PaperlayerView exact revision on arXiv

Source-linked AI summary

Advances in Quantum Cryptography

S. Pirandola, U. L. Andersen, L. Banchi, M. Berta, D. Bunandar, R. Colbeck, D. Englund, T. Gehring, C. Lupo, C. Ottaviani, J. Pereira, M. Razavi, J. S. Shaari, M. Tomamichel, V. C. Usenko, G. Vallone, P. Villoresi, P. Wallden

arXiv:1906.01645v1quant-phmath-phphysics.app-phphysics.comp-phphysics.optics

TL;DR

Quantum cryptography faces the need for secure communication amid advancing quantum threats and rapidly evolving protocols. This review synthesizes theoretical and experimental advances across QKD, device independence, continuous variables, quantum networks, and post-QKD primitives, concluding that the field is progressing toward practical implementations.

Abstract

from arXiv · show

Quantum cryptography is arguably the fastest growing area in quantum information science. Novel theoretical protocols are designed on a regular basis, security proofs are constantly improving, and experiments are gradually moving from proof-of-principle lab demonstrations to in-field implementations and technological prototypes. In this review, we provide both a general introduction and a state of the art description of the recent advances in the field, both theoretically and experimentally. We start by reviewing protocols of quantum key distribution based on discrete variable systems. Next we consider aspects of device independence, satellite challenges, and high rate protocols based on continuous variable systems. We will then discuss the ultimate limits of point-to-point private communications and how quantum repeaters and networks may overcome these restrictions. Finally, we will discuss some aspects of quantum cryptography beyond standard quantum key distribution, including quantum data locking and quantum digital signatures.

I. INTRODUCTION … B. Prepare and measure protocols

This section introduces quantum key distribution as a response to threats against classical cryptography and presents its discrete-variable foundations through the prepare-and-measure framework. It covers foundational protocols, idealized and practical schemes, security analyses, and composability.

I. INTRODUCTION

  • Quantum computing and possible classical factorization advances threaten RSA and other public-key cryptosystems, including through store-now-decrypt-later attacks when x + y > z [22–26].Post-quantum cryptography is described as partial and temporary, whereas QKD uses physical principles such as uncertainty and entanglement monogamy.Source: §I · p. 3
  • QKD trades security against rate and rate against distance: device-independent protocols are demanding and low-rate, while trusted-device protocols are faster but expose side-channel risks [31].Point-to-point links have secret-key capacity −log2(1 −η), scaling as 1.44η at long distance; repeaters and networks can improve long-distance rates [33] [39] [46].Source: §I · pp. 3–4

A. Generic aspects of a QKD protocol

  • A prepare-and-measure protocol sends non-orthogonal states encoding Alice’s random variable α through an Eve-controlled channel, after which Bob measures β and the parties share correlated raw data.No-cloning prevents Eve from copying signals perfectly, forcing information gain to disturb the quantum states.Source: A. Generic aspects of a QKD protocol · p. 4
  • Parameter estimation determines error correction and privacy amplification, while reconciliation may be direct, reverse, or two-way and sifting discards outcomes with incompatible measurement bases.Entanglement-based formulations replace state preparation with measurement on an entangled state and are useful for security and key-rate analysis.Source: A. Generic aspects of a QKD protocol · pp. 4–5

B. Asymptotic security and eavesdropping strategies

  • Asymptotic security distinguishes individual, collective, and general-coherent attacks: mutual information describes individual attacks, Holevo information bounds collective attacks, and de Finetti symmetrization reduces coherent attacks to collective ones [49, 50, 52–54].The analysis assumes n ≫1 signals and allows Eve delayed collective measurements using quantum memory.Source: B. Asymptotic security and… · p. 5

C. Finite-size effects

  • Finite-size analyses modify key rates for reconciliation inefficiency and a penalty ∆(n, ǫ), with composable security proofs available for discrete- and continuous-variable QKD.The penalty depends on the finite signal count and a composite ǫ accounting for abort, error correction, and parameter-estimation probabilities.Source: C. Finite-size effects · p. 5

D. Composable security of QKD

  • Composable security compares a real protocol with an ideal one that produces identical, secret keys, using trace distance to bound distinguishability and separating correctness and secrecy errors [63–76].This framework supports secure composition with larger protocols such as one-time-pad communication and accounts for arbitrary adversarial combinations.Source: D. Composable security of QKD · pp. 5–6

III. OVERVIEW OF DV-QKD

  • Discrete-variable QKD uses qubits represented on the Bloch sphere; BB84 employs four states from mutually unbiased X and Z bases, while photon polarization and relative phase provide experimental encodings.Polarization maps to horizontal, vertical, diagonal, anti-diagonal, and circular states, and interferometer phase shifters encode and decode information.Source: §III · p. 7, A. Preliminary notions · pp. 7–8

A. Preliminary notions

  • Entanglement-based E91 is conceptually related to BB84 and BBM92, but can provide device-independent security unavailable to separable-state BB84.The BB84–BBM92 equivalence underpinned unconditional-security proofs, while B92 showed that QKD can use two non-orthogonal states.Source: A. Preliminary notions · p. 8

B. Prepare and measure protocols

  • In prepare-and-measure DV-QKD, Alice encodes a discrete random variable into optical signals and Bob measures them to recover the information, typically illustrated with ideal single photons.The single-photon presentation emphasizes protocols’ in-principle operation, although practical true single-photon sources are not yet widely available.Source: B. Prepare and measure protocols · p. 8

1. BB84 protocol … 1. PNS attacks

This section reviews foundational quantum key-distribution protocols and the security role of basis choices, non-orthogonal states, and error rates. It also examines photon-number-splitting attacks in practical implementations and approaches to mitigating their impact while accounting for realistic implementation factors.

1. BB84 protocol

  • BB84 uses complementary-basis states whose mismatched-basis events are discarded, while eavesdropping creates detectable disturbance; secure key extraction remains possible up to approximately 11% QBER, even against coherent attacks.Error correction and privacy amplification use the measured QBER, and the unconditional-security proof reduces QKD to entanglement distillation with CSS codes.Source: §1 · pp. 9–10

2. Six-state protocol

  • The six-state protocol extends BB84 to three bases, raising the simple intercept-resend error rate to 1/3 and increasing the unconditional security threshold to about 12.6%.Its symmetric attacks are equivalent to universal quantum cloning machines, whereas BB84 corresponds to phase-covariant cloning.Source: §2 · pp. 10–11

3. B92 protocol

  • B92 distributes a key with two non-orthogonal states and uses unambiguous state discrimination, discarding inconclusive outcomes; its security is proven for lossless, lossy, and strong-reference-pulse implementations [85, 93, 94, 95].The standard protocol tolerates about 3.34% depolarizing noise, while adding uninformative states enables loss tolerance and device-independent security, with 3.36% tolerance.Source: §3 · p. 12

1. PNS attacks

  • Photon-number-splitting attacks exploit multiphoton emissions from practical sources: Eve removes one photon nondestructively, waits for basis revelation, and obtains perfect information without alerting Bob.For weak coherent pulses, multiphoton contributions must be subtracted from the raw-key gain, and the estimated error rate is rescaled for privacy amplification.Source: §1 · pp. 12–13
  • PNS attacks drastically decrease the secure key generation rate, motivating decoy-state methods and the SARG04 protocol as possible solutions.Source: §1 · p. 13
  • The BB84 rate includes privacy amplification and error-correction contributions, with an additional factor of one-half when Alice’s and Bob’s measurement bases coincide.For individual attacks, r_PA = log2(1 + 4e′ − 4e′2) for e′ ≤ 0.5, and 1 otherwise; the treatment is referenced in.Source: §1 · p. 13
  • Realistic BB84 estimates must account for dark counts, where Bob’s detector clicks for vacuum pulses.Source: §1 · p. 13

2. Decoy States … B. The link between Bell violation and unpredictability

This section examines practical and theoretical advances in quantum key distribution, including decoy states, alternative protocols, two-way communication, and device-independent security. It focuses on attack detection, Bell-inequality violations, eavesdropper information, and the quantification and extraction of randomness under quantum-realizable strategies.

2. Decoy States

  • Decoy states estimate single-photon yields and errors using multiple intensities, boosting key rates and enabling QKD beyond 100 km despite imperfect sources.Finite decoy sets can suffice: two decoy states asymptotically approach the ideal infinite-decoy estimates for Y1 and e1.Source: §2 · p. 13

3. SARG04 protocol

  • SARG04 modifies BB84’s classical announcement by revealing non-orthogonal state pairs, preventing photon-number-splitting attacks from giving Eve perfect bit information.Its security thresholds are 9.68% and 2.71% QBER for single- and double-photon pulses, respectively.Source: §3 · p. 14

1. E91 protocol

  • E91 uses entangled pairs and a CHSH test: maximal violation certifies decoupling from Eve, after which same-basis anti-correlated outcomes yield a private key.The ideal channel has E = −2√2 when p = 1.Source: §1 · p. 14

2. BBM92 protocol

  • BBM92 removes E91’s Bell-test requirement while retaining an entanglement-based security representation equivalent to BB84 for standard channel eavesdropping.A Bell test nevertheless enables device-independent security by relaxing assumptions about uncontrolled degrees of freedom.Source: §2 · pp. 14–15

E. Two-way quantum communication

  • Two-way quantum communication encodes information through unitary operations on traveling qubits, but noisy channels led direct-communication schemes to give way to QKD versions with security proofs.Security analyses exploit attacks on both forward and backward paths, while control-mode data estimates noise and privacy amplification.Source: E. Two-way quantum communication · p. 15, §2 · p. 16

1. Ping pong protocol

  • The ping-pong protocol detects Eve with control-mode measurements and privately delivers messages through encoding-mode rounds, but direct communication is fragile under noise and denial-of-service attacks.Eve’s undetected probability decreases exponentially with the number of tested bits; extending the encoding to all Pauli operators can double capacity.Source: §1 · pp. 15–16, Figure 2 · p. 15

2. Two-way QKD protocols

  • Two-way QKD protocols such as LM05 use forward-and-return transmission with a double-check control mode, detecting a specified intercept-resend attack with probability 37.5%.The control mode estimates channel noise for privacy amplification, while disclosed encoding-mode data estimates error correction.Source: §2 · p. 16

3. Intercept-resend strategy

  • For LM05 intercept-resend attacks, the direct-reconciliation threshold is 11.9%, whereas reverse reconciliation raises it to 25% because Eve’s information about Alice’s and Bob’s strings is asymmetric.More general attacks give an approximately 10% direct-reconciliation threshold while retaining 25% under reverse reconciliation; tight security proofs remain open.Source: §3 · p. 16, §4 · p. 16, §5 · p. 17

B. The link between Bell violation and unpredictability

  • Bell violation implies that Eve must sometimes send correlations whose outcomes remain unknown to her after the inputs are revealed.If the observed distribution is not a convex combination of local deterministic distributions, Eve cannot always know either Alice’s or Bob’s outcome.Source: B. The link between Bell violation and… · p. 18
  • The CHSH inequality bounds local correlations, while quantum correlations can violate it up to Tsirelson’s bound [151].The maximally entangled state with the specified measurement bases produces the parameterized distribution Pε and reaches the maximal CHSH violation described in the passage.Source: B. The link between Bell violation and… · p. 18
  • For 0 ≤ ε ≤ 1/8, maximizing the local component yields an eavesdropping strategy whose Alice-outcome guessing probability is 1/2 + 4ε.The decomposition contains local terms plus a PR-box component, which is maximally nonlocal but not realizable in quantum theory.Source: B. The link between Bell violation and… · pp. 18–19
  • Quantum-limited eavesdroppers have less power and therefore induce more outcome randomness than unrestricted decompositions.For binary inputs and outputs, qubits suffice for quantum realizability, while larger cases can be tested with increasingly tight semidefinite-program relaxations.Source: B. The link between Bell violation and… · p. 19
  • Establishing that Bell violation creates some randomness is insufficient by itself; the analysis must also determine how much key can be extracted from the raw data.The passage presents the unpredictability argument as intuition motivating a subsequent key-rate analysis.Source: B. The link between Bell violation and… · p. 19

C. Quantitative bounds … 2. The spot-checking CHSH QKD protocol

Device-independent QKD connects observed CHSH violations to extractable randomness using entropy accumulation, then applies this connection in a spot-checking protocol that tests devices before extracting a key. Security is composable under explicit laboratory, randomness, communication, and device-use assumptions, while tight bounds beyond CHSH remain limited.

C. Quantitative bounds

  • For a cq-state, the relevant security quantity is Alice’s smooth min-entropy conditioned on Eve, which quantifies the randomness available for key extraction.The protocol seeks to make the probability of simultaneously observing a high CHSH value and failing key extraction very small.Source: C. Quantitative bounds · p. 19
  • The entropy accumulation theorem converts a round-by-round conditional von Neumann entropy bound into total min-entropy, up to corrections of order √n, against general sequential adversaries.This yields roughly n times the one-round entropy evaluated at the average CHSH value.Source: C. Quantitative bounds · p. 19
  • For general non-local games, semidefinite-program hierarchies can bound min-entropy, but the resulting bounds are loose and improving them remains open.The tight CHSH entropy bound relies on technical features specific to the CHSH scenario.Source: C. Quantitative bounds · p. 19

1. The setup for DI-QKD

  • Device-independent security is composable, but it assumes secure laboratories, reliable classical processing, private randomness, authenticated classical communication, and an insecure quantum channel.The output’s prolonged security also relies on not reusing the devices in subsequent protocols, although modified protocols have been proposed.Source: §1 · p. 20

2. The spot-checking CHSH QKD protocol

  • The spot-checking CHSH protocol randomly designates rounds as tests or key-generation rounds, aborts when the tested average CHSH value falls below β −δ, and otherwise performs error correction and privacy amplification.The EAT determines the extractable key after accounting for information revealed during error correction.Source: §2 · p. 20
  • In the ideal implementation, a maximally entangled state and mostly correlated key-basis measurements provide key rounds, while occasional CHSH tests constrain device behavior.The expected CHSH value is β, and δ accommodates statistical fluctuations.Source: §2 · p. 20
  • For an ideal i.i.d. implementation, the completeness error is exponentially small in the number of rounds because aborts arise only from statistical fluctuations below β −δ.The choice of test round must occur after state sharing, requiring short-lived quantum memory or a modified key-expansion protocol using pre-shared randomness.Source: §2 · pp. 20–21
  • The protocol additionally requires that the preparation device cannot access Alice’s measurement device and that Alice’s device cannot learn whether a round is tested, so dishonest behavior can be detected.Bob’s device may identify key-generation rounds, but sufficiently poor key-round behavior causes abort during error correction.Source: §2 · p. 21

E. Historical remarks … V. EXPERIMENTAL DV-QKD PROTOCOLS

The section traces quantum cryptography from Ekert’s Bell-based protocol through device-independent, measurement-device-independent, twin-field, and practical discrete-variable implementations. It emphasizes security advances, experimental loopholes and constraints, untrusted relays, PLOB-bound violations, and detector requirements.

E. Historical remarks

  • Device-independent QKD evolved from Ekert’s Bell-inequality protocol through selfchecking [31] and the first full security proof by Barrett, Hardy, and Kent.Later work improved rates and attack models, while the entropy accumulation theorem enabled reasonable rate and noise tolerance [156] [157] [171].Source: E. Historical remarks · p. 21

F. Putting DI-QKD protocols into practice

  • DI-QKD requires closing the detection loophole because post-selection can fake nonlocality; CHSH-based protocols need detector efficiency above Eberhard’s bound of 2/3.Locality closure is not required for QKD when Alice’s and Bob’s laboratories are secure, although simultaneous closure of both loopholes was only recently achieved.Source: F. Putting DI-QKD protocols into… · pp. 21–22

G. Measurement device independence (MDI)

  • MDI-QKD removes trust assumptions from measurement devices by sending Alice’s and Bob’s prepared states to an untrusted relay controlled by Eve.Bell detection induces correlations without revealing the encoded bit values, while noise and imperfect measurements enter through the virtual channel’s QBER.Source: G. Measurement device independence (MDI) · pp. 22–23
  • Practical decoy-state DV MDI-QKD replaces single photons with phase-randomized attenuated coherent states, using linear optics and intensity randomization to resist photon-number-splitting attacks.Only two Bell-measurement outcomes are available with linear optics, reducing the secret-key rate; finite-size security has also been assessed.Source: G. Measurement device independence (MDI) · p. 23
  • The general MDI framework has each honest user prepare a bipartite state and send one subsystem to a relay applying a generic quantum instrument, with secret-key rates using mutual information averaged over outcomes and extending to CV systems [182].Source: G. Measurement device independence (MDI) · pp. 23–24

H. Twin-field QKD

  • TF-QKD sends phase-randomized optical fields to an untrusted relay for single-photon interference, accepting matching phase slices and extracting keys from equal-basis events.Finite phase slicing creates intrinsic QBER; the reported optimum is M = 16 with QBER ≈1.28%.Source: H. Twin-field QKD · p. 24
  • TF-QKD violates the point-to-point PLOB bound and approaches the single-repeater bound, while its proof-of-concept experiment overcame PLOB experimentally for the first time [183, 202].The protocol’s rate scales as O(√η), and the experiment was previously thought to exceed present technological capability.Source: H. Twin-field QKD · pp. 24–25, Figure 3 · p. 24

V. EXPERIMENTAL DV-QKD PROTOCOLS

  • Experimental DV-QKD uses attenuated coherent sources because perfect single-photon sources are difficult, while high rates require low detector dead times and long distances require low dark counts.Photon-number-splitting attacks motivated rigorous security analyses and alternative encoding protocols.Source: §V · p. 25

A. Detector technology … 1. Space-link losses

This section surveys advances in quantum key distribution technologies and experimental implementations, covering detector development, high-dimensional and integrated photonic systems, and satellite quantum communication. It emphasizes practical constraints including detector performance, finite-key effects, dimensionality, turbulence, space-link asymmetries, and orbital losses.

A. Detector technology

  • Superconducting nanowire detectors reached 80% quantum efficiency, 0.1 Hz dark counts, and 26 ps jitter, while self-differentiated InGaAs APDs enabled 1.25 GHz gating.SNSPDs have also been integrated into photonic circuits.Source: A. Detector technology · p. 25

B. Decoy state BB84

  • A simplified one-decoy BB84 system achieved the 421 km fiber distance record using 2.5 GHz clocking, approximately 50% superconducting detectors, and dark counts below 0.3 Hz.An asymmetric-basis implementation also reached 1.09 MBit/s versus 0.63 MBit/s for standard BB84 over 50 km.Source: B. Decoy state BB84 · p. 26, Figure 4 · p. 28

C. Differential phase shift QKD

  • Differential-phase QKD extended maximum transmission to 260 km in standard telecom fiber using a Michelson interferometer and superconducting detectors.Earlier demonstrations included 200 km distribution and a secure bit rate in the MBit/s range over 10 km.Source: C. Differential phase shift QKD · pp. 26–27, Figure 4 · p. 28

D. Coherent one-way

  • The coherent-one-way distance record reached 307 km using low-noise free-running InGaAs/InP detectors, ultra-low-loss fiber, and composable finite-key security analysis.A fully automated system also demonstrated 150 km in deployed telecom fiber, while ultra-low-loss fiber enabled 250 km.Source: D. Coherent one-way · p. 27, Figure 4 · p. 28

E. DV MDI-QKD

  • MDI-QKD reached 404 km with optimized four-decoy parameter estimation, achieving a 3.2 × 10^-4 bits per second secret key rate; zero distance reached 1.6 MBit/s.The 404 km experiment used approximately 65% efficient superconducting detectors and recorded about 10^14 successful transmissions over three months.Source: E. DV MDI-QKD · p. 28

F. High-dimensional QKD

  • High-dimensional QKD mitigates detector dead-time limits and achieved 23 Mbps and 26.2 Mbps secret-key rates, while a 43-km field demonstration reached 1.2 Mbps [263].Temporal-spectral schemes reached d = 1278 and 7.4 secret bits per detected photon, but require specialized security analyses; OAM QKD reached 0.65 bits per detected photon over 300 m with 11% error [255–267, 256].Source: F. High-dimensional QKD · pp. 29–30
  • High-dimensional QKD demonstrations using time-energy or OAM increase secret-key rates, but SLMs, DMDs, and q-plates reconfigure in about 1 ms, limiting clocks to the kHz regime.Photonic integrated circuits may reduce switching times to 20 µs or 2.5 µs, while further work should address multidimensional encoding, turbulence resilience, and measurement-device independence.Source: F. High-dimensional QKD · p. 30

G. Photonic integrated circuits

  • PICs integrate high-speed quantum operations in compact, stable circuits, enabling multiplexing, multiprotocol operation, and monitoring or compensation of channel drifts.They also support heterogeneous integration, integrated single-photon and entangled-photon sources, and dense multiplexing for higher secret-key rates.Source: G. Photonic integrated circuits · pp. 31–32
  • PIC demonstrations include one-gigahertz mult protocol QKD and 43-km polarization QKD with secret-key rates comparable to state-of-the-art time-bin systems.Silicon photonics also integrates SNSPDs and quantum-limited homodyne detectors, supporting compact receivers for discrete- and continuous-variable QKD.Source: G. Photonic integrated circuits · p. 31

A. Introduction

  • Space channels can connect ground links, satellites, and potentially lunar or planetary distances, extending QKD toward global and planetary-scale secure communications.Long-distance free-space experiments showed that atmospheric paths can support quantum communication, although single-photon discrimination and background rejection are more demanding than in classical links.Source: A. Introduction · pp. 32–33, B. The satellite opportunity · p. 33

B. The satellite opportunity

  • Satellite QKD was demonstrated between a LEO satellite and ground using retroreflectors and calibrated pulses, while trusted satellites can connect separate fiber networks through one-time-pad key exchange.Japan and China subsequently advanced concrete space-QKD programs, including SOTA in 2014 and Micius in 2015 [338, 339].Source: B. The satellite opportunity · p. 33

C. Type of orbits and applications

  • Downlink is the common space-QKD configuration because atmospheric turbulence affects uplinks more strongly, causing beam broadening and scintillation before the satellite, whereas downlinks traverse atmosphere only near reception.Expected losses vary radically with orbit altitude, wavelength, telescope diameter, and separation, conditioning feasible quantum-communication applications.Source: C. Type of orbits and applications · p. 33, §1 · p. 34, Figure 7 · p. 34

2. Low-Earth-orbit (LEO) … E. Ideal performances in a thermal-loss channel

This section reviews space-based quantum communication and continuous-variable quantum key distribution, covering protocols, operational and security foundations, and performance evaluation. It also derives ideal thermal-loss-channel performances for Gaussian protocols, including trusted detection noise and quantum memory.

2. Low-Earth-orbit (LEO)

  • LEO enabled early space-QKD demonstrations, including BB84 with polarization and temporal modes, while links faced minutes-long passes and Doppler shifts of tens of GHz.LEO was favored for launch accessibility and lower radiation exposure; satellite speed can reach 7 km/s in a 400-km orbit.Source: §2 · p. 34, Figure 8 · p. 34
  • Micius demonstrated ground-to-satellite teleportation, decoy-BB84 above 10 kbps, entangled QKD at sub-bps-to-few-bps rates, and an intercontinental quantum network.Teleportation fidelity was 0.80 ± 0.01; decoy-BB84 used about 22 dB loss, while entangled links involved roughly 1200 km slant distance and losses up to 36 dB.Source: §2 · p. 35

3. Higher Earth orbits (MEO and GEO)

  • MEO and GEO extend link duration, potentially permanently for GEO, but incur larger losses and stronger solar ionizing radiation; experiments have exchanged photons with MEO and GEO satellites.MEO includes GNSS satellites, making QKD-enabled secure navigation services a considered application.Source: §3 · p. 35

4. Night and day use of the link

  • Daylight satellite quantum communication requires strong background rejection, precise pointing, narrow fields of view, precise synchronization, short integration intervals, and 1550-nm wavelengths.These measures were proposed to support daylight inter-satellite operation, whereas space QKD had previously been investigated experimentally only at night.Source: §4 · p. 35

1. Other protocols

  • Beyond QKD, space links could support quantum digital signatures and blind quantum computing, while a 102-km fiber demonstration signed a one-bit message without assuming a secure channel.BQC can keep a client’s computation results hidden while remote quantum computers execute the algorithm.Source: §1 · pp. 35–36

2. Tests of quantum mechanics in space

  • Space quantum communication extends tests of quantum mechanics: Micius violated CHSH at 1200 km with S = 2.37 ± 0.09, while delayed choice was demonstrated over 3500 km.The CHSH value exceeded the local bound of 2 by four standard deviations, and the delayed-choice experiment used temporal modes reflected by a moving satellite.Source: §2 · p. 36

A. Brief introduction to CV systems

  • CV-QKD encodes keys in continuous optical quadratures measured by homodyne or heterodyne detection, with Gaussian protocols prominent because Gaussian states are experimentally routine and characterized by first and second moments.One-way protocols vary by coherent or squeezed states, Gaussian or discrete modulation, and homodyne or heterodyne measurement.Source: B. Historical outline · p. 37, A. Brief introduction to CV systems · p. 37

B. Historical outline

  • CV-QKD developed from early quadrature and squeezed-state proposals to coherent-state Gaussian modulation, reverse reconciliation beyond the 3dB limit, composable security proofs, and thermal-loss key-rate calculations.A prepare-and-measure protocol modulates Gaussian states, sends them through a thermal-loss channel, measures the output, estimates leakage, and performs reconciliation and privacy amplification; rates use an entangling-cloner model and an equivalent entanglement-based representation.Source: B. Historical outline · pp. 37–38, C. One-way CV-QKD protocols · p. 38

D. Computation of the key rate

  • Gaussian collective-attack key rates reduce to entropies and mutual information determined by the output bipartite state, reduced conditional states, and their covariance matrices.This reduction also permits security thresholds to be found by solving when the corresponding key rate equals zero.Source: D. Computation of the key rate · p. 39

E. Ideal performances in a thermal-loss channel

  • Ideal thermal-loss-channel analyses assume asymptotic security, perfect reconciliation, and infinite Gaussian modulation for one-way Gaussian protocols.The section gives separate analytical rates for coherent-state homodyne, coherent-state heterodyne, squeezed-state homodyne, and infinitely squeezed-state heterodyne.Source: E. Ideal performances in a… · pp. 39–40
  • For squeezed-state homodyne, a low-transmissivity, low-noise bound yields a security threshold expressed through the Lambert W-function.The bound is given for the low-η and low-¯n regime and is associated with Ref..Source: E. Ideal performances in a… · p. 40
  • Trusted detection noise can improve security thresholds, and Ref. reports the highest-known threshold so far for the considered thermal-loss and amplifier-channel setting.The cited studies use trusted noise to raise lower bounds to secret-key capacities.Source: E. Ideal performances in a… · p. 40
  • For pure loss, one protocol rate reaches half the PLOB bound, while an entanglement-based implementation with quantum memory can achieve the bound by removing homodyne sifting.The memory lets Alice and Bob choose the same quadrature in the squeezed-state homodyne protocol.Source: E. Ideal performances in a… · p. 40

F. Finite-size aspects … K. CV MDI-QKD

The reviewed CV-QKD advances span finite-size security, two-way and thermal-state protocols, unidimensional and discrete modulation, and asymptotic security analyses. These approaches improve robustness, simplify implementations, or extend operating regimes, while retaining protocol-specific security limitations and assumptions.

F. Finite-size aspects

  • Finite-size CV-QKD security incorporates parameter-estimation corrections and smooth-entropy convergence, with general-attack analyses using entropic uncertainty, post-selection, or de Finetti reduction.These results cover entanglement-based TMSV and squeezed-state protocols as well as one-way coherent-state protocols.Source: F. Finite-size aspects · p. 40

G. Two-way CV-QKD protocols

  • Two-way protocols use forward and backward transmissions, with ON/OFF switching selecting configurations against memoryless or memory attacks and enabling round-trip parameter estimation.In ON, Alice displaces Bob’s reference state and Bob heterodynes; in OFF, Alice measures the incoming state and prepares a new state, while the parties estimate transmissivity and noise from disclosed data.Source: G. Two-way CV-QKD protocols · pp. 40–41

1. Asymptotic security of two-way CV-QKD

  • Asymptotic two-way security reduces coherent attacks to two-mode Gaussian attacks through de Finetti random permutations and Gaussian-state extremality.The Eve model uses two beam splitters and correlated ancillary modes, with independent entangling cloners recovered when g = g′ = 0.Source: §1 · p. 41

2. Asymptotic key rates

  • Asymptotic key-rate formulas cover coherent-state protocols with heterodyne or homodyne detection in direct and reverse reconciliation, with OFF rates reducing to one-way rates when g = g′ = 0.ON is considered for one-mode Gaussian attacks and OFF for two-mode Gaussian attacks; squeezed-state variants are also discussed.Source: §2 · pp. 41–42

3. Further considerations

  • Two-way CV-QKD can achieve higher security thresholds than one-way protocols and is suited to channels with high thermal noise, while composable security has also been proven.Floodlight QKD can in principle reach Gbit/s secret-key rates at metropolitan distances using multiple optical modes.Source: §3 · p. 42

H. Thermal-state QKD

  • Thermal states can support CV-QKD without input purification in direct reconciliation and two-way reverse reconciliation, extending applications toward microwave and terahertz regimes.One-way thermal protocols use Gaussian displacement of noisy states and homodyne detection; two-way variants switch between configurations to address memoryless and correlated attacks.Source: H. Thermal-state QKD · p. 42, §1 · p. 42, §2 · p. 43

I. Unidimensional protocol

  • Unidimensional CV-QKD simplifies implementation to one modulator but leaves the unmodulated-quadrature transmittance unknown, bounded instead by covariance-matrix physicality.At low transmissivity and infinite modulation, its coherent-state homodyne rate is approximately (η log2 e)/3 versus (η log2 e)/2 for standard one-way CV-QKD, despite greater loss and noise fragility.Source: §I · pp. 43–44

J. CV-QKD with discrete modulation

  • Discrete modulation maps continuous-variable data more accurately for error correction, with binary, multilevel, and arbitrary phase encodings studied under progressively broader security analyses.Binary coherent-state modulation uses homodyne detection and advantage distillation, with security established against Gaussian and, more recently, general attacks.Source: J. CV-QKD with discrete modulation · p. 44

1. Basic concepts and protocol … A. Finite-size analysis in QKD

This section examines practical continuous-variable quantum key distribution, covering measurement-device-independent and advanced protocols, security analysis, finite-size effects, post-processing, implementation choices, and experimental progress. It also considers extensions, detector configurations, reconciliation, and demonstrated performance in rates, distances, and security properties.

1. Basic concepts and protocol

  • The CV MDI-QKD protocol removes measurement-device side channels by having Alice and Bob send coherent states to an untrusted relay that performs the measurement.The relay broadcasts γ, enabling conditional Alice–Bob correlations while Eve must attack both links to obtain information about the individual variables.Source: §1 · p. 44

2. Security and key rates

  • 170 km and 2 × 10^-4 bit/use are achievable with an asymmetric CV MDI-QKD configuration when one link has ηA = 1.Performance degrades when the relay is symmetrically positioned, where the maximum distance is about 3.8 km in standard optical fiber.Source: §2 · p. 45
  • 10^6–10^9 data points suffice for a positive rate of about 10^-2 bits/use under finite-size analysis, while 10^7–10^9 suffice against general coherent attacks with composable security.Finite-size estimation uses confidence intervals with lowest compatible transmissivity and highest compatible excess noise; composable security combines smooth-min entropy, parameter estimation, Gaussian optimality, and de Finetti reduction.Source: §2 · pp. 45–46

3. Variants of CV MDI-QKD

  • Variants incorporate noiseless linear amplification, photon subtraction or addition, squeezed states, discrete modulation, phase self-alignment, imperfect phase calibration, unidimensional encoding, and composable security [447] [448].A multi-party version is introduced separately as a scalable extension [449].Source: §3 · p. 46

4. Multipartite CV MDI-QKD

  • 50 parties can communicate privately at more than 0.1 bit/use within 40 m, corresponding to about 2.5 Mbits per second at 25 MHz in multipartite CV MDI-QKD.Users send Gaussian-modulated coherent states to an untrusted relay, whose generalized Bell detection creates correlations for conferencing and secret sharing; security holds asymptotically and compositionally with finite-size effects.Source: §4 · p. 46

A. Introduction / B. Point-to-point CV-QKD

  • CV-QKD experiments progressed from 780-nm bulk demonstrations unsuitable for robust long-distance operation to telecom systems reaching 1 Mbps over 25 km, about 300 bps over 100 km, and over 6 kbps across roughly 50 km of commercial fiber [455–476].The newer systems use telecom components, optimized error correction, and active feedback to improve stability and distance.Source: B. Point-to-point CV-QKD · p. 47

2. Detection

  • Receiver-generated local oscillators avoid transmitted-LO loss, scattering, and side-channel vulnerabilities, but require pilot-assisted synchronization and digital signal processing to correct phase and frequency drifts.Homodyne and heterodyne detectors trade complexity, quadrature information, bandwidth, quantum efficiency, and electronic-noise performance.Source: §2 · p. 48

3. Post-processing

  • 96% reconciliation efficiency at SNR = 0.08 over 80 km and 95.6% at SNR = 0.002 over 150 km enabled longer-distance CV-QKD.Earlier codes required SNR above roughly 1 and limited secure communication to about 25 km, whereas newer codes operate at much lower SNR.Source: §3 · p. 50
  • 1Mbps at 25km and 30kbps at 150km are the fastest secret-key rate and longest distance reported, respectively, with finite-size effects and collective-attack security included.Improved reconciliation combines multi-edge LDPC codes with multidimensional reconciliation, achieving 25Mbit/s and 30Mbit/s, while parameter estimation and large blocks remain limiting factors.Source: §3 · p. 50

1. Squeezed-state protocols

  • 0.1 bit/sample at 2.7km was achieved with 94.3% reconciliation efficiency and composable security, while squeezed-state systems also demonstrated one-sided-device-independent security against coherent attacks.The experiments used two-mode squeezed states, with measured noise suppression of 3.5dB at 1064nm and 10.5dB at 1550nm.Source: §1 · p. 51
  • Squeezed-state encoding with a uni-dimensional, small alphabet can eliminate Eve’s information in a purely lossy channel, reducing post-processing complexity despite limited alphabet size.Modulating the transmitted mode can also improve robustness to excess noise and extend secure communication distance.Source: §1 · p. 51

2. CV MDI-QKD

  • 0.1 secret bits per use were deduced for CV MDI-QKD with 2% and 60% channel attenuation, 0.01SNU excess noise, and assumed 97% post-processing efficiency [182].The proof-of-concept experiment used amplitude and phase modulation, free-space propagation, and a simplified CV Bell-state analyzer based on carrier local oscillators.Source: §2 · p. 51

A. Finite-size analysis in QKD

  • Finite-size security analyses make practical QKD security mathematically precise, reviewing established methods and entropic uncertainty relations with side quantum information.The treatment also extends to continuous-variable protocols and discusses device-independent QKD as an outlook.Source: A. Finite-size analysis in QKD · p. 51

B. Finite-size statistical analysis … 1. Attacks on the local oscillator

This section examines finite-key security analysis and implementation side channels in discrete- and continuous-variable QKD. It covers entropic methods, attacks involving detectors and local oscillators, experimental demonstrations, and countermeasures within realistic security models.

B. Finite-size statistical analysis

  • Privacy amplification extracts a secret key from the corrected raw key once a sufficiently strong smooth min-entropy lower bound is established.Smooth min-entropy quantifies Eve’s guessing probability, and two-universal hashing remains effective even when Eve has quantum memory.Source: B. Finite-size statistical analysis · p. 52, §1 · p. 52

2. Guaranteeing large smooth min-entropy

  • Finite-key smooth-min-entropy bounds use i.i.d. reductions, post-selection, virtual entanglement distillation, entropic uncertainty relations, or entropy accumulation.Entropic uncertainty with quantum side information handles general attacks and gives tight finite-key bounds, whereas entropy accumulation naturally supports device-independent security but has weaker bounds than the tightest methods [53, 84, 493–499].Source: §2 · pp. 52–53

C. Uncertainty principle versus entanglement: an intuitive approach to QKD security

  • Entropic uncertainty with quantum side information converts Eve-conditioned min-entropy estimation into statistical tests of Alice–Bob correlations, covering coherent attacks without distinguishing attack classes.Finite-key analysis incorporates information-reconciliation leakage and estimates discrepancies from a random raw-key sample [495–498].Source: C. Uncertainty principle versus… · p. 53

D. CV protocols

  • For squeezed-state continuous-variable protocols, entropic-uncertainty finite-key proofs remain applicable and yield a tight characterization, whereas standard de Finetti approaches fail without extra assumptions.Other continuous-variable protocols can use Gaussian de Finetti reduction, supporting the belief that Gaussian attacks remain optimal in the finite-key regime.Source: D. CV protocols · pp. 53–54

E. Extensions and Outlook

  • Security proofs must better match real hardware to reduce side-channel vulnerabilities, while device-independent QKD still lacks definitive ultimate finite-key rates and experimentally feasible security–parameter trade-offs.Current device-independent bounds use entropy accumulation and ensure sufficient entanglement, unlike device-dependent entropic-uncertainty approaches [157] [171].Source: E. Extensions and Outlook · p. 54

X. QUANTUM HACKING

  • Quantum hacking exploits violated proof assumptions, such as imperfect isolation or device behavior, through side channels that reveal key information or distort channel estimates.Security can be restored by modeling the side channel in the proof or adding protocol countermeasures; examples include photon-number splitting against attenuated-pulse DV-QKD [517].Source: §X · pp. 54–55

1. PNS and intensity-based attacks

  • Decoy states expose photon-number-splitting attacks, but source timing correlations can let Eve distinguish signal from decoy pulses and evade detection.External intensity modulation avoids the observed timing correlation, while heating gain-switched lasers can shift pulse timings and create unwanted inter-pulse correlations [521].Source: §1 · p. 55

2. Trojan horse attacks

  • Trojan-horse attacks use injected light and reflections to reveal basis or intensity settings, enabling otherwise undetectable attacks; defenses include attenuation, monitoring, spectral filtering, bounded leakage, thermal noise, and shutters.Coherent states are optimal among Gaussian Trojan states under the stated constraints, while thermal noise can reduce distinguishability below the earlier bound and increase the key rate [523–529].Source: §2 · pp. 56–57

3. Backflash attacks

  • Backflash light from APDs can reveal Bob’s detector, basis, or outcome; experiments found significant emission probabilities, while broadband filtering and photomultiplier tubes were proposed as mitigations.Pinheiro et al. [531] measured a backflash probability greater than or equal to 0.065 for a commercial Si APD and found a much lower probability for a photomultiplier tube.Source: §3 · p. 57

4. Faked states and detector efficiency mismatch

  • Faked-state attacks exploit passive basis selection, detector efficiency mismatch, reflections, or detector blinding to control Bob’s basis or outcomes while trading reduced errors for increased loss.Countermeasures include polarization scrambling, actively selected bases, four-detector configurations, photocurrent monitoring, and software key-rate calculations, although four detectors remain vulnerable when combined with a THA.Source: §4 · pp. 57–58
  • DEM attacks can leak key information without introducing errors, while DEM-aware analyses show that detector mismatch decreases the secure BB84 decoy-state key rate.The time-shift attack was demonstrated on a modified commercial system, and secure-rate formulas require thorough characterization of detector efficiencies across the mismatch parameter.Source: §4 · p. 58

1. Attacks on the local oscillator

  • Local-oscillator attacks in CV-QKD can manipulate beamsplitter responses, pulse timing, polarization, or clock jitter to engineer outcomes or corrupt shot-noise estimation.Proposed defenses include monitoring LO intensity, random wavelength filtering, real-time shot-noise measurements with multiple attenuation levels, and protection of the shot-noise unit.Source: §1 · p. 59
  • Generating the local oscillator locally can remove attacks on a transmitted LO, but phase-reference noise remains exploitable if treated as trusted.In the LLO attack described by Ren et al., Eve increases phase-reference intensity to lower phase noise and compensates by strengthening her signal attack while preserving Bob’s total measured noise.Source: §1 · p. 59

2. Saturation attacks on detectors … C. General weak-converse upper bound

This section surveys detector and side-channel attacks in CV-QKD, considers device independence as a mitigation, and develops rate limits for point-to-point quantum communication. It introduces the PLOB framework and a general REE-based weak-converse upper bound, using channel simulation and adaptive-to-block reduction to simplify adaptive protocols into block-type protocols built from resource states.

2. Saturation attacks on detectors

  • Saturation attacks exploit homodyne detectors’ finite linear range by rescaling and displacing intercepted states so Bob’s outcomes overlap the saturation region and trusted-party error estimation is reduced.Proposed defenses include Gaussian post-selection filtering and random signal attenuations; a related displaced-saturation attack was demonstrated experimentally and simulated.Source: §2 · p. 59

3. Trojan horse attacks

  • Trojan-horse attacks leak Alice’s modulation through injected states or side-channel modes, altering key rates under coherent- and squeezed-state protocols and motivating active monitoring of incoming or coupled light.Countermeasures include manipulating the input vacuum, measuring coupled-noise outputs, and monitoring incoming light.Source: §3 · p. 60

C. General considerations

  • Device vulnerabilities also arise from calibration manipulation, laser damage, and source phase control, enabling detector-efficiency loss, permanent blinding, monitoring failures, or loopholes in DV and CV systems.Suggested defenses include post-calibration self-tests, monitoring light leaving Alice’s source, and active phase randomization.Source: C. General considerations · p. 60

D. Device-independence as a solution?

  • Device-independent and measurement-device-independent QKD tolerate untrusted devices but are harder to implement, generally yield lower key rates, and remain vulnerable to isolation failures and source imperfections.Thus, device independence reduces many side-channel risks but is not a complete solution.Source: D. Device-independence as a solution? · pp. 60–61

A. Overview

  • The PLOB bound exactly characterizes the point-to-point pure-loss rate-loss limit, which can be surpassed only with pre-shared secret randomness or quantum repeaters [33].It also provides the benchmark for quantum repeaters and weakens to −log2(1 −ηdetη) when detector efficiency ηdet is included.Source: A. Overview · p. 62
  • Ideal point-to-point protocols remain below the PLOB bound with asymptotic scaling ≃η, whereas efficient relay-assisted protocols can beat it but follow the single-repeater scaling ≃√η.These comparisons are presented for ideal conditions including perfect detectors, zero dark counts and misalignment, and perfect error correction and reconciliation.Source: A. Overview · p. 62, Figure 11 · p. 63

C. General weak-converse upper bound

  • For any quantum channel E, the two-way capacity is upper-bounded by a general expression based on the relative entropy of entanglement (REE) [33].The bound applies in finite or infinite dimensions and computes the REE of adaptive-protocol output states over many channel uses.Source: C. General weak-converse upper bound · p. 64
  • The protocol is stretched by simulating the quantum channel with a resource state, reducing the adaptive scheme to a block protocol whose output is a tensor product of resource states up to trace-preserving LOCC [33] [582].The reduction is described as an adaptive-to-block technique, with channel simulation as its preliminary step.Source: C. General weak-converse upper bound · p. 64

D. LOCC simulation of quantum channels … I. Bounds for teleportation-covariant channels

The review develops LOCC and teleportation-based channel simulations, showing how stretching adaptive protocols yields single-letter REE bounds and concrete limits for teleportation-covariant channels, including CV-QKD thresholds.

D. LOCC simulation of quantum channels

  • LOCC simulation represents a channel output through an LOCC acting on the input and a resource state, with asymptotic simulations defined by point-wise limits of approximating channels.The formulation applies in finite and infinite dimensions and is crucial for bosonic channels and some discrete-variable channels.Source: D. LOCC simulation of quantum channels · p. 64, Figure 13 · p. 65
  • The framework deterministically simulates amplitude damping only asymptotically, leaving a non-asymptotic simulation—and consequently a sharper secret-key-capacity estimate—as an open problem.Known constructions use dimension limits or infinitely many resource systems, while conditional simulation fails for amplitude damping but works for diagonal amplitude damping and dephrasure channels.Source: D. LOCC simulation of quantum channels · p. 65

E. Teleportation covariance and simulability

  • Teleportation-covariant channels commute with teleportation unitaries, allowing corrections to move to the output and enabling simulation using a teleportation LOCC and the channel’s Choi matrix.The family includes Pauli, erasure, and bosonic Gaussian channels; continuous-variable simulations may require asymptotic finite-energy approximations.Source: E. Teleportation covariance and… · p. 65

F. Strong and uniform convergence

  • For bosonic channels, teleportation simulation converges in the energy-constrained diamond norm for finite energy, while uniform convergence holds for single-mode Gaussian channels if and only if their noise matrix has full rank.Strong convergence follows from the infinite-squeezing limit of Braunstein-Kimble teleportation, but standard diamond-norm uniform convergence is not general.Source: F. Strong and uniform convergence · pp. 65–66

G. Stretching of an adaptive protocol

  • Stretching replaces each channel use in an adaptive protocol by a resource state and collapses the resulting operations into one trace-preserving LOCC, preserving the original communication task.For asymptotic simulations, a finite total energy bound and a peeling argument control and propagate simulation error to the protocol output.Source: G. Stretching of an adaptive protocol · p. 66

H. Single-letter upper bound for two-way assisted capacities

  • Protocol stretching combined with REE yields single-letter upper bounds for all two-way capacities, including Choi-stretchable teleportation-covariant channels and asymptotically simulated bosonic channels [33].The bounds use REE monotonicity and subadditivity, and bosonic Gaussian bounds are expressed through the asymptotic Choi matrix.Source: H. Single-letter upper bound for… · pp. 66–67

I. Bounds for teleportation-covariant channels

  • For qubit Pauli channels, the REE-based capacity bounds specialize through the channel probabilities and extend straightforwardly to arbitrary finite-dimensional qudits.The section also derives bounds for thermal-loss, noisy-amplifier, and additive-noise Gaussian channels, with thermal-loss channels directly determining CV-QKD excess-noise thresholds.Source: §I · p. 67
  • CV-QKD security thresholds remain below the entanglement-breaking upper bound εUB = 1, with a substantial gap between best-known achievable thresholds and the upper bound.Figure 15 compares the upper bound, RCI lower bound, and trusted-noise, coherent-state, and two-way protocol thresholds.Source: §I · pp. 67–68, Figure 15 · p. 68

J. Capacities for distillable channels … C. Quantum communication networks

The section establishes exact capacities for distillable channels and repeater chains, identifies unresolved channel-capacity problems, and extends these methods to single-path and multi-path quantum networks. For pure-loss networks, capacities reduce to route, cut, and flow optimization problems.

J. Capacities for distillable channels

  • For distillable channels, all two-way capacities coincide, are achievable through rounds of one-way classical communication without adaptiveness, and admit simple formulas for fundamental channels.These include pure-loss, quantum-limited amplifier, dephasing, and erasure channels.Source: J. Capacities for distillable channels · p. 68
  • The PLOB secret-key capacity bounds lossy communication, extends to multiband channels, and determines the maximum QKD rate over a lossy line.The multiband expression uses the transmissivities of the separate frequency components.Source: J. Capacities for distillable channels · p. 68

K. Open problems

  • For thermal-loss channels, the RCI lower bound on secret-key capacity is not tight because trusted-detector-noise QKD protocols can achieve higher rates; similarly, trusted-noise protocols exceed noisy-amplifier CI.Source: K. Open problems · p. 69

A. Overview

  • Effective repeaters must beat the PLOB bound, whereas phase-randomized MDI protocols such as TF-QKD [184] can achieve this criterion.The proof-of-concept experiment in Ref. is identified as the first effective repeater implementation.Source: A. Overview · p. 69

B. Ideal chains of quantum repeaters

  • For distillable repeater chains, the secret-key capacity equals the minimum channel capacity, achieved by neighboring key exchanges followed by one-time-pad combination.Channel simulation and REE bounds establish the converse, while the neighboring-link protocol supplies the matching lower bound [39].Source: B. Ideal chains of quantum repeaters · p. 70
  • In a pure-loss repeater chain, the secret-key capacity is determined by the minimum transmissivity, while analogous exact formulas apply to amplifier, dephasing, and erasure chains [39].The chain result covers fundamental distillable channels, including bosonic pure-loss channels.Source: B. Ideal chains of quantum repeaters · p. 70

C. Quantum communication networks

  • For distillable pure-loss networks, single-path capacity is achieved by the route with maximum end-to-end transmissivity, equivalently obtained through cut optimization.The optimal route solves the widest-path problem in time O(|E| log2 |P|) [636, 637].Source: C. Quantum communication networks · p. 71
  • Multi-path pure-loss capacity is determined by maximum cut total loss and is found via maximum flow; it generally exceeds single-path capacity.Orlin’s algorithm solves the maximum-flow problem in O(|P|× |E|) time [639].Source: C. Quantum communication networks · p. 71

D. Practical designs for quantum repeaters … D. Quantum data locking

This section reviews practical quantum-repeater architectures for extending entanglement over long distances and quantum-data-locking protocols under constrained eavesdropper storage. It covers probabilistic, deterministic, and memory-less repeaters, along with uncertainty-based security, bounded quantum storage, and constructions with strengthened security guarantees.

D. Practical designs for quantum repeaters

  • Nested entanglement swapping extends elementary links of length L0 to distance L = 2^nL0, while parallel attempts yield a rate scaling as exp(−αL0) rather than exp(−αL).Quantum storage is needed while neighboring links are established, and BSM imperfections motivate entanglement distillation and multiple repeater generations.Source: D. Practical designs for quantum… · p. 72

1. Probabilistic quantum repeaters

  • Probabilistic repeaters use photonic distribution and swapping, but imperfect linear-optical BSMs impose long coherence times and low generation rates.Multiple-memory nodes mitigate these limits by attempting links in parallel; over long distances, however, rates remain low or require many memories, despite memory-assisted QKD advantages.Source: §1 · p. 73

2. Deterministic quantum repeaters

  • Deterministic repeaters set the BSM success probability PM to 1, but accumulated state and gate errors require purification or error correction.Error-resilient correction requires gate error rates around 0.001–0.01 or below, while performance trades off nesting depth against probabilistic elementary-link generation and accumulated errors.Source: §2 · pp. 73–74

3. Memory-less quantum repeaters

  • Memory-less repeaters substantially improve key rates through loss-resilient error correction, but require operation errors of 10^-4–10^-3, large photonic cluster states, and many intermediate nodes.These requirements can conflict with sparse existing optical infrastructure and represent a later repeater generation.Source: §3 · p. 74

A. Introduction

  • Quantum-data-locking security is composable when Eve must measure because her quantum memory is absent or has finite known storage time, but not with perfect unbounded resources.The framework contrasts bounded quantum storage, where Eve stores only sublinear qubits, with QDL, where she has unlimited capacity but finite storage time.Source: A. Introduction · p. 75

B. Entropic uncertainty relations

  • Entropic uncertainty relations lower-bound measurement uncertainty through a constant determined by the measurement set, reaching log2 d for maximal collections of mutually unbiased observables.Stronger fidelity- and metric-based uncertainty relations always imply an entropic uncertainty relation.Source: B. Entropic uncertainty relations · p. 75

C. Bounded quantum storage

  • Bounded quantum storage yields secret-bit bounds from smooth min-entropy, but does not dramatically improve rates over an unbounded quantum-capable eavesdropper and incurs a 1/k sifting factor.Eve may retain at most q qubits after n transmissions, while uncertainty relations bound her remaining classical side information.Source: C. Bounded quantum storage model · p. 76

D. Quantum data locking

  • n/2 bits is the maximum information Eve can access about n communicated bits when she lacks one shared basis bit, for every n.QDL uses a secret bit to select computational or diagonal encoding, forcing Eve to measure before learning the basis; the bound follows from the Maassen-Uffink EUR.Source: D. Quantum data locking · pp. 76–77
  • QDL violates total proportionality: knowing K can increase accessible information by more than H(K), unlike classical and quantum mutual information.The expected bound is I(X : ZK) < I(X : Z) + H(K), but QDL provides stronger violations.Source: D. Quantum data locking · p. 77
  • Random k = (log_2 d)^3 bases yield δ = ε log_2 d + O(1) QDL with probability bounded away from 1 when log_2 d > 16/ε, requiring asymptotically large d [682].For ε = 10^-1, the condition gives log_2 d ≳ 10^6; approximate mutually unbiasedness is typical when k is sufficiently smaller than d, but exact mutually unbiased bases do not necessarily yield QDL.Source: D. Quantum data locking · p. 77
  • Metric uncertainty relations produce QDL with δ = ε log_2 d and log_2 k = 4 log_2(1/ε) + O(log_2 log_2(1/ε)), including efficiently simulable quantum unitaries.These were the first protocols allowing arbitrarily small accessible information, although they still require asymptotically large d.Source: D. Quantum data locking · p. 77
  • QDL can be formulated using stronger security measures than accessible information, including total variation distance through Pinsker’s inequality and fidelity-based quantifiers.Metric and fidelity uncertainty relations therefore yield QDL under stronger security criteria.Source: D. Quantum data locking · p. 77

E. Quantum data locking for communication: the quantum enigma machine … E. Randomness amplification

The section surveys practical quantum data locking and quantum random-number generation, from capacity characterizations and experiments to device-independent randomness expansion and amplification from imperfect sources. It emphasizes both security guarantees and the experimental, computational, and implementation limitations that constrain deployment.

E. Quantum data locking for communication: the quantum enigma machine

  • Quantum data locking capacities formalize communication rates secure against Eve’s measured information, with weak capacity at least private capacity, while some channels have vanishing or substantially larger capacities.Strong QDL gives Eve channel-input access, whereas weak QDL gives access to the complementary-channel output; the identity qubit channel has unit strong QDL capacity.Source: E. Quantum data locking for… · pp. 77–78

F. Practical quantum data locking

  • Local-unitary QDL makes implementations feasible with trains of photons across small d-dimensional mode spaces, achieving nonzero QKD or direct-communication rates for any d ≥ 3, but requiring one secret-key bit per channel use.Original large-Hilbert-space protocols were considered experimentally unrealistic, whereas local unitaries address dimensional control and noisy-channel robustness.Source: F. Practical quantum data locking · p. 78

G. Experimental demonstrations

  • QDL was experimentally demonstrated using heralded single-photon polarization, pulse-position modulation with 128 × 128 spatial light modulators, and programmable on-chip ring resonators.The demonstrations included error correction, Fourier-transform-based random phase encoding, and time-of-arrival encoding.Source: G. Experimental demonstrations · p. 78

A. Introduction

  • Quantum randomness is defined by uniformity and independence from quantum side information, which statistical testing alone cannot certify; trusted QRNGs therefore estimate min-entropy and apply quantum-proof extraction.Pseudo-random generators remain deterministic, while device-independent protocols infer min-entropy from Bell-inequality violations before extraction.Source: A. Introduction · pp. 79–80

1. The setup for DI-QRE

  • Device-independent QRE assumes a secure laboratory, classical processing, and a private random seed, then uses composable security without public communication to reduce device-reuse concerns.Its protocol architecture differs from DI-QKD because Alice is the only honest party and does not receive unlimited randomness.Source: §1 · p. 80

2. The spot-checking CHSH QRE protocol

  • The spot-checking CHSH QRE protocol tests a fraction of entangled-pair rounds, aborts below a CHSH threshold, and extracts randomness from untested outputs at rates approaching H(X|E) [161].Completeness error is exponentially small in n; robust protocols can yield up to two random bits per entangled pair [161].Source: §2 · pp. 80–81

C. Historical remarks and further reading

  • DI-QRE evolved from early nonlocality proposals and low-rate experiments to asymptotically optimal expansion rates using the EAT, while current implementations still face Bell-test and device-integration challenges [706].Recent experiments achieve reasonable rates and can close both locality and detection loopholes, but commercial deployment remains unlikely soon.Source: C. Historical remarks and further… · p. 81, D. Implementations · p. 81

E. Randomness amplification

  • Quantum randomness amplification converts Santha–Vazirani sources into near-uniform randomness for every ε < 1/2, with current protocols using two noise-tolerant devices, while no-signalling security remains inefficient [722] [724] [725].Many protocols can use public randomness as a seed, supporting applications such as randomness beacons; amplification differs from extraction because no perfect seed is assumed.Source: E. Randomness amplification · pp. 81–82

XV. QUANTUM DIGITAL SIGNATURES … 2. No quantum memory requirement

This section introduces quantum digital signatures as one-time, information-theoretically secure signatures for classical messages, covering the Gottesman–Chuang construction, its security intuition, and practical limitations. It then discusses coherent-state comparison and a related protocol using classical verification keys, with security based on receivers’ measurement uncertainty.

B. Definitions and security properties

  • A QDS scheme generates sender and receiver keys, signs a message using the sender’s private key, and verifies it using a receiver’s public key, targeting unforgeability, non-repudiation, and transferability.Verification can distinguish rejection, acceptance with uncertainty about forwarding, and acceptance with confidence that other receivers or judges will also accept.Source: B. Definitions and security properties · pp. 82–83

C. What is a quantum digital signature scheme and why it is useful?

  • QDS uses quantum communication to sign classical messages with information-theoretic security, motivated by the vulnerability of RSA, DSA, ECDSA, and ElGamal to sufficiently powerful quantum computers.The reviewed QDS schemes are one-time: the private/public keys cannot be reused for signing other messages.Source: C. What is a quantum digital signature… · p. 83

E. The Gottesman-Chuang QDS

  • The Gottesman–Chuang protocol replaces classical computational one-wayness with non-orthogonal quantum states that cannot be perfectly distinguished or copied, making the public key a quantum state and the secret key its classical description.This construction is intended to remain secure against adversaries with unlimited computational power, although public-key copies and quantum-memory storage are required.Source: E. The Gottesman-Chuang QDS · p. 84, §1 · p. 84

1. The protocol

  • In GC-QDS, receivers compare distributed public-key copies with SWAP tests, while verification uses thresholds sa and sv to distinguish rejection, uncertain acceptance, and transferable acceptance.The protocol signs a bit by sending the corresponding classical secret strings, and receivers regenerate the quantum states to count mismatches against their stored keys.Source: §1 · p. 84

2. Security intuition

  • If the forger’s failure probability satisfies pf > sv, forging succeeds with probability no greater than e−c(pf−sv)2L, while repudiation is exponentially suppressed when sa < sv.Honest rejection likewise decays as e−c′′(pe−sa)2L when pe < sa; the operating regime is 0 < pe < sa < sv < pf, with thresholds chosen inside the gap g = pf − pe.Source: §2 · p. 85

3. Remarks

  • GC-QDS was initially analyzed under authenticated quantum channels, but later work lifted that assumption; its quantum public keys still require point-to-point quantum distribution and lack classical universal verifiability.Because quantum public keys cannot be copied or broadcast like classical keys, parties that did not participate in key generation cannot join later.Source: §3 · pp. 85–86

4. Practical limitations of GC-QDS

  • GC-QDS was impractical because public keys had to be stored for potentially months, receivers needed multiple copies and controlled SWAP operations, and authenticated quantum channels added cost.The comparison with QKD is sharp: GC-QDS appeared to require full universal quantum computers, whereas QKD can use technologies such as preparing and measuring single qubits.Source: §4 · p. 86

F. Practical QDS: Lifting the limitations

  • The review identifies four subsequent developments that lifted the major GC-QDS limitations and transformed QDS from a theoretical idea into a practical quantum communication primitive.This section presents that transition as making QDS technologically as mature as QKD, with further security, performance, and realization improvements discussed later.Source: F. Practical QDS: Lifting the… · p. 86

1. Simplifying state comparison

  • For coherent-state quantum public keys, a practical comparison replaces the SWAP-test in checking key equality and signature validity using beam splitters, mirrors, and photon detectors [737].Null-port clicks reveal phase differences: identical coherent states produce photons only at the signal port, whereas mismatches also produce null-port photons.Source: §1 · p. 86, Figure 20 · p. 87
  • The distributed multiport comparison introduces path-length, loss, and security-proof complications because quantum public keys must traverse the comparison process between Bob’s and Charlie’s laboratories.Alice could potentially tamper with states communicated between the receivers, and complete security proofs were initially available only for modified protocols.Source: §1 · pp. 86–87

2. No quantum memory requirement

  • After correlated classical verification keys are established through quantum communication, signing and verification proceed with a fully classical algorithm using mismatch thresholds for rejection or acceptance.The protocol parallels using QKD to establish a shared secret before classical one-time-pad encryption, but generates correlations for digital signatures instead.Source: §2 · p. 87
  • The no-memory QDS protocol replaces coherently stored quantum public keys with receiver-specific classical verification keys, preserving security because Alice cannot know which positions they measured conclusively.Receivers use unambiguous state discrimination to record certain positions and values; Alice must provide the full classical description, which cannot match all possible verification keys unless honest.Source: §2 · p. 87

3. QDS from QKD technology … XVI. CONCLUSIONS

This section examines QDS developments from QKD-based protocols through insecure-channel, multiparty, experimental, and classical-signature settings, then identifies key theoretical, experimental, security, and deployment challenges for quantum cryptography. It highlights requirements including robust long-distance QKD, practical repeaters, composable security, channel-capacity results, and defenses against implementation loopholes.

4. Insecure quantum channels

  • QDS remains possible at channel-error rates higher than QKD, enabling operation where QKD is experimentally infeasible.Using different quantum states for Bob and Charlie also limits forging because forgers lack complete copies of the legitimate quantum public key.Source: §4 · p. 88

3. QDS from QKD technology

  • QDS can use QKD technology without quantum memory or authenticated quantum channels, with non-repudiation ensured by secret symmetrization and threshold separation.Symmetrization prevents Alice from making Bob accept while Charlie rejects, and parameter estimation bounds channel tampering.Source: §3 · pp. 87–88, §1 · p. 88, §4 · p. 88

2. Security intuition and performance

  • Forging, repudiation, and honest-abort probabilities decrease exponentially with string length when thresholds satisfy pe < sa < sv < pf.The respective exponents depend on pf−sa, sv−sa, and pe−sa; threshold intervals are typically equally separated.Source: §1 · p. 88, §2 · p. 89

H. Extending QDS: Multiple parties, longer messages, and MDI

  • Multiparty QDS introduces quadratic communication requirements, collusion and transferability issues, while MDI-QDS adds side-channel protection and supports flexible quantum-network routing.Longer messages also require attention because single-bit iteration permits ordering attacks and may scale inefficiently.Source: H. Extending QDS: Multiple parties,… · pp. 89–90

I. Experimental QDS realizations

  • QDS experiments progressed from same-laboratory proof-of-principle demonstrations to kilometer-scale, fully secure, metropolitan-network implementations and high-rate protocols.Later protocols using decoy states and other improvements reached tens to hundreds of kilometers, bringing QDS on par with QKD in practicality.Source: §2 · p. 90, §1 · p. 90

J. Classical unconditional secure signatures

  • Classical unconditionally secure signatures can reduce the task to point-to-point secret keys, with Ref. using universal hashing for logarithmic key-size scaling with message length.These protocols require neither authenticated broadcast channels, anonymous channels, nor trusted third parties, and QKD can provide their secret keys.Source: J. Classical unconditional secure… · p. 91, K. Summary and outlook · p. 91

K. Summary and outlook

  • QDS offers information-theoretically secure, one-time signatures but requires fixed participating parties and lacks universal verifiability compared with classical public-key signatures.Its practical value depends on quantum-network infrastructure supporting many potential parties.Source: J. Classical unconditional secure… · p. 90, K. Summary and outlook · p. 91
  • QDS research remains promising because it may achieve better long-message scaling, linear quantum-channel scaling, and security at noise levels too high for QKD.Ref. demonstrates linear channel scaling, while Ref. demonstrates security beyond the QKD-feasible noise regime.Source: K. Summary and outlook · p. 91

XVI. CONCLUSIONS

  • QKD still needs robust protocols supporting long distances and high rates, potentially through practical repeaters and end-to-end security despite unreliable or untrusted middle nodes.The proposed routes rely on EPR-like correlations, either by producing maximally entangled states or by performing Bell detections.Source: §XVI · p. 92
  • Theoretical priorities include fully composable finite-size security for DV and CV protocols and secret-key capacities for thermal-loss and amplitude-damping channels.Two-way assisted capacities may require approaches beyond current simulation techniques.Source: §XVI · p. 92
  • Experimental work spans integrated photonics, satellite links, trusted-node networks, higher-dimensional and continuous-variable systems, and more robust point-to-point protocols.THz and microwave wavelengths may also support under-developed short-range applications.Source: §XVI · p. 92
  • QKD is not fully secure until loopholes from side channels, detector imperfections, and weak random-number generators are addressed through quantum-hacking countermeasures.Quantum hacking and countermeasures are identified as an important and growing area.Source: §XVI · p. 92
  • Deployment should integrate quantum cryptography with classical infrastructure and layer security according to confidentiality needs, from bounded-memory or data-locking schemes to standard QKD and DI-QKD.The conclusions associate these levels respectively with private communications, financial transactions, and political or strategic decisions; quantum fingerprinting, secret sharing, Byzantine agreement, and e-voting remain additional protocols of interest.Source: §XVI · p. 92

Appendix A: Formulas for Gaussian states … 3. Entropic quantities

The appendix develops Gaussian-state formulas using covariance matrices, symplectic methods, and operator exponentials, culminating in moment-based expressions for entropy, relative entropy, and relative entropy variance. It also reviews closed-form Gaussian fidelity and computational advantages of avoiding full symplectic diagonalization.

Appendix A: Formulas for Gaussian states

  • Moment-based formulas compute Gaussian-state fidelity, von Neumann entropy, quantum relative entropy, and its variance using operator exponential representations.The operator exponential form enables direct evaluation of these quantities from Gaussian-state parameters.Source: Appendix A · p. 93

1. Symplectic action and its computation

  • Symplectic actions extend odd scalar functions to covariance matrices and enable operator-function calculations without explicitly deriving every symplectic diagonalization matrix.Matrix functions are readily computed numerically or symbolically, whereas closed formulas for the diagonalizing matrix S are known only for specific two-mode states.Source: §1 · pp. 93–94

2. Fidelity between arbitrary Gaussian states

  • A general closed form expresses the fidelity between arbitrary multimode Gaussian states through their covariance matrices and first-moment difference.The construction uses Gibbs matrices and operator square roots, with the final covariance-matrix expression remaining invariant under exchanging the two states.Source: §2 · p. 94
  • For Gaussian-state discrimination, fidelity supplies a measurable single-POVM bound, and the optimal POVM can be explicitly computed for multimode states [779].For single-mode states, the optimal measurement is one of number-resolving detection, quadrature detection, or projection onto the eigenbasis of qˆpˆ + pˆqˆ [779].Source: §2 · pp. 94–95

3. Entropic quantities

  • The entropic functional yields both von Neumann entropy and quantum relative entropy directly from Gaussian states’ first moments, covariance matrices, and Gibbs matrices [33].The von Neumann entropy depends only on the covariance matrix’s symplectic eigenvalues, while relative entropy uses the two states’ statistical moments.Source: §3 · p. 95
  • The invariant relative-entropy formula bypasses full symplectic diagonalization, directly computing quantum relative entropy from statistical moments even when the diagonalizing matrix S is difficult to obtain.The symplectic spectrum remains easy to compute for von Neumann entropy, but the corresponding symplectic matrix is known only in limited cases.Source: §3 · p. 95
  • Relative entropy variance is expressed through the two Gaussian states’ first and second moments using Gibbs-matrix differences and B = 8κ^2G2V1G2.The formula was first derived for κ = 1 in and generalized to arbitrary κ in [611].Source: §3 · p. 95

Related papers

Loading 1906.01645v1…