# Quantum Key Distribution with Post-Processing Driven by Physical Unclonable Functions
## 1 Introduction  
Quantum key distribution (QKD) is the most mature quantum technology [1; 2; 3; 4; 5; 6; 7; 8]. Different QKD systems by various vendors are available on the market, and national and international initiatives aim to test the integration of the available QKD systems into existing communication infrastructures, as well their operation in various use cases under realistic conditions. Typically, the establishment of a secret key between two honest users ([PERSON] and [PERSON]) pertains to a quantum communication and a post-processing stage (see Figure 1). In the first stage, [PERSON] encodes random bits on non-orthogonal photonic states, which are sent to [PERSON] over a quantum channel. [PERSON] measures each received signal and records the outcomes. Subsequently, the two users publicly post-process their classical data in order to obtain a final information-theoretically secure secret key. The main steps involved in the post-processing stage are key sifting, error reconciliation, error verification, and privacy amplification. A successful implementation of all of these steps, without any detected failure, is expected to lead to a final secret key. However, for any of these steps, there is always a probability of undetected failure, in which case the security of the protocol is compromised. While processing their data, the two users have to verify the origin of the exchanged messages, otherwise the protocol is prone to a man-in-the-middle attack outlined in Figure 2. In this rather simple attack, an adversary ([PERSON]) cuts the quantum and classical service channels that connect [PERSON] and [PERSON]. She connects her QKD devices to the loose ends of the channels and pretends to be [PERSON] to [PERSON] and [PERSON] to [PERSON]. In this way, she canestablish two secret keys, one with [PERSON] and one with [PERSON], which allow her, e.g., to decrypt and modify any message sent from [PERSON] to [PERSON] (or vice versa). Such an attack can be prevented only by authenticating the service channel, and given that QKD protocols promise information-theoretically secure (ITS) distribution of random keys, authentication by means of ITS message authentication protocols is the natural choice for QKD [9; 10; 11]. Standard ITS message authentication codes (MACs) [12; 13; 14; 15; 16; 17; 18], however, require that the two users share a secret truly random key before they run their QKD system for the first time (see also Appendix A). Figure 1: Schematic presentation of the main steps and the flow of data in a QKD protocol. Figure 2: Schematic representations of a point-to-point QKD link (**a**) and of the man-in-the-middle attack (**b**). For this reason, a typical commercially available pair (sender-receiver) of QKD devices comes with a pre-shared secret key, or the users who purchase the system have to generate the key by some means and transfer it to their devices. Among other tasks, this key is used for authentication in the first QKD session until a sufficient amount of fresh secret key material has been produced. From that point on, message authentication for the subsequent QKD sessions is expected to consume part of the existing secret key that has been generated through QKD. Clearly, a QKD protocol is meaningful only if key consumption is smaller than the generation of fresh key in a session. For large distances and/or lossy channels, however, the generation of fresh secret bits may become very costly in terms of the amount of the pre-shared key information required for their production. Another problem is that the need for a pre-shared secret key considerably complicates the design of large full-mesh QKD networks. These drawbacks, together with the strong dependence of QKD on ITS MACs, have made individuals as well as public authorities and organizations question the usefulness of QKD protocols and hold a negative position with respect to further proliferation of the technology.