# Quantum Key Distribution with Post-Processing Driven by Physical Unclonable Functions
## 2 Results and Discussion
### Large QKD networks  
The previous subsection focuses on a typical point-to-point QKD scenario, where only two honest parties are involved and a single pre-shared key is required for the seeding of the first QKD session. The design of large full-mesh QKD networks with \(n\) users, however, requires \(n(n-1)/2\) pre-shared keys (see Figure 5a). For large \(n\), there is a large amount of key material that has to be distributed in a secure manner among the users in order for the first pairwise QKD sessions to be implemented. Moreover, it is very hard to add a new user to the network. Indeed, as soon as a new user (let us say [PERSON]) receives his QKD device, this should come with a list of keys pertaining to each one of the other users with whom [PERSON] may want to establish a QKD link. Each one of these users  
Figure 4: Integration of PUFs in a point-to-point QKD link. (**a**) Each pair of QKD boxes is associated with two PUFs namely, \(\text{PUF}_{\text{A}}\) and \(\text{PUF}_{\text{B}}\). A PUF generates a random key as a response to a challenge. The manufacturer creates a database of challenge-response pairs (CRPs), where only the joint keys are stored. (**b**) With the purchase of the QKD boxes, the users also have access to the corresponding PUFs. Moreover, one of them (say [PERSON]), receives a copy of the database. For the generation of a common random key, which will seed the first QKD session, [PERSON] and [PERSON] interrogate their PUFs independently with the same randomly chosen challenge. The corresponding entry is permanently removed from the database, while [PERSON] also keeps track of the used challenges. This procedure can be performed again, e.g., if the first QKD session aborts, and a new QKD session is necessary. has to be informed about [PERSON] joining the network, and he/she should receive a copy of the corresponding symmetric key to be used for the implementation of the first QKD session with him. Overall, the addition of a new user in a network with \(n\) users should be accompanied by the generation and the distribution of \(n\) additional symmetric secret keys, a rather tedious task. One solution to this problem is the use of a trusted centre, which shares a secret key with each one of the \(n\) users, thereby significantly reducing the number of pairwise shared secret keys (see Figure 5b). In this case, it is relatively easy for [PERSON] to join the existing network, as he has to obtain, together with his QKD device, only one secret key which is known to the key-distribution centre (KDC). The establishment of a QKD link with any other user can be achieved through the KDC, which can help the users to agree on a common secret key required for the post-processing in the first QKD session. The second solution to the aforementioned problems relies on the use of classical or quantum asymmetric cryptosystems, where each user holds a pair of keys (a private key and a public key). Standard widely used asymmetric cryptosystems rely on the difficulty of certain mathematical problems, and thus they offer computational security only [12; 13; 14; 15; 22; 24; 36; 37]. On the other hand, a small number of ITS quantum public-key cryptosystems have been proposed in the literature, but their implementation is beyond reach of current technology [38; 39; 40]. As long as we are interested in preserving the ITS character of QKD protocols, the only currently available route towards the realization of large QKD networks involves, in one way or another, the use of a trusted authority, such as a KDC, which is trusted by all the parties participating in the network. This solution is by no means optimal, because the functionality and the security of the entire QKD network depends strongly on the KDC, which automatically becomes the main target of potential adversaries.