# On the Security of Offloading Post-Processing
## 3 Outsourcing Information Reconciliation
### Protocol for Offloading Direct Reconciliation
The quantum channel between [PERSON] and [PERSON] is then modeled as a binary symmetric channel \(BSC(e)\) with a quantum bit error probability \(e\). Furthermore, let \(L_{E}^{IR}(\mathbf{K}|Q)\) be the additional information leaked to [PERSON] about the agreed key \(\mathbf{K}\) during the information reconciliation phase beyond what [PERSON] already gained during the previous steps of the key exchange. Moreover, \(H(\mathbf{K}_{A})=H(\mathbf{K}_{B})=n\) is for uniformly random input encoding, and mutual information \(I_{AB}:=I(\mathbf{K}_{A};\mathbf{K}_{B})=n(1-H_{b}(e))\) is defined by the error probability on the channel. Thus, the amount of information required to be exchanged during public discussion is \(|Q|\geq H(\mathbf{K}_{A}|\mathbf{K}_{B})=nH_{b}(e)\), where we assume an ideal reconciliation algorithm which works at the Shannon limit (i.e, equality holds). Without loss of generality, we assume that [PERSON] will correct his errors and the agreed key will be \(\mathbf{k}=\mathbf{k}_{A}\). Note here that in the DV-QKD-type protocols, we have \(I_{AE}=I_{BE}\)[25], which makes them suitable for direct reconciliation. Now, we show that the information [PERSON] gains about the final key during a protocol run of REM-IR is equal to the information leaked in local IR, where it only sees \(\mathbf{S}_{A}\). Concretely, by revealing \(\mathbf{S}_{e}\) and therefore \(\mathbf{E}\) and \(\mathbf{S}_{B}\) in addition to \(\mathbf{S}_{A}\), the information [PERSON] learns about the final key (\(\mathbf{k}\)) can be described as follows:  
\[L_{E}^{\texttt{REM-IR}}(\mathbf{K}|\mathbf{S}_{A},\mathbf{S}_{e})=L_{E}^{ \texttt{REM-IR}}(\mathbf{K}|\mathbf{K}\mathbf{H}^{\top},\mathbf{E}\mathbf{H}^ {\top})=L_{E}^{\texttt{REM-IR}}(\mathbf{K}|\mathbf{K}\mathbf{H}^{\top})=L_{E}^{ \texttt{REM-IR}}(\mathbf{K}|\mathbf{S}_{A})\,.\]  
This is due to the fact that the additional information [PERSON] gains by learning \(\mathbf{S}_{e}\), \(\mathbf{E}\) and therefore \(\mathbf{S}_{B}\) is only about \(\mathbf{E}\mathbf{H}^{\top}\), which is not correlated to the final key and also removed from \(\mathbf{k}_{B}\) during the IR step. This can also be seen by looking at [PERSON]'s key \(\mathbf{K}_{B}=\mathbf{K}_{A}+\mathbf{E}\), which is the sum of two independent random variables where the error term is removed by IR and does not contribute in any form to the final key string \(\mathbf{K}\). Therefore, the leakage during the protocol run is \(L_{E}^{\texttt{REM-IR}}(\mathbf{K}|\mathbf{S}_{A})=|\mathbf{S}_{A}|=nH_{b}(e)\). Variants of REM-IR could be, for example, to let [PERSON] and [PERSON] directly send \(\mathbf{s}_{A}\) and \(\mathbf{s}_{B}\), respectively, to the third party, who then computes \(\mathbf{s}_{\mathbf{e}}=\mathbf{s}_{B}-\mathbf{s}_{A}\). This version is equivalent, as also in REM-IR, the third party knows all syndromes (i.e., it can compute \(\mathbf{s}_{B}=\mathbf{s}_{\mathbf{e}}+\mathbf{s}_{A}\) from the publicly known \(\mathbf{s}_{\mathbf{e}}\), \(\mathbf{s}_{A}\)). Furthermore, to increase the reliability and availability of the results, the computation can be delegated and distributed to an arbitrary number of third parties. The security is not jeopardized by any extended protocol involving more external untrusted parties and serves as a general baseline for such scenarios. Figure 1: REM-IR protocol.