# On the Security of Offloading Post-Processing
## 3 Outsourcing Information Reconciliation
### On Outsourcing Reverse Reconciliation
The amount of information required to be exchanged during public discussion for reverse reconciliation per channel use is \(|Q|\geq H(K_{B}|K_{A})=H_{b}(e)\). For the proof, we assume that optimal codes reaching the Shannon limit are used (i.e., equality holds for the syndromes communicated). Thus, for offloading, any external party taking over the syndrome decoding for \(n\) bit keys based on a public \(\mathbf{H}\) needs \(|\mathbf{s}_{e}|=nH_{b}(e)\) amount of information to correct for the errors on the AB channel. Note here that \(\mathbf{s}_{e}\) itself does not carry any information about the key yet still fully defines the error \(\mathbf{e}\). We now prove the impossibility in two steps. (1) We calculate the change in mutual information by offloading the computation of \(\mathbf{e}\) by [PERSON] and therefore publishing the errorsyndrome \(\mathbf{s}_{e}\). (2) We then discuss the influence of discussion needed between [PERSON] and [PERSON] to compute the error syndrome \(\mathbf{s}_{e}=\mathbf{s}_{A}-\mathbf{s}_{B}=\mathbf{k}_{A}\mathbf{H}^{\top}- \mathbf{k}_{B}\mathbf{H}^{\top}\) in the first place, which clearly needs contributions from both peers. Furthermore, we know that [PERSON] is not allowed to learn enough information about \(\mathbf{k}\) to correct all errors through its conceptual channel (i.e., \(I_{AB}-I_{EB}\) have to be preserved or at least be larger than zero to leave [PERSON] and [PERSON] with a secure key). In the beginning of the protocol, we have \(I_{AB}=1-H_{b}(e)\) and \(I_{EB}=1-H_{b}(e+d-2 ed)\). After publishing \(\mathbf{s}_{e}\) and computing \(\mathbf{e}\) in step (1), the mutual information per bit changes to \(I_{AB}^{(i)}=1\) and \(I_{EB}^{(i)}=1-H_{b}(e+d-2 ed)+H_{b}(e)=I_{EA}^{(i)}\), respectively. This means that with knowledge of \(\mathbf{s}_{e}\) and implicitly \(\mathbf{e}\), [PERSON] can correct for all errors with [PERSON], but [PERSON] is left with some remaining uncertainty. Now, to compute \(\mathbf{s}_{e}=\mathbf{s}_{A}-\mathbf{s}_{B}\), another \(nH_{b}(e)\) bits have to be communicated in advance between [PERSON] and [PERSON] (2), which further impacts the knowledge of [PERSON] about the keys. However, after exchanging another \(nH_{b}(e)\) bits about \(\mathbf{k}_{B}\) in public to compute the error syndrome, we still have \(I_{AB}^{(ii)}=1\), but \(I_{EA}^{(ii)}\) is also increased to 1 because \(I_{EB}^{(i)}+H_{b}(e)=1-H_{b}(e+d-2 ed)+2H_{b}(e)>1\). [PERSON] already corrected all errors in step (1), and thus the additional information does not further increase their knowledge. On the contrary, for [PERSON], the information in step (2) is useful and further increases the mutual information with [PERSON] up to the maximum of one, which means [PERSON] has full knowledge about the agreed key. This is due to the fact that the published information is about the independent random variables \(K_{E}\) and \(K_{B}\) both contributing to the key agreement individually, where \(\mathbf{k}=\mathbf{k}_{B}=\mathbf{k}_{A}+\mathbf{e}\). In summary, [PERSON] either learns the key or, if step (2) is encrypted, leads to a negative key balance for QKD in the region of interest with \(d\leq e\). [Impossibility for quantum RR] For reverse reconciliation in the quantum setting, full offloading syndrome decoding is not possible with a positive key rate. Proof. : The quantum case is based on the same assumptions as the classical case and derives by looking at the entropies. [PERSON] and [PERSON] are connected to [PERSON] over a quantum channel, where \(I(\mathbf{K}_{A};\mathbf{K}_{E})\geq I(\mathbf{K}_{A};\mathbf{K}_{B})\) holds. We also assume a symmetric system with \(H(K_{A})=H(K_{B})=1\), and consequently \(H(\mathbf{K}_{A}|\mathbf{K}_{B})=H(\mathbf{K}_{B}|\mathbf{K}_{A})\) as well as \(H(\mathbf{K}_{A}|\mathbf{K}_{E})=H(\mathbf{K}_{E}|\mathbf{K}_{A})\), due to [PERSON] theorem.