# Synthesis of Sources of Common Randomness Based on Keystream Generators with Shared Secret Keys
## 6 From Ideal Security Towards Perfect Security by SKD Based on CR KSG and Winnow IR Protocol
[PERSON] gains no additional knowledge about their values, even though all parity bits \(S=\{S_{i}\}\) transmitted over the public channel are available to her. Hence, \(H(W_{i}|S)=H(W_{i})\), which is precisely the first claim of this theorem. To prove statement (89), let us recall that for the conditional Renyi entropy of order two and the corresponding Shannon entropy, the following inequality holds  
\[H(W_{i}|S=s)\geq R(W_{i}|S=s)\, \tag{93}\]  
where equality is achieved only when \(H(W_{i})=|W_{i}|\), which is when the sequence \(W_{i}\) has maximum entropy. Given that each bit in \(W_{i}\) is of the form \(W=X\oplus C_{K}\), \(C_{K}\sim B(0.5)\), we conclude that \(H(W_{i})=|W_{i}|\), and therefore, from (93), it follows that  
\[R(W_{i}|S=s)=H(W_{i}|S=s)=H(W_{i})=|W_{i}|\, \tag{94}\]  
which completes the proof of the theorem. \(\square\)  
**Remark 12**. : _Based on Corollary 5[35], Theorems 4 and 6, it follows that_  
\[I(K_{s};G,S)\leq\frac{1}{ln2}\ 2^{-t}\, \tag{95}\]  
_where \(t\) is the compression rate of the applied universal hash function \(G\). In other words, [PERSON]'s information about \(K_{s}\) given \(G\) and \(S\) can be made arbitrarily small._  
**Theorem 7**. : _The system shown in Figure 11 is perfectly secret if_  
\[\big{|}\widetilde{K}_{s}\big{|}=\tilde{\Delta}_{K_{G}}\, \tag{96}\]  
_up to an error smaller than \(\frac{1}{ln2}\ 2^{-t}\), where \(t\) is the security margin defining the compression rate of the applied universal hash function \(G\). The maximum effective secrecy rate, \(\big{|}\widetilde{K}_{s}\big{|}\) is given by_  
\[\big{|}\widetilde{K}_{s}\big{|}_{max}=\frac{1}{2}\left(\Psi_{U} \mbox{}^{Win}(p_{IR0\_max},\mu_{IR})-\Psi_{L}\mbox{}^{Win}(p_{IR0\_max},\mu_{ IR})\right)\,\ p_{IR0\_max}=0.0905. \tag{97}\]  
Proof. : A necessary and sufficient condition for perfect secrecy is that the eavesdropper's observations do not change their uncertainty about the applied secret keys, that is, the following must hold  
\[H(K_{s}|Z,S)=H(K_{s})=|K_{s}| \tag{98}\]Note that the condition for perfect secrecy (98) involves the complete set of observations \(\{Z,S\}\) available to the attacker, not only the ciphertext \(Z\), but also all the information \(\{S\}\) from the public channel during the execution of the associated SKD protocol. The relationship between \(M\), \(Z\), and \(K_{s}\) is defined by the Vernam cipher. \[Z=M\oplus K_{s} \tag{99}\]  
where \(K_{s}\sim B(0.5)\) and is independent of \(M\). It follows that \(Z\) is independent of \(K_{s}\), that is,  
\[H(K_{s}|Z,S)=H(K_{s}|S) \tag{100}\]  
Based on (95), from (100) it follows that  
\[H(K_{s}|Z,S)=H(K_{s}|S)\geq|K_{s}|-\frac{1}{ln2}2^{-t} \tag{101}\]  
which means that [PERSON]'s entropy about the secret key \(K_{s}\) is close to maximum, or in other words  
\[H(W_{i}|S=s)\geq R(W_{i}|S=s)\, \tag{93}\]0  
with accuracy \(\frac{1}{ln2}\,2^{-t}\). This proves that the condition for perfect secrecy (98) holds with respect to the secret key \(K_{s}\). On the other hand, since the CR block is an ISAR cryptosystem, it holds that  
\[H(W_{i}|S=s)\geq R(W_{i}|S=s)\, \tag{93}\]1  
From (102) and (103), it follows that in the case when  
\[H(W_{i}|S=s)\geq R(W_{i}|S=s)\, \tag{93}\]2  
the attacker gains no advantage in reconstructing \(K_{G}\) compared to reconstructing \(K_{s}\), since due to (103) and (104), they face a set of equally likely alternatives of the same cardinality \(2^{|K_{s}|}\), meaning that simultaneously the following holds  
\[H(W_{i}|S=s)\geq R(W_{i}|S=s)\, \tag{93}\]3  
with accuracy \(\frac{1}{ln2}\,2^{-t}\). This completes the proof of the theorem. \(\square\)  
**Remark 13**.