# On the Security of Offloading Post-Processing
## 3 Outsourcing Information Reconciliation
### On Outsourcing Reverse Reconciliation
We start from the syndrome-decoding equation \(\mathbf{s}_{e}=\mathbf{s}_{A}-\mathbf{s}_{B}=\mathbf{e}\mathbf{H}^{\top}\) and discuss options to hide \(\mathbf{s}_{A}\) from [PERSON] or to prevent any increase in \(I_{AE}\) by public discussion. In order to hide the bit flip positions, we discuss the following additional techniques, which are evident approaches toward the security goals for offloading RR but also not providing any positive key rate due to encrypting the raw key by the following means:  
* A one-time pad (OTP);
* Permutation;
* Padding (i.e., adding dummy (error) bits). _Encryption._ If the goal is to hide \(\mathbf{s}_{A}\) in an ITS way given that \(\mathbf{H}\) is public, either \(\mathbf{s}_{e}\) or \(\mathbf{s}_{B}\) must be one OTP encrypted. \(\mathbf{s}_{B}\) can be encrypted when transmitted to [PERSON] or already at the key level, therefore ultimately hiding the key \(\mathbf{s}_{B}^{\prime}=(\mathbf{k}+\mathbf{m})\mathbf{H}^{\top}\), where \(\mathbf{m}\) is a random masking value, which must also be securely transmitted from [PERSON] to [PERSON]. However, in the first case, \(|\mathbf{s}_{B}|=nH_{b}(e)\) bits are optimally required, and in the second case, a number of  
Figure 2: Secret key length balance (secret channel capacity) for reconciliation with encrypted \(s_{B}\), enabling error correction offloading to untrusted parties. Values are shown for different \(e\). To the left of the dashed line is the interesting region \(d<e\), which has a negative key balance and is therefore unfeasible. raw key bits \(|\mathbf{k}|\) is required, which is extremely inefficient. Above, we have already shown that even the first case leads to negative key rates. Unfortunately, encryption of \(\mathbf{s}_{e}\) also cannot be used to hide bit error positions because decoding requires a start vector to explore the vicinity too. Finding a vector close to a random vector with public \(\mathbf{H}\) leaks the bit flip positions \(\mathbf{e}\) and therefore also \(\mathbf{s}_{e}\). _Permutation._ An alternative method to hide \(\mathbf{e}\), \(\mathbf{s}_{e}\) and thus \(\mathbf{s}_{A}\) would be by permuting the raw key bits before running RR with an unencrypted \(\mathbf{s}_{B}\). Using a permuted key \(\mathbf{k}^{\prime}=\Pi(\mathbf{k})\) for the post-processing would render error correction information useless for [PERSON], but it has to be random for each block and applied on both peers in secret. Thus, a huge amount of shared key material is required, given that the permutation has to be selected randomly from the \(n!\) possible ones, which requires \(\mathcal{O}(n\log(n))\) bits to represent. In the end, if the selected permutation has to be communicated over the public channel via OTP, the key balance is even worse than with syndrome encryption. _Padding._ Padding the raw key with dummy bits could be used to hide error bits if combined with permutation. This corresponds to the technique of mixing raw key with dummy key bits. However, in this case as well, the positions and value of the dummy key bits have to be agreed upon secretly by [PERSON] and [PERSON], which also requires too many bits. Finally, additional errors could be introduced only to [PERSON]. Because the remaining error margin in practical CV-QKD is already very small, this technique can only hide a small amount of information and substantially increases the computational work at the remote instance through the increased error rate. In summary, all natural approaches for partially offloading RR with a positive key rate to a single server in general seem unfeasible.