Cryptographic security of quantum key distribution

1.1 Background

• Earlier QKD criteria could leave the rest of a key insecure after part of it is revealed to an eavesdropper.The introduction connects this shortcoming to the need for security guarantees that remain valid when a key is used.Source: §1.1 · pp. 5–6

1.2 Contributions

• The paper addresses the missing self-contained justification for the widely used QKD security criterion by revisiting it through Abstract Cryptography.It also discusses the operational meaning of the trace distance used in the criterion.Source: §1.2 · p. 6

1.3 Abstract cryptography

• Abstract Cryptography starts from composition of abstract systems and specializes downward, rather than building security from low-level computational and communication models.The framework permits classical or quantum processes and synchronous or asynchronous networks as instantiations.Source: §1.3 · pp. 6–7

1.4 Structure of this paper

• The paper models generic QKD in the AC framework, derives the trace-distance criterion, and illustrates composition while reviewing operational interpretations of trace distance.The examples illustrate how composed-protocol security follows from individual protocol security and the triangle inequality.Source: §1.4 · p. 7

2 Cryptographic security

• Cryptographic tasks are modeled as resources built from other resources by protocols, so a QKD-generated key can be used by later protocols.QKD typically uses an authentic classical channel and an insecure quantum channel; authentication can itself be built from an insecure channel and a password.Source: §2 · p. 8

2.1 Real-world ideal-world paradigm

• The earlier information-based QKD criterion can leave a key unusable: an attack by K¨onig et al. [KRBM07] can exploit a partial key revealed later.The real–ideal approach instead asks whether a distinguisher, encompassing the surrounding protocols and adversary, can distinguish the real system from an ideal one.Source: §2.1 · pp. 10–11

2.2 Example: one-time pad

• The one-time pad constructs a secure channel with perfect security because its real and ideal systems give the distinguisher identical outputs.Both return the message to Bob and a uniformly random string of the message length to Eve.Source: §2.2 · pp. 11–13

2.3 General security definition

• In the three-player AC definition, security requires both closeness to the ideal resource with Eve blocked (availability) and simulation of Eve’s access when she cheats.If protocols are ε- and ε′-secure, their composition is (ε + ε′)-secure.Source: §2.3 · pp. 15–16

2.4 The distinguishing metric

• The distinguishing advantage has an operational interpretation as the probability of a failure, but the security bound does not measure how grave that failure is.How bad a failure is depends on the protocol’s use, so ε must be chosen with the intended context in mind.Source: §2.4 · p. 17

3.1 Ideal key

• The ideal key resource gives Alice and Bob a shared secret key, while an Eve-controlled switch models an adversary preventing key generation.With no adversary, a filter flips that switch with probability δ when the protocol and noisy channel generate a key with probability 1 − δ.Source: §3.1 · p. 18
• Adaptive key length gives Eve control over the length, so the ideal resource models it by allowing her to input the key length.A protocol constructing the fixed-length resource must either abort or produce a key of fixed length.Source: §3.1 · p. 19

3.2 Real protocol

• QKD uses an authentic classical channel and an Eve-controlled insecure quantum channel; its phases are quantum-state distribution, error estimation, and classical post-processing.Alice and Bob abort above a noise threshold; otherwise they use error correction and privacy amplification to obtain keys.Source: §3.2 · pp. 19–20
• An alternative to the insecure channel is an Eve-controlled entanglement source that sends one half of an entangled state to Alice and the other to Bob.This source can be modeled similarly to the insecure channel, with the first arrow reversed.Source: §3.2 · p. 20

3.3 Security

• Applying the AC definition to the real and ideal QKD systems yields two security conditions, which are decomposed into simpler criteria in Section 4.The conditions’ real- and ideal-system sides are illustrated in Figures 3.2b and 3.1c, and Figures 3.2a and 3.1d, respectively.Source: §3.3 · p. 20

4.4 Robustness

• The availability condition models robustness under non-malicious noise; its failure bound εcor + εsec is useful only when abort probability δ is small for reasonable noise models.With honest behavior filtered onto the adversarial interfaces, the condition captures whether the protocol behaves as specified.Source: §4 · p. 22, §4.4 · pp. 26–27

4.1 Trace distance

• For Eq. (10), distinguishing the real and ideal systems reduces to the trace distance between the states gathered by the distinguisher.The distinguisher’s state reflects its chosen strategy, including its interaction with the quantum channel.Source: §4.1 · p. 23

4.2 Simulator

• The ideal-system simulator reproduces Eve’s communication, checks whether the protocol produced a key or error, and sets the secret-key resource’s switch accordingly.The ideal resource itself, rather than the simulated protocol, determines the key value.Source: §4.2 · p. 24, Figure 4.1 · p. 24

4.3 Correctness & secrecy

• Correctness bounds the probability that Alice and Bob’s keys differ, while secrecy measures how close the non-abort key is to uniform and independent of Eve.The secrecy criterion uses trace distance from a fully mixed key state independent of Eve’s system.Source: §4.3 · p. 25
• εcor-correctness and εsec-secrecy imply that Eq. (10) holds with ε = εcor + εsec.The theorem bounds the real–ideal security error by the sum of the two component errors.Source: §4.3 · p. 25
• Remark 4.2 states that Theorem 4.1’s security-criteria bound has a converse: if Eq. (10) holds for some ε, the corresponding QKD protocol is both ε-correct and 2ε-secret.21Source: §4.3 · p. 26

5.1 Partially known key

• Revealing part of a QKD key can help an E-only adversary guess the remainder, but it does not compromise a protocol satisfying Definition 2.1.A distinguisher that also receives the honest players’ key outputs sees no net information gain; processing the systems by revealing part of the key does not increase their distance.Source: §5.1 · pp. 28, 30

5.2 Sequential composition of key distribution and one-time pad

• An ε-secure QKD protocol composed with a perfect one-time pad constructs a secure channel within ε, by the triangle inequality.The QKD hybrid contributes at most ε distinguishing advantage, while the one-time pad contributes zero.Source: §5.2 · pp. 30, 32

5.3 Parallel composition of key distribution with itself

• Two parallel ε-secure QKD runs remain 2ε-secure, even when the adversary entwines messages across their insecure quantum channels.The bound follows by replacing the real systems with ideal systems one at a time and applying the triangle inequality.Source: §5.3 · pp. 33, 35

Appendix A

• Appendix A relates trace distance to distinguishing advantage and interprets it as a bound on real-system failure probability.It also bounds conditional key entropy and an eavesdropper’s probability of guessing the key in terms of trace distance.Source: Appendices · p. 35

Appendices B–C

• Appendix B discusses an alternative to the secrecy criterion of Eq. (1), while Appendix C covers technical details of Abstract Cryptography, including a sketch of composability.The complete proof of composability is cited as available in.Source: Appendices · p. 35

Appendix D

• Appendix D models universal-hashing authentication and composes it with QKD post-processing to construct a long key from a short key and insecure channels.Source: Appendices · p. 35

• Trace distance between two systems’ output states equals the distinguishing advantage between those states.Source: A Trace distance · p. 35
• Trace distance also bounds real-system failure probability and supports bounds on conditional key entropy and an eavesdropper’s key-guessing probability.Source: A Trace distance · p. 36

A.1 Metric definitions

• For states diagonal in the same basis, trace distance equals total variation distance between their eigenvalue distributions.Source: §A.1 · p. 36
• An optimal measurement makes the total variation distance between its outcome distributions equal to the states’ trace distance.The maximization ranges over measurements, and when one subsystem is classical, an optimal measurement can leave it unchanged.Source: §A.1 · pp. 37–38

A.2 Distinguishing advantage

• A distinguisher’s advantage in guessing which of two equally likely states it received is the trace distance between them.Source: §A.2 · p. 38

A.3 Probability of a failure

• Trace distance is used for QKD security because it corresponds to distinguishing advantage, the renormalized difference in a distinguisher’s chance of identifying the real or ideal world.Source: §A.3 · p. 40
• A maximal coupling makes the trace distance the probability that real and ideal classical outputs differ, with the coupled distributions retaining their original marginals.The probability of equality is at least 1 minus the total variation distance; the text notes this bound is tight, though it is not used.Source: §A.3 · p. 40
• For systems with trace distance at most ε, any measurement admits a coupling whose outcomes differ with probability at most that distance.This is offered as an intuitive way to view ε as a maximum failure probability, not as part of the security framework itself.Source: §A.3 · p. 42

A.4 Measures of uncertainty

• The appendix relates trace-distance security to uncertainty measures and defines Eve’s key-guessing probability as her best success probability over measurements.It also derives a bound on that probability in terms of trace distance.Source: §A.4 · p. 42, §A.4.1 · p. 43

A.4.2 Entropy

• For a key-Eve state within trace distance ε of a uniform key independent of Eve, the section bounds the key’s conditional von Neumann entropy.The bounds are stated for ε ≤ 1/4 and are combined into an upper and lower bound on conditional entropy.Source: §A.4.2 · pp. 43–44
• The section also relates conditional von Neumann entropy to relative entropy to bound the key-Eve state’s distance from the ideal uniform-key product state.Source: §A.4.2 · p. 44

B Alternative secrecy criterion

• Any QKD scheme proven secure under one definition remains secure under the other with a minor adjustment to failure parameter ε; derivation from a composable framework and additivity under parallel composition remain unclear.The concatenation of two keys that each individually satisfy Eq. (29) could possibly have distance from uniform greater than 2ε.Source: B Alternative secrecy criterion · p. 45

C.1 Distinguishing metric

• A distinguisher is a system that connects to a resource’s interfaces and outputs a bit indicating which system it believes it holds.Source: §C.1 · p. 45
• A valid distinguisher set is closed under composition with the relevant converters and resources, with efficient or unrestricted sets corresponding to computational or information-theoretic security.Source: §C.1 · pp. 45–46

C.2 Generic protocol composition

• Because distinguishing advantage is non-increasing under composition, the security criteria support composing two secure protocols, with the adversary-present case established using a simulator.The no-adversary case follows similarly with the simulator removed.Source: §C.2 · p. 46, §C.1 · p. 46

C.2.1 Sequential composition

• Sequentially composing protocols with errors ε and ε′ gives a protocol with error at most ε + ε′.The composed simulator is σ′σ.Source: §C.2.1 · p. 46

C.2.2 Parallel composition

• Parallel composition likewise gives a protocol whose distinguishing error is at most ε + ε′.The composed simulator is σ∥σ′.Source: §C.2.2 · p. 47

D Composition of authentication and QKD

• Recursive authentication and QKD can repeatedly expand a shared key, with total failure bounded by the sum of authentication and QKD failures across runs.The construction uses universal hashing that requires an almost uniform key; the new QKD key supplies key material for later authentication rounds.Source: D Composition of authentication and QKD · pp. 47–48

D.1 Authentication

• Authentication must prevent Eve from making Bob accept a corrupted message; the ideal channel delivers Alice’s message or an error instead.The section describes a channel that can be constructed from an insecure channel and a short shared secret key.Source: §D.1 · pp. 48, 50
• The repeated protocol’s abort histories cannot be reduced to a single conditioned-on-key state because there are n + 1 possible outcomes.These outcomes include no abort and abort after each of the n rounds.Source: §D.1 · p. 48
• Alice authenticates by sending x∥h_k(x); Bob outputs x′ only when the received tag matches h_k(x′), and otherwise outputs an error.The protocol uses a shared secret key; the simulator recreates the real interface using the ideal channel’s read and interrupt controls.Source: §D.1 · pp. 49–50
• ε-almost strongly universal2 hash functions satisfy the stated authentication-security condition.Portmann [Por14] showed that Eq. (32) holds for these hash functions.Source: §D.1 · p. 50

D.2 Parallel composition of authentication

• ℓ parallel repetitions are ℓε-close to ℓ ideal authentic channels with simulators.The section uses ε_auth for the accumulated failure across the parallel authentications in one QKD round.Source: §D.2 · p. 51

D.3 Sequential composition of authentication and key distribution

• The composed protocol constructs a length-m key from a length-ℓ short key and insecure classical and quantum channels, with failure ε_auth + ε_qkd.The authentication protocol constructs an authentic channel with failure ε_auth, and QKD constructs the long key from that channel with failure ε_qkd.Source: §D.3 · p. 51
• The proof replaces the real authentication system with its ideal channel and simulator, then replaces QKD with its ideal key resource; the triangle inequality bounds the total distance.Adding QKD to the authentication substitution cannot increase the distance, and the second substitution is ε_qkd-close.Source: §D.3 · p. 53

D.4 Iterated key expansion

• For recursive key expansion, key resources are modeled as parallel single-bit resources so part of a long key can be retained for the next round.Each single-bit resource can produce a key bit or an error, controlled at Eve’s interface.Source: §D.4 · p. 53
• The iterated protocol is n sequential compositions of the QKD-and-authentication protocol, using n parallel instances of the insecure channels.The section states that Eq. (31) follows immediately from this construction.Source: §D.4 · p. 54