# Synthesis of Sources of Common Randomness Based on Keystream Generators with Shared Secret Keys
## 3 System Architecture  
Figure 1 shows the general architecture of the proposed autonomous system for secret key distillation based on public discussion. The system consists of three subsystems:  
1. A CR block, which functions as a source of common randomness;
2. A SKD block, which performs information reconciliation (IR) and privacy amplification (PA);
3. A Splitter, which divides the distilled secret key \(K\) into two parts, \(K_{G}\), used for refreshing the secret key \(KSG(K_{G})\), and \(K_{S}\), intended for further cryptographic use. The lengths of \(K_{G}\) and \(K_{S}\) can be arbitrary, provided that their total length satisfies \(|K|=|K_{G}|+|K_{S}|\), and are typically chosen according to the system's operational requirements. Figure 1: Autonomous SKD systems that employ a synthetic source of CR based on a shared-key keystream generator \(KSG(K_{G})\) and local pure randomness. In each operation cycle \(i\) of the system, the CR block generates the output sequence \(Y\) by performing a bitwise modulo-2 addition (XOR) of the sequences \(X\) and \(C_{K}\), i.e.,  
\[Y=X\ \oplus\ C_{K} \tag{1}\]  
where \(X\) is a sequence distributed according to the Bernoulli distribution, generated by a local source of true randomness  
\[X\sim B(\varepsilon),\ \varepsilon=Pr\{X=1\},\ 0<\varepsilon\leq 1, \tag{2}\]  
and the sequence \(C_{K}\) is a running key (or keystream) produced by key stream generator \(KSG(K_{G})\), where \(K_{G}\) is the secret key. **Remark 1**. : _If [PERSON] and [PERSON] have a pre-shared secret key \(K_{G}\), they can generate their local sequences \(Y_{A}\) and \(Y_{B}\)_  
\[Y_{A}=X_{A}\oplus C_{K},\ Y_{B}=X_{B}\oplus C_{K}. \tag{3}\]  
_The probability of disagreement between those sequences, i.e., the BER is_  
\[p_{AB}=P(Y_{A}\oplus Y_{B}=1)=P(X_{A}\oplus X_{B}=1)=\varepsilon_{A}* \varepsilon_{B} \tag{4}\]  
_where \(*\) denotes binary convolution_  
\[p*q=p(1-q)+(1-p)q,\ 0\leq p,\ q\leq 1. \tag{5}\]  
_If \(\varepsilon_{A}=\varepsilon_{B}=\varepsilon\) is adopted, then it follows:_  
\[p_{AB}=2\varepsilon(1-\varepsilon). \tag{6}\]  
_The inverse relation also follows, which will be of interest in the subsequent discussion_  
\[\varepsilon=\frac{1}{2}\Big{(}1-\sqrt{1-2p_{AB}}\Big{)}. \tag{7}\]  
Therefore, the proposed CR source can be considered as a variant of [PERSON]'s satellite scenario, where by controlling the parameter \(\varepsilon\), any desired BER between [PERSON]'s and [PERSON]'s sequences can be achived; see Figure 2.  
Figure 2: Dependence (6) of the initial BER between [PERSON]’s and [PERSON]’s sequences on the parameter \(\varepsilon\) of the local source of pure randomness whose probability distribution is \(B(\varepsilon)\). It should be noted that such precise control of the correlation properties of sequences generated in [PERSON]'s satellite scenario is practically impossible to achieve [11]. Moreover, if [PERSON] does not possess the secret key \(K_{G}\), then the error probability between her sequence and [PERSON]'s sequence is  
\[Y=X\ \oplus\ C_{K} \tag{1}\]0  
given that  
\[Y=X\ \oplus\ C_{K} \tag{1}\]1  
where \(C_{KE}\) denotes the keystream generated by the key stream generator \(KSG(K_{KE})\), with [PERSON]'s secret key \(K_{KE}\
eq K\). Condition (9) is a mandatory property of any secure cryptographic \(KSG(K)\) and is closely related to the so-called avalanche effect; see [24; 25]. Similarly, we obtain  
\[Y=X\ \oplus\ C_{K} \tag{1}\]2  
Figure 3 illustrates the equivalent [PERSON] satellite scenario, where \(KSG(K_{G})\) functions as a satellite, broadcasting the keystream \(C_{K}\). To this signal, binary additive noises are superimposed at [PERSON]'s, [PERSON]'s, and [PERSON]'s channels. In the case of [PERSON]'s and [PERSON]'s channels, these noises correspond to sequences generated by local sources of pure randomness distributed according to \(B(\varepsilon)\).