arXiv CSopen access

From Bits to Mixed-Radix Keys: Horner Decomposition, Uniform Sampling, and the Information-Theoretic QKD Interface of the MR-OTP

From Bits to Mixed-Radix Keys: Horner Decomposition, Uniform Sampling, and the Information-Theoretic QKD Interface of the MR-OTP Fabio F.G. Buono∗

arXiv:2606.18526v1 [cs.CR] 16 Jun 2026

June 18, 2026

Preprint Abstract

D ra

ft

The Mixed-Radix One-Time Pad (MR-OTP) [1] generalizes the classical one-time pad to digit spaces with non-uniform bases, preserving Shannon perfect secrecy while enabling native encoding of heterogeneous data alphabets without conversion to binary. A practical deployment of the MR-OTP requires a concrete, bias-free procedure for converting raw binary entropy, as produced by a Quantum Key Distribution (QKD) source, into a key tuple that is uniform over the mixed-radix key space. This paper identifies Horner’s method [2] and its inverse as the canonical algebraic correspondence for this conversion, grounded in the structural equivalence between the mixed-radix positional weights of [1] and the nested form of polynomial evaluation. We prove that naive modular reduction introduces a statistical bias that violates the uniformity hypothesis of the MR-OTP perfect secrecy theorem (Proposition 3.1), and that rejection sampling combined with inverse Horner decomposition restores uniform distribution at an expected bit cost of at most 2⌈log2 P ⌉ (Theorem 3.4, Proposition 3.5). We prove end-to-end perfect secrecy for the full QKD pipeline in one session (Theorem 4.2) and across N sessions under a partition key-rolling scheme (Theorem 6.2). We prove that the information-theoretic security guarantee is preserved under any future algorithmic advance on the Base Recovery Problem, including a polynomial-time solution (Theorem 8.15), extend this to message distributions with arbitrary restricted support (Corollary 8.17), and establish an unconditional lower bound on the query complexity of base recovery in the known-plaintext setting (Theorem 8.10). We present a complete adversary taxonomy separating testing-based, algebraic, unbounded, and ciphertext-only adversaries, proving that base recovery is information-theoretically insoluble in the ciphertext-only setting (Corollary 8.2) and establishing that the information-theoretic guarantee on messages covers all classes unconditionally while the query lower bound and computational hardness cover disjoint subsets of the adversary space for the problem of identifying the base sequence from known-plaintext data. We identify the logical structure of the invariance result as an instance of the Syntactic Invariance Principle of [3]. We also quantify representational efficiency over binary OTP for natural alphabets (Proposition 5.3), develop a batched extraction algorithm (Theorem 9.2), and characterize security degradation for non-ideal QKD sources (Theorem 10.3). Five open problems identify the main directions for further work, with the product-support case of the optimal base selection problem resolved by Corollary 8.17.

Contents 1 Introduction ∗

3

Independent Researcher

1

5 5 5 5 6

3 Uniform Key Sampling: The Complete Algorithm 3.1 Why naive conversion fails: modulo bias . . . . . . . . . . . . . . . . . . . . . . . 3.2 Rejection sampling restores uniform distribution . . . . . . . . . . . . . . . . . . 3.3 Expected bit cost . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4 The complete algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.5 Worked example with rejection step . . . . . . . . . . . . . . . . . . . . . . . . .

6 6 7 7 8 8

4 End-to-End Information-Theoretic Security with QKD 4.1 The pipeline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.2 Stage 1: QKD produces a uniform bit stream . . . . . . . . . . . . . . . . . . . . 4.3 Stage 2: Algorithm 1 preserves uniformity . . . . . . . . . . . . . . . . . . . . . . 4.4 Stage 3: MR-OTP achieves perfect secrecy . . . . . . . . . . . . . . . . . . . . . . 4.5 The end-to-end theorem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.6 Contrast with QKD paired with a symmetric cipher . . . . . . . . . . . . . . . .

9 9 9 9 9 10 10

5 Representational Efficiency over Binary OTP 5.1 The efficiency question . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.2 Properties of the binary overhead . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.3 Efficiency for natural alphabets . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.4 Efficiency and key rolling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

10 10 11 11 12

D ra

ft

2 Horner’s Method and Its Inverse 2.1 Horner’s method: polynomial evaluation in nested form . . . . . . . . . . . . . . 2.2 The mixed-radix representation as a Horner evaluation . . . . . . . . . . . . . . . 2.3 Inverse Horner decomposition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.4 The forward–inverse duality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

6 Key Rolling, Session Structure, and Composability 6.1 The partition protocol from the first paper . . . . . . . . . . . . . . . . . . . . . 6.2 Session model and notation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3 Multi-session security theorem . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.4 The dynamic key rolling variant and its open status . . . . . . . . . . . . . . . . 6.5 Key consumption and overhead of base transmission . . . . . . . . . . . . . . . .

12 12 12 12 13 13

7 Open Problems

14

8 Computational Hardness of Base Recovery 8.1 Setup and motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2 Ciphertext-only indistinguishability of the base sequence . . . . . . . . . . . . . . 8.3 The base recovery problem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.4 Information-theoretic analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.5 Structural comparison with known hard problems . . . . . . . . . . . . . . . . . . 8.6 A provable lower bound in the query model . . . . . . . . . . . . . . . . . . . . . 8.7 Conjectured hardness and its consequences . . . . . . . . . . . . . . . . . . . . .

15 15 15 16 16 16 17 18

9 Batched Key Extraction 9.1 Motivation and setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2 The batched sampler . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3 Cost comparison with sequential sampling . . . . . . . . . . . . . . . . . . . . . . 9.4 Extension to mixed base sequences . . . . . . . . . . . . . . . . . . . . . . . . . .

22 22 22 23 23

2

10 Security Degradation under Non-Ideal QKD Sources 10.1 Model for non-ideal sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.2 Degradation through Algorithm 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.3 Degradation through N sessions . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.4 Security statement for non-ideal sources . . . . . . . . . . . . . . . . . . . . . . .

24 24 24 24 25

11 Conclusion

25

12 Acknowledgments

26

Notation. Throughout the paper, log2 denotes the base-2 logarithm, ⌊·⌋ the floor function, and ⌈·⌉ the ceiling function. The symbol Z denotes the integers and Z/mZ the integers modulo Q m. Given a base sequence B = (b1 , . . . , bL ) with each bi ≥ 2, we write P = L b i=1 i for the QL product of all bases and K = i=1 {0, . . . , bi − 1} for the corresponding key space. The symbol H(·) denotes Shannon entropy measured in bits, R denotes a source of independent uniform random bits, and all probability statements are taken over the randomness of R.

1

Introduction

D ra

ft

The one-time pad, introduced by Vernam in 1917 and patented in 1919 [4], achieves perfect secrecy in the sense that an intercepted ciphertext yields no information about the plaintext regardless of the computational resources available to the adversary. Shannon formalized this property in 1949 [5], proving that it holds if and only if the key is drawn uniformly at random, is at least as long as the message, and is never reused. The preceding paper [1] extended this classical construction to mixed-radix digit spaces by allowing each position of the message to reside in its own finite cyclic group, defining the MR-OTP and proving that Shannon’s perfect secrecy theorem carries over without modification. The construction originates from the earlier work [6], which introduced the idea of encoding data in a secret mixed-radix representation and observed that the numerical value of a sequence is hidden from any process that operates on the symbols alone. The MR-OTP as a unifying framework. The first paper [1] establishes the MR-OTP as a unifying algebraic framework for perfect-secrecy encryption over finite digit spaces. By allowing each position i of the message to carry its own base bi ≥ 2, the construction subsumes two classical families as special cases. When all bases are set to bi = 2, modular addition at each position reduces to bitwise XOR and the MR-OTP coincides with the binary OTP (Corollary 1 of [1]). When all bases are set to a common constant b, the construction recovers the onetime pad over an alphabet of size b, for example b = 26 for Latin text or b = 4 for nucleotide sequences (Corollary 2 of [1]). The extension to non-constant base sequences is the contribution of [1], where each symbol of the data is encoded in its native algebraic structure without any intermediate binary conversion. This unification preserves the information-theoretic constraint on key length without modification. As shown in Proposition 2 of [1], the pad must carry entropy at least equal to that of the message regardless of how the bases are chosen or whether they are kept secret, because the bases modify the representation of the data but leave the entropy that the key must supply unchanged. The MR-OTP therefore achieves Shannon’s bound [5] with equality. The present paper addresses the next algorithmic question, namely how to convert the output of a concrete binary entropy source into a key that satisfies the uniform distribution required by the MR-OTP. Quantum key distribution (QKD) systems such as BB84 [7] are the most natural source for this purpose, as they produce a stream of independent, uniformly distributed classical 3

bits whose distribution is guaranteed by the structure of the protocol, with no assumption on the computational resources of an adversary. The MR-OTP, however, requires a key K = (k1 , . . . , kL ) in which each digit ki is uniform over {0, . . . , bi − 1} and the digits are mutually independent, a condition that a binary stream satisfies only when every base bi is a power of 2, a requirement that the data alphabets of practical interest do not meet. Reading k = ⌈log2 P ⌉ bits and reducing the resulting integer modulo P introduces a statistical distortion known as modulo bias [8], which arises whenever P is not a power of 2. In most algorithmic settings this bias is negligible, but in the information-theoretic setting any non-uniformity in the key distribution violates the hypothesis of the MR-OTP perfect secrecy theorem [1] and renders the system insecure regardless of the magnitude of the distortion. Main contributions. 1. We identify Horner’s method [2] and its inverse as the canonical algebraic duality underlying the conversion from integers to mixed-radix tuples (Section 2). 2. We prove that naive modular reduction of a k-bit integer introduces a bias that breaks perfect secrecy (Proposition 3.1), and that a rejection-sampling step restores uniform distribution at an expected bit cost of at most 2⌈log2 P ⌉ (Theorem 3.4, Proposition 3.5).

ft

3. We prove end-to-end information-theoretic security of the full QKD pipeline for a single session (Theorem 4.2) and for N sessions under a partition key-rolling scheme (Theorem 6.2).

D ra

4. We prove that the information-theoretic security guarantee is preserved regardless of any computational advance on the Base Recovery Problem (Theorem 8.15), and extend this to message distributions with arbitrary restricted support (Corollary 8.17). 5. We prove that the Base Recovery Problem is information-theoretically insoluble in the ciphertext-only setting (Corollary 8.2), establish an unconditional lower bound on its query complexity in the known-plaintext setting (Theorem 8.10), separate the testing and algebraic adversary classes, and present the complete adversary taxonomy (Remark 8.16). 6. We identify the logical structure of the invariance result as an instance of the Syntactic Invariance Principle of [3], and use this framework to reformulate the dynamic key rolling open problem (Section 8.20, Open Problem 6.4). 7. We quantify representational efficiency over binary OTP (Section 5), develop the batched key extraction algorithm (Section 9), and characterize security degradation for non-ideal QKD sources (Theorem 10.3). Organization. Section 2 reviews Horner’s method, develops its inverse, and establishes the forward–inverse duality. Section 3 proves the bias theorem, the uniformity theorem, the cost bound, and states the complete algorithm. Section 4 proves end-to-end information-theoretic security of the full QKD pipeline. Section 5 quantifies representational efficiency over binary OTP. Section 6 proves multi-session security and formulates the dynamic key rolling open problem using the Syntactic Invariance Principle framework. Section 7 states the five open problems. Section 8 analyzes the Base Recovery Problem in both the ciphertext-only and known-plaintext settings, proves the information-theoretic insolubility of the former (Corollary 8.2), establishes unconditional bounds in the query model for the latter, and identifies the logical structure of the temporal security result as an instance of the Syntactic Invariance Principle of [3]. Section 9 develops the batched key extraction algorithm. Section 10 quantifies security degradation for non-ideal QKD sources.

4

2

Horner’s Method and Its Inverse

2.1

Horner’s method: polynomial evaluation in nested form

Let a0 , a1 , . . . , an be the coefficients of a polynomial and let x be an indeterminate. Evaluating the polynomial in expanded form as P (x) = an xn + an−1 xn−1 + · · · + a1 x + a0 requires O(n2 ) multiplications when each power xj is computed independently by repeated squaring. Horner’s method [2] eliminates this redundancy by rewriting the same expression in nested form as

P (x) = a0 + x a1 + x a2 + · · · + x(an−1 + x an ) · · · , which requires only n multiplications and n additions and is optimal by a classical lower-bound argument [9]. The nested form is computed by the recurrence bn = an ,

bj = aj + x bj+1

(j = n − 1, . . . , 0),

with P (x) = b0 .

2.2

ft

Remark 2.1. Horner’s method is valid over any ring, and in particular over Z and over Z/mZ for any modulus m. It is this algebraic generality that makes the method applicable to mixed-radix numeral systems over finite cyclic groups.

The mixed-radix representation as a Horner evaluation

D ra

Fix a length L and a base sequence B = (b1 , . . . , bL ) with each bi ≥ 2. Recall from [1] the positional weights Y Wi = bj , WL = 1. j>i

The integer value associated with a digit tuple (k1 , . . . , kL ) is V =

L X

ki Wi = k1 (b2 b3 · · · bL ) + k2 (b3 b4 · · · bL ) + · · · + kL .

(1)

i=1

Writing the same sum in nested form gives V =

· · · (k1 · b2 + k2 ) · b3 + k3 · · · · bL + kL ,

(2)

which is a Horner evaluation of the digit sequence (k1 , . . . , kL ) treated as coefficients, with the position-dependent multipliers b2 , b3 , . . . , bL playing the role of the variable x at each nesting level.

2.3

Inverse Horner decomposition

Definition 2.2 (InverseQHorner decomposition). Given a base sequence B = (b1 , . . . , bL ) and an integer V ∈ {0, . . . , i bi − 1}, the inverse Horner decomposition recovers the digit tuple (k1 , . . . , kL ) by the following procedure. 1. Set V (L) ← V . 2. For i = L downto 1, set ki ← V (i) mod bi and V (i−1) ← ⌊V (i) /bi ⌋. 3. Return (k1 , . . . , kL ).

5

Q Proposition 2.3 (Correctness). For every V ∈ {0, . . . , i bi − 1}, the inverse Horner decomP position returns the unique tuple (k1 , . . . , kL ) with 0 ≤ ki < bi and V = L i=1 ki Wi . (i) mod b and Proof. At step i, the division algorithm gives V (i) = ki + bi V (i−1) , so kP i = V i V (i−1) = ⌊V (i) /bi ⌋. Unrolling recovers the nested form Q (2), hence V = i ki Wi . Uniqueness follows since the map is injective on a set of cardinality i bi .

Example 2.4. B = (7, 13, 5), P = 455, V = 427: k3 = 427 mod 5 = 2, V ← 85;

k2 = 85 mod 13 = 7, V ← 6;

k1 = 6 mod 7 = 6.

K = (6, 7, 2). Check: 6 · 65 + 7 · 5 + 2 = 390 + 35 + 2 = 427. ✓

2.4

The forward–inverse duality Direction

Name

Operation

(k1 , . . . , kL ) → V V → (k1 , . . . , kL )

Horner (forward) Inverse Horner

V = ((· · · (k1 b2 + k2 )b3 + k3 ) · · · )bL + kL ki = V (i) mod bi , V (i−1) = ⌊V (i) /bi ⌋

ft

The forward map composes a digit tuple into a single integer by accumulating products in the manner of Horner evaluation, while the inverse map recovers the digits from the integer by successive modular reduction starting from the least significant position. The two operations are mutual inverses, establishing a bijection between K and the integer interval {0, . . . , P − 1}.

Uniform Key Sampling: The Complete Algorithm

3.1

Why naive conversion fails: modulo bias

D ra

3

A binary entropy source such as a QKD device reads k bits at a time and delivers an integer V that is uniform on {0, . . . , 2k − 1}. The inverse Horner decomposition requires V to be uniform on the smaller set {0, . . . , P − 1}, and these two distributions agree only when P is itself a power of 2. Proposition 3.1 (Modulo bias breaks perfect secrecy). Let k = ⌈log2 P ⌉, r = 2k mod P > 0. If V is uniform on {0, . . . , 2k − 1}, then: (i) Values v ∈ {0, . . . , r − 1} each have probability 2/2k ; values v ∈ {r, . . . , P − 1} each have probability 1/2k . (ii) The digits (k1 , . . . , kL ) from inverse Horner are not uniform over K. (iii) Perfect secrecy of the MR-OTP is violated. Proof. The map v 7→ v mod P sends {0, . . . , 2k − 1} to {0, . . . , P − 1}, with each residue v ′ < r covered by ⌊2k /P ⌋ + 1 pre-images and each v ′ ≥ r by ⌊2k /P ⌋. Since r > 0 these counts differ, so the distribution on {0, . . . , P − 1} is non-uniform. The inverse Horner map is a bijection (Proposition 2.3), so the key distribution over K is non-uniform, violating the uniformity hypothesis of Theorem 1 in [1]. Example 3.2. B = (7, 13, 5), P = 455, k = 9, 29 = 512, r = 57. The 57 keys corresponding to V ∈ {0, . . . , 56} each have probability 2/512; the remaining 455−57 = 398 keys have probability 1/512.

6

3.2

Rejection sampling restores uniform distribution

Definition 3.3 (Rejection sampler S(B)). Given a base sequence B, let P = ⌈log2 P ⌉. The rejection sampler S(B) proceeds through the following steps.

Q

i bi and k =

1. Draw k uniform bits from R and interpret them as an integer V ∈ {0, . . . , 2k − 1}. 2. If V ≥ P , discard V and return to step 1. 3. Apply the inverse Horner decomposition to V and return the resulting key K. Theorem 3.4 (Uniform sampling). S(B) terminates with probability 1 and outputs K uniform on K with mutually independent digits. Proof. Termination. The acceptance probability per round is P/2k ≥ 1/2 (since 2k ≤ 2P ). Rounds are independent, so termination is geometric with parameter ≥ 1/2. Uniformity upon acceptance. For any v ∈ {0, . . . , P − 1}: Pr[V = v | V < P ] =

1/2k 1 = . k P P/2

3.3

D ra

ft

Independence and uniformity of digits. The inverse Horner map is a bijection {0, . . . , P −1} → K (Proposition 2.3), so it carries Q the unique uniform distribution on {0, . . . , P − 1} to the unique uniform distribution on K = i {0, . . . , bi − 1}. Q For independence, observe that |K| = P = i bi . For any fixed values t1 ∈ {0, . . . , b1 − 1}, . . . , tL ∈ {0, . . . , bL Q − 1}, just one v ∈ {0, . . . , P − 1} maps to (t1 , . . . , tL ), so Pr[K = (t1 , . . . , tL )] = 1/P = i (1/bi ). This factorization of the joint distribution into a product of marginals is mutual independence, with each ki uniform on {0, . . . , bi − 1}.

Expected bit cost

Proposition 3.5 (Bit cost bound). The expected number of bits consumed by S(B) satisfies E[bits] = k ·

2k ≤ 2k = 2⌈log2 P ⌉. P

Proof. Rounds are i.i.d., each using k bits, with success probability p = P/2k . Expected rounds: 1/p = 2k /P . Total expected bits: k/p ≤ 2k since 2k ≤ 2P . Remark 3.6 (Practical acceptance rates for natural alphabets). • B = (4)L (nucleotides): P = 22L , k = 2L, no rejection ever needed. Expected rounds: 1. • B = (26)5 (five Latin letters): P = 11 881 376, k = 24, acceptance ≈ 70.8%, expected ≈ 1.41 rounds. • B = (26, 10, 8): P = 2080, k = 12 (since 211 = 2048 < 2080 ≤ 212 = 4096), acceptance = 2080/4096 ≈ 50.8%, expected ≈ 1.97 rounds. • B = (20)4 (four amino acids): P = 160 000, k = 18 (since 217 = 131 072 < 160 000 ≤ 218 = 262 144), acceptance ≈ 61.0%, expected ≈ 1.64 rounds. In all cases the expected number of rounds is at most 2, confirming that the overhead of rejection sampling is negligible in practice.

7

3.4

D ra

ft

Remark 3.7 (Comparison with Lemire’s method). Algorithm 1 uses the simplest form of rejection sampling, which performs one integer division per accepted sample during the inverse Horner decomposition. Lemire [8] proposes a multiplication-based variant that avoids integer division in most cases by computing the 2k-bit product V · P and accepting when the lower k bits of the product exceed the threshold (−P ) mod 2k , falling back to a division only on rejection events. Since the probability of rejection is 1 − P/2k ≤ 1/2, the expected number of divisions per sample in Lemire’s method is at most 1/2, compared to 1 in Algorithm 1. From a computational standpoint, Lemire’s method reduces the division count by roughly a factor of 2 on general-purpose processors where integer divisions are slower than multiplications by a substantial margin, and this advantage is largest when P is close to 2k−1 and the rejection probability is highest. From an entropic standpoint, both methods consume the same expected number of bits per key, namely k·2k /P , so the choice of method leaves the rate of QKD-generated entropy consumption unchanged. For implementations that pair the MR-OTP with a dedicated QKD hardware source operating at rates in the megabit-per-second range, the throughput of key tuples is bounded by the bit generation rate of the source, and both methods deliver the same throughput. On software platforms or embedded systems where division latency is a concern, Lemire’s variant is preferable and is a drop-in replacement for the rejection step in Algorithm 1 without affecting any of the security properties proved in Theorem 3.4 or Theorem 4.2. A further comparison arises from the work of Draper and Saad [10] on entropy-optimal discrete sampling, which shows that any unbiased sampler for a distribution over P outcomes must consume at least log2 P = H(Uniform(P )) bits per sample in expectation, with achievable algorithms reaching between H(Uniform(P )) and H(Uniform(P )) + 2 bits per sample. The expected cost of Algorithm 1 is k · 2k /P , which can be written as log2 P · (2k /P ) · (k/ log2 P ). Since 2k /P ≤ 2 and k/ log2 P = ⌈log2 P ⌉/ log2 P ≤ 1 + 1/ log2 P , the algorithm is within a small constant of the entropy-optimal bound for all P ≥ 4, and the gap vanishes as P grows. Achieving the tight [H(P ), H(P ) + 2] bound of Draper and Saad requires arithmetic of considerably greater complexity, and for the cryptographic application considered here the simpler algorithm is sufficient.

The complete algorithm

Algorithm 1 MR-OTP Key Extraction from a Binary Entropy Source Require: Base sequence B = (b1 , . . . , bL ), bi ≥ 2; binary entropy source R. Ensure: Q K = (k1 , . . . , kL ) uniform on K. L 1: P ← i=1 bi ; k ← ⌈log2 P ⌉ 2: repeat 3: Read k bits from R; interpret as integer V 4: until V < P 5: for i = L downto 1 do 6: ki ← V mod bi ; V ← ⌊V /bi ⌋ 7: end for 8: return (k1 , . . . , kL ) Corollary 3.8. Algorithm 1 satisfies all preconditions of Theorem 1 of [1]: it terminates almost sure, and outputs a key uniform on K with independent digits.

3.5

Worked example with rejection step

Example 3.9. B = (7, 13, 5), P = 455, k = 9.

8

Round 1. Bits 110101011 ⇒ V = 427 < 455. Accept. Decompose: K = (6, 7, 2) (see Example 2.4). Hypothetical rejection. Bits 111111110 ⇒ V = 510 ≥ 455. Reject; read 9 new bits.

4

End-to-End Information-Theoretic Security with QKD

4.1

The pipeline

We now assemble the full pipeline from QKD output to encrypted message and prove that the composition preserves information-theoretic security at every stage, tracing it through three consecutive transformations. QKD source (raw bits)

−→

Algorithm 1

−→

MR-OTP encryption

(key extraction)

(ciphertext)

Each stage must preserve the uniformity and independence properties required by the MROTP perfect secrecy theorem, and we analyze them in order.

4.2

Stage 1: QKD produces a uniform bit stream

D ra

ft

A QKD protocol such as BB84 [7] allows two parties to establish a shared string of classical bits over an insecure channel. The established string is indistinguishable, from the perspective of any adversary with bounded computational resources, from a string drawn uniformly at random and with no dependence on the adversary’s view. A QKD protocol is said to be ε-secure when the trace distance between the joint state of the key and the adversary’s view is at most ε from the ideal distribution of a uniform, independent key [11]. The present paper operates in the ε = 0 limit, which is the standard model for information-theoretic analyses of QKD-based systems [7, 11], and this is stated as an assumption. Assumption 1 (Ideal QKD source). The QKD source produces a stream of bits that are mutually independent and each uniformly distributed on {0, 1}.

4.3

Stage 2: Algorithm 1 preserves uniformity

Under Assumption 1, Algorithm 1 reads consecutive k-bit blocks from the QKD stream and processes each one through rejection sampling followed by inverse Horner decomposition. By Theorem 3.4, the output K = (k1 , . . . , kL ) is uniform on K with mutually independent digits, which is the condition required for the MR-OTP to achieve perfect secrecy. Proposition 4.1 (Stage 2 preserves uniformity). Under Assumption 1, Algorithm 1 outputs a key K that is uniform on K with mutually independent digits. Proof. The QKD source produces independent uniform bits, so each block of k bits drawn by Algorithm 1 is uniform on {0, . . . , 2k − 1}. By Theorem 3.4, the rejection step conditions on acceptance and delivers V uniform on {0, . . . , P − 1}, after which the inverse Horner decomposition, being a bijection (Proposition 2.3), carries this uniform distribution to the uniform distribution on K.

4.4

Stage 3: MR-OTP achieves perfect secrecy

Under Proposition 4.1, the key K delivered to the MR-OTP satisfies the uniformity and independence conditions of Theorem 1 of [1], so the encryption of any message M under K achieves perfect secrecy.

9

4.5

The end-to-end theorem

Theorem 4.2 (End-to-end information-theoretic security). Under Assumption 1, the composition QKD −→ Algorithm 1 −→ MR-OTP achieves perfect secrecy in the sense of Shannon [5]: for every message distribution Pr[M ] and every ciphertext C = c with Pr[C = c] > 0, Pr[M = m | C = c] = Pr[M = m]

for all m.

Proof. By Assumption 1, the QKD output is a uniform independent bit stream. Algorithm 1 reads disjoint blocks of k bits for each key, and since the blocks are disjoint and the source is i.i.d., each call to Algorithm 1 is independent. By Proposition 4.1, each call produces a key K uniform on K with independent digits, and each call is independent of all other calls. The MR-OTP then encrypts M under K; by Theorem 1 of [1], this achieves perfect secrecy.

4.6

Contrast with QKD paired with a symmetric cipher

D ra

ft

The standard deployment of QKD pairs it with a symmetric cipher such as AES, where QKD establishes a short session key that seeds the cipher and derives a keystream of arbitrary length. This hybrid scheme operates with computational security at the encryption stage, because AES provides a guarantee that holds against adversaries with bounded computational resources, including adversaries equipped with large-scale quantum hardware. The pipeline of Theorem 4.2 replaces AES with MR-OTP, so both stages carry an information-theoretic guarantee and the composition inherits this property by Theorem 4.2. The MR-OTP requires key material at least as long as the message, as mandated by Shannon’s bound [5], while AES expands a short key into an arbitrary-length keystream. This difference reflects the fundamental distinction between the two security models, where information-theoretic security requires key entropy that matches message entropy, and the MR-OTP achieves that bound with equality and without excess. P Remark 4.3. The key consumption rate of the full pipeline is L i=1 log2 bi bits of QKD output per message symbol, plus the rejection overhead of at most a factor of 2 in expected bit cost (Proposition 3.5). When P is close to a power of 2, the overhead approaches zero and nearly all generated bits are consumed by the algorithm.

5

Representational Efficiency over Binary OTP

5.1

The efficiency question

P The binary OTP converts every message into a binary string and therefore requires L i=1 ⌈log2 bi ⌉ bits of key for a message of length L over a base sequence B. The MR-OTP operates in the PL digit space and requires only i=1 log2 bi bits of key for the same message, a saving that arises because the binary encoding rounds each log2 bi up to the nearest integer while the MR-OTP uses the fractional value, and we formalize this saving as the binary overhead. Definition 5.1 (Binary overhead). The binary overhead of a base sequence B = (b1 , . . . , bL ) with respect to binary OTP is ∆(B) =

L X

⌈log2 bi ⌉ − log2 bi

i=1

10

≥ 0.

5.2

Properties of the binary overhead

Proposition 5.2 (Properties of ∆(B)). (i) ∆(B) = 0 if and only if every bi is a power of 2. (ii) ∆(B) < L always (since ⌈x⌉ − x < 1 for all x). (iii) For a uniform base sequence bi = b for all i: ∆(B) = L(⌈log2 b⌉ − log2 b). (iv) The overhead per position ⌈log2 b⌉ − log2 b is maximized when b = 2k−1 + 1 for integer k, giving overhead approaching 1 bit per position, and equals zero when b is a power of 2. Proof. (i) ⌈x⌉ = x iff x ∈ Z, and log2 bi ∈ Z iff bi is a power of 2. (ii) ⌈x⌉ − x ∈ [0, 1) for all x. (iii) and (iv) follow by direct computation.

Efficiency for natural alphabets b

log2 b

⌈log2 b⌉

Overhead/symbol

Binary Nucleotides (DNA) Octal Decimal digits Hexadecimal Amino acids Latin alphabet ASCII printable Extended ASCII

2 4 8 10 16 20 26 95 256

1.000 2.000 3.000 3.322 4.000 4.322 4.700 6.570 8.000

1 2 3 4 4 5 5 7 8

0.000 0.000 0.000 0.678 0.000 0.678 0.300 0.430 0.000

ft

Alphabet

D ra

5.3

Table 1: Binary overhead per symbol (in bits) for common alphabets. The overhead column is ⌈log2 b⌉ − log2 b. MR-OTP eliminates this overhead, while binary OTP pays it at every symbol. Proposition 5.3 (Efficiency gain for natural alphabets). For a message of length L over alphabet of size b, the MR-OTP requires L log2 b bits of key, while the binary OTP requires L⌈log2 b⌉ bits. The relative saving is ∆(B) log2 b = 1− . L⌈log2 b⌉ ⌈log2 b⌉ For the Latin alphabet (b = 26) the saving is ≈ 6.0%, for decimal digits (b = 10) it is ≈ 16.9%, and for amino acids (b = 20) it is ≈ 13.6%. Proof. Direct computation from Definition 5.1 with bi = b for all i. Remark 5.4 (Relation to source coding). The quantity log2 b is the Shannon entropy of a symbol drawn uniformly from an alphabet of size b [12], and the binary OTP wastes ⌈log2 b⌉ − log2 b bits per symbol by rounding the entropy up to the nearest integer number of bits. The MROTP operates in the native symbol space, applying the same principle that underlies arithmetic coding [13], where a message is represented in a numeral system matched to the source alphabet so that the representation length approaches the source entropy. The MR-OTP imports this principle into cryptography to reduce key material consumption.

11

5.4

Efficiency and key rolling

The efficiency gain compounds across sessions in the key-rolling protocol of [1]. If two parties exchange N messages each of length L over a uniform alphabet of size b, the total reduction in key material relative to binary OTP over the entire exchange amounts to
N · L · ⌈log2 b⌉ − log2 b bits. As a concrete example, for N = 106 messages each containing L = 1000 amino acid symbols (b = 20), this quantity is approximately 6.78 × 108 bits, corresponding to roughly 85 megabytes of key material saved over the lifetime of the shared key pool, and this reduction extends the period of operation before the pool must be replenished, in proportion to the saving.

6

Key Rolling, Session Structure, and Composability

6.1

The partition protocol from the first paper

6.2

D ra

ft

The key-rolling protocol of [1] operates by strict partition of a shared initial key K0 . At session t, the active portion of the shared material is split into three consecutive, non-overlapping segments, namely the pad Ktmsg used to encrypt the current message Mt , the base specification msg Bt+1 for the next session, and the pad material Kt+1 for the next session, with no segment read more than once. The security proof of Theorem 4.2 applies to each session in isolation, because each call to Algorithm 1 draws from a disjoint block of the QKD stream, and the independence of the blocks under Assumption 1 makes the sessions independent in the information-theoretic sense. We now make this multi-session argument precise.

Session model and notation

Let R be an ideal bit source (Assumption 1). A session schedule for N sessions is a sequence of baseQvectors B1 , . . . , BN and message lengths L1 , . . . , LN . For session t ∈ {1, . . . , N }, write t Pt = L i=1 bt,i and kt = ⌈log2 Pt ⌉. Algorithm 1 is invoked for session t using a block Rt of bits from R, where the blocks R1 , . . . , RN are consecutive and non-overlapping. The base vectors B1 , . . . , BN are drawn from disjoint blocks RB,1 , . . . , RB,N , also non-overlapping and non-overlapping with the pad blocks. Definition 6.1 (Partition key rolling). A partition key-rolling scheme for N sessions is a tuple (B1 , . . . , BN , K1 , . . . , KN ) where each Bt and each Kt = (kt,1 , . . . , kt,Lt ) is produced by Algorithm 1 applied to disjoint, non-overlapping segments of a single ideal bit source R, with no segment used more than once across all sessions and all base specifications.

6.3

Multi-session security theorem

Theorem 6.2 (Multi-session perfect secrecy). Under Assumption 1 and Definition 6.1, the N session partition key-rolling scheme achieves perfect secrecy across all sessions at the same time. For every t ∈ {1, . . . , N }, every message distribution Pr[Mt ], and every ciphertext Ct = ct with Pr[Ct = ct ] > 0,   Pr Mt = m Ct = ct , C1 = c1 , . . . , Ct−1 = ct−1 = Pr[Mt = m] for all m, and the keys K1 , . . . , KN are mutually independent. Proof. By Definition 6.1, the bit blocks used to produce K1 , . . . , KN and B1 , . . . , BN are pairwise disjoint. Since R is i.i.d. under Assumption 1, any collection of disjoint blocks is jointly independent. By Theorem 3.4, Algorithm 1 applied to disjoint blocks produces keys that are 12

each uniform on their respective Kt and mutually independent across sessions. The ciphertexts C1 , . . . , Ct−1 are functions of M1 , . . . , Mt−1 and K1 , . . . , Kt−1 only, and since Kt is independent of all Ks with s < t and independent of all Bs , the pair (Kt , Ct ) is independent of (C1 , . . . , Ct−1 ). Applying Theorem 1 of [1] session by session then gives perfect secrecy for each Mt conditioned on the entire ciphertext history. Remark 6.3. Theorem 6.2 formalizes the intuition of [1] that strict partition of key material is both necessary and sufficient for multi-session security. The proof uses no property of the base sequence Bt other than that it was drawn from a block of R disjoint from the pad blocks, which means the result holds whether the bases are fixed, drawn uniformly, or drawn according to any other distribution, as long as the disjointness condition is satisfied.

6.4

The dynamic key rolling variant and its open status

D ra

ft

The first paper describes a variant in which the base sequence Bt+1 for the next session is derived from fresh, unused key material. A more aggressive variant introduced here as a new direction, and left without a formal analysis, derives Bt+1 as a function of the current ciphertext Ct and the previous base sequence Bt , through a deterministic transformation f (Ct , Bt ). This variant makes the base structure depend on transmitted data, so the sequence of digit spaces changes as a function of the communication history and is unpredictable to an observer who knows Ct but has no access to Bt . The dependency introduces a complication for the disjointness argument of Theorem 6.2. When Bt+1 = f (Ct , Bt ), the value Bt+1 is a deterministic function of Ct , which is public, and of Bt , which is secret. An adversary who recovers Bt by any means thereby recovers Bt+1 and the base sequence at all future sessions, making the security of those sessions dependent on the secrecy of Bt . This forward dependency is absent in the partition protocol, where each Bt+1 is drawn from a fresh block of bits with no connection to previous sessions. Open Problem 6.4. Let f : C × B → B be a deterministic function, where C is the ciphertext space and B is the space of valid base sequences. Define the dynamic key rolling scheme by Bt+1 = f (Ct , Bt ) with B1 drawn from fresh key material. Using the Syntactic Invariance Principle of [3], the problem reduces to finding a property P of the joint distribution of (C1 , . . . , Ct , B1 , . . . , Bt , M1 , . . . , Mt ) such that P holds after session 1, that each application of f and each MR-OTP encryption step preserves P , and that P implies Pr[Mt = m | Ct = c, C1 = c1 , . . . , Ct−1 = ct−1 ] = Pr[Mt = m] for all t. The question is whether any such P exists for a function f that gives an adversary bounded in computation a larger base search space than the partition protocol, without requiring the disjointness condition of Definition 6.1. The Syntactic Invariance Principle reformulation makes the structure of the difficulty precise. In the partition protocol, the invariant P is immediate because disjoint blocks are independent by construction. In the dynamic scheme, Bt+1 is a function of Ct , which is public, so any invariant P must survive the exposure of Ct at every session boundary. A necessary condition is that f satisfies the property that the distribution of Bt+1 given Ct carries no information about Kt , which is the condition that prevents Ct from acting as a bridge between the base sequence and the key. Whether any f of practical interest satisfies this condition, and whether the corresponding invariant P can be verified, remains open.

6.5

Key consumption and overhead of base transmission

Because the bases Bt+1 are themselves transmitted using fresh key material, their encoding has a cost that must be accounted for. Suppose each base bi requires at most β bits to represent in the shared key (where β depends on the agreed-upon base alphabet, but is left as a parameter

13

here to keep the result general). Then the total key material consumed per session t is L X i=1

|

log2 bi + Lβ , |{z} bases {z }

pad

and the overhead fraction relative to the pad is Lβ/

P

i log2 bi . This overhead is negligible when

L

1X log2 bi ≫ β, L i=1

that is, when the average base is large relative to its own representation cost. In typical cases of interest (e.g. bases matched to natural-language or biological alphabets, where bi ≥ 4) this condition holds comfortably. In the degenerate case bi = 2 for all i, the overhead equals the pad length and the mixed-radix structure provides no representational gain over the binary OTP, as expected.

Open Problems

ft

1. Optimal base selection. Corollary 8.17 and Q Remark 8.18 establish that when the message distribution has product support S = i Si , the base sequence b∗i = |Si | achieves the Shannon bound with equality. The general case, where the support S does not decompose as a product and the distribution over S is not uniform, requires finding a base sequence B that minimizes the expected key material per unit of source entropy subject to the uniformity constraint of Algorithm 1. This problem relates to the classical problem of optimal prefix-free coding [12], with the distinguishing constraint being uniform distribution of the key.

D ra

7

2. Dynamic key rolling. Open Problem 6.4 asks for conditions on the transformation f that make the dynamic key-rolling variant secure. A weaker version of the problem asks whether the dynamic scheme gives an adversary bounded in computation a larger search space than the partition protocol, without relying on any unproven hardness assumption. 3. Computational hardness of base recovery. When the base sequence B is kept secret (as discussed in Proposition 2 of [1]), an adversary must search the space of valid base sequences before any decryption attempt. The size of this space grows as (bmax − 1)L and is exponential in L. Characterizing the average-case hardness of this search problem, and whether it admits a reduction from a known hard problem or a lower bound on the number of required operations, is an open problem developed further in Section 8. 4. Batched key extraction. Algorithm 1 generates one key tuple per invocation, consuming an expected k · 2k /P bits. For long messages, a single rejection-sampling step applied to an integer drawn from {0, . . . , P N − 1} and decomposed via a single cascaded inverse Horner pass over N positions may reduce overhead relative to N independent invocations. The theoretical analysis of this approach, including the acceptance probability and a proof that the joint distribution of all N digits is uniform and independent, is developed in Section 9. 5. ε-security composition. Theorem 4.2 and Theorem 6.2 both assume an ideal QKD source (Assumption 1). For real QKD systems whose output is ε-close to the ideal distribution in trace distance, the end-to-end security degradation as a function of ε, the number of sessions N , and the session parameters Lt and Pt is characterized in Section 10.

14

8

Computational Hardness of Base Recovery

8.1

Setup and motivation

The perfect secrecy of the MR-OTP holds for adversaries with arbitrary computational resources, with no restriction on their nature. Proposition 2 of [1] establishes that keeping the base sequence B secret provides no reduction in the information-theoretic key length required. When B is secret, any adversary who wishes to attempt decryption must first identify B, and this section formalizes the structure of that identification problem and relates it to known computational problems. Throughout this section we assume the bases are drawn from a finite set, writing bmax for the maximum permitted base value, so that each bi ∈ {2, 3, . . . , bmax } and the space of valid base sequences of length L has cardinality (bmax − 1)L .

8.2

Ciphertext-only indistinguishability of the base sequence

Before stating the recovery problem, we establish a structural fact about what the ciphertext reveals about B. Proposition 8.1 (Ciphertext independence from bases). Let B be any fixed base sequence and K be uniform on KB . Then for every C = (c1 , . . . , cL ) with each ci ∈ {0, . . . , bi − 1},

ft

Pr[C = c | B = b] =

L Y 1

b i=1 i

D ra

regardless of M , and in particular this probability depends on b only through the values b1 , . . . , bL and through no other property of the key. Proof. This is a restatement of Step 1 of the proof of Theorem 1 of [1]: for each position i, the digit ki is uniform on {0, . . . , bi − 1}, so ci is uniform on {0, . . . , bi − 1} independently of mi . The positions are independent by the independence of the ki . Corollary 8.2 (Ciphertext-only insolubility of base recovery). An adversary given only C and the parameters L and bmax obtains zero information about B beyond the necessary constraint bi > ci for each i, and every base sequence B ′ satisfying that constraint is consistent with the observed ciphertext under some key. The base recovery problem in the ciphertext-only setting is therefore insoluble in the information-theoretic sense, with feasible set F(C) = {B ′ ∈ {2, . . . , bmax }L : b′i > ci ∀i}, and the maximum probability with which any algorithm identifies B from C alone is bounded above by the uniform distribution over F (C). Q Proof. By Proposition 8.1, the likelihood Pr[C = c | B = b] depends on b only through i 1/bi . Applying Q Bayes’ rule with a uniform prior on B, the posterior Pr[B = b | C = c] is proportional toQ i 1/bi over the feasible set F(C). For any two base sequences B, B ′ in F(C) with Q ′ i bi = i bi , the posterior assigns them equal probability, and the ciphertext C carries zero distinguishing information between them. The Q maximum a posteriori estimate of B given C is the sequence in F(C) with smallest product i bi , which coincides with the true B with probability at most 1/|F(C)| in the worst case, so identification succeeds with probability bounded above by 1/|F(C)| for any algorithm. Remark 8.3. Corollary 8.2 establishes that the ciphertext-only setting is the wrong frame for hardness analysis, since the problem is insoluble for information-theoretic reasons, so the question of computational hardness lives in a different setting. The setting with computational content is known-plaintext, where the adversary holds one or more plaintext-ciphertext pairs and the constraints ci = (mi + ki ) mod bi become informative about bi . The Base Recovery Problem is therefore stated in the known-plaintext setting throughout the remainder of this section. 15

8.3

The base recovery problem

We state the computational problem in the known-plaintext setting, and accompany it with a weaker decision variant. Definition 8.4 (Base Recovery Problem, BRP). Let B = (b1 , . . . , bL ) be a base sequence drawn uniformly at random from {2, . . . , bmax }L . The adversary is given T ≥ 1 plaintext-ciphertext pairs (M (1) , C (1) ), . . . , (M (T ) , C (T ) ), where each pair is encrypted under a fresh key K (t) drawn uniformly from KB , and the base sequence B is the same for all T pairs. Given these pairs and the parameters L, bmax , and T , the Base Recovery Problem asks to output B. Definition 8.5 (Base Distinguishing Problem, BDP). Under the same setup as Definition 8.4, given the T plaintext-ciphertext pairs and a candidate base sequence B ′ , decide whether B ′ = B.

8.4

Information-theoretic analysis

ft

Remark 8.6. The known-plaintext formulation is the natural setting for base recovery because (t) (t) (t) each pair (M (t) , C (t) ) imposes the constraint ci ≡ mi + ki (mod bi ), which bounds bi from (t) (t) below by max(ci , mi mod bi ) + 1 and creates residue conditions that a correct bi must satisfy and a wrong bi will violate with high probability. With T independent pairs under fresh keys, the feasible set of base sequences shrinks as T grows, and for generic (M, C) the set of bases consistent with all T pairs converges to a small set as T → ∞, a behavior that stands in contrast with the ciphertext-only setting of Corollary 8.2, where every base sequence in F(C) remains consistent with the observation.

D ra

Proposition 8.7 (Residual base uncertainty). In the known-plaintext setting with T pairs under fresh independent keys, the feasible set of base sequences consistent with all observations is n o (t) (t) FT = B ′ ∈ {2, . . . , bmax }L : ci ≡ mi + k (mod b′i ) for some k ∈ {0, . . . , b′i − 1}, ∀i, t , and |FT | decreases in T . For each position i, the constraint imposed by one pair eliminates all (t) (t) bases b′i that are incompatible with the residue (ci − mi ) being representable modulo b′i . (t)

(t)

(t)

(t)

Proof. The encryption equation ci = (mi + ki ) mod bi with ki ∈ {0, . . . , bi − 1} requires (t) (t) (t) (t) bi > max(ci , mi ) and that (ci − mi ) mod bi is a valid digit, which eliminates all b′i that fail the residue condition. Independence of the T pairs follows from the fresh key assumption, and each pair contributes an independent set of constraints, so FT ⊆ FT −1 .

8.5

Structural comparison with known hard problems

The Base Recovery Problem shares structural features with two families of well-studied computational problems, and the comparison reveals where the BRP requires its own treatment. Comparison with Learning With Errors. The LWE problem [14] asks, given a matrix A over Zq and a vector b = As + e where s is secret and e is a small error vector, to recover s. In the BRP, the “matrix” is the identity (each position is independent), the “error” is the key digit ki , and the “secret” is the base bi . The structural difference that distinguishes the two problems is that in LWE the modulus q is fixed and public, while in the BRP the modulus bi is the unknown quantity, and recovering an unknown modulus from modular residues is a problem outside the scope of LWE for which the known reductions from lattice problems to LWE are inapplicable.

16

Comparison with syndrome decoding. The syndrome decoding problem [15] asks, given a parity-check matrix H over Fq and a syndrome s = He, to find a low-weight error vector e. The BRP involves no weight constraint on ki and no linear algebraic structure over a fixed field, because the moduli vary by position and the positions share no ambient field, so the NPhardness result for syndrome decoding requires a different algebraic setup from the one present in the BRP. Closer analogy: modular arithmetic with unknown modulus. The BRP is most closely related to the problem of recovering an unknown modulus from a sequence of residues, given (t) (t) (t) (t) observations ci ≡ mi + ki (mod bi ) for unknown bi and unknown ki , where the problem (t) (t) asks to identify bi from the pairs (mi , ci ). This problem is related in spirit to recovering an unknown period in a sequence of modular residues, for which no polynomial-time algorithm is known in general and for which no hardness proof exists in the cryptographic sense.

8.6

A provable lower bound in the query model

A formal lower bound on the number of queries required to identify B is provable in the following model, which captures adversaries that work by testing candidate base sequences against the known-plaintext data.

ft

Definition 8.8 (Query model for BRP). A query adversary for the BRP is a deterministic algorithm that holds T known-plaintext pairs and, at each step, selects a candidate base sequence B ′ ∈ FT and receives a single bit indicating whether B ′ = B. The query complexity of the BRP is the minimum number of queries sufficient to identify B with certainty in the worst case.

D ra

Remark 8.9. The oracle in Definition 8.8 is well-defined in the known-plaintext setting because a membership oracle for the feasible set FT can be implemented by checking whether B ′ is consistent with all T observed pairs, which is a computation on the given data alone. This contrasts with the ciphertext-only setting, where every base sequence in F(C) is consistent with the observation and the oracle answer is always positive, so the oracle carries zero discriminating power. Theorem 8.10 (Query lower bound for BRP). Every deterministic query adversary for the BRP requires at least |FT | − 1 queries in the worst case to identify B from T known-plaintext pairs. In the regime where T is small relative to L and bmax , so that |FT | remains exponential in L, this lower bound is Ω((bmax − 1)L−αT ) for a constant α depending on bmax . Proof. Each query to a candidate B ′ eliminates at most one element from FT : a positive answer identifies B immediately, and a negative answer eliminates only the queried candidate, so a deterministic adversary that queries one element at a time requires at least |FT | − 1 queries in the worst case, since the adversary might receive negative answers for all but the last candidate. The asymptotic bound follows from Proposition 8.7, which shows that each of the T pairs eliminates at most a constant fraction of the base space at each position. Remark 8.11 (Scope of the query lower bound and its relation to computational hardness). Theorem 8.10 establishes a lower bound in the query model, which captures adversaries that work by testing candidate base sequences one at a time and receiving a binary answer from the known-plaintext oracle. An adversary that uses the algebraic structure of the known pairs to narrow the search by computation on those pairs falls outside this model, and the theorem is silent on such adversaries. This distinction marks the boundary between what the query lower bound proves and what Open Problem 8.12 asks. The query lower bound covers testing-based adversaries, meaning any algorithm whose only tool is membership queries to the feasible set FT , and it shows that at least 17

|FT |−1 such queries are required. Open Problem 8.12 asks about algebraic adversaries, meaning whether any probabilistic polynomial-time algorithm, including one that computes arbitrary (t) (t) functions of the known pairs (mi , ci ), can identify B with non-negligible probability. The two results are therefore complementary and address disjoint classes of adversary, and a negative answer to Open Problem 8.12 would extend the lower bound from the testing model to the full computational model, closing the gap between the two classes. What both share, and what Theorem 8.15 formalizes for all adversary classes at once, is that any algorithm, whether testing-based, algebraic, or unbounded, that recovers B from the available data obtains zero information about M as a consequence of that recovery, so the two layers of adversary coverage are independent of each other and both independent of the information-theoretic guarantee on M .

8.7

Conjectured hardness and its consequences

Open Problem 8.12 (Hardness of BRP). Let L, bmax , T , and δ > 0 be parameters. Is there a probabilistic polynomial-time algorithm that, given T known-plaintext pairs produced by the MR-OTP with a base sequence drawn uniformly from {2, . . . , bmax }L and fresh uniform keys, outputs the correct base sequence with probability greater than 1/|FT | plus δ, for any nonnegligible δ and any polynomial T = T (L)?

ft

When the answer to Open Problem 8.12 is negative, the BRP is hard in the known-plaintext setting and the following consequence holds.

D ra

Proposition 8.13 (Conditional two-layer security). Assume the Base Recovery Problem is hard in the sense of Open Problem 8.12. Then the MR-OTP with a secret base sequence has a twolayer security structure with the following properties. (i) An adversary with unbounded computational resources and access to a polynomial number of known-plaintext pairs can recover B by exhaustive search over FT , and after recovering B still obtains zero information about any future message M encrypted under a fresh key, because the MR-OTP pad provides perfect secrecy for each fresh encryption independently of any prior observations. (ii) An adversary bounded in computation who cannot solve the BRP in the known-plaintext setting cannot recover M from a ciphertext encrypted under a fresh key even after observing a polynomial number of prior pairs, because the base sequence remains hidden from any computation within those bounds. (iii) The two layers are independent in the sense that the information-theoretic guarantee of layer (i) holds independently of whether the computational guarantee of layer (ii) holds, and the breach of layer (ii) leaves layer (i) intact. Proof. Property (i) follows from Theorem 1 of [1] and Theorem 4.2: for any fixed B, the distribution of a fresh ciphertext C given a fresh message M is uniform over the ciphertext space and independent of M , so recovering B yields zero information about any future M encrypted under a key that is independent of all observed pairs. Property (ii) follows from the definition of computational hardness, since an adversary bounded in computation who cannot output B cannot compute mi = (ci − ki ) mod bi because bi is unknown. Property (iii) follows because the proof of (i) is purely information-theoretic and holds independently of whether layer (ii) is intact. Remark 8.14 (Two kinds of secret and their independence). The MR-OTP with a secret base sequence involves two distinct kinds of secret, and understanding their separation is essential for correct security analysis.

18

The base sequence B is a computational secret in the known-plaintext setting, where its secrecy imposes a search problem on any adversary with search space of cardinality |FT |, which remains exponential in L for small T , and the lower bound of Theorem 8.10 establishes that testing-based search requires a number of operations exponential in L, while Open Problem 8.12 asks whether algebraic search can do better. In the ciphertext-only setting, B is hidden by Corollary 8.2 for information-theoretic reasons, which is a stronger protection. The pad K is an information-theoretic secret whose secrecy is guaranteed by the structure of the MR-OTP encryption map, holding independently of the computational resources of the adversary. Theorem 8.15 establishes that knowing B gives zero information about any message encrypted under a fresh key, since the posterior distribution of M given (C, B) for a fresh encryption equals the prior distribution of M . These two secrets are independent in a precise sense, because the encryption map that protects M requires knowing both B and K, and K is protected by the uniform distribution of the pad in the information-theoretic sense, so gaining B from prior pairs leaves the pad of any fresh encryption with its full guarantee intact, and a system designer can reason about the two layers with complete independence, where the computational layer controls the cost of identifying B from known pairs and the information-theoretic layer guarantees that each fresh message remains protected once B is known.

D ra

ft

Theorem 8.15 (Invariance of information-theoretic security under computational layer failure). Let A be any algorithm, bounded in computation or unbounded, that recovers the base sequence B from T known-plaintext pairs. Even given B as additional input, any algorithm attempting to determine a future message M from its ciphertext C, where C is produced under a fresh key independent of all observed pairs, succeeds with probability at most Pr[M = m] for any m. For every message distribution Pr[M ], every base sequence B, and every ciphertext c with Pr[C = c] > 0 under a fresh key, Pr[M = m | C = c, B = b] = Pr[M = m]

for all m.

Proof. Fix B = b and apply Bayes’ rule, noting that C is produced under a fresh Q key independent of all prior observations. By Proposition 8.1, Pr[C = c | M = m, B = b] = i 1/bi for every m P ′ ′ with Pr[C Q = c | B = b] = m′ Pr[C = c | M = m , B = b] Pr[M = m ] = Q mi <Pbi . The marginal ′ ( i 1/bi ) m′ Pr[M = m ] = i 1/bi . Therefore Q ( i 1/bi ) Pr[M = m] Pr[C = c | M = m, B = b] Pr[M = m] Q Pr[M = m | C = c, B = b] = = Pr[M = m]. = Pr[C = c | B = b] i 1/bi This holds for every fixed b, and therefore holds independently of how B was obtained by A. Remark 8.16 (Complete adversary taxonomy). The results of this section partition the space of possible adversaries into classes and establish what each class achieves and what remains out of reach, as summarized in the following table.

19

What it can do

What lies out of reach

Testing-based adversary (any computational bound, KP setting)

Eliminate elements of FT one query at a time

Identify B in fewer than |FT | − 1 queries (Thm. 8.10, unconditional)

Algebraic adversary (PPT, KP setting)

Compute arbitrary functions of the T known pairs

Identify B with probability above 1/|FT | (Open Prob. 8.12, conditional)

Unbounded (KP setting)

adversary

Recover B from T known pairs by exhaustive search over FT

Obtain any information about a future M encrypted under a fresh key (Thm. 8.15, unconditional)

Ciphertext-only adversary (any computational bound)

Constrain bi > ci and compute the posterior over F(C)

Identify B with probability above the MAP estimate over F (C) (Cor. 8.2, informationtheoretic)

ft

Adversary class

D ra

The table admits four structural observations, the most consequential being that the informationtheoretic guarantee on future messages M is the only result that covers all adversary classes unconditionally, as Theorem 8.15 holds for every adversary in every row. The query lower bound and computational hardness address disjoint adversary classes and different algorithmic strategies for recovering B in the known-plaintext setting, where a testing-based adversary is constrained by Theorem 8.10 independently of its computational power, an algebraic adversary with polynomial-time resources is constrained by Open Problem 8.12 when the answer is negative, and together the two results cover the space of adversaries trying to identify B from known pairs. The ciphertext-only adversary occupies a structurally different position from all others, facing an information-theoretic obstacle rather than a computational one, since the posterior over F(C) is spread across an exponential number of candidates and this is a stronger protection that is unconditional. The work of recovering B by any means, at any cost, and by any strategy, from any amount of known-plaintext data, provides zero advantage in recovering any future message encrypted under a fresh key, as established by Theorem 8.15 for every row of the table and every outcome of the adversary’s attempt to recover B. Corollary 8.17 (Perfect secrecy with restricted message support). Let S ⊆ M be any subset of the message space, and let Pr[M ] be any distribution with support contained in S, so that Pr[M = m] = 0 for every m ∈ / S. The MR-OTP with a key K uniform on KB achieves perfect secrecy for this distribution, so that for every base sequence B, every ciphertext c with Pr[C = c] > 0, and every m, Pr[M = m | C = c, B = b] = Pr[M = m]. Q

When |S| < P = i bi , the key carries more entropy than the message requires, and the excess is log2 P − log2 |S| bits per message. The minimum key entropy consistent with perfect secrecy for the distribution Pr[M ] concentrated on S is H(M ), and the MR-OTP with base sequence B Q achieves this minimum when i bi = |S|, the key K is uniform on KB , and M is uniform on S, so that both the key and the message are drawn uniformly from spaces of equal cardinality. Proof. The proof of Theorem 8.15 makes no assumption on the support of Pr[M ], and the computation Pr[M = m | C = c, B = b] = Pr[M = m] holds for every m with Pr[C = c | B = 20

b] > 0, which covers all m in the support of Pr[M ] and assigns zero posterior to all m outside the support, consistent with the prior. The excess entropy claim follows from Shannon’s bound, which requires H(K) ≥ H(M ) for any cipher achieving perfect secrecy, with equality when the key space and message space have the same cardinality and both are used uniformly. Remark 8.18 (Connection to optimal base selection). Corollary 8.17 connects the invariance theorem to the optimal base selection problem (Open Problem 1 of Section 7). When the message distribution has support S with |S| < P , the current base sequence B wastes log2 P − log2 |S| bits of key per message, and the problem of finding the base sequence B ∗ Q that minimizes this waste while maintaining perfect secrecy reduces to finding B ∗ such that i b∗i is as close as possible to |S|Qfrom above, subject to each b∗i ≥ 2. When the support S has product structure, meaning S = i Si with |Si | symbols per position, the optimal base sequence sets b∗i = |Si | and wastes no key material, which is the native encoding principle of the MR-OTP, where matching the base at each position to the alphabet size at that position eliminates the binary overhead of Section 5 and also the support overhead identified here, achieving the Shannon bound.

D ra

ft

Remark 8.19 (Significance of Theorem 8.15). Theorem 8.15 requires no assumption on the computational hardness of the BRP, and establishes that the information-theoretic security of the MR-OTP is preserved under any future algorithmic advance, including the discovery of a polynomial-time algorithm for the known-plaintext BRP, a quantum algorithm that speeds up base recovery beyond Grover’s bound, or any other computational development. An adversary who gains full knowledge of B by any means and at any computational cost holds a fresh ciphertext that is uniform over the ciphertext space and independent of the message, because the fresh key is independent of all prior observations, and this property distinguishes the MR-OTP from systems whose security rests on computational assumptions, where recovering a secret key yields the plaintext. Remark 8.20 (Structure of the proof and the Syntactic Invariance Principle). The proof of Theorem 8.15 has the same logical structure as the Syntactic Invariance Principle of [3], instantiated in the probabilistic setting of information theory rather than in the syntactic calculus of superposition. The invariant property P is the independence of any future M from the observable (C, B), expressed as Pr[M = m | C = c, B = b] = Pr[M = m] for all m, c, b, where C is produced under a fresh key. Step 1 of the structure establishes that P holds for every fresh encryption: by Proposition 8.1, the MR-OTP encryption map produces a ciphertext C whose distribution given Q B is i 1/bi , independent of M . Step 2 establishes that P is preserved by every operation an adversary can perform on the observable (C, B), since C is the result of a function of the fresh K alone (with M entering only through the sum mi + ki mod bi , and K being independent of all prior observations), so further processing of C and B introduces zero new information about M . Step 3 concludes that M is unreachable from (C, B) by any sequence of operations of any length on any set of observations. The correspondence with the proof of Lemma 2 of [3] is the following. The Skolem constants a and b of that proof, which are opaque to the rewriting rules and remain frozen across every derivation step, correspond to the message digits mi , which are opaque to any computation on (C, B) for a fresh encryption. The frozen subterms a+b and b+a, whose relative order is a global invariant of the entire derivation, correspond to the message M , whose distribution is a global invariant of the entire fresh encryption scheme. The rewriting system having no access to the numerical relationship between a and b corresponds to any algorithm operating on (C, B) having no access to the value of a freshly encrypted M . The structural difference between the two settings is worth stating with precision. In [3], the invariant holds per-derivation, meaning every term in every derivable clause satisfies the syntactic property P , and this is an absolute statement about individual terms. In the present paper, the invariant is distributional, meaning the property P holds for the probability distri-

21

bution of M given the observable, and this is a statement about the measure induced by the uniform key, averaged over fresh encryptions. The two settings therefore share the same logical architecture while operating at different levels of description, where the syntactic level in [3] corresponds to the distributional level here, and the invariance in both cases is what makes the target unreachable by any process operating at the level of the observable. Remark 8.21 (The temporal security layer and its unconditional value). The combination of Theorem 8.10 and Theorem 8.15 yields a security architecture whose value is unconditional. Theorem 8.10 establishes that any algorithm working by testing candidate base sequences requires at least |FT | − 1 queries before it can identify B, with |FT | remaining exponential in L for small T , since the known-plaintext pairs reduce the feasible base set from (bmax − 1)L toward a smaller set as T grows, but for polynomial T the reduction is at most polynomial in the number of bits of constraint, leaving the search space exponential. Theorem 8.15 establishes that once the search is completed and B is known, the adversary gains zero information about any future message encrypted under a fresh key, so the search consumes computational resources with zero cryptanalytic return on future messages, and the entire work invested in recovering B is irrelevant to the security of any fresh encryption.

D ra

ft

Corollary 8.22 (Unconditional temporal security). Let W be the work performed by any adversary to recover B from T known-plaintext pairs, measured in the number of candidate base sequences tested. By Theorem 8.10, W ≥ |FT | − 1 in the worst case, a quantity that is exponential in L for small T , and by Theorem 8.15, independently of the value of W and independently of whether B is recovered, the adversary obtains zero information about any future message encrypted under a fresh key from its ciphertext, so the work W is a pure delay on future message recovery with zero informational return, bounded below by a quantity exponential in L for small T , with the bound holding unconditionally.

9

Batched Key Extraction

9.1

Motivation and setup

Algorithm 1 produces one key tuple (k1 , . . . , kL ) per invocation by drawing k = ⌈log2 P ⌉ bits, rejecting if the resulting integer V falls outside {0, . . . , P − 1}, and then decomposing V into digits. For a message of length N over a uniform base sequence bi = b for all i, this requires N independent invocations, each consuming an expected k · 2k /P bits. A batched approach draws a single large integer U from {0, . . . , P N − 1} and decomposes it into all N digits at once, reducing the rejection overhead from N separate geometric trials to one.

9.2

The batched sampler

Definition 9.1 (Batched rejection sampler SN (b)). Let b ≥ 2, N ≥ 1, Q = bN , and q = ⌈log2 Q⌉. The batched sampler SN (b) proceeds through the following steps. 1. Draw q uniform bits from R and interpret them as an integer U ∈ {0, . . . , 2q − 1}. 2. If U ≥ Q, discard U and return to step 1. 3. Apply inverse Horner decomposition with base sequence (b, b, . . . , b) of length N to U , producing (k1 , . . . , kN ) with each ki ∈ {0, . . . , b − 1}. 4. Return (k1 , . . . , kN ). Theorem 9.2 (Batched uniform sampling). The batched sampler SN (b) terminates with probability 1 and outputs a tuple (k1 , . . . , kN ) that is uniform on {0, . . . , b − 1}N with mutually independent digits. 22

Proof. The acceptance probability per round is Q/2q ≥ 1/2 by the same argument as Theorem 3.4, since q = ⌈log2 Q⌉ implies 2q ≤ 2Q. Upon acceptance, U is uniform on {0, . . . , Q − 1} = {0, . . . , bN − 1} by the same Bayes argument as Theorem 3.4. The inverse Horner decomposition with constant base b applied to U uniform on {0, . . . , bN − 1} produces (k1 , . . . , kN ) that is jointly uniform on {0, . . . , b − 1}N , since bN = |{0, . . . , bN − 1}| and the map is a bijection. Independence follows from Theorem 3.4 applied to the base sequence (b, b, . . . , b).

9.3

Cost comparison with sequential sampling

Proposition 9.3 (Batched vs. sequential bit cost). Let b ≥ 2, N ≥ 1, P = b, Q = bN , k = ⌈log2 b⌉, and q = ⌈log2 bN ⌉. The expected bit cost of N sequential invocations of S(b) is N ·k·

2k ≤ 2N k = 2N ⌈log2 b⌉. b

The expected bit cost of one invocation of SN (b) is q·

2q ≤ 2q = 2⌈N log2 b⌉. bN

ft

The batched approach satisfies q ≤ N k, with equality only when b is a power of 2, and when b is not a power of 2 the batched approach uses fewer bits with a saving per message of ∆batch (b, N ) = N ⌈log2 b⌉ − ⌈N log2 b⌉ ≥ 0,

D ra

with equality if and only if b is a power of 2.

Proof. The cost bounds follow from Proposition 3.5 applied to S(b) in the first case and SN (b) in the second. The inequality ⌈N log2 b⌉ ≤ N ⌈log2 b⌉ follows from the sub-additivity of the ceiling function: for any real x, ⌈N x⌉ ≤ N ⌈x⌉. Equality holds when x = log2 b ∈ Z, i.e., when b is a power of 2. Example 9.4. For b = 26 (Latin alphabet) and N = 10: k = ⌈log2 26⌉ = 5, sequential cost ≤ 100 bits; q = ⌈10 log2 26⌉ = ⌈47.00⌉ = 47, batched cost ≤ 94 bits, giving a saving of 6 bits, consistent with ∆batch (26, 10) = 50 − 47 = 3 bits of reduction in q relative to N k, doubled by the factor-2 cost bound. For b = 4 (nucleotides): k = 2, q = 2N , so the sequential and batched costs are identical since 4 is a power of 2. Remark 9.5. The saving ∆batch (b, N ) grows with N up to a maximum of ⌊log2 b⌋−log2 b per digit, which equals the fractional part of log2 b. For the Latin alphabet this is approximately 0.300 bits per symbol, and for decimal digits approximately 0.678 bits per symbol, consistent with the overhead values in Table 1. The batched sampler therefore eliminates the binary encoding overhead of Section 5 and the rejection overhead from the ceiling function, approaching the theoretical minimum of log2 b bits per symbol as N → ∞.

9.4

Extension to mixed base sequences

For a non-uniform base sequence B = (b1 , .Q . . , bL ) repeated N times, the batched sampler generalizes by taking Q = P N where P = L i=1 bi , drawing a single integer U uniform on {0, . . . , P N − 1}, and decomposing via N L successive modular reductions using the repeated base sequence. Theorem 9.2Qextends to this case with the same proof, replacing bN by P N and {0, . . . , b − 1}N by KN = N t=1 K, where the independence of all N L digits follows from the bijectivity of the extended inverse Horner decomposition over {0, . . . , P N − 1}.

23

10

Security Degradation under Non-Ideal QKD Sources

10.1

Model for non-ideal sources

Assumption 1 postulates an ideal bit source. Real QKD implementations produce a key string S ∈ {0, 1}n whose joint distribution with the adversary’s quantum state ρE satisfies the εsecurity condition 1 ρSE − ρU ⊗ ρE 1 ≤ ε, 2 where ρU denotes the uniform distribution over {0, 1}n and ∥ · ∥1 is the trace norm [11]. We work in a classical reduction of this model, replacing the trace norm condition with the total variation distance condition TV(Pr, Uniform({0, 1}n )) ≤ ε, S

which is implied by the quantum condition and suffices for the analysis below.

10.2

Degradation through Algorithm 1

ft

Proposition 10.1 (Security degradation through key extraction). Let the QKD source produce a bit string whose distribution is ε-close to uniform in total variation. Then the key K output by Algorithm 1 satisfies
2k TV Pr, Uniform(K) ≤ · ε, K P Q where k = ⌈log2 P ⌉ and P = i bi .

D ra

Proof. Algorithm 1 applies a deterministic function f to the bit string V drawn from the source, accepting V when V < P and returning the inverse Horner decomposition of V . The total variation distance is non-increasing under the application of any function (data processing inequality), so TV(Prf (V ) , Prf (U ) ) ≤ TV(PrV , PrU ) where U is uniform on {0, . . . , 2k − 1}. The rejection step conditions on V < P , which has probability P/2k under the uniform distribution and probability in [P/2k − ε, P/2k + ε] under the source. Conditioning on a set of probability p inflates total variation by at most 1/p, giving TV(Pr, Uniform(K)) ≤ K

ε 2k ε 2ε⌈log2 P ⌉ , ≤ = P log2 P P/2k

where the last inequality uses 2k ≤ 2P and P ≥ 2k−1 . For the simpler bound stated, 2k /P ≤ 2 suffices.

10.3

Degradation through N sessions

Proposition 10.2 (Security degradation over N sessions). Under the same model, if each session t uses P a disjoint kt -bit block from the source and the source is ε-close to uniform over the entire t kt bits, then the joint distribution of (K1 , . . . , KN ) satisfies TV



Pr

K1 ,...,KN

,

N Y t=1

 2kt · ε ≤ 2N ε. Uniform(Kt ) ≤ N · max t Pt

Proof. By the triangle inequality for total variation, the distance between the joint distribution and the product of uniforms is bounded by the sum of the per-session distances. Each session contributes at most (2kt /Pt )ε ≤ 2ε by Proposition 10.1, and there are N sessions.

24

10.4

Security statement for non-ideal sources

Theorem 10.3 (ε-secure MR-OTP). Let the QKD source be ε-close to ideal in total variation. Under the partition key-rolling scheme of Definition 6.1 with N sessions and session parameters (Lt , Pt ), for every message Mt and ciphertext history (C1 , . . . , Ct−1 ), Pr[Mt = m | Ct = c, C1 = c1 , . . . , Ct−1 = ct−1 ] − Pr[Mt = m] ≤ 2N ε for all m and all c, c1 , . . . , ct−1 with positive probability. Proof. By Proposition 10.2, the joint key distribution is (2N ε)-close in total variation to the product of uniforms. The MR-OTP encryption map (Mt , Kt ) 7→ Ct is a function of Kt alone (for fixed Mt ), and the data processing inequality gives TV(PrCt |Mt , Uniform) ≤ 2N ε. The posterior bound follows from the definition of total variation distance applied to the conditional distribution.

11

Conclusion

ft

Remark 10.4 (Parameter setting). Theorem 10.3 gives a concrete design guideline: to achieve an end-to-end security parameter of δ over N sessions, the QKD system must deliver bits with ε ≤ δ/(2N ). For N = 103 sessions and target δ = 2−64 , the required source quality is ε ≤ 2−75 , which is within the certified output of current QKD hardware [11]. The bound 2N ε is linear in N , reflecting the fact that the composition of N sessions with independent ε errors accumulates total variation additively across sessions, and the bound is tight in the sense that N sessions with independent ε errors cannot achieve better than N ε total variation in general.

D ra

This paper has established the algorithmic foundations needed to deploy the Mixed-Radix OneTime Pad together with a quantum key distribution source in a way that preserves end-to-end information-theoretic security across an arbitrary number of sessions and under non-ideal bit sources. The central technical contribution is the identification of Horner’s method and its inverse as the natural algebraic correspondence between the binary integer representation produced by a QKD source and the mixed-radix key space defined in [1]. The forward Horner evaluation composes a digit tuple into a single integer using the positional weights Wi of [1], while the inverse decomposition recovers the digits by successive modular reduction, forming a bijection between K and the integer interval {0, . . . , P − 1}. The key algorithmic observation, formalized in Proposition 3.1 and Theorem 3.4, is that reading k bits from a binary source and reducing modulo P produces a biased distribution whenever P is not a power of 2, and that this bias constitutes a violation of the uniformity hypothesis of perfect secrecy at any magnitude. Adding a rejection step corrects the distribution to uniform, with expected bit cost bounded by a factor of 2. The single-session theorem (Theorem 4.2) and the multi-session theorem (Theorem 6.2) show that the composition of an ideal QKD source, Algorithm 1, and the partition key-rolling protocol achieves Shannon perfect secrecy across all sessions at once, with keys of different sessions being mutually independent. The proof requires only the disjointness of the bit blocks assigned to different sessions and carries no computational assumption. The batched sampler (Section 9, Theorem 9.2) extends single-tuple extraction to N digits at once from one large integer, with Proposition 9.3 showing a saving of ∆batch (b, N ) = N ⌈log2 b⌉ − ⌈N log2 b⌉ bits over sequential sampling, approaching the theoretical minimum of log2 b bits per symbol as N grows. The ε-security analysis (Section 10, Theorem 10.3) replaces the ideal source assumption with a quantitative bound, showing that an ε-close source over N sessions produces posterior error at

25

D ra

ft

most 2N ε, giving the concrete design requirement ε ≤ δ/(2N ) for a target end-to-end security parameter δ. The computational hardness analysis (Section 8) develops the structure of the Base Recovery Problem across two settings and establishes three layers of results at different levels of conditionality. The unconditional layer covers two distinct facts, the first being that Corollary 8.2 establishes that base recovery in the ciphertext-only setting is information-theoretically insoluble, a stronger protection than any computational hardness claim, and one that holds without assumption. Theorem 8.10 shows that in the known-plaintext setting, any testing-based algorithm requires at least |FT | − 1 queries to identify B, a quantity exponential in L for small T . Theorem 8.15 shows that an adversary who recovers B by any means gains zero information about any message encrypted under a fresh key, because the posterior Pr[M = m | C = c, B = b] equals the prior Pr[M = m] for every m. Corollary 8.22 combines these to establish that the work of recovering B is a pure delay with zero informational return, exponential in L and independent of any hardness assumption. Corollary 8.17 extends the invariance result to message distributions with restricted support, showing that perfect secrecy holds for any distribution over any subset S ⊆ M, and that the key entropy is minimized when the base sequence matches the support structure of S. The conditional layer rests on the hardness of the BRP, and Proposition 8.13 shows that when the BRP is hard in average case, no probabilistic polynomial-time algorithm can identify B with probability above the MAP posterior bound, adding an algebraic adversary guarantee to the combinatorial guarantee of the query lower bound. Remark 8.14 separates the computational secret B from the information-theoretic secret K, establishing that the two are independent and that each layer retains its guarantee regardless of the state of the other. Remark 8.16 presents the complete adversary taxonomy across four adversary classes, showing that Theorem 8.15 is the only result covering all classes unconditionally, and that the query lower bound and computational hardness cover disjoint subsets of the adversary space for the problem of identifying B. Section 8.20 identifies the logical structure of the invariance result as an instance of the Syntactic Invariance Principle of [3], where the message M is encoded at the numerical level of description and any algorithm operating at the symbolic level of (C, B) has no access to that level by the same mechanism that makes frozen subterms unreachable in the superposition calculus of that paper. Two directions remain open, namely the dynamic key-rolling variant (Open Problem 6.4) and the average-case hardness of the Base Recovery Problem in the known-plaintext setting (Open Problem 8.12).

12

Acknowledgments

The author used an artificial intelligence based language assistant to support text revision, translation, and bibliography formatting. All scientific ideas and conclusions are the author’s own.

References References [1] F. F. G. Buono, “New ideas on a new old type of cipher: The mixed-radix one-time pad,” 2026.

26

[2] W. G. Horner, “A new method of solving numerical equations of all orders, by continuous approximation,” Philosophical Transactions of the Royal Society of London, vol. 109, pp. 308–335, 1819. [3] F. F. G. Buono, “Syntactic systems cannot see semantic invariants,” 2026. [4] G. S. Vernam, “Cipher printing telegraph systems for secret wire and radio telegraphic communications,” Transactions of the AIEE, vol. 45, pp. 295–301, 1926. [5] C. E. Shannon, “Communication theory of secrecy systems,” Bell System Technical Journal, vol. 28, no. 4, pp. 656–715, 1949. [6] F. F. G. Buono, “A new type of cipher,” 2012. [7] C. H. Bennett and G. Brassard, “Quantum cryptography: Public key distribution and coin tossing,” in Proceedings of the IEEE International Conference on Computers, Systems and Signal Processing, (Bangalore, India), pp. 175–179, 1984. [8] D. Lemire, “Fast random integer generation in an interval,” ACM Transactions on Modeling and Computer Simulation, vol. 29, no. 1, pp. 3:1–3:12, 2019.

ft

[9] D. E. Knuth, The Art of Computer Programming, Vol. 2: Seminumerical Algorithms. Addison-Wesley, 3 ed., 1997. [10] T. L. Draper and F. A. Saad, “Efficient rejection sampling in the entropy-optimal range,” 2025.

D ra

[11] R. Renner, Security of Quantum Key Distribution. PhD thesis, ETH Zurich, 2005. [12] T. M. Cover and J. A. Thomas, Elements of Information Theory. Wiley-Interscience, 2 ed., 2006. [13] J. Rissanen, “Generalized kraft inequality and arithmetic coding,” IBM Journal of Research and Development, vol. 20, no. 3, pp. 198–203, 1976. [14] O. Regev, “On lattices, learning with errors, random linear codes, and cryptography,” Journal of the ACM, vol. 56, no. 6, pp. 34:1–34:40, 2009. [15] E. R. Berlekamp, R. J. McEliece, and H. C. A. van Tilborg, “On the inherent intractability of certain coding problems,” IEEE Transactions on Information Theory, vol. 24, no. 3, pp. 384–386, 1978.

27