# Why is does the protocol of Ding et al. produce biased bits and does it relate to passive security?

I am not understanding the following from "Lattice Cryptography for the Internet" by C. Peikert (pages 9):

We remark that a work of Ding et al. DXL14 proposes a different reconciliation method for lower bandwidth "approximate agreement," in the context of a key exchange against a passive adversary. However, we observe that the agreed-upon bit produced by their protocol is necessarily biased, not uniform, so it should not be used directly as a secret key (and the protocol as described does not satisfy the standard definition of passive security for key exchange).

I don't understand the biased part and how it is related to passive security for key exchange. Maybe I just don't understand the definition of passive security for key exchange. I don't know. Any help would be appreciated.

Now, you may wonder: is it because it uses Polynomial instead of Vector of polynomials, because of limited domain of $\mathit{Sig}$ function (i.e. $E= {-\lfloor {\frac {q}{4}}\rfloor ,...,\lfloor {\frac {q}{4}}\rceil \}}$), or if there’s some other reason?
Well, it's simply because any deterministic map from $\mathbb{Z}_q$ to 0,1 must be biased when $q$ is odd.