{'fraction_non_alphanumeric': 0.03997042546994376, 'fraction_numerical': 0.012434745591826675, 'mean_word_length': 4.264685067232838, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 2, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 13, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Network Network Coding-Based Post-Quantum Cryptography

We propose a novel hybrid universal network-coding cryptosystem (HUNCC) to obtain secure post-quantum cryptography at high communication rates. The secure network-coding scheme we offer is hybrid in the sense that it combines information-theory security with public-key cryptography. In addition, the scheme is general and can be applied to any communication network, and to any public-key cryptosystem. Our hybrid scheme is based on the information theoretic notion of individual secrecy, which traditionally relies on the assumption that an eavesdropper can only observe a subset of the communication links between the trusted parties - an assumption that is often challenging to enforce. For this setting, several code constructions have been developed, where the messages are linearly mixed before transmission over each of the paths in a way that guarantees that an adversary which observes only a subset has sufficient uncertainty about each individual message. Instead, in this paper, we take a computational viewpoint, and construct a coding scheme in which an arbitrary secure cryptosystem is utilized on a subset of the links, while a pre-processing similar to the one in individual security is utilized. Under this scheme, we demonstrate 1) a computational security guarantee for an adversary which observes the entirety of the links 2) an information theoretic security guarantee for an adversary which observes a subset of the links, and 3) information rates which approach the capacity of the network and greatly improve upon the current solutions. A perhaps surprising consequence of our scheme is that, to guarantee a computational security level b, it is sufficient to encrypt a single link using a computational post-quantum scheme. In addition, the information rate approaches 1 as the number of communication links increases.


I. INTRODUCTION
The connection between Information Theory and Cryptography goes back to Shannon himself -it is said that his work in security inspired his seminal work on communications. There, he Patent application submitted: no. 63  This necessity in Alice and Bob sharing large secret keys is often non-practical, e.g. if Alice and Bob are geographically distant. Hence, much effort has been devoted to developing alternative solutions which relax upon the perfect secrecy condition. One such relaxation comes from assuming that the eavesdropper has limited computational power. Such schemes, referred to as computationally secure in this paper, rely on the conjecture that certain one-way functions are hard to invert [2]. Thus, Alice encrypts the private message using a one-way function before sending it to Bob. This function should be hard for Eve to invert, but inversion for Bob should be possible if he possesses the right key. One way to achieve this is via public-key cryptography.
A public-key cryptosystem consists of an encryption function Enc(·), a decryption function Dec(·), a secret key s, and a public key p. The encryption function uses the public key to encrypt the private message M into Enc(M, p). The decryption function uses the secret key to decrypt the encrypted message M = Dec[Enc(M, p), s]. The critical property is that decrypting the encrypted message without the secret key is computationally expensive. Although there are many ways of characterizing this, we will focus on the notion of security level. Informally, a public-key cryptosystem has security level b, referred to as being b-bit secure, if the amount of operations expected to decode the encrypted message, without knowledge of the secret key, One of the first, and most widely used, public-key cryptosystems is the RivestShamirAdleman (RSA) cryptosystem [3]. The security of RSA relies on the hardness conjecture of two mathematical problems: integer factorization and the RSA problem. In 1994 however, Peter Shor presented a polynomial-time algorithm for integer factorization, known as Shor's algorithm [4] -with the caveat that the algorithm runs on a quantum computer. In other words, if sufficiently large quantum computers are ever to be built, Shor's algorithm can be used to break the RSA cryptosystem [5]- [9]. This subsequently led to an increased interest in cryptosystems which are resilient to quantum attacks, a field known as post-quantum cryptography [10], [11].
A candidate for post-quantum cryptography, known as the McEliece cryptosystem, was introduced in [12]. The McEliece cryptosystem is immune to attacks that use Shor's algorithm. Interestingly, the McEliece is also based on a connection between cryptography and communication theory -its security relies on the fact that decoding a general linear code is NP-hard [13]. The original scheme uses binary Goppa codes [14], [15]. Apart from having no known quantum attacks, the encryption and decryption algorithms are faster than those of RSA. Two main disadvantages of McEliece are: i) in usual applications, the size of the public key is much larger than that of RSA and ii) it suffers from a large communication overhead, with a communication rate around 0.5 in the original paper.
One may be tempted to increase the communication rate by changing the parameters of the Goppa code. However, a key result pertaining to the communication rate was presented in [16], where a polynomial time algorithm was given for distinguishing the matrix of a high rate Goppa code with a random matrix. Therefore, the security of high rates Goppa code may not be guaranteed. Another idea is to look at other families of codes, away from Goppa codes. As shown in Table II, most of them have been broken.
In parallel with the advances in computational security, another relaxation on perfect privacy was considered in the literature, mostly by information theorists [17]- [23]. Instead of restricting the computational power of the eavesdropper, in physical layer security one limits how much information Eve can obtain about the encrypted message. In this setting, information-theoretic security can be obtained at the expense of the communication rate, as shown in the seminal work of Wyner [17], where he introduced the wiretap channel -the analog of the classical Alice, Bob and Eve triple under the physical layer security assumption. For example, in [24] it is assumed that the eavesdropper can observe any set w out of a total of n transmitted symbols. Denoting this set by Y Ew , it was shown that there exist encryption codes with communication rate n−w n which does not leak any information about the message to the eavesdropper, i.e. H(M |Y Ew ) = H(M ). The price to pay in rate to achieve perfect secrecy in physical layer security is significantdecreasing the rate of the legitimate communication is necessary.
In an effort to increase the efficiency in terms of rate, yet another relaxation of the perfect secrecy of Shannon was introduced, namely individual secrecy [25]- [36]. This is best explained in a network setup, where Alice has many messages to send to Bob, say M 1 , . . . , M m , and Eve may observe any w of them. By increasing the rate beyond the limits given by the wiretap channel of Wyner, it is inevitable that information will be leaked. Yet, it is unclear whether the eavesdropper Eve is able to utilize this information to recover the sent messages. The notion of individual secrecy crystallizes this concept by guaranteeing that H(M i |Y E,w ) = H(M i ), for all i = 1, . . . , m. Note that this is generally weaker than perfect secrecy, where H(M 1 , . . . , M m |Y E,w ) = H(M 1 , . . . , M m ). In other words, the information that Eve obtains from her observation does not help her decipher each individual message -rather it is information about the combination of the messages. Individual secrecy is definitely a weaker notion of security, yet it often allows to increase the rate drastically, sometimes even making the encryption process free in terms of rate. While there is no doubt that efficient rates are beneficial, the assumptions of physical layer security, namely that Eve does not experience a worse channel than Bob, are hard to enforce in practice. Figure 2 depicts a simple example of secure postquantum candidates for multipath networks based on the following security solutions considered in the literature we elaborated above, (a) One-time pad [1] (b) McEliece cryptosystem [12] (c) Network coding wiretap II [20] (d) Individual Security for networks [36].

Main Contribution
In this work, we consider a new hybrid network-coding cryptosystem (HUNCC) to obtain post-quantum cryptography at high rates. In this secure network-coding scheme, we combine the computational security principles, with the physical layer security primitives, thus introducing a hybrid system which relies on both individual secrecy, and computational secure cryptosystems.
We illustrate this concept via a multi-path secure transmission scheme, where multiple messages are to be sent between Alice and Bob, using parallel links. By doing so, we are able to address one of the main shortcomings of physical layer security, namely that the adversary eavesdropper cannot observe all the messages sent between Alice and Bob. In the system we will introduce shortly, Eve may in fact observe the entirety of the transmission between Alice and Bob.
We will make an assumption on Eve's computational power however, similar to computationally secure systems. On the other hand, instead of encrypting the entirety of the messages from Alice using public-key cryptography, we only encrypt over some of the communication links. Under the computational limitation assumption, the links that are encrypted are analogous to losses for Eve -and thus, we may now employ traditional techniques from physical layer security codes. In other words, we are able to enforce that the eavesdropper only observe part of the messages, via cryptography, under the computational limitation assumption. This, in turn, allows an increase in the communication rate -similar to what is done in individual secrecy, while still providing security guarantees that are computationally strong. If Alice and Bob have more communication channels, the communication rate will be even larger. Indeed, the rate goes to one as the number of channels increases. In Table I, we compare the performance of the individual secure coding scheme and the original McEliece cryptosystem to our proposed hybrid scheme.
Ind. Sec. Code [36] HUNCC McEliece Cryp. [37] Encrypted paths 0 c l Information rate In recently considered heterogeneous networks, one may not assume that the cryptosystem, with the public-key, can be applied on all paths. The HUNCC coding scheme can ensure post-quantum security across the entire network, using the public-key only for the information transmitted over one path. Moreover, we show important applications in which HUNCC is applicable. Specifically, we consider single path communication, distributed storage, ultra-reliable low-latency streaming communications, and the case of myopic adversaries.
For a network with two paths, we illustrate our hybrid scheme in Figure 2e: Alice wants to send a private message M = [M 1 , M 2 ] ∈ F 2 q u to Bob via l = 2 communication links. An eavesdropper, Eve, depending on how strong she is, can observe the communication in one or both of these channels.
Alice and Bob agree on a public key encryption scheme (Enc, Dec, p, s). Alice first encodes the message M using the individually secure code with generator matrix G = ( 1 1 2 1 ). We denote this encoding by . Alice then encodes Enc(X 1 , p), sends it to Bob via channel 1, and sends X 2 via channel 2. Bob then decodes X 1 = Dec(Enc(X 1 , p), s) to retrieve all of X and multiplies by the inverse of the generator matrix to retrieve the original message M = XG −1 .
If Eve is a weak eavesdropper, observing only one communication channel, the scheme is information-theoretically individually secure irrespective of her computational power. This occurs because each piece of the message, M i , is independent from any single X j . If Eve is a strong eavesdropper, observing both communication channels, each message M i will be computationally secure with almost the same security level as the encryption scheme (Enc, Dec, p, s). Indeed, we show in Theorem 1 that if the best known attack on (Enc, Dec, p, s) needs 2 b operations to break it, then Eve needs at least 2 b − 2 b operations to determine any message M i , where is the amount of operations needed to solve a 2 × 2 linear system. 1 We note that for the individually secure code G to work, F q u must have characteristic larger than 2. Also, the image of the individually secure code must be injectively mapped into the domain of the encryption function Enc. We consider the following example.
Suppose Alice and Bob agree on using a 128-bit McEliece cryptosystem. Utilizing the suggestion in [10], Bob selects a [2960, 2288]-Goppa code with a public key of 1537536 bits 2 . In this case, the domain of the encryption function is F 2288 2 . Alice and Bob must agree on an injective mapping from the image of the code G, given by F q u with characteristic larger than 2, to F 2288 2 .
In this case, they could set q u = 3 1443 so that log 2 (q u ) ≈ 2287.1 bits. Thus, Alice can map X 1 into a 2288 bit vector and encode it using the Goppa code into E(X 1 , p) ∈ F 2960 2 . Alice will then send log 2 |E(X 1 , p)| = 2960 bits through link 1 and log 2 |X 2 | ≈ 2287.1 bits through link 2. Thus, the total communication cost will be around 5248 bits giving a communication rate slightly larger than 0.87. By Theorem 1 both messages, M 1 and M 2 are 128-bit secure. In Section VII-E, we look at an example where Alice and Bob agree on using an RSA scheme.
The structure of this work is as follows. In Section II, we provide a background on the main security blocks we use in the proposed solution. In Section III, we formally describe the system model. The security notions and the threat models we will use in the paper are defined in Section IV. In Section V, we present our scheme HUNCC with our main results. In Section VI we analyze the performance of HUNCC and discuss our results. In Section VII, we present a few examples for which HUNCC is applicable. Finally, we conclude the paper in Section VIII.

II. BACKGROUND
In this section we give some background information on the two main building blocks of our scheme: i) computational secure cryptosystems and, ii) information-theoretic individual security. We note that, although we focus on the McEliece Cryptosystem, any computationally secure cryptosystem can be used in our scheme. In Section VII-E, we provide an example of how the original RSA can be used in our scheme.

A. Computationally Secure Cryptosystems
We start by introducing some helpful notation and definitions for public-key cryptosystems.
is the deciphering function, and p ∈ P and s ∈ S represent the public and private key respectively, • For a messagem ∈ {0, 1} k b , a public key p ∈ P, and the corresponding secret key s ∈ S, Dec(Enc(m, p), s) =m, A public-key encryption (Enc, Dec, p, s, k b , n b ) has security level b if the best known algorithm to recoverm with the knowledge of Enc(m) and p alone needs to perform at least 2 b operations.
Parameters for long-term security in post-quantum cryptography were suggested in [10], [38]. These parameters determine a trade-off between the security level, the information rate, and the size of the public-key in the cryptosystems. We focus now on the McEliece cryptosystem and take a look at RSA in Section VII-E.
1) The McEliece Cryptosystem: The original McEliece cryptosystem [12] remains unbroken. In this scheme, Bob produces a generator matrix G ∈ F k b ×n b q by randomly choosing an irreducible polynomial of degree t over GF (2 d ), which corresponds to an irreducible Goppa code of length n b = 2 d and dimension k b ≥ n b − td. Note that this code can correct at least t errors 3 and can be decoded efficiently [11]. Bob then generates two matrices with the intent of concealing G, a random dense nonsingular matrix S ∈ F k b ×k b q and a random permutation matrix P ∈ F n b ×n b q . The scheme works as follows. Key Generation: • Public Key: Bob generates the public key . Both Alice and Eve have access to it.
• Private Key: The private key consists of (S, D G , P), where D G is an efficient decoding algorithm for G.
Encryption: To encrypt a messagem ∈ F k b q , Alice randomly chooses a vector z ∈ F n b of weight t and encrypts it as c =mG pub ⊕ z. Decryption: To decrypt the message, Bob first calculates cP −1 =mSG ⊕ zP −1 , and then applies the decoding algorithm D G . Since cP −1 has hamming distance t, it follows that,mSG = D G (cP −1 ). Then, since both G and S are invertible,m = (mSG)G −1 S −1 .
Many attempts have been made to improve the performance of the original McEliece cryptosystem by replacing Goppa codes with other families of codes. Most of these, however, have been broken. We summarize some of these attempts in Table II [45] Landias et al, 2013 [46] TABLE II: Code-based encryption systems.

B. Individual Information-theoretic Security
Individual security operates under the assumption that Eve is a weak eavesdropper Y Ew , i.e. only has access to w communication paths. The privacy guarantee is that, while Bob is able to decode completely all the k u ∈ F q u messages transmitted over the network of length k b ∈ F 2 bits each, Eve is ignorant with respect to each individual message. Thus, In general, individual security does not imply perfect privacy over the entire messages transmitted. Eve may potentially obtain information about mixtures of the encrypted messages transmitted. In many applications, this information is considered insignificant [26]- [36]. If the messages are statistically independent, this means that, In [36], individually security is generalized to k s -individual perfect secrecy, where k s ≤ k u − w, such that the eavesdropper has zero mutual information with any set of k u − w messages i.e., (1) And in [47], the assumption that the messages be independently and uniformly distributed, is removed. The authors in [36] present two code constructions which satisfy (1), a random code over a binary field, and a (k u , w)-linear code over a field F q u with u ≥ k u , where and the number of paths, l, is greater or equal to k u . We now show a detailed code construction of the linear code. Code Generation: Let C be a linear code over F q u , with u ≥ k u , of length k u and dimension w, , be the parity check matrix and the basis matrix for the code C, respectively, i.e. such that, H IS G T IS = I andG IS G IS = I yetG IS G IS = 0. Then, the individual security code is generated by It is important to note that unlike in public-key cryptosystems, and in particular the McEliece cryptosystem, in physical-layer security schemes, the generation matrix and the code is public. Thus, we can assume that both Bob and Eve have access to all the matrices described above. Encryption: Alice encrypts the message M ∈ F ku×1 Decryption: To decrypt the message, Bob uses the parity check matrix H IS and the basis matrix G IS to compute (M 1 ; . . . ; M k ) = H IS X and (M k +1 ; . . . ; M k ) =G IS X. By [36], since Eve only observes w symbols from the encrypted vector X T she is not able to decode and is completely ignorant with respect to any set k − w symbols of information transmitted over the network.

III. SYSTEM MODEL
We consider a network consisting of a source node, Alice, connected to a destination node, Bob, via l noiseless independent communication links. The network is illustrated in Figure 1. The goal is for Alice to transmit k u messages M = [M 1 ; . . . ; M ku ] ∈ F ku q u , of length k b ∈ F 2 bits each, privately to Bob in the presence of an eavesdropper, Eve. In this paper, our main focus is on post-quantum security. Thus, we assume Eve has access to a quantum computer.
We denote by Y = [Y 1 ; . . . ; Y l ] the vector of messages which Alice sends to Bob via each communication link. These messages must be such that Bob is able to decode M from them. Thus, we say Y is reliable if H(M |Y ) = 0. The messages Y , however, should satisfy certain properties if Eve is not to decode M herself. This will depend on how powerful Eve is.
We consider two types of Eve. A strong Eve, E s , which observes all communication links, having access to the entirety of Y . And a weak Eve, E w , which only observes a subset of the communication links. We denote the observations of each by Y Es and Y Ew , respectively. We note that because of reliability, information-theoretic privacy is not obtainable against a strong Eve.

IV. SECURITY DEFINITIONS
In this section, we define the security notions and the threat models used in the rest of the paper. Throughout, we assume a ciphertext-only attack model, i.e., the adversary Eve only has access to Y Es or Y Ew . Standard techniques from cryptography allow to expand the threat model to chosen-plaintext attacks, see e.g. [48]. We first define the notion of computational security. It should be noted that this definition of security level imposes implicitly a restriction on the size of the encoded message M , and on its distribution. Indeed, assuming a public-key cryptosystem, the adversary may always use a brute-force attack, by guessing potential message inputs until the correct one is found. Generally, it is assumed that the message M takes a value uniformly at random in a set {0, 1} k b , and thus it follows that k b ≥ b. In fact, most cryptosystems require k b to be strictly larger than b. Throughout this paper, we opt to leave this relationship implicit, and rather focus on the security level b, and select the appropriate k b based on this security level.
The computation security level of Definition 2 is relevant in the case of a single link, or equivalently a single message. When there are several messages being transmitted on each link, it is desirable to provide a security guarantee that applies to each message individually. For a weak Eve, this can be obtained via information-theoretic individual secrecy.
Remark 1. It should be noted that the linear code construction given in Section II-B actually guarantees a stronger notion of individual secrecy, c.f. (1). While such distinction is importantit reduces the possible set of joint messages M 1 , . . . , M l exponentially -the notion of individual secrecy in Definition 3 is more convenient to manipulate, and turns out to be sufficient to prove our main results. In this section, we present our proposed hybrid cryptosystem, which we refer to as Hybrid Universal Network-Coding Cryptosystem (HUNCC). In Figure 3, we illustrate how HUNCC operates on a multipath network with l communication links.
At a high level, the cryptosystem works as follows. Alice and Bob agree on a public-key cryptosystem (Enc, Dec, p, s, k b , n b ) as in Definition 1. Alice then selects c of the l links to be encrypted links. This alone does not provide full security, as the l − c links which do not experience encryption are unsecured. To solve this, we introduce an extra step before the encryption phase in which the messages are mixed using an individually secure linear code as in Section II-B. By doing this, we show in Theorem 1, that each message is now computationally secure. The security performance and the total communication rate of the scheme will depend on the choice of c and of the parameters of the public-key cryptosystem.

A. Scheme Description
We now give a more detailed explanation of HUNCC, as presented in Algorithm 1. We start by looking at the encoding process at Alice, illustrated in i , . . . , X can be injectively mapped into a sequence of bits b i of length k b . Eachb i is encoded via the public-key encryption before being sent, i.e., each link i transmits y i = Enc(b i , p i ). Note that y i is of length n (c.f. lines 6-13 in Algorithm 1).
For the paths i > c, Alice directly sends the collection X unencrypted. For consistency, it will be easier to also assume that the data sent on the path is a bit sequenceb i , this time of length k b (c.f. lines 14-16 in Algorithm 1).
We now detail the decoding process at Bob. As per Section III, we assume that all paths are error-free. Hence, Bob obtains all the messages transmitted over the network. For the c encrypted Transmission over the multipath network: 11: for each path 1 ≤ i ≤ c which support cryptosystem do 12: Transmit y i 13: end for 14: for each remaining path 1 ≤ i ≤ (l − c) without cryptosystem do 15: Transmit Decoding scheme at Bob: 17: Stage 1: Public-key decryption 18: for each path 1 ≤ i ≤ c with cryptosystem do

B. Security and Information Rate
We prove that HUNCC is computationally secure, as per Definition 4. This makes HUNCC well suited for dealing with a strong Eve which observes the entirety of the communication links. The proof relies on the following elementary lemma, which is the key interface between the computational security of the public-key cryptosystem, and the individual secrecy of the linear code.
Lemma 1. Let f : X → V be an injective function with computational security level b, i.e., the inversion function f −1 (f (X)) = X takes at least 2 b operations in expectation to complete. Consider an arbitrary pair of random variables (X, Y ), such that X ∈ X and Y ∈ Y are independent. Then, any function g : V × Y → X such that g(f (X), Y ) = X takes at least 2 b operations to complete in expectation.
Proof. The proof is by contradiction. Denote by Comp(h(x)) the number of operations that the best algorithm for computing a function h(x) assumes. Assume that there exists a function g such that g Thus, there must exist a specific y 0 ∈ Y such that E[Comp(g(f (X), y 0 ))] < 2 b . But then, the function h : V → X defined as h(v) = g(v, y 0 ) completes in less than 2 b operations, which is a contradiction.
Lemma 1 essentially states that an independent and unrelated observation Y may not help in decoding more efficiently a ciphertext f (X).
We are now ready to prove the main theorem of this section. Proof. The proof is in two parts. First, we show that recoveringB i , for i = 1, . . . , c requires at least 2 b operations. Next, we show that there cannot be a decoding algorithm g(Y 1 , . . . , Y l ) = M j which completes with too few operations, as otherwise, such decoding could be used to decipher B i more efficiently. For ease of notation, we let c = 1, i.e., only one path is being encoded, and l = 2, i.e. there are only two paths in total. The general case follows mutadis mutandis.
Part 1: RecoveringB i is hard: We start by showing that it takes at least 2 b operations to recoverB 1 . Let g(Y 1 , Y 2 ) =B 1 be any decoding function that Eve employs. We have: where the penultimate equality follows from the individual secrecy assumption on G IS . Therefore, we have thatB 1 is independent of Y 2 . Since Y 1 = Enc(B 1 ), we thus have that the decoding function of Eve g(Enc(B 1 ), Y 2 ) falls under the setting of Lemma 1, and thus requires at least 2 b operations to complete since (Enc, Dec, p, s, k b , n b ) has security level b.
Part 2: Recovering M j cannot be too easy: ] complete in 2b operations for j = 1, 2. Since Y 2 =B 2 can be written equivalently as [X 1 2 , . . . , X ], we can construct the matrix: Next, using Lemma 2, there exist a matrixÃ, which can be constructed from G IS such that: Note that, in general, performing this matrix multiplication takes no more than δ = O(l 3 ) operations 6 as we will show in Lemma 2. Therefore, using once again the fact thatB 1 can be obtained equivalently from [X 1 1 , . . . , X ], we just constructed an Algorithm to recoverB 1 from the observations Y 1 , Y 2 using 2b + δ operations. It follows from Part 1 that log(2b + δ) ≥ b, which implies inb ≥ log(2 b − δ). Finally, via Taylor expansion, when δ is sufficiently small, we get: Therefore, we get that recovering M j must take at least b − δ/2 b operations.
We now prove Lemma 2, used in the proof of the Theorem above. Proof. The individually secure linear code defines 2 u(ku−c) cosets. One of them is the code itself. Each coset contains 2 uc codewords. The vector M i c is used as the index to choose the coset, and M i l−c is used to select the codeword within the coset. Since, given M i c , we known the specific coset selected, from X i l−c we can know the codeword selected in the coset. Note that X i l−c contain exactly uc bits, which is the same number of bits that represent the possible codewords in each coset. Such that using the index of the codeword we obtain M i l−c . Now that we have the entire column M i , we can use the encoding matrix G IS to obtain X i c . We can represent this as solving the linear system, where the variables marked with underline are the unknowns. By using Gaussian elimination, we can solve the linear system in O(l 3 ) operations. Hence, the number of operations needed to obtain X i c given M i c and X i l−c is O(l 3 ). In addition to being computationally secure, if Eve is a weak eavesdropper, observing no more than l − w of the paths, HUNCC is information-theoretically secure.
Proof. The proof follows directly from the individual security of the code G IS as given in [36,Section VI].
We now show the information rate of HUNCC.
Theorem 3. Let 1 ≤ c ≤ l be the number of encrypted paths using the public-key cryptosystem (Enc, Dec, p i , s i , k b , n b ). Then, the information rate is: In particular, R → 1 with convergence rate O( 1 l ). Proof. The total rate in the multipath network with l paths is obtained directly summing the rate k b /n b of the c encrypted paths with the rate of 1 in all the remaining l − c paths.
A few important remarks on HUNCC are in order: First, it is essential to note that the public-key used in the c encrypted paths of HUNCC is just the traditional public-key from the underlying cryptosystem. For instance, the one provided in the McEliece cryptosystem. Hence, this public-key is independent of the k u -messages transmitted over the multipath network and can be supplied to Alice in advance over a public channel. Moreover, unlike in information-theoretic security where a unique secret-key is utilized per message transmitted, as is the case for a one-time pad [1], the public-key in HUNCC can be used for multiple messages. In the same manner, the generation matrix G IS of the individually secure code is not confidential. Alice and Bob can agree on it over a public channel, i.e. this matrix may be revealed to Eve. Also, this matrix may be used indefinitely for any future transmissions.
Another point is related to the security level of HUNCC. As stated in Theorem 1, if the underlying public-key cryptosystem has security level b, HUNCC is individually computationally secure with security level at least . We note that this value is extremely close to b. Indeed, if b = 128 and we used Gaussian elimination to solve the system pertaining to Lemma 2, HUNCC would need l > 10 38 to reduce the security level by 1.
Finally, although our main focus is on post-quantum cryptosystems, HUNCC can be used with any public-key cryptosystem, including ones which are combined with a symmetric-key cryptosystem [38], [50], [51].
In Section VI, we present a more detailed analysis of the performance of HUNCC. And in Section VII we provide other features and applications of HUNCC.

VI. PERFORMANCE ANALYSIS
In this section, we analyze the performance of HUNCC. We focus on three measures, the information rate, the individual computational secrecy, and the information-theoretic individual secrecy. In particular, we compare the trade-off between these quantities as we vary the number of encrypted links, denoted by c in Algorithm 1.
We start by considering the communication rate, see Theorem 3. We note that the rate increases as we reduce the number of encrypted links c. On the other hand, the computational security level remains virtually constant as long as at least one path is encrypted, i.e. c ≥ 1.
Finally, in the case of a weak Eve, the individual security level increases linearly with the number of links, l − w, from which the weak Eve does not get information. In other words, while the computational bit-level security remains constant, the uncertainty of an adversary which observes a subset of the links increases.
Remark 2. In Algorithm 1, we assume that each path utilizes the same public-key cryptosystem, with identical public and private keys. If we instead opt to use different cryptosystems, each with independent public and private keys, the total computational security does increase, though marginally. Using c public-key cryptosystems increases the security level from b to b + log(c). Total rate for l = 5 Total rate for l = 10 Total rate for l = 20 Total rate for l = 50 It should be emphasized that this increase on the security level comes at the cost of additional private-keys needing to be shared prior to the communication phase.
In Figure 5, we illustrate each performance parameter versus the number of encrypted links c, for HUNCC with the original McEliece cryptosystem using a [1024, 512]-Goppa code. The information rate over each encrypted path is k b /n b ≈ 0.5. For illustration purposes, we consider normalized measures of security. Namely: 1) the normalized computational security level is the security level divided by the maximum computational security that can be obtained by using the cryptosystem over all links, i.e. f s crypto = min{c,1}·b code bmax . 2) the normalized individual security level is the fraction between the number of the links the weak Eve can see divided by the total links in the network, i.e. f s IS = l−w l . In the example given in Figure 5, the results are for the case in which the same McEliece cryptosystem code with the same public-key is used in all the c links. Hence, the normalized computational security level is zero for c = 0 and one for any c = l. Note that, via Theorem 1, the computational security level for any 1 ≤ c < l, is bounded by b − δ/2 δ , where δ = O(l 3 ). This difference is negligible and does not appear on the plot, which essentially remains constant and equal to one for c ≥ 1.
The solution proposed in this paper is not restricted to the original McEliece cryptosystem. Any cryptosystem can be utilized. To illustrate this, in Figure 6 we present the efficiency of the proposed solution and the resulting trade-offs for other codes suggested for the McEliece cryptosystem. In particular, the result presented in Figure 6 are for l = 3 and l = 10, and the following    [52], [53]. For this family of codes, the following parameters are suggested, k b = 16384 and n b = 24576, i.e. a code with rate k b /n b = 0.6667. This code achieves b = 75.8-bit computational security. 4) Niederreiter in [39] proposed a Reed-Solomon code with a rate of 0.57, however the generalized Reed-Solomon codes were broken [40]. In [54], a Niederreiter-type system, which utilized the same Goppa codes used by original McEliece construction, and with the same security level, was proposed. That encryption scheme was also considered in [10] and tested under the state-of-the-art attacks of the McEliece cryptosystem, and it thus assumed to achieve b = 58-bit computational security.
In this comparison, presented in Figure 6, the maximum computational security level obtained is of 256-bit using the McEliece cryptosystem with [6624, 5129]-Goppa codes. Hence, the results presented on the left in Figure 6 for each possible code are normalized with b max = 256. Recall that while the computational security level is one of the main parameters considered in choosing a cryptosystem, another one is the size of the public-key. We note also that the computational security level of HUNCC remains essentially constant despite increasing the number of links

VII. OTHER FEATURES AND APPLICATIONS
In this section, we present a few features and applications that exemplify the applicability and the performance of the proposed HUNCC scheme for extensive essential applications.

A. Single Path Communication
While the main network scheme considered in this work is with multi-paths, the secure coding scheme we propose in this work is universal in the sense that it can be applied for any communication network [28]. For instance, it can be used in classical point-to-point single-path communication, as well as heterogeneous mesh networks. Figure 7 depicts how the proposed secure scheme can be applied in classical point-to-point single-path communication. In this setting, similar to the model presented in Section III, there is one source Alice, one legitimate destination Bob, and an eavesdropper Eve. The main difference is that, in the model presented in this section, there is only one path to transmit information between Alice and Bob. Alice wants to transmit securely over the single-path communication a message M of k u symbols over a finite field F q u . For this, we propose that Alice and Bob utilize HUNCC as described in Section V, by essentially simulating parallel virtual links. More precisely, at the first stage Alice will encode the k u symbols using the linear individual secure code, G IS ∈ F l×l q . Then, Alice encrypts c of the symbols before the transmission over the channel using the public-key provided by Bob over the public directory. The remaining process is as given in Section V. Hence, we obtain the same communication rate and security level as in the multipath network case.

B. Myopic Adversaries
An additional important scenario considered in the literature is one in which Eve is allowed not only to eavesdrop the information transmitted over the network, but also to corrupt the encrypted packets. This scenario is considered in the literature under different models of adversaries, for instance, with passive attacks [28], [55], [56], myopic adversaries [57]- [60], man in the middle attack [61], [62], byzantine attacks [63], [64], etc.
In the case of a weak eavesdropper, which can obtain only information from w < l subset of the paths in the network; we can augment our linear individual security code to perform error correction, which allows to recover up to t errors which may be injected by Eve. A possible solution is to generalize the code in the same manner as presented in [28,Sections IV and VII]. Such extension comes at a cost. To correct t injected errors, the rate must be decreased by 2t. Note that in this setting, the code can support the case in which Eve can corrupt any subset of messages transmitted over the network, whether they are on the paths which are encrypted, or not. Indeed, the correction property only relies on the decoding of the linear coding scheme, and is independent of the deciphering phase.
In the case of a strong eavesdropper, which can obtain the information from all the paths in the network, we can utilize the same generalized code to correct the t errors that may be injected by Eve. However, in this case, to ensure security, Alice will need to encrypt at least 2t + 1 messages that are transmitted over the different paths in the network. Hence, we must encrypt the additional 2t messages, transmitted to correct the errors, to prevent Eve from obtaining sufficient encoded messages by the linear code, which may provide her with the needed rank to decode the total message.
Future work can consider the case where authentication can be utilized between the encoded messages to reduce the overhead required to correct the injected errors in the above-proposed solution. Note that if Bob is able to identify the corrupted messages, Alice needs to include only one additional symbol per injected error, as opposed to the two messages in the model presented above. Furthermore, the linear code can be generalized as shown in [28] to support the scenario where the paths in the network are not error-free [28], [65]. In the case where the cryptosystem is based on error-correction codes as in the McEliece cryptosystem, instead of adding an error vector at the source, Alice can use the errors of the channel to confuse Eve. The codes in those cases are designed to be able to decode at the legitimate decoder, given those errors. Hence Bob will be able to decode the information. All of those extensions allow us to increase the effective rate of those solutions.
One of the main drawbacks of distributed storage is that, storing the data at more locations can potentially increase the risk in the security and privacy of the data [76]- [78]. One way to address this is by reinterpreting the problem as a multipath network. This is done by considering Alice and Bob to be the same individual at different times, and the communication links to be the storage nodes. In this way, the different privacy solutions to the multipath network, including HUNCC, can be readily applied to secure the data in a distributed storage system. Dealing with erasures and errors, of both a probabilistic or adversarial nature, can be done analogous to the way presented in Section VII-B.

D. Ultra-Reliable Low-Latency Communications
Recently the application of network coding in streaming communication which demand low delays has been considered [79]- [84], with applications in audio/video [85], [86], smart-city [87], [88], IoT networks and control applications [89], [90], distributed computation [91], etc. Figure 9 depicts a multi-path low-latency communication for video streaming. Traditional coding solutions which achieve high throughput are generally not suitable to guarantee low in-order delivery delay which is a requirement in these applications. This has led to a series of work that propose methods to explore the trade-off between high-rate, and low-delay, see e.g. [81]- [84], [92].
When the communication needs to also be secure, we propose to use HUNCC scheme of Section V, in conjunction with the coding schemes of say [81]- [84]. While in those works the number of messages from Alice, that are involved in the linear network encoding process, depend on the desired rate/delay trade-off, in the security application, this number is further constrained by the security guarantees that are desired. This might come at the cost of delay, as more messages may need to be mixed in together to provide secrecy.
Future works of interest include the study of new secure codes for streaming communications which allow to optimally trade-off delay, security guarantees, and information rate.

E. RSA Cryptosystem
Although in this work, we focus on post-quantum cryptography, and specifically on the McEliece coding-scheme in the c encrypted paths, any computationally secure cryptosystem can be used for our solution. Here we briefly discuss an example of how RSA [3] can be applied in our network-coding solution, in the context of the example given in Figure 2-(e), i.e. a multipath network with two paths. As a first stage of encoding at Alice, we assume that the generation matrix, G = ( 1 1 2 1 ), of the individual security code is used. Such that, X = M G = [M 1 +M 2 , M 1 +2M 2 ]. Now, say Alice and Bob agree on using an RSA scheme only over the first path. For 128-bit security, they settle on using a 3072 bit key. Using a 328 bit OAEP padding, the message size can be at most 2744 bits. Thus, Alice can map X 1 into a 2744 bit vector and encode it using RSA into E(X 1 , p) ∈ F 3072 2 . Alice will then send log 2 |E(X 1 , p)| = 3072 bits through channel 1 and log 2 |X 2 | ≤ 2288 bits through channel 2. Thus, the total communication cost will be around 5360 bits giving a communication rate slightly greater than 0.85.

VIII. CONCLUSIONS
In this work, we suggests a novel secure post-quantum cryptographic scheme that achieves high communication rates without sacrificing the computational security level. Surprisingly, this solution based on premixing the information can provide the same security level suggested for post-quantum security, even if only a single link is encrypted. This is particularly appealing when a classical public-key cryptosystem (e.g., McEliece coding scheme) can only be used in part of the data transmitted or stored. In addition to this flexibility, we showed that the information rate converges to 1 as O(1/l), thus greatly improving upon the current post-quantum cryptosystems. This scheme demonstrates the potential for hybrid solutions, which combines information-theory security with public-key cryptography, as a way to improve the performance of the security schemes in terms of the information rate and security trade-off.