Finite-key analysis for practical implementations of quantum key distribution

• BB84, introduced by Bennett and Brassard in 1984, provides an explicit protocol for distributing a secret key using quantum physics.Source: §1 · p. 1
• QKD combines information-theoretic security without assumptions on an eavesdropper’s computational power with implementations that can use existing technologies.Security proofs still depend on assumptions about authorized devices, while real-device imperfections may create side channels or permit classical attacks.Source: §1 · p. 1
• Most unconditional-security proofs provide bounds only for infinitely long keys, despite finite-key corrections being important in usual QKD operating ranges.Earlier work on finite-key analysis included approaches later shown not to yield composable security.Source: §1 · p. 1
• Using the non-asymptotic formalism of [30], the paper derives unconditional finite-key bounds for prepare-and-measure BB84 without decoy states and entanglement-based BBM92, plus a partial bound for decoy-state BB84.The decoy-state treatment uses a simplified treatment of statistical fluctuations.Source: §1 · p. 2

2.1 Asymmetric BB84 protocol

• Only Z-basis matches form the raw key, while X-basis correlations estimate Eve’s knowledge; the raw-key length is n = NpZ^2.The protocol also discards 2NpZpX signals during sifting.Source: §2.1 · p. 2

2.2 Finite-key bound for the secret fraction

• The finite-key bound modifies Eve’s uncertainty for statistical fluctuations and subtracts finite-key and error-correction costs from the secret fraction.The finite-key version is cast in a simple form using Sξ(X|E), a finite-key correction, and the measured error-correction leakage.Source: §2.2 · pp. 2–3
• The bound’s n/N = pZ^2 factor accounts for the fraction of detected signals that enter the raw key, while finite samples require a fluctuation-adjusted estimate of Eve’s uncertainty.In the asymptotic limit, pZ can approach 1 because a smaller X-basis sample can suffice for parameter estimation.Source: §2.2 · p. 2
• Parameter-estimation deviations produce upper and lower bounds on measured probabilities, with absolute-error estimates that do not assume a distribution for the underlying data.The formalism uses λU,L bounds; rephrasing it in terms of relative errors is listed as an open issue.Source: §2.2 · pp. 2–3
• The most general compatible state is impractical to parametrize, but BB84 symmetry justifies a product-state reduction and yields a lower bound on smooth min-entropy.The resulting entropy bound includes a correction for the possibility that privacy amplification fails.Source: §2.2 · p. 3
• The total security parameter sums tolerated failure probabilities, including parameter-estimation and privacy-amplification failures.The number of estimated parameters determines how many parameter-estimation failure terms enter the total.Source: §2.2 · pp. 3–4

2.3 Putting finite-key bounds into practice

• The processed block length n and error-correction leakage depend on the chosen post-processing code, and extending the run does not increase security if data are split into blocks.Performance is expressed as a secret-key rate, not by the secret fraction alone.Source: §2.2 · p. 3, §2.3 · p. 4
• Experimental design optimizes the key rate using a priori expected detection and error values, but the security bound is evaluated with the measured values.The prescribed workflow selects design parameters before running the experiment, then inserts measured values and re-optimizes the secret fraction for privacy amplification.Source: §2.3 · pp. 4–5

3.1.1 Generalities

• Weak coherent pulses are treated as Poissonian photon-number mixtures when successive pulses have no phase coherence, and Eve’s photon-dependent forwarding and error choices are constrained by observed rates.The analysis uses an uncalibrated-device scenario in which transmission and detector losses are included in Eve’s forwarding probabilities.Source: §3.1.1 · pp. 5–6

3.1.2 Implementations without decoy states

• Without decoy states, the optimal parameters set f0 = 0, fk = 1, and eX(k) = 0 for k ≥ 2, determining the single-photon yield and error estimates.The multiphoton probability follows from the Poissonian source model.Source: §3.1.2 · p. 6

3.1.3 Implementations with decoy states

• Decoy states let Alice and Bob estimate photon-conditioned parameters across intensities, while requiring Eve’s attack parameters to be common to all intensities.A few intensity values provide a good estimate, although exact parametrization in principle requires infinitely many.Source: §3.1.3 · p. 6

3.1.4 An example of decoy states

• The finite-key decoy example uses three intensities, including vacuum, assumes specified ordering relations between the two nonzero intensities, and extracts the key from only one intensity.The vacuum setting is modeled as containing only empty pulses.Source: §3.1.3 · p. 6, §3.1.4 · p. 7

3.2 Finite-key security bounds

• Finite-key entropy bounds replace each estimated parameter with its worst-case value compatible with the statistical deviation ξ(m′, d).The recipe applies to implementations both with and without decoy states.Source: §3.2 · p. 7

3.2.1 Implementations without decoy states: unconditional security bound

• Without decoy states, the observed detection rate R has no statistical fluctuation, while multiphoton fractions and X-basis error estimates do.The latter estimates use N signals and m samples, respectively, so both contribute finite-statistics corrections to the single-photon error estimate.Source: §3.2.1 · pp. 7–8

3.2.2 Implementations with decoy states: approximate bound

• For decoy states, three parameters are estimated, but the full fluctuation treatment for photon yields is out of scope, so the resulting bound is not claimed to be unconditionally secure.The simplified recipe first solves for f0 and f1 without fluctuations, then adds fluctuations to Yk; error-rate estimates receive their corresponding fluctuations.Source: §3.2.2 · p. 8

3.3 A priori expected values for experiment design

• The expected detection rate depends on channel transmittivity t, detector efficiency η, and dark-count rate pd; the modeled channel error is Q = (1 − V)/2 for visibility V.The curves use a fixed unsifted-key length N.Source: §3.3 · p. 9

3.3.1 Implementations without decoy states

• Without decoy states, at least N ≈ 10^7 signals are required to extract a secret key.The optimization is over μ and the finite-key parameters.Source: §3.3.1 · p. 9

3.3.2 Implementations with decoy states: case study

• For decoy-state key extraction, Alice can use all higher-intensity μII pulses in the X basis for parameter estimation, while the key comes only from μI pulses.Bob’s X-basis probability is the same for both intensities.Source: §3.3.2 · p. 9
• Decoy-state rates are much better than without decoys; zero-intensity pulses are optimal only at N = 10^15 because their dark-count-estimation benefit is small.The study fixes μII = 0.65 and finds μI ≈ 0.5, with μI slightly dependent on N; qII decreases with N.Source: §3.3.2 · p. 9
• Fixing the number N of detected signals avoids optimization settings that can otherwise use infinitely many signals or leave an intensity unused infinitely often.The resulting raw-key size is n = NpZ^2.Source: §3.3.2 · p. 9
• The a priori estimates neglect double-click contributions because they are numerically small, although the implementation must account for them as random bits akin to dark counts.Earlier decoy-state estimates agree well overall, but this approach finds no key below 10^6 signals, versus a reported non-negligible rate at 10^4 for another protocol.Source: §3.3.2 · pp. 9–10

4.1 Asymptotic bounds

• The two treatments handle double clicks differently: squashing adds a random bit to the raw key, whereas this approach deletes those events and estimates their fraction δ2c.The deleted-event fraction is obtained from the difference between detection rates R and R′.Source: §4.1 · p. 10
• When X,Z are very small, for example at very high optical visibility, the present approach shows basically no errors.Source: §4.1 · p. 10
• In the small-error regime, the asymptotic rate from the approach in (33) is larger than that from (30), but it requires estimating δ2c as an additional parameter.The finite-key comparison therefore considers the cost of that additional estimate.Source: §4.1 · p. 11

4.2 Finite-key security bounds and a priori expected values

• For the finite-key bounds, the first approach estimates one parameter, while the second estimates two, including the double-click fraction.The expected parameters are evaluated for continuous-wave pumping in the limit y ≪ 1, neglecting dark counts on Alice’s side.Source: §4.2 · p. 11
• For small numbers of signals, the squashing bound outperforms the double-click bound; for larger numbers, their rates are identical within the reported approximations.The optimized y and pX values are also basically identical for both bounds; y is about 0.05 at N = 10^5 and about 0.1 for large N, while pX scales as N^-1/4.Source: §4.2 · p. 11

5 Conclusion

• At N ≳10^15 the bounds recover asymptotic values; weak-coherent-pulse prepare-and-measure needs N ∼10^7 signals for a key, versus N ∼10^5 for entangled-state implementations.These estimates use a priori expected observed parameters.Source: §5 · p. 11
• The decoy-state prepare-and-measure bound uses a partial treatment of statistical fluctuations and is provided for one key intensity and two decoy intensities, one of them zero.Source: §5 · pp. 11–12
• The weak-coherent-pulse analyses assume no phase coherence between successive pulses, while the entanglement-based analysis assumes continuous pumping.Source: §5 · p. 12
• The bounds assume equally frequent 0 and 1 bits in both raw keys; detector-efficiency differences can cause systematic imbalance, for which the paper prescribes accounting for excess bits in Eve’s information.Source: §5 · p. 12
• The prepare-and-measure bounds do not apply to Plug-and-Play configurations because Alice’s source cannot be assumed to emit exact weak coherent pulses when attenuating an unknown incoming signal.The paper expects the difference to be small and notes that a finite-key extension may follow the procedure used here.Source: §5 · p. 12
• The reported expected-value calculations optimize pX, but passive detection may make that optimization difficult because it can require changing the basis-choice beam splitter.Source: §5 · p. 12
• The bounds guarantee unconditional security, but their tightness in the finite-key regime is unknown; using absolute errors for statistical fluctuations may allow improvement with relative errors.Source: §5 · p. 12
• The evaluated key extraction uses one-way post-processing without pre-processing; two-way post-processing and pre-processing are not included in these bounds.For typical error rates, the paper says improvements from those methods are expected to be significant only near the critical distance.Source: §5 · p. 12