# On the Security of Offloading Post-Processing
## 3 Outsourcing Information Reconciliation
### On Outsourcing Reverse Reconciliation
We also know from the definition of mutual information that [PERSON] has less uncertainty about the final key (i.e., [PERSON]'s key) than [PERSON] \(H(\mathbf{K}_{A}|\mathbf{K}_{E})\leq H(\mathbf{K}_{A}|\mathbf{K}_{B})\). Additionally, because the entropy function is concave, we also know that \(H(\mathbf{K}_{A}|\mathbf{K}_{E})\leq H(\mathbf{K}_{B}|\mathbf{K}_{E})\leq H( \mathbf{K}_{A}|\mathbf{K}_{E})+H(\mathbf{K}_{A}|\mathbf{K}_{B})\). Due to [PERSON]'s theorem [23], we require [PERSON] to communicate \(H(\mathbf{K}_{B}|\mathbf{K}_{A})\) bits (e.g., \(\mathbf{s}_{B}\)) to enable [PERSON] to compute the error syndrome. Furthermore, we require [PERSON] to eventually publish \(H(\mathbf{K}_{A}|\mathbf{K}_{B})\) bits (e.g., \(\mathbf{s}_{e}\)) in order to fully outsource error correction, also assuming an optimal code. Contrary to forward reconciliation, both strings published are useful for [PERSON] because the information about the error is independent from the bits revealed about [PERSON]'s key. Thus, with access to this public information, [PERSON] is now able to reduce its uncertainty \(H(\mathbf{K}_{B}|\mathbf{K}_{E})\) about the key because  
\[H(\mathbf{K}_{B}|\mathbf{K}_{E})\leq H(\mathbf{K}_{A}|\mathbf{K}_{E})+H( \mathbf{K}_{A}|\mathbf{K}_{B})<2H(\mathbf{K}_{A}|\mathbf{K}_{B})\,,\]  
leading to \(I(\mathbf{K}_{A};\mathbf{K}_{E})=1\). In essence, after seeing \(\mathbf{s}_{e}\) and \(\mathbf{s}_{B}\), [PERSON] can calculate \(\mathbf{s}_{A}=\mathbf{s}_{B}-\mathbf{s}_{e}\) and remove all uncertainty \(H(\mathbf{K}_{E}|\mathbf{K}_{A})<H(\mathbf{K}_{A}|\mathbf{K}_{B})\) about \(\mathbf{k}_{A}\) and subsequently the final key \(\mathbf{k}=\mathbf{k}_{B}\). However, even with these results in mind, it is unclear if weaker notions of offloading would enable certain levels of partial or assisted secure outsourcing with positive key rates. An impossibility result for _partial offloading_ is hard to formalize, as in an edge case, no meaningful computation would be delegated to the untrusted server, and the entire error reconciliation would be performed as local operations. In the following, we argue that no obvious or natural approaches for reasonable (partial) delegation of computations exist. We have seen that to be left with a secure key after all steps, the outsourced error reconciliation has to hide either \(\mathbf{s}_{e}\) or \(\mathbf{s}_{B}\) with ITS properties. However, \(\mathbf{s}_{e}\) cannot be encrypted by masking because the nature of the outsourced computation is to find a minimum weight vector which fulfills \(\mathbf{e}\mathbf{H}^{\top}=\mathbf{s}_{e}\) for a given \(\mathbf{s}_{e}\) and a public \(\mathbf{H}\), which always requires publishing a target vector \(\mathbf{e}\), which is the reference for distance minimization. Therefore, a simple solution is to encrypt \(\mathbf{s}_{B}\) during transmission with previously acquired secure key material. This requires \(nH_{b}(e)\) additional key bits, leading to a reduced capacity of \(C_{s-enc}=H_{b}(e+d-2 ed)-2H_{b}(e)\). Although the protocol is secure and enables offloading of error correction, it does not lead to a positive key rate for the regions of interest where \(d<e\), which is also shown in Figure 2.  
To give more evidence that an encrypted IR protocol with a positive key balance is not achievable, we review the most relevant and evident techniques to protect the key of [PERSON] or even \(\mathbf{s}_{A}\) in an ITS sense to prevent [PERSON] from learning [PERSON]' key or increase \(I(\mathbf{K}_{A};\mathbf{K}_{E})\). In order to build an encrypted RR protocol, different techniques could be used, but the parity check matrix \(\mathbf{H}\) is considered to be publicly known, which limits the application of hiding techniques to the raw key vector. Furthermore, the discussed solutions should not increase the computational effort to correct errors.