PaperlayerView exact revision on arXiv

Source-linked AI summary

Reliable numerical key rates for quantum key distribution

Adam Winick, Norbert Lütkenhaus, Patrick J. Coles

arXiv:1710.05511v2quant-ph

TL;DR

QKD performance analysis must address practical protocol imperfections, while optimization can become costly for high-dimensional or many-signal protocols. The paper develops a numerical method for reliable lower bounds and reports higher key rates than prior literature in three scenarios.

  • Problem

    QKD performance analysis must address practical protocol imperfections, and optimization can be costly for high-dimensional or many-signal protocols.

    Source: §1 · p. 1

  • Method

    The reliable primal method converts a nearly optimal eavesdropping attack into a reliable lower bound on the key rate for finite-dimensional QKD protocols.

    Source: §1 · p. 1, §6 · p. 11

  • Results

    The method improves prior key rates in three scenarios, and its plotted curves are described as essentially unbeatable.

    Source: §1 · p. 2, §6 · p. 12

  • Takeaways & Limitations

    Eliminating looseness from key-rate calculations is a major advance for QKD research.

    Source: §6 · p. 12

    Implementation-dependent function-evaluation errors are not treated universally, and bounding them for a particular implementation is beyond the article's scope.

    Source: §3.3 · p. 5

Abstract

from arXiv · show

In this work, we present a reliable, efficient, and tight numerical method for calculating key rates for finite-dimensional quantum key distribution (QKD) protocols. We illustrate our approach by finding higher key rates than those previously reported in the literature for several interesting scenarios (e.g., the Trojan-horse attack and the phase-coherent BB84 protocol). Our method will ultimately improve our ability to automate key rate calculations and, hence, to develop a user-friendly software package that could be used widely by QKD researchers.

1 Introduction

The introduction motivates reliable, efficient numerical key-rate calculations for evaluating practical QKD protocols amid device imperfections and costly optimizations. It presents a two-step approach for producing reliable lower bounds and reports improvements over previous literature in three scenarios.

1 Introduction

  • Numerical methods are presented as more robust to device imperfections and protocol changes, and as amenable to user-friendly software.The envisioned workflow lets users specify a protocol while a computer performs the key-rate calculation.Source: §1 · p. 1
  • Numerical key-rate calculations must be efficient for high-dimensional or many-signal protocols and reliable despite finite precision and optimization tolerances.Optimization can take days, while QKD key rates must come with a security guarantee.Source: §1 · p. 1
  • The method improves previously reported key rates in all three scenarios, including BB84 with detector efficiency mismatch [18].The other examples are the Trojan-horse attack and BB84 with phase-coherent signal states.Source: §1 · pp. 1–2
  • The earlier dual approach could introduce looseness through an inequality and become non-convex, reducing efficiency for protocols with many signal states.For prepare-and-measure protocols, its optimization parameters scale quadratically with the number of signal states.Source: §1 · p. 2
  • The approach first approximately minimizes a convex function to find a near-optimal attack, then converts that attack into a reliable key-rate lower bound.Any algorithm can perform the initial minimization.Source: §1 · p. 2
  • The main technical result converts a near-optimal eavesdropping attack into a tight lower bound by linearizing the convex objective and dualizing the linearized problem.Linearization about the global minimum gives the tightest lower bound by this method.Source: §1 · p. 2

2 Background

The background formulates the asymptotic key rate as an optimization over states consistent with experimental data. Convexity makes the optimization tractable, while numerical reliability still requires a guaranteed lower bound.

2 Background

  • The asymptotic expression combines privacy amplification and error correction, and assumes an i.i.d. state structure corresponding to collective attacks.Security also holds against coherent attacks when random permutation enables the Quantum de Finetti theorem to apply.Source: §2 · pp. 2–3
  • The feasible state set S is defined by linear constraints from asymptotic experimental data, with positivity and trace-one conditions.The constraints use Hermitian operators Γ_i, and the identity enforces Tr(ρ) = 1.Source: §2 · p. 3
  • The key-rate optimization minimizes over states consistent with observed data to account for the worst-case eavesdropping attack.The observed error-correction term and post-selection probability are fixed by the data and are pulled outside the minimization.Source: §2 · p. 3
  • The objective is convex because relative entropy is jointly convex and the maps G and Z are linear; the optimization is convex when S is convex.G and Z are associated with post-selection and the protocol's key map.Source: §2 · p. 3

3 Main result

The section develops a two-step procedure: approximate convex minimization supplies an eavesdropping attack, then a dualized linearization converts it into a reliable lower bound. It extends the bound to boundary cases and numerical imprecision, and shows how it can approach the optimum.

3.1 Reliable lower bound

  • Any feasible attack supplies an upper bound, while maximizing the dual of a linearization yields a reliable lower bound even without global convergence.The bound is tight at the optimal attack, and continuity means a near-optimal attack yields a near-optimal lower bound.Source: §3.1 · pp. 3–4, Figure 1 · p. 4

3.2 A more robust bound

  • Theorem 2 extends the bound to any feasible ρ, including cases where ∇f(ρ) does not exist, by applying the method to a perturbed function.The perturbation maps boundary states to interior points; singular G(ρ) can make the gradient undefined.Source: §3.2 · pp. 4–5

3.3 Finite precision computation

  • Theorem 3 tolerates constraint violations from numerical imprecision, but fully treats only implementation-independent errors; bounding function-evaluation errors is implementation-specific and beyond scope.The authors use Theorem 3 in their key-rate calculations.Source: §3.3 · pp. 5–6

3.4 Convergence and tightness

  • With suitable implementation, the bound can be arbitrarily tight: small ε, ε′ and an attack ρ close to optimal make the Theorem 3 bound approach f(ρ∗).The bound is tight when applied to the optimal attack.Source: §3.4 · p. 6

3.5 Finding a near-optimal attack

  • Step 1 adapts Frank-Wolfe to a subspace representation, reducing each search to a semidefinite program that is easier to solve than the original minimization.The subspace representation reduces equality constraints to a single semidefinite constraint.Source: §3.5 · p. 6

4 General framework for protocols

The framework maps discrete-variable prepare-and-measure and entanglement-based protocols into a prototypical protocol, then models its stages and key rate through constrained optimization.

4.0.1 Prototypical protocol

  • The prototypical protocol covers discrete-variable prepare-and-measure and entanglement-based schemes through common measurement, announcement, post-selection, key-mapping, and error-correction stages.The source-replacement scheme gives prepare-and-measure protocols the same mathematical description as entanglement-based ones.Source: §4.0.1 · p. 7, Figure 2 · p. 7

4.0.2 Mathematical model for prototypical protocol

  • Public announcements are modeled as quantum channels that add classical announcement registers, while post-selection projects onto kept announcements and the key map stores Alice’s key symbol in a register.The model also imposes experimental constraints on the shared state; prepare-and-measure protocols add constraints fixing Alice’s state using tomographically complete observables.Source: §4.0.2 · p. 8

4.0.3 Key rate

  • The key rate is obtained by minimizing the explicit rate expression over all bipartite states satisfying the experimental constraints.The framework formulates the protocol-dependent map and constraints, then applies the numerical method to those objects.Source: §4.0.3 · p. 9

5 Examples

Across three BB84 imperfections, the numerical approach reports higher key rates than prior literature. The examples cover detector-efficiency mismatch, Trojan-horse attacks, and phase-coherent signals.

5 Examples

  • Across three BB84 imperfections, the approach yields significantly higher key rates than previously reported in the literature.The examples assume Shannon-limit error correction; for these low-dimensional cases, upper and lower bounds differ by about 10^-6 times the key rate, though the gap could grow with signal-state count.Source: §5 · p. 9

5.1 Efficiency mismatch

  • For all three detector-mismatch cases, the method outperforms the earlier dual-problem numerics, which outperform the analytical method of Ref. [18].The comparison assumes single-photon signals, no multiple photons at Bob’s apparatus, and one perfect detector while the other’s efficiency varies.Source: §5.1 · p. 10, Figure 3 · p. 10

5.2 Trojan-horse attack

  • For single-photon BB84 under a Trojan-horse attack, the method gives higher key rates than both the analytical method of Ref. [15] and the numerical method of Ref. [19].The comparison plots key rate against error rate for different µout values, assuming identical z and x error rates.Source: Figure 4 · p. 10, §5.2 · p. 11

5.3 BB84 protocol with phase-coherent signal states

  • For Huttner et al.’s [16] phase-coherent BB84, numerics exceed Lo and Preskill’s [17] bound and Ref. [19] throughout the plotted parameter range.The plotted variables are signal-state amplitude α and transmission probability η.Source: §5.3 · p. 11, Figure 5 · p. 11

6 Conclusions

The reliable primal method provides arbitrarily tight key-rate lower bounds, including bounds robust to numerical imprecision, and improves reported rates for three examples. The authors identify broader applications and software development as future directions.

6 Conclusions

  • The method’s main contribution is Step 2, which converts the nearly optimal eavesdropping attack from Step 1 into a reliable key-rate lower bound; Theorem 3 permits this despite numerical imprecision.Source: §6 · p. 11
  • The method is arbitrarily tight, improves key rates reported for three examples, and makes the plotted curves essentially unbeatable.The main robust result also lower-bounds the key rate despite numerical imprecision.Source: §6 · pp. 11–12
  • Future applications include device imperfections, side channels, multi-photon events, and several protocol families, as well as evaluating novel protocol ideas.The listed protocols include decoy-state protocols with partial phase randomization, measurement-device independent protocols, differential-phase shift protocols, and coherent one-way protocols.Source: §6 · p. 12
  • The authors plan to incorporate the reliable primal method into their publicly available key-rate software, which they believe could serve researchers in industry and academia.They report that it improves on the software’s dual-problem approach in speed and tightness.Source: §6 · p. 12
  • The authors identify extending the approach to finite-key analysis as a future direction.Source: §6 · p. 12

A Proof of Theorem 1

The proof establishes a lower bound using convexity and semidefinite programming, then shows when that bound is attained. It uses strong duality and optimality conditions to establish the equality result.

A.2 Inequality in (8)

  • The quantity g(ρ, σ) measures how much the linearization of f about ρ changes when moving to σ.Source: §A.2 · p. 15
  • Under differentiability and convexity, the linearization lies below the objective, reducing the lower-bound argument to a linear semidefinite program and its dual.The proof uses the dual problem to obtain the lower bound in (8).Source: §A.2 · p. 15

A.3 Equality in (8)

  • If f(ρ) equals the optimum value α, the proof establishes equality in (8), using Slater’s condition for strong duality and KKT conditions for optimality.Source: §A.3 · pp. 15–16

B Proof of Lemma 1

The proof makes the gradient expression well-defined by showing that both matrices inside its logarithms are full rank. It achieves this by regularizing the output of G and applying the pinching channel.

B Proof of Lemma 1

C Proof of Theorem 2

The proof establishes continuity of the objective in the state and in the regularization parameter. It combines entropy continuity with trace-distance bounds and a smoothing argument.

C.1 Continuity in ρ

  • Completely positive trace-nonincreasing maps and the pinching channel preserve the trace-distance bounds needed to prove continuity of f(ρ).Source: §C.1 · pp. 17–18
  • Fannes’ inequality supplies an entropy-continuity bound that vanishes as the trace-distance parameter κ approaches zero.Source: §C.1 · pp. 17–18

C.2 Continuity in ϵ

  • For 0<ϵ≤1/[e(d′−1)], the proof bounds the change in f under regularization using an entropy-continuity estimate.It first bounds the difference between G(ρ) and Gϵ(ρ), then applies entropy continuity.Source: §C.2 · pp. 18–19
  • The gap between f(ρ) and its regularized form fϵ(ρ) equals the absolute value of H(Z(G(ρ))) − H(G(ρ)) + H(Gϵ(ρ)) − H(Z(Gϵ(ρ))).Source: §C.2 · p. 19

C.3 Proof of Theorem 2

Theorem 2 uses a perturbed optimization to extend lower bounds beyond states where the original gradient may not exist. The treatment of representation imprecision enlarges the approximate constraint set to cover the exact and approximate representations.

C.3 Proof of Theorem 2

  • Theorem 2 applies the lower-bounding result to a perturbed function, then relates its bound to the original quantity α through continuity and Lemma 9.The substitution G → Gϵ gives the corresponding bound for α(ϵ); the proof then relates α(ϵ) to α.Source: §C.3 · pp. 19–20
  • The perturbation addresses cases where ∇f(ρ) may not exist: ∇fϵ(ρ) exists for all ρ ∈ S.This distinction is why the perturbed bound applies across S even when the earlier gradient-based result does not.Source: §C.3 · p. 20

D.1 Imprecise representations

  • Approximate representations of the constraints can violate them numerically, so Lemma 10 is used to upper-bound the resulting constraint violation.The approximate operators and expectation values are related to their exact counterparts through representation errors; increasing precision can make those errors arbitrarily small.Source: §D.1 · pp. 20–21
  • Expanding the approximate feasible set by the representation error makes it encompass both the exact set S and the approximate set ˜S.The expanded set tends to ˜S as ϵ′ tends to zero; further expansion may be needed for solver imprecision.Source: §D.1 · pp. 20–21

D.2 Imprecise solvers

The solver may return a matrix that is not positive semidefinite or does not satisfy the approximate constraints. The method expands the optimization set to include the solver output and the exact feasible set, preserving a reliable lower bound.

D.2 Imprecise solvers

  • The solver’s ˜ρ may fail positive semidefiniteness or the approximate constraints, so the method adds identity to make the matrix positive semidefinite and expands the set to contain it.The expansion accounts for how closely ˜ρ′ satisfies the approximate constraints through ϵsol.Source: §D.2 · pp. 21–22
  • The expansion parameter ϵ′ combines representation and solver precision to specify a set large enough to contain both the exact solution and the imprecise solver output.Figure 6 illustrates the set expansion used before applying the lower-bounding technique.Source: §D.2 · p. 22, Figure 6 · p. 22
  • Minimizing over ˜Sϵ′ yields a reliable lower bound on α because the expanded set contains the exact feasible set S.The construction is designed to contain both the exact solution and the imprecise solver output.Source: §D.2 · p. 22

D.3 Proof of Theorem 3

Theorem 3 lower-bounds the objective over a relaxed set that allows small constraint violations, using perturbation and continuity. Its proof recasts the optimization as a semidefinite program and uses duality to obtain the bound.

D.3 Proof of Theorem 3

  • Theorem 3 considers a perturbed optimization over ˜Sϵ′, a relaxed set that contains S, so its lower bound on the relaxed problem also lower-bounds α.The proof further perturbs the objective to ensure a well-defined gradient and uses continuity to relate the perturbed problem to the target.Source: §D.3 · pp. 22–23
  • Duality rewrites the minimization as a maximization, and continuity is then used to obtain the stated lower bound on α.The proof simplifies the dual problem before combining the resulting relations to obtain the bound.Source: §D.3 · pp. 23–25
  • The proof replaces inequality constraints with equalities and nonnegativity constraints using slack variables, then recasts the problem with one positive semidefinite variable.The resulting semidefinite program has the same form as the one used in the proof of Theorem 1.Source: §D.3 · pp. 23–24

E Tightness

Theorem 3’s lower bound is arbitrarily tight for suitably small perturbations when applied to a near-optimal state. The appendix illustrates the framework with models for detector-efficiency mismatch, a Trojan-horse attack, and phase-coherent BB84.

E Tightness

  • For sufficiently small ϵ and ϵ′, Theorem 3’s bound on a near-optimal state is arbitrarily tight.The tightness argument takes the limit of the bound and relates it to the bound from Theorem 2.Source: E Tightness · pp. 25–26

F.1 Efficiency Mismatch

  • The efficiency-mismatch model represents Bob’s system as a qutrit, with a vacuum dimension for no-click events caused by detector inefficiency.One detector is assumed perfect while the other has efficiency η.Source: §F.1 · p. 26

F.2 Trojan-horse attack

  • The Trojan-horse BB84 example uses source replacement and models Eve’s attack as a depolarizing channel with probability p = 2Q.The signal states are biased toward the z-basis for high-efficiency sifting.Source: §F.2 · p. 27

F.3 BB84 protocol with phase-coherent signal states

  • The phase-coherent BB84 model uses source replacement and a lossy channel with transmission probability η.A squashing model represents Bob’s system as a qutrit, including a vacuum dimension for channel-loss no-click events.Source: §F.3 · p. 28

Related papers

Loading 1710.05511v2…