# On the Security of Offloading Post-Processing
## 3 Outsourcing Information Reconciliation
### Multiparty Computation-Based Outsourcing
PA is used to extract the mutual information between [PERSON] and [PERSON] such that the adversary [PERSON] is left without any information, except for a negligible error that can be made arbitrarily small. Although the underlying matrix-vector multiplication seems rather efficient, because of finite key effects and its influence on the secure key rate, a large block length has to be used [29]. Therefore, this step is also computationally very demanding [6], and solutions to entirely offloading this task from the device, or at least from the trusted area within a device, would be desirable. In a PA protocol, [PERSON] randomly selects a hash from a family of universal hashes with the right compression rate--based on [PERSON]'s potential knowledge on the key--and communicates the selected function publicly to [PERSON]. Both peers then apply the same function on the local reconciled key and arrive at the final shared key. The main property of a universal hash family is that they guarantee a low number of collisions, even if the input is chosen by an adversary. Because the block length in QKD is large, the complexity of the universal hashes is also relevant. One family of strongly universal hashes is given by multiplication of the raw key with a random matrix which would need a lot of randomness. Nevertheless, to reduce the randomness needed, a Toeplitz matrix can also be used for PA, which requires only \(n+m\) random bits compared with the \(n\cdot m\) for a random matrix. The use of the Toeplitz matrix also reduces the computational effort for PA because the diagonal structure enables the use of a number theoretical transforms for faster processing of the vector matrix product. Assume that \(\mathbf{k}^{\prime}_{A}=\mathbf{k}^{\prime}_{B}=\mathbf{k}^{\prime}\) is the reconciled key at [PERSON] and [PERSON] with a length \(n\) and \(\mathbf{k}\) represents the final keys of a length \(m\). Then, PA works as follows:

1. [PERSON] randomly generates a uniform string of a length \(n+m-1\) defining the Toeplitz matrix \(\mathbf{T}\) and sends it to [PERSON]. 2. [PERSON] computes \(\mathbf{k}=\mathbf{k}^{\prime}\,\mathbf{T}\) as the final key. 3. [PERSON] receives \(\mathbf{T}\) from [PERSON] and also computes his key as \(\mathbf{k}=\mathbf{k}^{\prime}\,\mathbf{T}\). Thus, both parties perform the same vector-matrix multiplication to shrink the identical keys from \(n\) to \(m\) bits, where the ratio \(n/m\) for CV-QKD is computed as demonstrated by [PERSON] et al. [29] and for DV-QKD as shown by [PERSON] et al. [25]. If we want to offload PA, we would have to offload the core vector-matrix multiplication, which reduces the \(n\) raw key bits to \(m\) final bits. The ratio is already known at the beginning of the PA step, but the Toeplitz matrix has to be generated for each block and exchanged clearly, which makes offloading a problem. If \(\mathbf{T}\) could be kept secret, it would be possible to use a permutation-based approach for PA offloading to a single server, but for a public matrix, this is not possible. However, encrypting \(\mathbf{T}\) is not an option, as it can be immediately seen that the key balance becomes negative if the encryption key for the matrix is longer than the raw key processed. Thus, hiding the input and output keys while still offloading the computation is not feasible in a single-sever model. However, if multiple servers are available, a very efficient non-interactive multiparty protocol is possible (i.e., without requiring the servers to communicate). The protocol is shown in Figure 3. The peer shares the raw key in \(n\) parts with a linear secret sharing scheme--working over \(\mathbb{F}_{2}\) or a larger prime field \(\mathbb{F}_{p}\)--and sends them to the servers (one share per server). The servers compute the \([[\mathbf{k}^{\prime}]]=[[\mathbf{k}]]\mathbf{T}\), where \([[\cdot]]\) denotes the sharing of a value.