# An Intrusion Resistant SCADA Framework Based on Quantum and Post-Quantum Scheme
## 4 Proposed Scheme
### Relationship between Keys and Their Derivations in Our Proposed Scheme  
In the following paragraphs, to address the relationship between keys and their derivations, we explain our proposed main framework, and then explain how the SPHINCS-256 public key is generated and to whom it is related or derived from. We have also added three figures. Figures 2 and 3 provide the structure of our proposed scheme. Figure 4 provides the general construction of a SPHINCS tree. Figure 6 shows the computation of SPHINCS at the topmost layer of the tree.  
In our proposed framework, as shown in Figures 2 and 3, we use two primary keys:  
1. Symmetric Key, QK, derived from Quantum Key Distribution.
2. A public key, PK, derived from SPHINCS-256 algorithm.  
Flow of the proposed algorithm: The symmetric key, QK, finalised from the authenticated QKD, is used to encrypt the message (data gathered by RTU) to generate cipher. The sender copies the message before encryption, and the message copy is fed to the SPHINCS-256 to generate signature and the public key, PK. A tuple containing Cipher, Signature and public key is sent to the receiver. The public key, PK, is used to validate the signature when received by the receiver.  
From the above explanation, we can conclude that the public key, PK, of SPHINCS-256 is not derived from the symmetric key, QK. This feature makes the framework secure since the public key does not carry the essence of the symmetric key, QK because QK is used to encrypt the message.  
However, the SPHINCS-256 algorithm has key generation phase which generates its own key pair, (Public key, Private key). The Public key is the PK used in our main framework, explained above and in Figures 2 and 3.  
**Key Generation in SPHINCS-256 [13,43]:** The SPHINCS-256 tree is based on hyper tree construction. When the SPHINCS-256 tree is seen as bottom to top approach, the bottom layer of tree has leaf trees as HORST tree with its own leaves. The leaf of the HORST tree is denoted as \(\mathrm{L}_{i}\) and the root of the HORST tree is \(\mathrm{PK}_{H}\). The \(\mathrm{L}_{i}\) is computed by hashing the elements of HORST secret/private key, \(\mathrm{SK}_{H}\). In Figure 4, we can see that the root node of the below tree is computed to generate the leaf of the following above tree which further generates its own root node. Thus, in simple terms, we can say that the private key of HORST tree is further computed, passing through the main tree via FTS node, OTS nodes and hash nodes, to generate the root of the main tree, SPHINCS-256 public key. Thus, SPHINCS-256 public key, PK, is deterministically derived from HORST private or secret key, \(\mathrm{SK}_{H}\).  
In our proposed scheme, only the HORST secret key, SK\({}_{H}\), is generated by QRNG. Thus, the QRNG is used only once in the SPHINCS-256 tree. And, it is used only in the HORST tree.  
For a detailed view, Figure 6 shows a SPHINCS tree with \(d\) layers, and the root computation of SPHINCS-256 public key, PK, at \(d\)-1 layer. The \(d\)-1 layer has the secret key, SK\({}_{d-1}\), computed and passed on from the below trees. The SK\({}_{d-1}\) is further hashed to generate seed. The seed along with bitmask is fed to the WOTS scheme to generate public key of WOTS, PK\({}_{WOTS}\). The Leaf, L\({}_{i(d-1)}\) is computed by hashing PK\({}_{WOTS}\). And, the L\({}_{i(d-1)}\) is fed to binary hash tree to obtain the root of the main tree, PK.