# Synthesis of Sources of Common Randomness Based on Keystream Generators with Shared Secret Keys
## 5 Optimal SKD System Based on CR KSG and Winnow IR Protocol  
According to Theorem 1, the crucial influence on the shape of the admissible region comes from the parity bit structure that [PERSON] and [PERSON] send over the public channel, i.e., the structure of the entire set of masks \(\{m_{i}\}=\left\{\left[\,m_{i1},m_{i2},\ \ldots,m_{iN_{i}}\right]\right\}\), \(i=1,2,\ldots,\ n_{p}\), where \(m_{ij}\in\{0,1\}\). We denote by \(CR\ KSG_{\mathrm{W}}\) the CR KSG system in which the Winnow protocol is used for the IR phase of the SKD protocol. The choice of this IR protocol is based on its efficiency in the case of a small initial error \(p_{IR0}\) between [PERSON]'s and [PERSON]'s sequences. Recall that in the CR KSG system \(p_{IR0}\), and according to (7) equivalently the parameter \(\varepsilon\), are system design choices. Therefore, properly chosen \(p_{IR0}\) will enable this protocol to correct errors efficiently and quickly with minimal communication while simultaneously preventing information leakage to Eve (so-called privacy maintenance) [39; 40; 41]. The Winnow protocol begins by dividing the initial sequences into data blocks of length \(N\). The choice of this length has been the subject of intensive analysis over the past two decades, predominantly within QKD algorithms. Reference [39] demonstrates that the Winnow protocol with shorter block lengths, especially for \(N=8\), is more efficient at error correction than with longer block lengths. Therefore, in the following, we adopt this value as a fixed parameter of the \(CR\ KSG_{\mathrm{W}}\) system. A detailed explanation of the protocol steps is provided below (Algorithms 1 and 2). ```
1:[PERSON] and [PERSON] permute their initial key strings according to the negotiated rule and divide the permuted key strings into blocks of length \(\mathrm{N}\ =\mathbb{2}^{r}\), \(\mathrm{r}\ \geq\ 3\). 2:[PERSON] and [PERSON] calculate the parity of each N-bit block. 3:[PERSON] and [PERSON] compare their block parity pair. If the block parity pair is accordant error-correcting operation is not performed but the first bit of the block is discarded for privacy maintenance. Otherwise, an odd number of errors exist in the N-bit block, and the first bit of the block is discarded for privacy maintenance. Then, an error-correcting operation is performed with the Hamming algorithm for the remaining N-1 bits. 4:Steps 1-3 are performed iteratively until the predetermined number of iterations are reached. ```  
**Algorithm 1** The Winnow protocol  
The following theorem provides explicit expressions for the upper and lower bounds of the admissible region of \(CR\ KSG_{W}\), thereby enabling the optimal synthesis of the corresponding SKD system. Theorem 5: _The upper and lower bounds of the region \(\widetilde{D}^{W}\), which corresponds to the \(CR\ KSG_{W}\) system with the Winnow IR protocol, are given by the following expressions_  
\[\Psi_{U}^{Win}\Big{(}p_{IR0},\ \mu_{IR}^{Win}\Big{)}=min\Big{\{}\big{|} \widetilde{K}_{G}\big{|}+h_{b}\bigg{(}\frac{1}{2}\Big{(}1-\sqrt{1-2p_{IR0}} \Big{)},\ \mu_{IR}^{Win}(p_{IR0})-\tilde{\mathrm{\imath}}\ \Big{\}}\, \tag{73}\]  
\[\Psi_{L}^{Win}\Big{(}p_{IR0},\ \mu_{IR}^{Win}\Big{)}=1-\mu_{IR}^{Win}(p_{IR0})- \frac{1}{n_{IR0}}\bigg{[}2n_{b}h_{b}\bigg{(}\frac{1}{2}\Big{(}1-(1-2p_{IR0})^{ 4}\Big{)}\bigg{)}+n_{H}h_{b}\bigg{(}\frac{1}{2}\Big{(}1-(1-2p_{IR0})^{2}\Big{)} \bigg{)}\bigg{]}\, \tag{74}\]  
_where \(\mu_{IR}^{Win}\) is the data remaining efficiency of the Winnow protocol, and \(p_{IR0}\) denotes the initial BER between [PERSON]'s and [PERSON]'s sequences. The variable \(n_{b}\) denotes the number of parity blocks of length \(N=8\) sent by [PERSON], while \(n_{H}\) represents the number of her transmitted syndromes from the (7,4) Hamming error-correcting code._  
**Proof of Theorem 5. ** During the execution of the Winnow protocol, two classes of parity bits are transmitted over the public channel  
\[S_{b}=[Y_{1},Y_{2},\ \ldots,\ Y_{8}]\cdot[1,\ 1,\ 1,\ \ldots,1]^{\mathrm{T}}\, \tag{75}\]  
\[S_{H}=