# Wide Area Key Distribution Network Based on a Quantum Key Distribution System
## 4 The Security of the Public-XOR-Key Scheme
### Comparison of the Security of the Public-XOR-Key Scheme and Re-Encryption Scheme
 \tag{34}\]From Equations (32) and (34), the conditional probability of \(S=0\) is  
\[p(S=0|C=c_{w})=\frac{p^{n-w}(1-p)^{w}}{p^{n-w}(1-p)^{w}+p^{w}(1-p)^{n-w}}. \tag{35}\]  
Similarly, the conditional probability of \(S=1\) is  
\[p(S=1|C=c_{w})=\frac{p^{w}(1-p)^{n-w}}{p^{n-w}(1-p)^{w}+p^{w}(1-p)^{n-w}}. \tag{36}\]  
Therefore, the conditional entropy \(H(S|C)\)  
\[H(S|C)=\frac{1}{2}\sum_{w=0}^{n}\left\{C_{n}^{w}\left[p^{n-w}(1-p)^{w}+(1-p)^{ n-w}p^{w}\right]H\left[\frac{p^{n-w}(1-p)^{w}}{p^{n-w}(1-p)^{w}+(1-p)^{n-w}p^{w}} \right]\right\}. \tag{37}\]  
In this model, the information about the [PERSON]'s random key \(s\) obtained by [PERSON] is \(I_{s}=1-H(S|C)\). Then we contrast the information leakage of the public-XOR-key scheme and re-encryption scheme. Theorem 3: _For the adversary with the same capacity, the information leakage of re-encryption scheme and public-XOR-key scheme are the same, i.e., \(I_{key}=I_{s}\)._  
Proof of Theorem 3: Define two functions \(\Delta\) and \(f_{p}(w)\) as follows,  
\[\Delta\equiv I_{key}-I_{s}=H(S|C)-H(QK_{1}|B),\]  
\[f_{p}(w)=\left[p^{n-w}(1-p)^{w}+(1-p)^{n-w}p^{w}\right]\cdot H\left[\frac{p^{ n-w}(1-p)^{w}}{p^{n-w}(1-p)^{w}+(1-p)^{n-w}p^{w}}\right].\]  
It can be seen that \(f_{p}(i)=f_{p}(n-i)\). The difference between \(I_{key}\) and \(I_{s}\) is  
\[ \begin{split}\Delta=& H(S|C)-H(QK_{1}|B)\\ =&\sum_{w=0}^{n}\left[\frac{1}{2}C_{n}^{w}f_{p}(w) \right]-\sum_{w=0}^{n-1}\left[C_{n-1}^{w}f_{p}(w)\right]\\ =&\left(\frac{1}{2}C_{n}^{0}-C_{n-1}^{0}\right)f_{p} (0)+\sum_{w=1}^{n-1}\left(\frac{1}{2}C_{n}^{w}-C_{n-1}^{w}\right)f_{p}(w)+ \frac{1}{2}C_{n}^{n}f_{p}(n)\\ =&-\frac{1}{2}f_{p}(0)+\frac{1}{2}f_{p}(n)+\sum_{w=1 }^{n-1}\left(\frac{1}{2}C_{n}^{w}-C_{n-1}^{w}\right)f_{p}(w)\\ =&\sum_{w=1}^{n-1}\left(\frac{1}{2}C_{n}^{w}-C_{n-1} ^{w}\right)f_{p}(w)\end{split}  \tag{38}\]  
Sum the \(i\)th term and the \((n-i)\)th term in Equation (38),  
\[ \begin{split}&\sum_{w=i,n-i}\left(\frac{1}{2}C_{n}^{w}-C_{n-1}^{w} \right)f_{p}(w)\\ =&\left(\frac{1}{2}C_{n}^{i}-C_{n-1}^{i}\right)f_{p} (i)+\left(\frac{1}{2}C_{n}^{n-i}-C_{n-1}^{n-i}\right)f_{p}(n-i)\\ =&\left[\left(\frac{1}{2}C_{n}^{i}-C_{n-1}^{i}\right) +\left(\frac{1}{2}C_{n}^{n-i}-C_{n-1}^{n-i}\right)\right]f_{p}(i).\end{split}  \tag{39}\]It is easy to check that  
\[\frac{1}{2}C_{n}^{i}-C_{n-1}^{i}=\frac{1}{2}\left(C_{n-1}^{i-1}-C_{n-1}^{i} \right),\ \ \frac{1}{2}C_{n}^{n-i}-C_{n-1}^{n-i}=\frac{1}{2}\left(C_{n-1}^{n-i-1}-C_{n-1}^{n -i}\right). \tag{40}\]  
Therefore Equation (39) is  
\[\sum_{w=i,n-i}\left(\frac{1}{2}C_{n}^{w}-C_{n-1}^{w}\right)f_{p}(w) \tag{41}\] \[= \frac{1}{2}\left[\left(C_{n-1}^{i-1}-C_{n-1}^{i}\right)+\left(C_{ n-1}^{n-i-1}-C_{n-1}^{i}\right)\right]f_{p}(i)= 0.\]  
Substitute Equation (41) into Equation (38), if \(n\) is an odd number, there is \(\Delta=0\). If \(n\) is an even number, there is  
\[\Delta=\left(\frac{1}{2}C_{n}^{\frac{n}{2}}-C_{n-1}^{\frac{n}{2}} \right)f_{p}\left(\frac{n}{2}\right) \tag{42}\] \[= \frac{1}{2}\left(C_{n-1}^{\frac{n}{2}-1}-C_{n-1}^{\frac{n}{2}} \right)f_{p}\left(\frac{n}{2}\right)=0.\]  
Therefore, for all values of \(n\), there is \(\Delta=0\), i.e., \(I_{key}=I_{s}\). Accordingly, for the same assumption of Eve's capacity, the security of the key distribution scheme we proposed is equivalent to that of the re-encryption scheme. The public-XOR-key scheme can not only improve the practical performance and simplify the system's complexity, but also ensure that it does not reduce the security. Discussion about Information Leakage of the Key Distribution Network from the Perspective of Unicity Distance  
In the model of key distribution network using re-encryption scheme or public-XOR-key scheme, a secret key \(s\) or \(Qk_{1}\) is encrypted with other QKD keys several times. In [PERSON]'s ciphertext-only attack model, the plaintexts are encrypted with the same key multiple times. In this section, we analyze the practical QKD networks from the perspective of [PERSON]'s ciphertext-only attack model, which is an in-depth discussion of unicity distance.