# Wide Area Key Distribution Network Based on a Quantum Key Distribution System
## 2 Preliminaries
### The Theory of Unicity Distance  
In order to discuss the information leakage of the practical QKD network, we study it from a perspective of the unicity distance. [PERSON] laid the foundations of communication theory of secrecy system in [27]. In the second part of the paper, he put forward the concept of unicity distance, which gave a way of calculating approximately how many ciphertexts are required to obtain the key of a secrecy system. The adversary tries each possible key to decrypt the intercepted ciphertexts, and records the keys which make the deciphered messages meaningful in the original language. Only one of the record keys is the correct one, others are spurious keys.  
Figure 1: The model of re-encryption key distribution scheme for the relay QKD system. The dotted arrow stands for the quantum key distribution (QKD) process. The solid arrow stands for the re-encryption process. Relay node \(i\) re-encrypts the ciphertext \(c_{i}\) and transfers \(c_{i+1}=c_{i}\oplus a_{i}\) to the next node.  
In [PERSON]'s ciphertext-only attack model, suppose there is a symmetric cryptosystem \(\left(M,C,K,E,D\right)\), where \(\left|C\right|=\left|M\right|\). In the cryptosystem, \(M\) denotes plaintext space, \(C\) denotes ciphertext space, \(K\) denotes key space, \(E\) denotes the encryption algorithms and \(D\) denotes the decryption algorithms. For \(m\in M\), \(k\in K\), the encryption algorithm is \(E_{k}(m_{i})=c_{i}\). Suppose the plaintexts are in language \(L\), the rate(entropy) is  
\[H_{L}=\lim_{n\rightarrow\infty}\frac{H(A^{n})}{n}. \tag{1}\]  
The redundancy of the language \(L\) is defined as  
\[R_{L}=1-\frac{H_{L}}{\log_{2}\left|A\right|}, \tag{2}\]  
where \(A\) is the word set, \(\left|A\right|\) is the number of words in language \(L\), \(A^{n}\) is the totality of all plaintext n-alphabets, and \(H_{L}\) denotes the average information bits of the each word in language \(L\). \(R_{L}\) measures the degree of statistical constraint imposed by language \(L\).  
For \(Y\in C^{n}\), \(K(Y)\) is defined as a set of all possible key with the given ciphertext \(Y\), \(p(Y)\) is the probability of the events \(Y\) occurring. The expected number of spurious key is  
\[\overline{S_{n}}=\sum_{Y\in C^{n}}p(Y)\left(\left|K(Y)\right|-1\right)=\sum_{ Y\in C^{n}}p(Y)|K(Y)|-1. \tag{3}\]  
When \(n\) is sufficiently large, the relationship between the redundancy of the language \(R_{L}\) and the plaintext \(M\) is  
\[H(M^{n})\approx n(1-R_{L})\log_{2}\left|M\right|\text{.} \tag{4}\]  
Since \(H\left(K|C^{n}\right)=H(K)+H\left(M^{n}\right)-H\left(C^{n}\right)\), \(H\left(C^{n}\right)\leq n\log_{2}\left|C\right|\), where \(C^{n}\) is the totality of all ciphertext n-alphabets. Then  
\[H\left(K|C^{n}\right)\geq H(K)-nR_{L}\log_{2}\left|M\right|\text{.} \tag{5}\]  
According to [PERSON]'s inequality and Equation (3), the conditional entropy is  
\[\begin{split} H\left(K|C^{n}\right)&=\sum_{Y\in C ^{n}}p(Y)H\left(K|Y\right)\leq\sum_{Y\in C^{n}}p(Y)\log_{2}\left|K(Y)\right| \\ &\leq\log_{2}\sum_{Y\in C^{n}}p(Y)|K(Y)|=\log_{2}\left(\overline{ S_{n}}-1\right).\end{split} \tag{6}\]  
Therefore, the expected number of spurious key \(\overline{S_{n}}\) satisfies that  
\[\overline{S_{n}}\geq\frac{2^{H(K)}}{\left|M\right|^{nR_{L}}}-1. \tag{7}\]  
When the length of the ciphertext is \(N_{0}\), the expectation of the number of spurious key is null. \(N_{0}\) is defined as the unicity distance of the system,  
\[N_{0}\approx\frac{H(K)}{R_{L}\log_{2}\left|M\right|}\text{,} \tag{8}\]  
where the entropy \(H(K)\) measures the uncertainty of the value of \(k\).