# Wide Area Key Distribution Network Based on a Quantum Key Distribution System
## 4 The Security of the Public-XOR-Key Scheme
### Comparison of the Security of the Public-XOR-Key Scheme and Re-Encryption Scheme  
We have already analyzed the security of the public-XOR-key scheme. Now we contrast its security with that of re-encryption scheme. We first model the re-encryption scheme and analyze the information obtained by [PERSON] in the scheme, then contrast it with the result in Section 4. The endpoint transfers the message encrypted by local random key \(s\). We denote the cryptosystem of QKD network using the re-encryption scheme as \((S,C,QK,E^{\prime\prime},D^{\prime\prime})\). A local random key \(s\) is encrypted \(n\) times with \(Qk_{i}\) by [PERSON] and the relay nodes. To simplify the model, suppose the local random key, QKD keys, ciphertexts are all binary words with the length of 1. The encryption algorithm is the simplest XOR, that is  
\[E^{\prime\prime}_{Qk_{i}}(s)=s\oplus Qk_{i}=c_{i}. \tag{26}\]  
The ciphertexts \(c_{i}\), for \(i=1,2,...,n\) are available to [PERSON]. The assumption of the capacity of [PERSON] about the QKD keys is the same as the decryption of the threat model in Section 4. For a chain network, which contains \(n\) point-to-point QKD systems, the local random key \(s\) is encrypted \(n\) times with \(Qk_{i}\). The QKD keys can be analyzed as a Boolean vector \(Qk\) with the length of \(n\). The ciphertext can be analyzed as a Boolean vector \(c\) with the length of \(n\). Let \(QK,C\in\{0,1\}^{n}\), \(S\in\{0,1\}\) denote the random variables of the vectors of QKD keys, ciphertexts and local random key, respectively. The equivocation of the local random key \(H(S|C)\) measures the uncertainty of the local random key \(s\) when given ciphertexts. When \(H(S|C)\) is null, [PERSON] gets the random key \(s\). **Theorem 2**. : _In the assumption model of key distribution network using re-encryption scheme, the value of the conditional entropy \(H(S|C)\) is_  
\[H(S|C)=\frac{1}{2}\sum_{w=0}^{n}\left\{C_{n}^{w}\left[p^{n-w}(1-p)^{w}+(1-p)^{n- w}p^{w}\right]H\left[\frac{p^{n-w}(1-p)^{w}}{p^{n-w}(1-p)^{w}+(1-p)^{n-w}p^{w}} \right]\right\}. \tag{27}\]  
**Proof of Theorem 2. ** According to the definition of conditional entropy,  
\[ \begin{split}& H(S|C)\\ =&\sum_{c}p(C=c)H(S|C=c)\\ =&-\sum_{c}\left[p(C=c)\sum_{s}p(S=s|C=c)\log p(S=s|C =c)\right].\end{split}  \tag{28}\]  
Then we analyze the properties of the terms in the sum. In order to guarantee the randomness of the local random key \(s\), there is  
\[p(S=0)=p(S=1)=\frac{1}{2}. \tag{29}\]  
For the Boolean vector \(C\in\{0,1\}^{n}\), there are \(2^{n}\) values. Classify \(C\) by the hamming weight. Equation (28) becomes  
\[ \begin{split}& H(S|C)\\ =&-\sum_{c}\left[p(C=c)\sum_{s}p(S=s|C=c)\log p(S=s|C=c) \right]\\ =&-\sum_{w=0}^{n}\left[C_{n}^{w}p(C=c_{w})\sum_{s}p( S=s|C=c_{w})\log p(S=s|C=c_{w})\right],\end{split}  \tag{30}\]  
where \(c_{w}\) denotes a particular vector of length \(n\) with hamming weight \(w\). According to Bayesian formula, when \(C=c_{w}\), the conditional probability of \(S=0\) in Equation (30) is  
\[p(S=0|C=c_{w})=\frac{p(C=c_{w}|S=0)\cdot p(S=0)}{p(C=c_{w})}. \tag{31}\]  
Since \(c_{i}=s\oplus Qk_{i}\), the distribution of \(c_{i}\) depends on \(Qk_{i}\) and \(s\). When random variable \(S=0\), there is \(QK_{i}=C_{i}\). Then  
\[p(C=c_{w}|S=0)=p(QK=c_{w}|S=0)=p(QK=c_{w})=p^{n-w}(1-p)^{w}. \tag{32}\]  
When random variable \(S=1\), there is \(QK_{i}=C_{i}\oplus 1\). Then  
\[p(C=c_{w}|S=1)=p(QK=\overline{c_{w}}|S=1)=p(QK=\overline{c_{w}})=p^{w}(1-p)^{ n-w}. \tag{33}\]  
In Equations (32) and (33), the second equality holds because the random variables \(QK\) and \(S\) are independent of each other. According to the formula of total probability,  
\[ \begin{split}& p(C=c_{w})\\ =& p(C=c_{w}|S=0)p(S=0)+p(C=c_{w}|S=1)p(S=1)\\ =&\frac{1}{2}p^{n-w}(1-p)^{w}+\frac{1}{2}p^{w}(1-p)^ {n-w}.\end{split}