💻 computer science

From Bits to Mixed-Radix Keys: Horner Decomposition, Uniform Sampling, and the Information-Theoretic QKD Interface of the MR-OTP

This paper establishes a practical and information-theoretically secure framework for converting raw binary entropy from Quantum Key Distribution sources into uniform mixed-radix keys for the Mixed-Radix One-Time Pad by utilizing Horner's method for mapping, rejection sampling to eliminate bias, and rigorous proofs of security and efficiency.

Original authors: Fabio F. G. Buono

Published 2026-06-19

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Fabio F. G. Buono

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: A New Kind of "Unbreakable" Lock

Imagine you have a secret message you want to send. The gold standard for secrecy is the One-Time Pad (OTP). Think of this as a lock where the key is a random string of numbers exactly as long as your message. If the key is truly random and never reused, the message is mathematically impossible to crack, no matter how powerful the computer trying to break it is.

However, traditional OTPs have a flaw: they only speak "Binary" (0s and 1s). If you want to send a letter like "A" (which is naturally a symbol, not a 0 or 1), you have to translate it into binary first. This translation wastes space and is inefficient.

This paper introduces the Mixed-Radix One-Time Pad (MR-OTP). Think of this as a lock that speaks the native language of your data.

If you are sending DNA (4 letters), the lock uses a 4-sided die.
If you are sending English text (26 letters), it uses a 26-sided die.
If you are sending numbers (10 digits), it uses a 10-sided die.

This paper solves the practical problem of how to build this lock using a Quantum Key Distribution (QKD) machine, which only produces a stream of 0s and 1s.

The Core Problem: The "Rough Cut" of Randomness

The Analogy:
Imagine you have a machine that spits out perfect, fair 6-sided dice rolls (0–5). But your lock requires a 7-sided die (0–6).

The Naive Mistake: You might think, "I'll just take a 6-sided roll, add a 1, and if I get a 7, I'll just wrap it around to 0."
The Problem: This creates a "bias." Some numbers (like 0 and 1) would appear more often than others (like 6). In the world of perfect secrecy, even a tiny bias is like leaving a crack in the door. It ruins the "unbreakable" guarantee.

The Paper's Solution:
The authors propose a strict "Rejection Sampling" rule.

The machine generates a number.
If the number fits inside your 7-sided range, you keep it.
If it's too big (e.g., you rolled a 7 or 8), you throw it away and try again.
You repeat this until you get a valid number.

This ensures every number from 0 to 6 has an exactly equal chance of being picked. The paper proves this method is efficient enough to be practical, wasting very few bits of the quantum stream.

The Secret Sauce: "Horner's Method"

How do you turn a long string of binary bits (from the quantum machine) into a specific set of mixed dice rolls (e.g., one 7-sided, one 13-sided, one 5-sided)?

The Analogy:
Think of a nested Russian doll or a set of instructions for building a tower.

Forward (Building): You start with the first digit, multiply it by the size of the next die, add the next digit, multiply by the next die size, and so on. This is called Horner's Method. It's a clever math trick to pack different-sized numbers into one big integer.
Backward (Unpacking): To get the keys back, you do the reverse. You take the big number, divide it by the last die size to get the remainder (the last key), then divide the result by the next die size, and so on.

The paper proves that this "packing and unpacking" is a perfect, one-to-one match. It's the algebraic bridge that lets you turn a stream of 0s and 1s into a perfect, unbiased set of mixed-radix keys.

The Security Guarantee: "The Two-Layer Shield"

The paper addresses a scary question: What if a hacker figures out the "shape" of the dice (the base sequence) we are using?

The authors prove a "Two-Layer Shield":

Layer 1: The Shape is Hidden (Computationally Hard).
If the hacker doesn't know we are using a 7-sided die or a 13-sided die, they have to guess. The paper shows that guessing the sequence of dice sizes is incredibly difficult, especially if the hacker only sees the encrypted message (ciphertext) without the original text. In fact, if they only see the ciphertext, it is mathematically impossible to know the dice sizes at all.
Layer 2: The Key is Unbreakable (Information-Theoretic).
Even if the hacker does figure out the dice sizes (the "shape"), they still cannot read the message. Why? Because the actual key (the random numbers rolled on those dice) is generated fresh for every message.
- The Analogy: Imagine the hacker figures out that you are using a 26-sided die. That's great for them! But they still don't know which number (A–Z) you rolled for this specific message. Since the roll was truly random and never reused, knowing the die size tells them nothing about the letter.

The Big Conclusion: The security of the message does not depend on the hacker being too slow to guess the dice sizes. Even if they guess the sizes instantly, the message remains perfectly secret because the key is random.

Efficiency: Saving Space

The paper also points out a nice side effect.

Old Way (Binary OTP): To send a letter "A" (1 of 26), you must use 5 bits (since $2^5 = 32$ ). You waste 6 bits of space because 32 is bigger than 26.
New Way (MR-OTP): You use exactly the space needed for 26 options.
The Result: Over millions of messages, this saves a massive amount of "key material" (the random bits needed from the quantum machine). It's like packing a suitcase: the old way forced you to use a giant box for a small shirt; the new way uses a box that fits the shirt perfectly.

Summary of Claims

How to convert: You can turn quantum random bits into mixed-radix keys using a "reject and retry" method combined with a math trick called Horner's decomposition.
No Bias: This method creates a perfectly uniform key, which is required for the "unbreakable" guarantee.
End-to-End Security: The whole process (Quantum Machine $\to$ Conversion $\to$ Encryption) is mathematically proven to be unbreakable.
Future-Proof: Even if a super-computer in the future figures out how to guess the "dice sizes" (the base sequence) instantly, the messages remain secure because the keys are fresh and random.
Efficiency: It saves space compared to traditional binary methods, especially for natural languages and biological data.

The paper does not claim this is a commercial product ready for sale today, nor does it claim to solve all cryptographic problems. It strictly proves the mathematical foundations and algorithms required to make this specific type of "perfect secrecy" work with real-world quantum hardware.

Technical Summary: From Bits to Mixed-Radix Keys

Problem Statement
The Mixed-Radix One-Time Pad (MR-OTP), introduced in a preceding work [1], generalizes the classical binary One-Time Pad to digit spaces with non-uniform bases. It allows for the native encoding of heterogeneous data alphabets (e.g., DNA sequences, Latin text) without intermediate binary conversion while preserving Shannon's perfect secrecy. However, a practical deployment requires a mechanism to convert the raw binary entropy output of a Quantum Key Distribution (QKD) source into a key tuple that is uniformly distributed over the mixed-radix key space.

A naive approach—reading $k = \lceil \log_2 P \rceil$ bits (where $P$ is the product of the bases) and reducing the resulting integer modulo $P$ —introduces a statistical distortion known as "modulo bias." In the information-theoretic setting, any non-uniformity in the key distribution violates the hypothesis of the perfect secrecy theorem, rendering the system insecure regardless of the magnitude of the bias. The paper addresses the algorithmic challenge of converting a uniform binary stream into a uniform mixed-radix key tuple without introducing this bias, while maintaining end-to-end information-theoretic security.

Methodology
The paper establishes a structural equivalence between mixed-radix positional weights and the nested form of polynomial evaluation.

Algebraic Correspondence: The authors identify Horner's method and its inverse as the canonical algebraic duality for this conversion. The forward map (Horner evaluation) composes a digit tuple into a single integer, while the inverse map (Inverse Horner decomposition) recovers the digits from an integer via successive modular reduction. This establishes a bijection between the key space $\mathcal{K}$ and the integer interval $\{0, \dots, P-1\}$ .
Rejection Sampling: To eliminate modulo bias, the paper proposes a rejection sampling algorithm (Algorithm 1). The algorithm draws $k$ bits to form an integer $V$ . If $V \ge P$ , the sample is discarded, and the process repeats. If $V < P$ , the inverse Horner decomposition is applied to generate the key tuple.
Security Analysis Framework: The paper analyzes the full pipeline (QKD $\to$ Key Extraction $\to$ MR-OTP Encryption) across single and multiple sessions. It employs a partition key-rolling scheme where disjoint blocks of the QKD stream are used for each session's key and base sequence.
Adversary Taxonomy: The security analysis distinguishes between four adversary classes: testing-based, algebraic, unbounded, and ciphertext-only. It separates the "computational secret" (the base sequence $B$ ) from the "information-theoretic secret" (the pad $K$ ).

Key Contributions and Results

Uniform Key Sampling: The paper proves that naive modular reduction breaks perfect secrecy (Proposition 3.1). It demonstrates that rejection sampling combined with inverse Horner decomposition restores a uniform distribution over the key space (Theorem 3.4). The expected bit cost of this process is bounded by $2\lceil \log_2 P \rceil$ , with an expected number of rejection rounds of at most 2 (Proposition 3.5).
End-to-End Security: The composition of an ideal QKD source, the rejection sampling algorithm, and the MR-OTP achieves Shannon perfect secrecy for a single session (Theorem 4.2) and across $N$ sessions under a partition key-rolling scheme (Theorem 6.2). This holds without computational assumptions.
Representational Efficiency: The paper quantifies the efficiency gain of MR-OTP over binary OTP for natural alphabets. By operating in the native symbol space, MR-OTP eliminates the "binary overhead" ( $\lceil \log_2 b \rceil - \log_2 b$ ) inherent in binary encoding. For example, it offers a $\approx 16.9\%$ reduction in key material for decimal digits and $\approx 6.0\%$ for the Latin alphabet (Proposition 5.3).
Base Recovery Problem (BRP):
- Ciphertext-Only: The paper proves that recovering the base sequence $B$ from ciphertext alone is information-theoretically insoluble (Corollary 8.2). The ciphertext provides zero information about $B$ beyond the constraint $b_i > c_i$ .
- Known-Plaintext: In the known-plaintext setting, the paper establishes an unconditional lower bound on the query complexity for testing-based adversaries, showing that identifying $B$ requires at least $|F_T| - 1$ queries, where $|F_T|$ remains exponential in the message length $L$ for small $T$ (Theorem 8.10).
- Invariance of Security: A central result (Theorem 8.15) proves that even if an adversary (bounded or unbounded) successfully recovers the base sequence $B$ from known-plaintext data, they gain zero information about any future message encrypted under a fresh key. The information-theoretic security of the pad is preserved regardless of the computational status of the base recovery problem.
Batched Extraction: The paper introduces a batched key extraction algorithm (Section 9) that draws a single large integer to generate $N$ key digits simultaneously. This reduces the rejection overhead compared to sequential sampling, approaching the theoretical entropy limit of $\log_2 b$ bits per symbol as $N \to \infty$ (Theorem 9.2).
Non-Ideal Sources: The paper extends the security guarantees to non-ideal QKD sources that are $\epsilon$ -close to uniform in total variation distance. It shows that the end-to-end security degradation is bounded by $2N\epsilon$ for $N$ sessions (Theorem 10.3).

Significance and Claims
The paper claims to provide the complete algorithmic foundation for deploying the MR-OTP with QKD sources while maintaining strict information-theoretic security. Its primary significance lies in:

Resolving the Bias Problem: It provides a provably correct method (rejection sampling + Horner inversion) to convert binary entropy to mixed-radix keys without violating the uniformity requirement of perfect secrecy.
Unconditional Temporal Security: It establishes that the security of future messages is independent of the computational difficulty of recovering the base sequence. Even if the base sequence is recovered, the system retains perfect secrecy for fresh encryptions. This creates a "two-layer" security structure where the computational layer (hiding the base) and the information-theoretic layer (hiding the message) are independent.
Efficiency: It demonstrates that MR-OTP is not only theoretically sound but practically more efficient than binary OTP for non-power-of-two alphabets, reducing key consumption without sacrificing security.
Adversary Classification: It rigorously separates adversary capabilities, proving that the information-theoretic guarantee holds unconditionally for all adversary classes, while computational hardness results apply only to specific subsets (testing vs. algebraic) in the known-plaintext setting.

The paper concludes by identifying open problems, specifically regarding the dynamic key-rolling variant (where the base sequence depends on previous ciphertexts) and the average-case computational hardness of the Base Recovery Problem for algebraic adversaries.