# On the Security of Offloading Post-Processing
## 3 Outsourcing Information Reconciliation
### Multiparty Computation-Based Outsourcing
Because of the linearity of the secret sharing scheme, the necessary multiplications with public constants and additions can be carried out on the shares without interaction between the servers. The results are then sent back to [PERSON], who reconstructs the final key. For the case of prime fields, [PERSON] additionally reduces the result vector \(mod\)The security of the protocol against a passive adversary is governed by the security of the underlying secret sharing scheme. Because the parties do not interact with each other but only communicate with the peer, they cannot learn any information about the final key as long as ITS linear secret sharing is used (e.g., additive or Shamir secret sharing [32]). The computational effort of the solution is the same for every server, which would also be the same as for local computation. Unfortunately, the REM-PA protocol does not provide efficient verifiability aside from recomputation or spot checking, and therefore efficient protection against active attackers cannot be easily achieved during the PA phase. However, if the confirmation round is shifted to after PA, then it will detect errors in the keys and prevent from erroneous keys by aborting the protocol. Thus, it can also detect malicious behavior by the external servers but not directly attribute the errors to them. If the confirmation is shifted to after PA, then it is important to encrypt the tag sent because otherwise, the leaked information cannot be removed anymore, as is normally carried out by PA. Additionally, a secure channel is assumed to distribute the shares to the severs, which may prevent from certain use cases. However, contrary to the MPC-based LDPC decoding, no interaction between servers is required. ## 5 Use Cases

To answer why offloading computationally intensive tasks is interesting at all, we present the expected benefits in general and discuss advantages for certain networking scenarios. The overall goal which can be achieved is savings in energy or cost at the device side, beneficially impacting the cost-effectiveness of the end user's equipment. Therefore, if the devices are simpler and require less computational power, then the cost savings could be substantial (e.g., in cases where the user buys the equipment). Compared with data center environments, the devices are also less energy-efficient for running computation-intensive tasks. If this part can be offloaded to a more efficient data center, then the overall operational cost can also be lowered. Therefore, dedicated cloud solutions which further pool information reconciliation for a larger amount could further help to reduce energy consumption. By regularly updating the external hardware resources, the system can benefit from Moore's law and the continuous drop in cost of computation resources. They can even be shifted flexibly between different locations and data centers to optimize energy usage and cost if more offerings are available. In general, it would even be possible to leverage public cloud services for REM-IR, which requires no trust assumption at all for the environment. Because of these arguments, we think the ability to offload and relocate computationally intensive tasks also leads to higher energy efficiency for computation resources. Additionally, it could also lead to more flexibility on the QKD level (i.e., QKD as a service). The virtualization of the computationally expensive post-processing tasks could be convenient in the future. Not all optical network units (ONUs) have access to QKD

Figure 3: REM-PA protocol. functionality, but the same hardware may be used for coherent passive optical networks (PONs) and CV-QKD [41; 42]. Therefore, we may provide QKD to them by just allocating additional processing resources while also switching their software-defined transceiver into QKD mode. Furthermore, networking equipment is installed for longer times and not updated often.