PaperlayerView exact revision on arXiv

Source-linked AI summary

Quantum Conference Key Agreement: A Review

Gláucia Murta, Federico Grasselli, Hermann Kampermann, Dagmar Bruß

arXiv:2003.10186v2quant-ph

TL;DR

The paper addresses how more than two parties can establish a common secret key, beyond composing bipartite QKD links. It reviews CKA protocols that exploit multipartite entanglement in device-dependent and device-independent settings. The review covers rate advantages, implementation trade-offs, security-analysis challenges, and alternatives to GHZ-state distillation.

  • Problem

    Conference key agreement seeks a common secret key for more than two parties, while multipartite quantum correlations may offer protocols beyond compositions of bipartite QKD links.

  • Method

    The paper reviews quantum CKA proposals based on multipartite entanglement in both device-dependent and device-independent scenarios.

  • Results

    The reviewed protocols include higher-rate multipartite schemes in constrained networks, W-state rates scaling linearly with channel transmittance, continuous-variable MDI protocols, and private-state approaches not requiring GHZ distillation.

  • Takeaways & Limitations

    Multipartite entanglement supports genuinely multipartite CKA designs with potential network advantages, while private states broaden the resources usable for conference keys.

Abstract

from arXiv · show

Conference key agreement (CKA), or multipartite key distribution, is a cryptographic task where more than two parties wish to establish a common secret key. A composition of bipartite quantum key distribution protocols can accomplish this task. However, the existence of multipartite quantum correlations allows for new and potentially more efficient protocols, to be applied in future quantum networks. Here, we review the existing quantum CKA protocols based on multipartite entanglement, both in the device-dependent and the device-independent scenario.

I. INTRODUCTION

CKA extends key distribution to N users establishing a common secret key, and multipartite entanglement motivates genuinely multipartite protocols beyond compositions of bipartite links. The section also introduces the security requirements of correctness, secrecy, and completeness.

  • I. INTRODUCTION: CKA generalizes key distribution so N users establish a common secret key for secure network communication.A common key can alternatively be constructed from several bipartite QKD links.
  • I. INTRODUCTION: Multipartite entanglement enables genuinely multipartite CKA schemes beyond protocols based only on bipartite QKD.The review focuses on proposals using multipartite quantum entanglement to establish a conference key.
  • A. Multipartite entangled resources: GHZ and W states belong to distinct multipartite entanglement classes with different physical properties relevant to protocol design.GHZ entanglement is not robust to particle loss, whereas W states retain bipartite entanglement when one particle is lost.
  • 1. Security definition: A secure CKA protocol requires correctness, secrecy, and completeness, with correctness and secrecy jointly bounded by ϵs ≥ ϵcorr + ϵsec.Completeness additionally requires an honest implementation whose non-abort probability exceeds 1 − ϵc.
  • 1. Security definition: Composable security allows a generated conference key to serve as a building block for further protocols, subject to the stated security conditions.The passage notes that this implication does not always carry over to the device-independent scenario.

2. Security model

The security model treats Eve as an external adversary who can observe public communication and tamper with quantum channels. Attacks range from memoryless individual attacks to unrestricted coherent attacks with cross-round correlations.

  • 2. Security model: Eve can eavesdrop on all public communication and attempt to tamper with quantum channels or exploit correlations with the conference key.The adversary is external to the N communicating parties.
  • 2. Security model: Individual attacks restrict Eve to separate attacks and measurements in each round without quantum memory.Her quantum side information is measured round by round.
  • 2. Security model: Collective attacks let Eve apply the same IID attack each round, store quantum side information, and process it jointly afterward.This distinguishes collective attacks from individual attacks by granting Eve quantum memory.
  • 2. Security model: Coherent attacks impose no capability assumptions beyond quantum mechanics, allowing arbitrary correlations across rounds.The shared states at one round may correlate with previous and future rounds.

C. Generic Protocols

Generic multipartite CKA protocols distribute entangled states, measure them, estimate parameters, reconcile raw keys, and apply privacy amplification. Their asymptotic performance is summarized by the key rate.

  • C. Generic Protocols: The overall goal is for N users to combine shared quantum resources with local operations and public communication to establish a secure conference key.The generic protocol structure is organized into preparation, measurement, estimation, reconciliation, and amplification.
  • C. Generic Protocols: A source distributes a multipartite entangled state to all N parties repeatedly, after which they perform randomly selected local measurements.One measurement setting is favored for key generation, while others provide test rounds.
  • C. Generic Protocols: Parameter estimation uses announced test and sampled key-generation data to assess correlations and possible eavesdropper influence.The parties retain raw-key strings of n_raw < n bits after this step.
  • C. Generic Protocols: Information reconciliation publicly corrects every Bob’s raw key to match Alice’s string, accounting for the multipartite setting.The correction procedure must handle all Bobs rather than a single receiver.
  • C. Generic Protocols: Privacy amplification applies a communicated two-universal hash function to partially secure strings, producing a secure key of ℓ < n_raw bits.Every party applies the same selected hash function.
  • C. Generic Protocols: The asymptotic key rate r∞ describes the key rate in the limit of infinitely many protocol rounds.The repetition rate τ is the inverse duration of one preparation-and-measurement round.

III. PROTOCOLS FOR MULTI-QUBIT STATES

Early multi-qubit CKA protocols use multipartite GHZ correlations as a generalization of familiar bipartite key-distribution protocols. GHZ measurements provide perfectly correlated, random, uniformly distributed Z-basis outcomes, with distinct constraints for N ≥ 3.

  • III. PROTOCOLS FOR MULTI-QUBIT STATES: The first multipartite CKA proposals exploit correlations of the N-party GHZ state.Later protocols generalize six-state and BB84 approaches to multipartite systems.
  • III. PROTOCOLS FOR MULTI-QUBIT STATES: GHZ-state measurements in the Z basis yield perfectly correlated, random, and uniformly distributed outcomes suitable for conference key agreement.For N ≥ 3, this perfect correlation requires all parties to measure in the Z basis.
  • III. PROTOCOLS FOR MULTI-QUBIT STATES: The multipartite GHZ correlation differs from the bipartite case, where a matching basis can be selected for Bob for each basis chosen by Alice.This basis flexibility underlies bipartite six-state and BB84 QKD.
  • III. PROTOCOLS FOR MULTI-QUBIT STATES: Early three-party GHZ protocols proved security against individual attacks for ideal GHZ-state preparation but did not consider noise robustness.Subsequent work addressed security through GHZ-state distillation.

1. Multiparty six-state protocol

The multipartite six-state protocol generalizes six-state QKD by using three measurement bases, with Z for key generation and X/Y for parameter estimation. Its security analysis estimates error rates and reduces arbitrary states to depolarized states, yielding an asymptotic key-rate expression and higher rates than bipartite implementations in a constrained network setting.

  • Protocol operation: The protocol uses X, Y, and Z measurements, with Z-basis rounds generating the key and X/Y rounds testing information leakage.The X- and Y-basis measurements are performed less frequently for parameter estimation.
  • Parameter estimation: The Z-measurement statistics estimate bipartite and total QBERs, while X-basis statistics estimate the QBER associated with X^⊗N.QABi measures disagreement between Alice and Bob_i; QZ is the probability that at least one Bob disagrees with Alice.
  • Key rate: The asymptotic key rate is expressed as r∞ = 1 − h(QX) − max_i h(QABi), combining the X-basis and largest bipartite error contributions.The rate applies to the depolarized-state analysis and depends on QX, QZ, and the bipartite QBERs, with the displayed expression involving QX and QABi.
  • Security analysis: The security proof reduces arbitrary N-qubit states to depolarized GHZ-diagonal states through local operations implementable by outcome flips and additional Y-basis measurements.The operations preserve the relevant key-generation statistics while simplifying the security analysis.
  • Network performance: In a quantum-router bottleneck with constrained channel capacity, the GHZ-based multipartite six-state protocol achieves higher rates than several bipartite-QKD implementations when gate quality exceeds a threshold.This comparison concerns the network implementation analyzed in Ref..

2. Multiparty BB84 protocol

The multipartite BB84 protocol uses only Z- and X-basis measurements and bases its security analysis on smooth-entropy uncertainty relations. Its asymptotic rate is obtained by estimating the relevant conditional entropy from X-basis errors.

  • Protocol operation: The multipartite BB84 protocol requires measurements in only the Z and X bases.Its security analysis uses the uncertainty relation for smooth entropies, extending a technique used for bipartite BB84 security proofs.
  • Security analysis: The uncertainty relation connects Alice's Z-basis conditional min-entropy with the X-basis conditional max-entropy involving Alice and the Bobs.The incompatibility factor q equals m when Alice measures X or Z over m rounds.
  • Parameter estimation: The Bobs' X-basis outcomes estimate the entropy of Alice's X-outcome string through the data-processing inequality and the X-basis error.This provides the quantity needed for the finite- and asymptotic-security analysis.
  • Key rate: Reference establishes the asymptotic secret-key rate of the multiparty BB84 protocol.The supplied passage introduces this result without displaying the rate formula.

3. Comparison of multiparty six-state and BB84 protocols

The six-state protocol has higher asymptotic rates than multiparty BB84 for the same implementation, while BB84 can reach a nonzero finite-key rate with fewer rounds in the low-noise regime. The finite-key advantage of BB84 grows with the number of parties, although it may reflect rate-estimation overhead.

  • Asymptotic comparison: The six-state protocol's higher asymptotic rates arise because its protocol structure constrains the underlying state more strongly than BB84.This explanation is stated for any specific implementation.
  • Finite-key comparison: Although six-state tolerates higher noise, BB84 can require significantly fewer rounds to prove a nonzero key rate in the low-noise finite-key regime.The lower minimum-signal threshold for BB84 may be caused by differences in the techniques used to compute the finite-key rates.
  • Finite-key comparison: At fixed QABi = 0.03, multiparty BB84 yields a nonzero conference key with fewer rounds than six-state, and this finite-key advantage increases with N.Figure 2 compares N = 2, 5, and 8 under the local depolarizing-channel model.

4. Prepare-and-measure implementation

A prepare-and-measure reformulation reduces the entanglement Alice must control from N-partite to (N−1)-partite, with product states sufficient for most key-generation rounds. However, protocols using only separable states have a demonstrated security result only for N = 3, and their rates decrease with increasing N under the described extension.

  • Round-dependent resources: For Z-basis key-generation rounds, Alice can prepare product states by sending N−1 copies of the bit state to the Bobs.Entanglement remains necessary for the corresponding test-round states when Alice measures X or Y.
  • Resource reduction: Prepare-and-measure implementations can replace Alice's control of N-partite entanglement with control of (N−1)-partite entanglement.This reduces implementation resources for the multipartite protocols.
  • Round-dependent resources: Entanglement is required only in a small fraction of rounds for parameter estimation, while most key-generation rounds use product-state preparation.This feature is presented as particularly relevant to near-term noisy hardware.
  • Scope boundary: A separable-state prepare-and-measure protocol is proven secure for N = 3, but extending it to arbitrary N makes the distributed states increasingly distinguishable.The stated consequence is greater eavesdropper information with less disturbance and a decreasing secret-key rate, even under perfect implementation.

B. W state protocol

The W-state protocol uses post-selected multipartite entanglement generated by single-photon interference, producing a conference key whose loss scaling is favorable relative to GHZ-based protocols. Its security is established in the finite-key regime against coherent attacks.

  • Protocol construction: The protocol post-selects a W-class state through single-photon interference at a central untrusted node.Each party sends an optical pulse to a balanced multiport, and rounds with exactly one detector click are retained.
  • Protocol construction: Single-click events create a coherent superposition in which one party’s qubit is |1⟩ and all others are |0⟩, with equal weights and detector-dependent phases.The parties measure their qubits in an X-Y-plane direction chosen according to the detector that clicked.
  • Security analysis: The protocol estimates eavesdropper knowledge using the expectation value of Z⊗N, which equals −1 for a shared W-class state.The protocol cannot be recast as a prepare-and-measure scheme because the measurement direction depends on the clicked detector.
  • Security analysis: Security is proven in the finite-key regime against coherent attacks by the eavesdropper.
  • Performance: The W-state protocol’s key rate scales linearly with channel transmittance t, whereas GHZ-based protocols encoded in photon polarizations scale no better than t^N.This gives the W-state protocol an advantage in high-loss scenarios under the stated ideal assumptions.

IV. CONTINUOUS VARIABLE CONFERENCE KEY AGREEMENT

Continuous-variable CKA protocols use multipartite CV GHZ correlations in star networks, with one scheme post-selecting the state through a central multipartite Bell detection. These protocols support security against collective Gaussian attacks, while one also has finite-key composable security against coherent attacks.

  • Scope and resources: CV CKA protocols allow arbitrary numbers of users to establish conference keys through a central untrusted relay in a star network.The reviewed schemes build on protocols for three-party conferencing and extend them to general user numbers.
  • Scope and resources: Both protocols rely on correlations generated by an N-mode CV GHZ state.
  • Protocol construction: Protocol post-selects the multipartite CV GHZ state through a central multipartite Bell detection, while users send Gaussian-modulated coherent states to the relay.Beam splitters and homodyne detections implement the Bell measurement, whose public outcome enables displacement correction.
  • Key distillation: The corrected coherent-state variables retain CV GHZ correlations and are used to distil a binary conference key, with asymptotic rates expressed through mutual information and the Devetak-Winter formula.Unlike discrete-variable protocols, the correlated variables used for key distillation are complex numbers.
  • Comparison: Protocol is not measurement-device-independent and is harder to implement, although it could achieve slightly higher performance than protocol.It requires preparing several squeezed optical modes and entangling them into a specific target state.
  • Security: Both protocols are secure against collective Gaussian attacks, and protocol is additionally proven secure in finite-key composable security against coherent attacks.The latter result uses a Gaussian de Finetti reduction.

V. DEVICE-INDEPENDENT CONFERENCE KEY AGREEMENT

Device-independent conference key agreement uses multipartite Bell correlations and entropy-based security analysis, but its rates and composability remain constrained by analytical and adversarial challenges. The reviewed work also shows that conference keys need not arise from GHZ distillation alone.

  • Security analysis: DICKA security against coherent attacks must account for devices with memory that may change behavior across rounds and correlate with previous outcomes.This makes fully device-independent adversarial analysis significantly more intricate.
  • Device-independent security: DICKA security can be analyzed against fully adversarial devices using the entropy accumulation theorem, which reduces the analysis to collective attacks.The theorem maintains some noise robustness in the device-independent setting.
  • Security and composability: Device-independent composability is not guaranteed when the same devices are reused, unless parties can control and reset their internal memory between executions.Subsequent public communication can otherwise leak information about a previously generated key.
  • Device-independent security: The protocol of Ref. introduces a multiparty inequality that enables positive conference-key rates in the device-independent scenario.Its rates are evaluated for N = 3, 5, 8 under a depolarizing channel applied to all qubits.
  • Security analysis: Key-rate bounds in Ref. use an analytical lower bound on H(A|E) derived from a relation between the multipartite inequality and CHSH.For arbitrary Bell inequalities, direct computation of H(A|E) is generally unavailable; min-entropy estimation via semidefinite hierarchies is costly and may be non-tight.
  • Private states and resource states: Multipartite private-state theory establishes that an ε-secret conference key is equivalent, under LOCC, to distilling a state close to a private state.Multipartite bound-entangled states can be close to private states even when no GHZ state can be distilled.
  • Private states and resource states: Conference keys can be established from states that are biseparable in every round, although genuine multipartite entanglement is necessary for single-shot key distillation.Thus, single-round and multi-copy resource requirements differ.

VII. OUTLOOK

The outlook identifies experimental scaling and security-proof tightness as central challenges for quantum conference key agreement. It proposes new protocols, resource states, network architectures, and analytical tools to improve performance and noise tolerance.

  • Experimental outlook: Multipartite entanglement has been generated in ion traps, photonic systems, superconducting circuits, nuclear spin qubits in diamond, and atomic ensembles.Scaling these implementations to many users remains necessary for experimental progress.
  • Security-proof development: Developing new protocols and security-proof techniques is presented as important for making quantum CKA a feasible technology.The outlook links theory improvements to reduced experimental demands.
  • Protocol development: New protocols using different resource states and network architectures could improve performance and noise robustness.The review specifically identifies d-dimensional multipartite CKA as an undeveloped direction motivated by bipartite high-dimensional QKD.
  • Protocol development: Asymmetric high-dimensional multipartite entangled states can support layered protocols that establish secret keys simultaneously among different user subsets.This connects high-dimensional multipartite CKA with layered network architectures.
  • Security-proof development: DICKA protocols based on the introduced Bell inequalities currently have only non-tight numerical lower bounds on key rates.Tighter analytical security bounds could yield higher rates.
Loading 2003.10186v2…