Random Key Basis Protocol in Cryptography

• Random Key Basis Protocol is a framework where keys are derived from randomly chosen bases, enhancing security in both classical and quantum systems.
• It encompasses schemes like BCB12, Merkle’s random-oracle protocols, and DIQKD, each employing distinct methods and security assumptions.
• The protocol’s security ranges from computational hardness in combinatorial models to unconditional, device-independent guarantees in quantum implementations.

“Random Key Basis Protocol” is not a single standardized protocol name but a recurrent designation for cryptographic schemes in which secret-key establishment is organized around randomized basis choices, shared random structure, or high-entropy random key material. In the literature, the term covers a classical combinatorial protocol based on set partitions, random-oracle key agreement in the Merkle tradition, and several quantum protocols—especially device-independent quantum key distribution (DIQKD)—that generate key from two randomly chosen key-generating bases rather than one fixed basis (Bouroubi et al., 2013, 0801.3669, Schwonnek et al., 2020). This suggests a family resemblance rather than a unique canonical construction: the common theme is that basis selection or basis-like structure is itself part of the key-generation resource.

1. Terminological scope and research uses

In the classical combinatorial setting, the expression denotes BCB12, a protocol in which Alice and Bob share a secret partition of a large set and derive a common key over a classical channel by comparing block indices and extracting symbols from matched positions. In the random-oracle setting, it denotes key agreement protocols whose only hardness source is oracle randomness, with Merkle’s construction as the canonical example. In quantum cryptography, it denotes protocols in which key bits are generated from more than one basis, chosen at random, so that Eve does not know in advance which key-generating basis is used in a given round (Bouroubi et al., 2013, 0801.3669, Schwonnek et al., 2020).

This diversity matters because the security model changes with the usage. In BCB12, security is argued from the hardness of reconstructing a secret partition. In Merkle-type protocols, security is measured by oracle-query complexity. In DIQKD, security is tied to Bell-inequality violations and conditional entropy bounds. A plausible implication is that “random key basis” functions more as a descriptive label for protocol architecture than as a uniquely defined primitive.

2. Classical combinatorial protocol: BCB12

BCB12 is a classical, combinatorial protocol for generating and sharing random cryptographic keys over a classical communication channel, intended specifically to provide keys suitable for Vernam / one-time-pad encryption (Bouroubi et al., 2013). Alice and Bob share in advance a secret partition

$T=\{A_1,A_2,\dots,A_k\}$

of $[n]=\{1,2,\dots,n\}$, with $n$ large. Each party independently generates a random sequence of integers in $[n]$, maps each integer to the index of the block containing it, and obtains sequences $T_A$ and $T_B$ of block indices.

Alice sends the parameter $m=L_M\times S$ to Bob, where $L_M$ is the message length and $S$ is a positive integer amplification parameter. Bob generates his own random sequence of length $m$, computes $[n]=\{1,2,\dots,n\}$0, and sends $[n]=\{1,2,\dots,n\}$1 to Alice. Alice compares $[n]=\{1,2,\dots,n\}$2 and $[n]=\{1,2,\dots,n\}$3 position by position and constructs a sign list

$[n]=\{1,2,\dots,n\}$4

Each “+” is treated as a key-generating event. For the corresponding block $[n]=\{1,2,\dots,n\}$5, Alice applies one function from a small family: $[n]=\{1,2,\dots,n\}$6 The rule for choosing $[n]=\{1,2,\dots,n\}$7 is determined from the binary representation of the block index $[n]=\{1,2,\dots,n\}$8 of the first “+”: if the two least significant bits are “00” or “11”, use the sum; if “10”, use the product; if “01”, use the maximum. The outputs are converted to binary and concatenated to form the key $[n]=\{1,2,\dots,n\}$9. If the resulting key length $n$0 satisfies $n$1, Alice encrypts with Vernam’s XOR: $n$2

The protocol is explicitly designed to satisfy the Vernam conditions that the key be random, at least as long as the plaintext, used only once, and known only to sender and receiver. Its security argument is computational rather than information-theoretic: the public channel reveals $n$3, Bob’s block-index list, the sign list, and the ciphertext, but not the partition $n$4. The authors describe the relevant search space in terms of set partitioning, which they characterize as NP-hard. The paper also states that keys generated by BCB12 “have been proved random, using statistical tests.” At the same time, the protocol has clear limitations: it requires a pre-shared secret partition, it does not discuss authentication, and its own key-generation phase is not claimed to be unconditionally secure.

3. Random-oracle protocols and the Merkle limit

In the random-oracle literature, “random key basis” refers to key agreement protocols whose security derives only from access to a random function, rather than from algebraic assumptions such as discrete logarithm or RSA (0801.3669). The central result is that if Alice and Bob each make at most $n$5 queries to a random oracle, then any such protocol can be broken by an eavesdropper making $n$6 oracle queries, and Merkle’s original protocol attains this quadratic gap.

Merkle’s protocol is formulated with a random function

$n$7

Alice picks $n$8 distinct random inputs $n$9, computes $[n]$0, and sends the list $[n]$1 to Bob. Bob does the same with $[n]$2, producing $[n]$3. If $[n]$4 for some pair, the first such collision defines the key: Alice uses $[n]$5, Bob uses $[n]$6. Honest cost is $[n]$7 oracle queries per party, whereas an eavesdropper must invert a collision value in a domain of size $[n]$8, requiring $[n]$9 queries.

The general theorem proves that no random-oracle-only key agreement can do asymptotically better: for every $T_A$0, an eavesdropper making

$T_A$1

queries can match Bob’s output with probability at least $T_A$2, where $T_A$3 is the honest agreement probability. The structural reason is that Eve can learn the “intersection queries” asked by both parties and thereby recover the hidden correlations induced by the random oracle. The resulting $T_A$4 barrier is the defining limitation of random-oracle key agreement.

4. Device-independent QKD with random key basis

In DIQKD, the term denotes a modified CHSH-based protocol in which Alice’s key bits are generated from two possible measurement bases chosen at random, rather than from a single fixed basis (Schwonnek et al., 2020). Alice has inputs $T_A$5, Bob has inputs $T_A$6, and key rounds are those with $T_A$7. The sifting probability is

$T_A$8

and the asymptotic key rate is

$T_A$9

with

$T_B$0

where $T_B$1.

The Bell parameter is

$T_B$2

with

$T_B$3

Security reduces to bounding Eve’s uncertainty

$T_B$4

from the observed CHSH violation, via a device-independent entropic uncertainty relation

$T_B$5

The operational significance of using two key-generating bases is that Eve does not know in advance which incompatible measurement will contribute to the key. Under the depolarising model,

$T_B$6

the protocol lowers the critical CHSH value for positive asymptotic key rate from $T_B$7 to $T_B$8, corresponding to a QBER improvement from $T_B$9 to $m=L_M\times S$0. Finite-key analysis for general attacks gives positive rates for approximately $m=L_M\times S$1 to $m=L_M\times S$2 rounds under state-of-the-art experimental parameters. Event-ready Bell tests such as Hensen and Rosenfeld enter the positive asymptotic key region under this protocol.

5. Related quantum variants and extensions

Several related protocols generalize the same design principle. In “Quantum key distribution protocol with pseudorandom bases,” Alice and Bob share a short seed $m=L_M\times S$3 for a PRNG that outputs basis angles

$m=L_M\times S$4

Alice sends

$m=L_M\times S$5

and Bob measures in the corresponding basis, so there is no sifting. The paper shows better secret key rates than BB84 and the asymmetric BB84 protocol against intercept-resend for single-photon sources, but also states that the protocol strongly requires single-photon sources because multi-photon pulses enable PNS+QSD attacks (Trushechkin et al., 2017).

In “Quantum key distribution protocols with slow basis choice,” security is proved for QKD protocols in which basis choice is not changed for every pulse or block, provided signals do not leak any information on the basis and sequences with more than one detection event are discarded. The paper applies this to RRDPS and BB84-type protocols and states that slow basis choice can be used without compromising the secret key rate (Sasaki et al., 2016).

A multipartite extension appears in “Device-independent quantum secret sharing with advanced random key generation basis,” where two basis combinations,

$m=L_M\times S$6

are randomly selected for key generation and combined with noise preprocessing and postselection. The protocol increases the noise tolerance threshold from $m=L_M\times S$7 to $m=L_M\times S$8, reduces the global detection efficiency threshold from $m=L_M\times S$9 to $L_M$0, and increases the maximal distance between any two users to $L_M$1 km (Zhang et al., 2024).

A later refinement, “Modified security analysis of device-independent quantum key distribution with random key basis,” reformulates the DIQKD optimization as a strongly convex optimization problem, replaces the original polytope step for Bob’s angles with a lower-cost treatment, and derives an explicit form of the pessimistic error arising in angular optimization (Bhattacharyya et al., 18 Aug 2025).

6. Security assumptions, limitations, and misconceptions

The literature distinguishes sharply between information-theoretic, computational, and model-dependent security. BCB12 is inspired by one-time-pad use, but its own key-generation security rests on the difficulty of reconstructing a secret partition and therefore is computational; it also requires a pre-shared partition and does not address authentication (Bouroubi et al., 2013). Merkle-type random-oracle protocols are optimal only in the limited sense that no construction can exceed a quadratic oracle-query gap; they do not yield superquadratic black-box security (0801.3669). DIQKD random key basis protocols, by contrast, are explicitly formulated to provide information-theoretic security under standard device-independent assumptions, but they demand loophole-free Bell violations and large finite data sets (Schwonnek et al., 2020).

A common misconception is that adding “random basis” automatically strengthens security regardless of implementation. The counterexamples are explicit. In pseudorandom-basis QKD, the basis schedule may remove sifting and improve key rate, but the protocol strongly requires single-photon sources (Trushechkin et al., 2017). In KLJN key exchange, deterministic and statistical RNG-compromise attacks show that if Eve knows or is correlated with Alice’s and Bob’s random number generators, the secure bit can be recovered; the papers conclude that the security of the KLJN key exchange scheme, similarly to other protocols, necessitates that the random number generator outputs are truly random for Eve (Chamon et al., 2020, Chamon et al., 2021).

The broader record therefore supports a precise reading. A random key basis protocol is not defined by one particular hardware platform or one security theorem. It is defined by an architectural choice: key establishment is tied to randomized basis selection, structured shared randomness, or both. Whether that choice yields unconditional secrecy, computational hardness, or only conditional security depends entirely on the accompanying model—Bell violation, oracle access, combinatorial secrecy, source assumptions, or RNG integrity.