# Quantum Key Distribution with Post-Processing Driven by Physical Unclonable Functions
## 2 Results and Discussion
### Security Considerations  
The Wegman-Carter authentication (WCA) scheme [17] that is usually employed in standard QKD systems is ITS only if the pre-shared secret key is truly random, or at least very close to perfect. In particular, it has been shown that a WCA scheme that is executed with an \(e^{\prime}-\)perfect key, is indistinguishable from the ideal scenario, with a probability of \((1-\varepsilon-e^{\prime})\), where \(\varepsilon\) refers to the security of the ideal scheme [16; 41]. The protocols outlined in Figures 4, 6, and 7, can provide two honest users with the secret key that is necessary for ITS post-processing in the first QKD session if the following conditions are satisfied:  
1. The numerical keys produced by the PUFs under consideration are close to truly random. 2. The legitimate users never make their PUF tokens/tags available to other parties. 3. Each entry in the database of challenge-response pairs is used only once. 4. The MAC that is used for the distribution of the key in Figure 7 is ITS. For various PUFs that have been discussed in the literature, the generated keys have been shown to successfully pass widely accepted tests of random sequence certification, such as the ones provided by the NIST suite [25; 31; 35; 42]. For all practical purposes, such a  
Figure 8: Schematic representation of an entity authentication session. In order for the KDC to confirm the identity of the newly connected QKD device of [PERSON], they run the protocol in the shaded region to obtain a common secret key through their PUFs. The key manager also chooses a random binary string \(\mathbf{s}\), and they send it to the user. The user runs a publicly known MAC to obtain a tag \(\tau\) for the concatenated message involving their unique identity (in binary format) \(\mathrm{ID}_{\mathrm{C}}\) and the received random binary string. The tag is sent to the KDC, where it is compared to the tag produced locally by the key manager, and the identity of the QKD device is accepted only if the two tags agree. If a secret key is already shared between the user and the KDC, then the steps in the shaded box can be omitted. key can be considered to be close to truly random, and there are no correlations between different elements or parts of the key. Moreover, keys that have been generated from different PUFs or from the same PUF but for different challenges can be considered as uniformly distributed independent random strings. As a result, the entries in a database of CRPs are ITS, because the extraction of the individual keys \(\mathbf{k}_{j}^{(\mathrm{u})}\) and \(\mathbf{k}_{j}^{(\mathrm{v})}\) from the joint key \(\mathbf{k}_{j}^{(\mathrm{u})}\oplus\mathbf{k}_{j}^{(\mathrm{v})}\) is impossible by virtue of a one-time-pad (OTP) encryption, unless the attacker has also access to at least one of the PUFs. Furthermore, an attacker cannot launch a machine learning attack [27] in order to create a model of either of the two PUFs. This is because machine learning requires direct access to a set of CRPs \(\{(c_{j},\mathbf{k}_{j}^{(\mathrm{u})}):j=1,2,\ldots\}\), whereas in our case, the individual keys are not accessible and they are stored encrypted in a secure manner. For the sake of simplicity, in Figures 4 and 6 we have assumed that one challenge suffices for the seeding of the first QKD session. This may not be always the case. A typical QKD system requires at least a 256-bit key (e.g., see Appendix A), while the length of the key that can be generated from a PUF for a single challenge ranges from a few hundred to a few thousand bits. The precise length depends on the type of the PUF under consideration as well as on the details of the fuzzy extractor. If a single challenge cannot provide a key of an appropriate length for seeding the first QKD session, then one can concatenate two or more keys pertaining to different challenges. Indeed, as long as different challenges yield independent nearly perfect keys, the resulting longer key is also close to truly random.