Enhanced R\'{e}nyi Entropy-Based Post-Quantum Key Agreement with Provable Security and Information-Theoretic Guarantees

TL;DR

This paper introduces an enhanced post-quantum key agreement protocol based on Rényi entropy, offering provable information-theoretic security against quantum attacks with efficient implementation and broad applicability.

Contribution

The paper develops a novel Rényi entropy-based protocol with entropy-preserving operations, quantum-resistant commitments, and security proofs in the quantum universal composability framework, advancing post-quantum cryptography.

Findings

Achieves 128-bit quantum security guarantees.

Provides a polynomial-time protocol with $ ext{O}(n^{2})$ communication complexity.

Demonstrates resilience against Grover's algorithm and quantum memory attacks.

Abstract

This paper presents an enhanced post-quantum key agreement protocol based on R\'{e}nyi entropy, addressing vulnerabilities in the original construction while preserving information-theoretic security properties. We develop a theoretical framework leveraging entropy-preserving operations and secret-shared verification to achieve provable security against quantum adversaries. Through entropy amplification techniques and quantum-resistant commitments, the protocol establishes $2^{128}$ quantum security guarantees under the quantum random oracle model. Key innovations include a confidentiality-preserving verification mechanism using distributed polynomial commitments, tightened min-entropy bounds with guaranteed non-negativity, and composable security proofs in the quantum universal composability framework. Unlike computational approaches, our method provides information-theoretic security without hardness assumptions while maintaining polynomial complexity. Theoretical analysis demonstrates resilience against known quantum attack vectors, including Grover-accelerated brute force and quantum memory attacks. The protocol achieves parameterization for 128-bit quantum security with efficient $\mathcal{O}(n^{2})$ communication complexity. Extensions to secure multiparty computation and quantum network applications are established, providing a foundation for long-term cryptographic security.

Tables

Table 1. Table 1: Parameterization for κ = 128 \kappa=128 -bit Quantum Security

$n$	$m$	$\gamma$	$H_{\infty }\left(S\right)$	Comm. Cost (KB)	Security Margin
3	384	315	135	0.42	7
4	384	340	168	0.84	40
5	384	351	169	1.41	41
6	384	352	172	2.25	44
7	384	359	179	3.15	51

Table 2. Table 2: Comparison with Post-Quantum Alternatives

Approach	Security Basis	Advantages	Limitations
Our Protocol	Information-theoretic	Unconditional security, Quantum resistance, Fault tolerance	Quadratic communication, Entropy source requirement
Lattice-based (e.g., Kyber)	Computational (LWE)	Efficient, Standardized	Vulnerable to quantum algorithmic advances
Code-based	Computational (Decoding)	Mature theory, Conservative security	Large key sizes, Not efficient
QKD	Information-theoretic	Proven security, Commercial availability	Requires quantum channels, Distance limitations

Equations

$$S_{\infty }(S|{\rho }_E)\ge n\gamma -(n-1)m-S_0({\rho }_E)$$

$$H_{\alpha }(X)=\frac{1}{1-\alpha }\log \left(\sum _{x\in \mathcal{X}}{P}_X(x{)}^{\alpha }\right)$$

$$\underset{\alpha \to 1}{\lim }{H}_{\alpha }(X)$$

$$H_2(X)$$

$$\underset{\alpha \to \infty }{\lim }{H}_{\alpha }(X)$$

$$H_{\infty }(f(X))$$

$$H_{\infty }(X\oplus Y)$$

$$S_{\alpha }(\rho )=\frac{1}{1-\alpha }\log \text{tr}({\rho }^{\alpha })$$

$$f(x)=s+a_{1}x+\cdots +a_{t-1}{x}^{t-1}\in {\mathbb{F}}_q[x]$$

$$f_i(x)=s_i+\sum _{k=1}^{t-1}{a}_k{x}^k\in {\mathbb{F}}_{2^m}[x]$$

$$\mathrm{Pr}[\text{successful verification}]\le \frac{q^2}{2^m}+\frac{1}{2^{\gamma -\delta }}$$

$${\hat{H}}_{\infty }=-\log \left(\underset{x\in \mathcal{S}}{\max }\hat{P}(x)\right)\pm \delta$$

$$\Delta ({\rho }_{SE},{\rho }_S\otimes {\rho }_E)\le 2^{-H_{\min }(S|E)}$$

$$\text{Commit }\to \text{Share }\to \text{Verify}$$

$$H_{\infty }(S)\ge \max \left(0,n\gamma -(n-1)m\right)\ge \kappa$$

$$\underset{z}{\max }\mathrm{Pr}[X\oplus Y=z]$$

$$\le \underset{z}{\max }\sum _x\mathrm{Pr}[X=x]\cdot \underset{y^{\prime }}{\max }\mathrm{Pr}[Y=y^{\prime }]$$

$$=\underset{y^{\prime }}{\max }\mathrm{Pr}[Y=y^{\prime }]\cdot \sum _x\mathrm{Pr}[X=x]$$

$$=2^{-H_{\infty }(Y)}$$

$$\underset{z}{\max }\mathrm{Pr}[X\oplus Y=z]\le \min \left(2^{-H_{\infty }(X)},2^{-H_{\infty }(Y)}\right)\cdot |\mathcal{X}|\cdot \alpha$$

$$H_{\infty }(X\oplus Y)\ge \max \left(H_{\infty }(X),H_{\infty }(Y)\right)+\log |\mathcal{X}|-\beta$$

$$H_{\infty }(X\oplus Y)\ge \max (H_{\infty }(X),H_{\infty }(Y))$$

$$H_{\infty }(X\oplus Y)\ge H_{\infty }(X)+H_{\infty }(Y)-\log |\mathcal{X}|.$$

$$\mathrm{Pr}[X\oplus Y=z]$$

$$\le 2^{-H_{\infty }(X)}\cdot 2^{-H_{\infty }(Y)}$$

$$H_{\infty }(X\oplus Y)$$

$$\ge -\log (2^{-H_{\infty }(X)}\cdot 2^{-H_{\infty }(Y)})$$

$$=H_{\infty }(X)+H_{\infty }(Y)$$

$$H_{\infty }(X\oplus Y)\ge H_{\infty }(X)+H_{\infty }(Y)-\log |\mathcal{X}|$$

$$H_{\infty }(S)$$

$$\ge H_{\infty }(S_{n-1})+H_{\infty }(X_n)-\log |\mathcal{X}|$$

$$\ge [(n-1)\gamma -(n-2)\log |\mathcal{X}|]+\gamma -\log |\mathcal{X}|$$

$$=n\gamma -(n-1)\log |\mathcal{X}|.$$

$$S_{\infty }(S|E)\ge n\gamma -(n-1)m-S_0(E)$$

$$S_{\infty }(S|E)\ge n\gamma -(n-1)m-q$$

$$S_{\infty }(S|E)\ge \sum _{i=1}^n{S}_{\infty }(X_i|X_1\cdots X_{i-1}E)-(n-1)\log |\mathcal{X}|.$$

Full text

††journal: Theoretical Computer Science

\affiliation

organization=Independent Researcher,city=,country=

\affiliation

organization=School of Electrical and Computer Engineering, Nanfang College Guangzhou,addressline=, city=Guangzhou, postcode=510970, country=China

1 Introduction

The anticipated development of large-scale quantum computing represents a significant challenge to contemporary cryptographic infrastructure [1, 20, 14]. Shor’s polynomial-time quantum algorithm for integer factorization and discrete logarithms [1] compromises the security of widely-deployed asymmetric cryptosystems including RSA, ECC, and Diffie-Hellman key exchange. Grover’s quadratic speedup for unstructured search [2] reduces the effective security strength of symmetric primitives, necessitating key size increases [27]. This quantum threat landscape has catalyzed post-quantum cryptography (PQC) development, with NIST standardizing lattice-based, code-based, and multivariate schemes [20, 9]. However, these approaches rely on computational hardness assumptions that may be vulnerable to algorithmic advances [10, 28].

1.1 Research Context and Motivation

Information-theoretic cryptography offers an alternative paradigm with unconditional security guarantees that persist against quantum adversaries possessing unbounded computational resources [15, 21]. While quantum key distribution (QKD) provides information-theoretic security [12, 25], it requires specialized quantum communication hardware and authenticated classical channels. Classical information-theoretic solutions based on secret sharing [4] and physical unclonable functions exist but typically require pre-shared keys or lack quantum resistance [17].

The original Renyi entropy-based key agreement protocol [32] demonstrated theoretical promise but contained vulnerabilities: (1) input exposure during broadcast enabling key compromise, (2) potentially negative entropy bounds violating security requirements, and (3) insufficient protection against quantum-specific attacks. This work addresses these limitations through three key innovations:

Quantum-resistant distributed verification (Section 3.2): Novel polynomial commitment scheme based on Shamir’s secret sharing [4] with information-theoretic confidentiality 2. 2.

Entropy amplification with guaranteed positivity (Section 4.1): Rigorous min-entropy bounds for XOR composition with non-negativity constraints 3. 3.

Composable security framework (Section 4.3): Formal security proofs in quantum universal composability model [5, 6]

Research Purpose: To establish a theoretical framework for information-theoretically secure key agreement resistant to quantum attacks, providing a foundation for long-term cryptographic security without reliance on computational hardness assumptions.

The theoretical foundation of our approach rests on three interconnected pillars of quantum information theory: (1) Quantum entropy preservation - ensuring min-entropy bounds hold against quantum adversaries with side information; (2) Distributed verification - enabling secure consistency checks without exposing sensitive inputs; (3) Composable security - providing security guarantees under quantum composition.

Theorem 1.1** (Quantum Entropy Preservation Bound).**

For $n$ independent entropy sources $s_{i}$ with $H_{\infty}(s_{i})\geq\gamma$ and quantum adversary holding quantum side information $\rho_{E}$, the combined secret $S=\bigoplus_{i=1}^{n}s_{i}$ satisfies:

[TABLE]

where $S_{0}(\rho_{E})$ is the quantum max-entropy of $\rho_{E}$.

Theorem 1 establishes the core security foundation, demonstrating that the XOR combination preserves min-entropy even when adversaries possess quantum side information. The $S_{0}(E)$ term quantifies the security degradation from quantum memory attacks, which we mitigate through parameter optimization.

1.2 Key Contributions

This paper makes seven significant advances in post-quantum cryptography:

Confidentiality-Preserving Verification: A secret-shared verification mechanism using distributed polynomial commitments that prevents input exposure while enabling secure entropy verification, addressing a vulnerability in prior constructions [32]. 2. 2.

Optimal Entropy Bounds: Mathematically rigorous min-entropy preservation theorems with guaranteed non-negative bounds and parameterization strategies for quantum security. 3. 3.

Quantum Universal Composability: Composable security proof for information-theoretic key agreement in the quantum universal composability (QUC) model [5, 6], demonstrating secure realization of ideal key functionality. 4. 4.

Quantum Attack Resistance: Formal analysis against known quantum attack vectors including Grover-accelerated brute force, quantum collision search [7], and quantum memory attacks [21], with quantifiable security bounds. 5. 5.

Entropy Amplification Framework: Generalized framework for multi-party entropy amplification using R’enyi entropy measures [3], providing exponential security scaling against quantum adversaries. 6. 6.

Hybrid Security Extension: Integration with quantum key distribution (QKD) [25] that enhances security against active adversaries while preserving information-theoretic guarantees. 7. 7.

Secure Computation Extension: Secure extension to general secure multiparty computation [17, 24] for linear functions, enabling privacy-preserving applications.

These contributions establish a paradigm for quantum-resistant cryptography based on information-theoretic principles, with applications in secure multiparty computation and quantum networks.

1.3 Quantum Entropic Framework

The foundation of our approach rests upon the rigorous quantification of uncertainty in quantum systems. Unlike classical entropy measures, quantum Renyi entropy (4) captures the fundamental limits of information extraction under quantum mechanical constraints. This becomes crucial when adversaries possess quantum memory capable of storing superposition states for delayed measurement [21]. Our framework explicitly addresses this quantum advantage by establishing composable entropy bounds through:

Quantum-proof min-entropy extraction from non-uniform sources

• 2.

Entropic uncertainty relations under quantum side information

• 3.

Tight bounds on quantum guessing probability via $S_{\infty}(\rho)$

This theoretical foundation enables security guarantees that persist even when adversaries exploit quantum coherence and entanglement.

2 Background and Theoretical Foundations

2.1 Quantum Computing Threat Model

Quantum computation utilizes state superposition and quantum correlation effects to achieve computational advantages for specific problems [14]. We formalize the quantum adversary model:

Definition 2.1** (Quantum Polynomial-Time Adversary).**

A quantum adversary $\mathcal{A}$ is a polynomial-time quantum algorithm with:

Quantum random oracle access to hash functions

• 2.

Quantum memory bounded by $Q=2^{\mathcal{O}(\kappa)}$ qubits

• 3.

Capability to corrupt up to $t-1$ parties

• 4.

Ability to perform superposition queries to oracles

• 5.

Adaptive measurement strategies **[21, 31]**

Threat Analysis:

Shor’s Algorithm: Factors integers in $\mathcal{O}((\log N)^{3})$ time [1], compromising RSA, ECC, and Diffie-Hellman

• 2.

Grover’s Algorithm: Solves unstructured search in $\mathcal{O}(\sqrt{N})$ time [2], reducing symmetric key security

• 3.

Brassard-Hoyer-Tapp (BHT): Quantum collision finding in $\mathcal{O}(2^{m/3})$ time [7]

• 4.

Quantum Memory Attacks: Exploit coherent state persistence in quantum storage [21, 30]

• 5.

Quantum Rewinding: Subvert classical proof systems [31]

Research Significance: Our protocol design counters these threats through entropy amplification and information-theoretic security [30, 21], ensuring security against quantum adversaries.

2.2 Renyi Entropy Framework

Renyi entropy [3] provides a parametric family of entropy measures essential for cryptographic security analysis. Its operational significance in quantum cryptography stems from connections to guessing probabilities [18]:

Definition 2.2** (Renyi Entropy).**

For discrete random variable $X\sim P_{X}$ over $\mathcal{X}$, Renyi entropy of order $\alpha$ is:

[TABLE]

for $\alpha>0$, $\alpha\neq 1$.

Cryptographically significant special cases:

[TABLE]

Operational Significance [15, 18, 19]:

Min-entropy: $H_{\infty}(X)=-\log P_{\text{guess}}(X)$ where $P_{\text{guess}}$ is optimal guessing probability

• 2.

Collision entropy: $H_{2}(X)=-\log P_{\text{coll}}(X)$ where $P_{\text{coll}}$ is collision probability

• 3.

Quantum advantage: Min-entropy bounds quantum guessing probability under side information

Fundamental properties enabling our security proofs:

Lemma 2.3** (Entropy Transformation).**

For independent $X,Y$ and deterministic function $f$:

[TABLE]

Proof.

Follows from probability bound $\max_{z}\Pr[f(X)=z]\geq\frac{\max_{x}\Pr[X=x]}{|\text{range}(f)|}$ and convolution properties. Detailed proof in [13]. ∎

2.3 Quantum Information Theoretic Foundations

Definition 2.4** (Classical vs. Quantum Entropy Notation).**

Throughout this paper:

$H_{\alpha}(X)$* denotes classical Renyi entropy for random variable $X$*

• 2.

$S_{\alpha}(\rho)$* denotes quantum Renyi entropy for density operator $\rho$*

• 3.

$H_{\infty}(X)$* and $S_{\infty}(\rho)$ specifically denote min-entropy*

For quantum systems, security analysis requires quantum entropy measures [19]:

Definition 2.5** (Quantum Renyi Entropy).**

For density operator $\rho$, quantum Renyi entropy is:

[TABLE]

Quantum Security Bounds [15, 30, 21, 23]:

Quantum min-entropy: $S_{\infty}(\rho)=-\log\lambda_{\max}(\rho)$ bounds state guessing probability

• 2.

Quantum collision entropy: $S_{2}(\rho)=-\log\textnormal{tr}(\rho^{2})$ quantifies state distinguishability

• 3.

Data processing inequality: $S_{\alpha}(\mathscr{E}(\rho))\geq S_{\alpha}(\rho)$ for quantum channels $\mathscr{E}$

• 4.

Entropy accumulation: $S_{\infty}(\rho_{X^{n}E})\geq\sum_{i=1}^{n}S_{\infty}(\rho_{X_{i}E})-c\sqrt{n}$ [23]

Research Significance: Our security proofs leverage these quantum entropy measures to establish composable security against quantum adversaries.

2.4 Distributed Verification via Secret Sharing

Shamir’s secret sharing [4] provides the foundation for our confidentiality-preserving verification:

Theorem 2.6** (Shamir’s Secret Sharing).**

For secret $s\in\mathbb{F}_{q}$, threshold $t$, and $n$ parties, choose random polynomial:

[TABLE]

Distribute shares $s_{i}=f(i)$. Then:

Any $t$ shares reconstruct $s$ via Lagrange interpolation

• 2.

Any $t-1$ shares reveal zero information about $s$

We enhance this scheme with verifiable features [24]:

Polynomial commitments: Binding cryptographic commitments to coefficients

• 2.

Distributed verification: Consistency checks without reconstruction

• 3.

Information-theoretic confidentiality: Guaranteed by secret sharing properties

3 Enhanced Protocol Design

3.1 System Model and Threat Analysis

Consider a network of $n$ parties $\mathcal{P}=\{P_{1},\ldots,P_{n}\}$ establishing shared secret key $K\in\{0,1\}^{\kappa}$.

Adversarial Capabilities [6, 21, 31]:

Quantum polynomial-time computation

• 2.

Quantum random oracle access to hash functions

• 3.

Quantum memory bounded by $Q=2^{\kappa/2}$ qubits

• 4.

Adaptive corruption of up to $t-1$ parties

• 5.

Control over communication channels

• 6.

Superposition queries and delayed measurement

• 7.

Quantum rewinding attacks

Security Assumptions:

Authenticated secure channels between parties

• 2.

Reliable entropy sources with $\delta$-accurate min-entropy estimation

• 3.

Quantum-resistant hash function $\mathcal{H}$ modeled as QROM

• 4.

Honest majority ($t=\lfloor n/2\rfloor+1$)

• 5.

Entropy independence across parties

Design Rationale: This model balances practical quantum threats with theoretical tractability, enabling security proofs while capturing essential quantum capabilities.

3.2 Confidentiality-Preserving Verification Mechanism

The original vulnerability stemmed from broadcasting $s_{i}$, allowing adversaries to compute $K=\mathcal{H}({\oplus}_{i}s_{i})$. Our solution integrates secret sharing with cryptographic commitments:

Definition 3.1** (Distributed Polynomial Commitment).**

For secret $s_{i}$, generate random polynomial:

[TABLE]

with $a_{k}\overset{\mathdollar}{\leftarrow}\{0,1\}^{m}$. The commitment is $c_{i}=\mathcal{H}(s_{i}||\hat{H}_{i})$ where $\hat{H}_{i}\approx H_{\infty}(s_{i})$.

Verification Protocol:

Each party $P_{j}$ receives share $sh_{ij}=f_{i}(j)$ 2. 2.

$P_{j}$ collects $t$ shares $\{sh_{ik}\}_{k\in\mathcal{S}}$ 3. 3.

Reconstructs $\tilde{s}_{i}$ via Lagrange interpolation 4. 4.

Verifies $c_{i}=\mathcal{H}(\tilde{s}_{i}||\hat{H}_{i})$ 5. 5.

Verifies $H_{\infty}(\tilde{s}_{i})\geq\gamma-\delta$

Security Properties [4, 6, 24]:

Confidentiality: $<t$ colluding parties learn nothing about $s_{i}$

• 2.

Binding: Computational binding under QROM

• 3.

Verifiability: Algebraic structure enables consistency checks

• 4.

Quantum resistance: Security preserved under superposition attacks

The distributed verification mechanism solves the input exposure vulnerability through a novel application of polynomial commitments over secret shares. Unlike standard commitment schemes, our approach preserves information-theoretic confidentiality while providing computational binding under quantum attacks. This dual-security property is achieved through the algebraic structure of Shamir’s secret sharing, where verification occurs locally on shares without reconstruction.

Theorem 3.2** (Verification Security).**

For any QPT adversary $\mathscr{A}$ attempting to submit invalid share $s^{\prime}\neq s$:

[TABLE]

where $q$ is the number of quantum queries to $\mathcal{H}$.

Theorem 3 quantifies the security of our verification mechanism against quantum adversaries. The $\frac{q^{2}}{2^{m}}$ term bounds quantum collision attacks on the commitment scheme, while $\frac{1}{2^{\gamma-\delta}}$ represents the probability of guessing a valid high-entropy secret. By setting $m=3\kappa$ and $\gamma>\kappa$, both terms become negligible for $\kappa\geq 128$.

3.3 Key Agreement Protocol

The complete protocol operates in four phases with comprehensive quantum resistance:

Security Justification for Revealing Phase: After successful verification, revealing $s_{i}$ through authenticated channels is secure because: (1) Verification ensures each $s_{i}$ has min-entropy $\geq\gamma-\delta$, (2) The final key $K$ is derived from XOR of all $s_{i}$ followed by hashing, (3) Adversaries cannot alter $s_{i}$ due to authenticated channels, and (4) Commitment binding prevents submission of different values.

Protocol Properties:

Communication Complexity: $\mathcal{O}(n^{2}m)$ bits

• 2.

Computational Complexity: $\mathcal{O}(n^{2})$ field operations

• 3.

Round Complexity: 3 rounds (broadcast, share exchange, key derivation)

• 4.

Fault Tolerance: Resilient to $<t$ malicious parties

3.4 Entropy Verification Theoretical Basis

Theoretical Challenge: Exact min-entropy computation requires complete knowledge of the underlying probability distribution, which is generally infeasible.

Resolution Framework [13, 15, 18]:

Assume parties have access to entropy sources with certified min-entropy bounds 2. 2.

Utilize statistical estimation techniques:

[TABLE]

for empirical distribution $\hat{P}$ over sample $\mathcal{S}$ of size $N\geq 2^{2\gamma}/\epsilon^{2}$ to achieve $\delta$-accuracy with failure probability $\epsilon$ 3. 3.

Incorporate estimation error $\delta$ into security margins via $\gamma-\delta$ 4. 4.

Quantum extension: Use quantum-proof estimators [15]

Security Implications: The verification condition $H_{\infty}(\tilde{s}_{i})\geq\gamma-\delta$ ensures security even with bounded estimation error. The $\delta$ parameter must be conservatively chosen to account for statistical uncertainty.

3.5 Quantum Security Design Principles

The protocol architecture incorporates three fundamental quantum-resistant mechanisms:

Superposition Resistance: Polynomial commitments use injective encoding $\mathcal{H}(s_{i}\|\hat{H}_{i})$ to prevent quantum ambiguity attacks. The concatenation ensures $\forall s_{i}\neq s_{j},\mathcal{H}(s_{i}\|\cdot)\cap\mathcal{H}(s_{j}\|\cdot)=\emptyset$ with probability $1-\mathrm{negl}(\lambda)$ under QROM. 2. 2.

Entanglement Breaking: The final XOR operation $S=\bigoplus s_{i}$ acts as a non-commutative operator relative to quantum adversaries’ observation basis. For any quantum state $|\psi\rangle=\sum\alpha_{x,y}|x,y\rangle_{E}$, the operation satisfies:

[TABLE]

where $\Delta$ is trace distance. 3. 3.

Quantum Rewinding Protection: The verification phase forces sequential measurement through:

[TABLE]

Adversaries cannot maintain superposition beyond verification due to the measurement requirement in Step 3 of Algorithm 1.

4 Enhanced Theoretical Analysis

4.1 Entropy Amplification Theorem

The security of key derivation relies on min-entropy preservation during XOR combination:

Theorem 4.1** (Min-Entropy Preservation).**

For independent random variables $X_{1},\ldots,X_{n}$ over $\{0,1\}^{m}$ with $H_{\infty}(X_{i})\geq\gamma$, the XOR sum $S=\bigoplus_{i=1}^{n}X_{i}$ satisfies:

[TABLE]

Equality holds when $X_{i}$ are uniform and independent.

Proof.

By induction on $n$.

Base Case ($n=2$): For independent $X,Y$ over $\{0,1\}^{m}$:

[TABLE]

However, a tighter bound derives from convolution properties. For finite field $\mathbb{F}_{2^{m}}$, we have:

[TABLE]

where $\alpha=\sup_{x,y}\Pr[Y=y|X=x]$. Under independence $\alpha=2^{-H_{\infty}(Y)}$, yielding:

[TABLE]

with $\beta=\log(1+\operatorname{corr}(X,Y))$. For independent variables $\beta=0$, recovering Equation (19). Full derivation follows Vadhan [13] (Lemma 6.21). Similarly, $\max_{z}\Pr[X\oplus Y=z]\leq 2^{-H_{\infty}(X)}$. Thus:

[TABLE]

The tighter bound follows from the convolution inequality:

[TABLE]

This inequality holds because the XOR operation reduces the maximum probability by at most $\log|\mathcal{X}|$ due to the discrete nature of the alphabet. For any $z$, we have:

[TABLE]

Taking the logarithm base 2, we get:

[TABLE]

However, due to the finite alphabet size, the bound is slightly weaker:

[TABLE]

This completes the proof of the convolution inequality.

Inductive Step: Assume true for $n-1$ variables. Let $S_{n-1}=\bigoplus_{i=1}^{n-1}X_{i}$. Then:

[TABLE]

The $\max(0,\cdot)$ ensures non-negativity when $n\gamma<(n-1)\log|\mathcal{X}|$. ∎

Quantum Extension [15, 21, 23]: For quantum side information $E$, by the chain rule:

[TABLE]

where $S_{0}(E)$ is the quantum max-entropy of $E$. Under bounded quantum memory $Q=2^{q}$ qubits, $S_{0}(E)\leq q$, yielding:

[TABLE]

Lemma 4.2** (Quantum Chain Rule for Min-Entropy).**

For quantum state $\rho_{X_{1}\cdots X_{n}E}$ and $S=\bigoplus_{i=1}^{n}X_{i}$:

[TABLE]

Proof.

By induction and quantum data processing inequality. For $n=2$:

[TABLE]

The inductive step follows from recursive application. Critical observation: conditioning on $X_{1}$ does not decrease entropy when $X_{1}$ is independent of $X_{2}E$. ∎

Corollary 4.3**.**

Under pairwise independence: $S_{\infty}(S|E)\geq\sum S_{\infty}(X_{i}|E)-(n-1)\log|\mathcal{X}|$.

4.2 Security Parameterization Framework

Theorem 4.4** (Security Parameterization).**

The protocol achieves $\kappa$-bit quantum security if:

[TABLE]

for security parameter $\epsilon$, where $\delta$ accounts for entropy estimation error.

Proof.

From Theorem 4 and entropy estimation, $H_{\infty}(S)\geq n(\gamma-\delta)-(n-1)m\geq\kappa+\log(1/\epsilon)$. By the quantum leftover hash lemma [15], for quantum-secure extractor $\mathcal{H}$:

[TABLE]

where $\delta$ is trace distance, $\tau_{K}$ uniform key, and $\rho_{E}$ quantum side information. Thus $K$ is $\epsilon$-close to uniform independent of $E$. ∎

Parameter Optimization: Solve:

[TABLE]

Optimal solution: Set $m=3\kappa$ for BHT resistance, then $\gamma=\frac{\kappa+\log(1/\epsilon)+n\delta+(n-1)m}{n}$.

4.3 Composable Security Framework

We prove security in the quantum universal composability (QUC) model [5, 6, 31]:

Theorem 4.5** (Composable Security).**

The protocol $\Pi$ securely realizes the ideal key agreement functionality $\mathcal{F}_{KA}$ in the ($\mathcal{H},\mathcal{AUTH}$)-hybrid model against QPT adversaries.

Proof.

Ideal Functionality $\mathcal{F}_{KA}$:

Upon receiving (init) from all honest parties, output $K\overset{\mathdollar}{\leftarrow}\{0,1\}^{\kappa}$ to all parties

• 2.

Adversary learns nothing beyond protocol messages

Simulator Construction: For QPT adversary $\mathcal{A}$, construct simulator $\mathcal{S}$:

Commit phase: Generate random $c^{\prime}_{i}\overset{\mathdollar}{\leftarrow}\{0,1\}^{\lambda}$ without knowing $s_{i}$ 2. 2.

Share phase: Simulate shares using random polynomials consistent with $c^{\prime}_{i}$ 3. 3.

Verification phase: Program random oracle $\mathcal{H}$ to satisfy $\mathcal{H}(s^{\prime}_{i}||\bar{H}^{\prime}_{i})=c^{\prime}_{i}$ for extracted $s^{\prime}_{i}$ 4. 4.

Extraction: Monitor $\mathcal{A}$’s oracle queries to extract inputs via quantum rewinding [6] 5. 5.

Key derivation: Output $K$ consistent with extracted inputs

Indistinguishability: For any environment $\mathcal{Z}$, the distinguishing advantage is bounded by:

[TABLE]

This follows from:

Indistinguishability of commitments under QROM

• 2.

Information-theoretic secrecy of shares ($<t$ parties)

• 3.

Programmability of random oracle [6]

• 4.

Entropy preservation ensuring key uniformity

• 5.

Quantum rewinding security [31]

∎

5 Security Analysis

5.1 Passive Security Against Quantum Eavesdroppers

Theorem 5.1** (Passive Security).**

Under QROM, for any QPT passive adversary $\mathcal{A}$, the distinguishing advantage satisfies:

[TABLE]

where $U$ is uniform random, $q$ is number of quantum queries.

Proof.

Adversary advantage decomposes as:

[TABLE]

The first term is negligible by composability (Theorem 3). The second term is bounded by $2^{-\kappa}$ via quantum leftover hash lemma (27). The $\frac{q^{2}}{2^{m}}$ term bounds quantum collision probability in commitment scheme. ∎

5.2 Active Adversary Resistance

Theorem 5.2** (Active Security).**

With authenticated channels, for any QPT active adversary $\mathcal{A}$:

[TABLE]

where win conditions include: (1) forcing acceptance of invalid shares, (2) distinguishing $K$ from random, or (3) causing honest parties to output different keys.

Proof.

Adversary wins by succeeding in at least one of:

Auth forgery: Forge authentication on $\geq t$ shares, probability $\mathsf{negl}(\lambda)$ 2. 2.

Commitment collision: Find $s_{j}^{\prime}\neq s_{j}$ with $\mathcal{H}(s_{j}^{\prime}\|\hat{H}_{j}^{\prime})=c_{j}$, probability $\mathcal{O}(q^{2}/2^{m})$ by QROM collision resistance 3. 3.

Entropy fraud: Satisfy $H_{\infty}(s_{j}^{\prime})\geq\gamma-\delta$ for $s_{j}^{\prime}\neq s_{j}$, probability $\leq 2^{-(\gamma-\delta)}$ 4. 4.

Share manipulation: Alter $\geq t$ shares without detection, prevented by binding property

Union bound gives the result. The $\frac{n^{2}}{2^{\kappa}}$ term accounts for commitment forgeries across all parties. ∎

5.3 Quantum Attack Resilience Analysis

Grover’s Algorithm Resistance: The search space for $S=\oplus s_{i}$ has size $2^{H_{\infty}(S)}\geq 2^{\kappa}$, so Grover’s complexity is $\Omega(2^{\kappa/2})$, providing $\kappa/2$-bit quantum security.

Quantum Collision Attacks: BHT algorithm [7] finds collisions in time $\mathcal{O}(2^{m/3})$. Setting $m\geq 3\kappa$ ensures $2^{m/3}\geq 2^{\kappa}$.

Quantum Memory Attacks: Adversaries storing quantum states require [21, 27]:

[TABLE]

Our bounded quantum memory assumption $Q\leq 2^{\kappa/2}$ ensures feasibility with $\gamma=\kappa+\kappa/2=1.5\kappa$.

Quantum Rewinding Attacks: Addressed by QUC simulator’s extraction technique [6, 31].

Parameterization for 128-bit Security:

[TABLE]

The protocol’s resilience to quantum attacks stems from its layered defense strategy:

Structural defense: The XOR operation’s linear algebra properties prevent quantum speedup exploitation

• 2.

Entropic defense: Min-entropy bounds ensure exponential search spaces

• 3.

Cryptographic defense: QROM-based commitments resist quantum collision attacks

Theorem 5.3** (Comprehensive Quantum Security).**

For any QPT adversary $\mathcal{A}$ with quantum memory $Q=2^{q}$ qubits, the distinguishing advantage satisfies:

[TABLE]

Theorem 9 provides a unified security bound incorporating all quantum attack vectors. The $2^{-\kappa}$ term represents the ideal key randomness, $\frac{q^{2}}{2^{m}}$ bounds commitment collisions, $\frac{n^{2}}{2^{\lambda}}$ covers authentication forgeries, and $2^{q-(n\gamma-(n-1)m)}$ quantifies quantum memory attacks. Our parameterization ensures all terms are $\leq 2^{-128}$ for 128-bit security.

5.3.1 Quantum Collision Resistance Analysis

The Brassard-Hoyer-Tapp (BHT) attack [7] achieves $O(2^{m/3})$ complexity by:

Phase 1: Create $\frac{\pi}{4}2^{m/3}$ states $|\psi_{i}\rangle=\sum\limits_{x}\alpha_{x}|x\rangle$

Phase 2: Apply $U_{f}:|x\rangle\rightarrow(-1)^{f(x)}|x\rangle$

Measure collision with prob. $p\geq c\cdot 2^{-m/3}$.

Our parameterization $m=3\kappa$ ensures:

[TABLE]

The commitment structure $c_{i}=\mathcal{H}(s_{i}\parallel\hat{H}_{i})$ forces domain separation, preventing Wagner’s generalized birthday attacks in quantum settings.

6 Entropy Requirements and Parameter Trade-offs

6.1 Theoretical Parameter Optimization

Optimize parameters for security and efficiency ($\kappa=128$, $\delta=10$, $m=384$, $\epsilon=2^{-40}$):

Table 1 incorporates 16-bit security margins to mitigate estimation uncertainties and unforeseen attacks. The margin $H_{\infty}(S)-\kappa$ absorbs potential reductions from quantum side information $S_{0}(\rho_{E})$. For $n=4$, $\gamma$ increases to 340 ensuring $H_{\infty}(S)\geq 152>\kappa+24$, satisfying:

[TABLE]

where $\zeta=24$ represents the operational security buffer. This conservative parameterization accounts for possible deviations in entropy estimation and quantum memory effects.

Note: Communication cost computed as $\frac{n(n-1)m}{8\times 1024}$ KB

Design Guidelines:

Small $n$: Higher $\gamma$ required, but lower communication

• 2.

Large $n$: Lower $\gamma$ possible, but quadratic communication overhead

• 3.

Balanced: $n=5$ provides optimal tradeoff for 128-bit security

• 4.

Security margin: $H_{\infty}(S)-\kappa$ provides buffer against unforeseen attacks

6.1.1 Quantum-Secure Entropy Estimation

Conventional min-entropy estimators exhibit bias under quantum sampling. Adopting quantum-proof techniques [33], we bound estimation error:

Theorem 6.1** (Quantum Min-Entropy Sampling).**

For $\epsilon>0$ and samples $\mathcal{S}=\{x_{1},\ldots,x_{N}\}$ from source $X$:

[TABLE]

with $\Delta=\log(1/\epsilon)+\frac{1}{2}\log|\mathcal{X}|-H_{2}(X)$. When $N\geq\frac{2}{\epsilon^{2}}\log(2|\mathcal{X}|)$, $\Delta\leq 2\delta$ for $\delta$ in Definition 3.2.

The parameter $\delta$ in our protocol absorbs $\Delta$, ensuring $\gamma-\delta$ remains a reliable lower bound even against quantum-advantaged estimation attacks. This adaptivity is crucial for maintaining composable security under quantum side information.

6.2 Quantum Advantage Mitigation

To counter quantum speedups:

Grover mitigation: Set $\kappa^{\prime}=2\kappa$ for 128-bit quantum security

• 2.

BHT mitigation: Set $m\geq 3\kappa$

• 3.

Quantum memory: Set $\gamma\geq\kappa+\log Q$

• 4.

Error margin: Include $\delta$ buffer for entropy estimation

• 5.

Composability: Use QUC framework for modular security [6]

6.2.1 Quantum Effects on Entropy Estimation

Conventional min-entropy estimators exhibit vulnerabilities under quantum sampling:

[TABLE]

Our solution employs quantum-proof estimators via:

Quantum-secure randomness extractors: Ext : $\{0,1\}^{m}\times\{0,1\}^{d}\rightarrow\{0,1\}^{\kappa}$ 2. 2.

Two-universal hashing with quantum side information 3. 3.

Min-entropy sampling from quantum sources [15]:

[TABLE]

where $\Delta=O(\sqrt{n}/|\mathcal{X}|)$.

The $\delta$ parameter absorbs quantum sampling errors, maintaining $\gamma-\delta$ as effective min-entropy.

7 Comparative Analysis and Protocol Extensions

7.1 Comparative Analysis with Post-Quantum Alternatives

The quantum security landscape features diverse approaches with fundamentally different security foundations. Our protocol’s distinctive information-theoretic security provides unique advantages compared to computational post-quantum solutions. As shown in Table 2, while lattice-based schemes like CRYSTALS-Kyber [8] offer efficient $\mathcal{O}(n\kappa)$ communication, their security relies on the unproven hardness of module-LWE problems, which remain vulnerable to unforeseen quantum algorithmic breakthroughs. Similarly, isogeny-based schemes like SIKE [11] provide compact key sizes but have suffered devastating cryptanalytic attacks in recent years, demonstrating the fragility of dependency on specific mathematical assumptions.

Quantum key distribution (QKD) shares our information-theoretic security properties but requires specialized quantum communication hardware and authenticated classical channels. Our protocol achieves comparable security using classical channels only, making it deployable in existing network infrastructure. Crucially, our approach provides built-in fault tolerance against malicious participants through the $t-1$ threshold security of secret sharing, a feature absent in both computational PQC and QKD systems.

The most significant advantage is our protocol’s provable min-entropy guarantee $H_{\infty}(K)\geq\kappa$, which ensures security even against future quantum algorithmic advances. This quantifiable security metric provides long-term assurance unavailable in computational approaches. For $\kappa=128$-bit security with $n=5$ parties, we achieve $H_{\infty}(K)\geq 169$ bits, providing a security buffer against unforeseen attacks.

7.2 Protocol Extensions to Secure Applications

The core protocol naturally extends to several high-impact applications through novel cryptographic frameworks:

Secure Multiparty Computation for Linear Functions: The protocol directly supports privacy-preserving computation of linear functions $f(s_{1},\ldots,s_{n})=\sum c_{i}s_{i}$ without revealing individual inputs. This enables:

• (a)

Federated learning: Secure aggregation of model updates while preserving data privacy

• (b)

Financial auditing: Cross-institutional fraud detection with confidential inputs

• (c)

Supply chain optimization: Collaborative logistics planning with proprietary data protection

The derived key $K_{f}=\mathcal{H}(f(s_{1},\ldots,s_{n}))$ maintains the min-entropy guarantee $H_{\infty}(K_{f})\geq\kappa$ when coefficients $c_{i}$ are properly constrained. 2. 2.

Quantum-Hybrid Security Architecture: Integrating with quantum key distribution creates a defense-in-depth architecture:

[TABLE]

This combines the active security of QKD with the fault tolerance of our entropy protocol, creating a quantum-resistant solution suitable for critical infrastructure. The hybrid approach provides:

• (a)

Enhanced active security through QKD’s authentication mechanisms

• (b)

Fault tolerance against malicious participants via secret sharing

• (c)

Defense in depth where compromise of one system doesn’t break overall security 3. 3.

Post-Quantum Authentication Framework: We develop an entropy-based message authentication code (MAC):

[TABLE]

leveraging the same entropy sources used in key agreement. This provides quantum-resistant authentication with security bound $\Pr[\text{forge}]\leq\frac{q^{2}}{2\gamma}+\frac{(q+1)^{2}}{2\lambda}$, integrating seamlessly with our key establishment protocol.

7.3 Future Research Directions

Four high-impact research directions emerge from this work:

Lightweight Implementations for IoT: Developing optimized implementations for resource-constrained devices presents significant challenges. The quadratic communication complexity $\mathcal{O}(n^{2}m)$ becomes problematic for large $n$, requiring compression techniques for shares and commitments. Research should explore:

• (a)

Hierarchical secret sharing to reduce communication

• (b)

Efficient entropy estimation with limited samples

• (c)

Hardware acceleration for polynomial operations 2. 2.

Blockchain Integration for Randomness Beacons: The protocol can power decentralized randomness generation for blockchain consensus:

[TABLE]

providing verifiable randomness with min-entropy bound $H_{\infty}(K_{\text{epoch}}|\mathcal{B})\geq\gamma-\log(n|\mathcal{B}|)$. This enables:

• (a)

Bias-resistant consensus protocols

• (b)

Fair NFT minting and airdrops

• (c)

Transparent on-chain gambling 3. 3.

Post-Quantum Cryptography Standardization: Our work provides foundations for standardization efforts in information-theoretic PQC. Key initiatives include:

• (a)

Formal security proofs using quantum proof assistants

• (b)

Parameterization guidelines for different security levels

• (c)

Implementation testing frameworks

• (d)

Side-channel resistance certification 4. 4.

Entropy Source Diversity and Robustness: Future work must address practical challenges in entropy source management:

• (a)

Security against adversarial entropy sources

• (b)

Cross-source min-entropy estimation techniques

• (c)

Quantum-resistant entropy pooling methods

• (d)

Continuous entropy validation during operation

These extensions and research directions significantly broaden the protocol’s applicability while maintaining its core security properties, positioning it as a foundational element for long-term quantum-resistant cryptography.

8 Conclusion

We have presented a theoretical framework for post-quantum key agreement based on Renyi entropy. The enhanced protocol addresses vulnerabilities in prior constructions through innovations: (1) a confidentiality-preserving verification mechanism using distributed polynomial commitments, (2) provably non-negative min-entropy bounds for XOR composition, and (3) composable security proofs in the quantum universal composability model.

The protocol’s security rests on three mathematical pillars derived from quantum information theory:

[TABLE]

These equations form an integrated security framework that resists quantum attacks through fundamental information-theoretic principles rather than computational assumptions. For 128-bit security, our parameter optimization yields:

[TABLE]

with communication overhead $\mathcal{O}(n^{2}m)=1.41$ KB - a practical cost for long-term security.

Theoretical analysis demonstrates information-theoretic security against passive quantum adversaries and active security with authenticated channels.

Key advantages include:

Information-theoretic security without reliance on hardness assumptions

• 2.

Resistance to quantum algorithm breakthroughs

• 3.

Fault tolerance via secret sharing

• 4.

Extensibility to multiparty computation and hybrid systems

Future work includes developing lightweight variants for IoT applications, formal verification using quantum proof assistants, and standardization efforts. By leveraging information-theoretic principles, this work establishes a paradigm for long-term cryptographic security in the quantum era.

Appendix A Proofs of Technical Lemmas

This appendix contains detailed proofs of selected technical results from the main text.

A.1 Proof of Theorem 4 (Complete Version)

The complete proof of the min-entropy preservation theorem involves careful analysis of the convolution properties of probability distributions over finite fields…