_{3}\) is the parity-check matrix of the (7,4) Hamming error-correcting code, so \(S_{H}\) is a three-bit syndrome of this code [42]. By examining the structure of the matrix \(H_{3}\), we observe that each row contains exactly four ones, which implies that the masks in this class satisfy the following property  
\[m_{Hi}=[m_{Hi1},\ m_{Hi2},\ \ldots,m_{Hi7}]\,\ \sum_{j=1}^{7}m_{Hij}=4\,\ i=1,2,3. \tag{78}\]  
Therefore, the sum in the expression for the lower bound (47) in Theorem 2 can be split into two terms: one corresponding to the parity bits from class \(S_{b}\) and the other corresponding to the parity bits from class \(S_{H}\). Based on (77), we have \(\frac{1}{2}\sum_{j=1}^{N_{i}}m_{ij}=8\) and \(\frac{1}{2}\sum_{j=1}^{N_{i}}m_{ij}=4\) for classes \(S_{b}\) and \(S_{H}\), respectively. Since \(N_{i}=8\), for all \(i\), we finally obtain  
\[\sum_{i=1}^{n_{p}}h_{b}\left(\frac{1}{2}\left(1-(1-2p_{IR0})^{ \frac{1}{2}\sum_{j=1}^{N_{i}}m_{ij}}\right)\right)= 2n_{b}\left(\frac{1}{2}\left(1-(1-2p_{IR0})^{4}\right)\right)+n_{ H}h_{b}\left(\frac{1}{2}\left(1-(1-2p_{IR0})^{2}\right)\right). \tag{79}\]  
The factor of 2 in the first term arises from the fact that, in addition to [PERSON], [PERSON] also sends his parity bits from class \(S_{b}\). By substituting (79) into (47), we obtain the statement (74) for the lower bound. The upper bound (73) follows directly from (46) by instantiating the general remaining data efficiency \(\mu_{IR}(p_{IR0})\) with \(\mu_{IR}^{Win}(p_{IR0})\), which corresponds to the Winnow protocol. This completes the proof of the theorem. \(\square\)  
In [40], a complete algorithm is presented for calculating \(\mu_{IR}^{Win}(p_{IR0})\), \(n_{b}\), \(n_{H}\), \(n_{p}\), and \(p_{IR\_end}\), where \(p_{IR\_end}\) denotes the BER between [PERSON]'s and [PERSON]'s sequences at the end of the protocol. Figures 5-7 show how these quantities vary as functions of \(p_{IR0}\), with the number of parity bits normalized with respect to the initial sequence length \(n_{IR0}\)  
\[\hat{n}_{p}=\frac{n_{p}}{n_{IR0}}\,\ \hat{n}_{b}=\frac{n_{b}}{n_{IR0}}\,\ \hat{n}_{H}=\frac{n_{H}}{n_{IR0}}. \tag{80}\]  
**Remark 9**. : _The Winnow protocol iteratively applies the basic operations of dividing strings into blocks, exchanging block parity bits, computing and sending (7,4) Hamming code syndromes, performing error correction, and discarding a corresponding number of bits to maintain privacy. As the number of iterations increases, the value of \(\mu_{IR}^{Win}(p_{IR0})\) decreases for every \(p_{IR0}\), as shown in Figure 5, thereby reducing the key distillation rate of the \(CR\)\(KSG_{W}\) system. On the other hand, according to Figure 7, a smaller number of iterations increases \(p_{IRend}\) for each \(p_{IR0}\), effectively reducing the key distillation rate. Therefore, selecting the number of iterations is a trade-off between these two opposing effects and is typically determined through experimental evaluation of the system. Our choice of a maximum of four iterations (\(max\ iter=4\)) has been practically confirmed as the optimal solution._  
In Figure 8 (middle), the admissible region for the key distillation rate of the \(CR\)\(KSG_{W}\) system is shown, with Winnow protocol parameters \(N=8\), \(max\ iter=4\), and an upper bound on the KDR \(\delta\leq 10^{-4}\). Figure 5: Evolution of \(\mu_{IR}^{Win}(p_{IR0})\) over four iterations of the Winnow protocol.