# Integrating Classical Preprocessing into an Optical Encryption Scheme
## 3 Results
### A Hybrid Construction
#### 3.2.2 Security Analysis  
The proposed hybrid construction, satisfies the notion of correctness and security as defined in Section 3.1:  
**Proposition 2**. : _Let \(\mathcal{T}\) be an \(\ell\)-restricted AONT on \(\mathbb{E}_{2}^{s}\), let \(\mathcal{C}\) be a binary repetition code of odd length \(r\), and and assume that AlphaEta is \(\delta\)-correct. Then the protocol in Figure 2 is \(\delta^{\prime}\)-correct according to Definition 4 where_  
\[\delta^{\prime}=1-\left(\sum_{i=0}^{\frac{r-1}{\delta}}\binom{r}{i}\delta^{i} (1-\delta)^{r-i}\right)^{\ell}. \tag{9}\]  
Proof. : The recipient receives all but \(r\ell\) elements of the plaintext through the classical channel and the missing \(r\ell\) elements via AlphaEta. Using the shared key of the AlphaEta protocol, since this protocol is \(\delta\)-correct, the recipient recovers each of the corresponding \(r\ell\) elements with probability of error smaller than \(\delta\). Since \(\mathcal{C}\) is a binary repetition code, each codeword containing up to \((r-1)/2\) errors can be decoded correctly. This can be done with probability greater than  
\[\sum_{i=0}^{\frac{r-1}{\delta}}\binom{r}{i}\delta^{i}(1-\delta)^{r-i}. \tag{10}\]  
Therefore, the recipient can recover all \(\ell\) bits sent through the AlphaEta channel and therefore obtain the \(s\) elements of the plaintext with probability of error smaller than  
\[1-\left(\sum_{i=0}^{\frac{r-1}{\delta}}\binom{r}{i}\delta^{i}(1-\delta)^{r-i} \right)^{\ell}. \tag{11}\]  
**Remark 5**. : _By ([10] Theorem 1), for the AlphaEta protocol \(\delta\) is less that \(10^{-9}\). As shown in Section 4.2, this allows acceptably small values for \(\delta^{\prime}\)._  
In the proof of the following theorem, we are assuming the probability of \(Y_{i}=0\) and \(Y_{i}=1\) equals \(1/2\) to use the results in [8] and assume the measurements and the values sent through AlphaEta to be  
Figure 3: A quantum symmetric-key encryption scheme. close to independent. In case we would like to provably ensure this as part of the protocol, we could apply a one-time pad (only) to the bits \(a_{1},\ldots,a_{\ell t}\) prior to sending them through the AlphaEta channel. Let \(\mathcal{T}\) be an \(\ell\)-restricted AONT on \(\mathbb{F}_{2}^{s}\), let \(\mathcal{C}\) be a binary repetition code of odd length \(r\), and assume that AlphaEta is \(\epsilon\)-secure. Then the protocol in Figure 2 is \(\epsilon\)-secure according to Definition 4. Proof. : We will use some properties about the entropy function. In particular, we recall the Chain Rule for entropy and a Corollary. For any random variables \(X,Y\) and \(Z\), the following holds:  
\[H(Y|X) = H(X,Y)-H(X) \tag{12}\] \[H(X|Z) = H(X,Y|Z)-H(Y|X,Z) \tag{13}\]  
Throughout the proof, we will use capital letters to denote the random variables taking the values of the corresponding plaintext and ciphertext bits. The ciphertext for our protocol is of the form \(c=\left(\left|\psi_{1}\right\rangle,\ldots\left|\psi_{\ell}\right\rangle,y_{ \ell+1},\ldots,y_{s}\right)\) as described in Figure 3. Let \(X_{i}\) denote the random variable corresponding to a bit of plaintext. After measuring the non-classical part, one should obtain \(a_{1},\ldots,a_{\ell t}\). Not knowing the bases, one obtains \(\tilde{a}_{1},\ldots,\tilde{a}_{\ell t}\). Thus, the reconstructed ciphertext is of the form \(y=\tilde{a}_{1},\ldots,\tilde{a}_{\ell t},y_{\ell+1},\ldots,y_{s}\).