Fast, efficient error reconciliation for quantum cryptography
W. T. Buttler, S. K. Lamoreaux, J. R. Torgerson, G. H. Nickel, C. H. Donahue, C. G. Peterson
备注：
8 pages, 1 figure, 3 tables. This resubmission constitutes a referee modified response. In addition, the probabilities were incorrect in the 1st submission; that said, the actual algorithm outlined, along with its conclusions, remain unchanged. Only the Section on Hamming error correcting and detecting is significantly changed. This corrections resulted in the deletion of one Table, and the inclusion of 4 new equations
We describe a new error reconciliation protocol {\it Winnow} based on the exchange of parity and Hamming's ``syndrome'' for $N-$bit subunits of a large data set. {\it Winnow} was developed in the context of quantum key distribution and offers significant advantages and net higher efficiency compared to other widely used protocols within the quantum cryptography community. A detailed mathematical analysis of Winnow is presented in the context of practical implementations of quantum key distribution; in particular, the information overhead required for secure implementation is one of the most important criteria in the evaluation of a particular error reconciliation protocol. The increase in efficiency for Winnow is due largely to the reduction in authenticated public communication required for its implementation.
We introduce new quantum key distribution protocols using quantum continuous variables, that are secure against individual attacks for any transmission of the optical line between Alice and Bob. In particular, it is not required that this transmission is larger than 50 %. Though squeezing or entanglement may be helpful, they are not required, and there is no need for quantum memories or entanglement purification. These protocols can thus be implemented using coherent states and homodyne detection, and they may be more efficient than usual protocols using quantum discrete variables.
We consider the two-way quantum cryptographic protocol with coherent states assuming direct reconciliation. A detailed security analysis is performed considering a two-mode coherent attack, that represents the residual eavesdropping once the parties have reduced the general attack by applying symmetric random permutations. In this context we provide a general analytical expression for the keyrate, discussing the impact of the residual two-mode correlations on the security of the scheme. In particular we identify the optimal eavesdropping against two-way quantum communication, which is given by…
We investigate the performance of continuous variable quantum key distribution scheme in a practical setting. More specifically, we take non-ideal error reconciliation procedure into account. The quantum channel connecting the two honest parties is assumed to be lossy but noiseless. Secret key rates are given for the case that the measurement outcomes are postselected or a reverse reconciliation scheme is applied. The reverse reconciliation scheme loses its initial advantage in the practical setting. If one combines postselection with reverse reconciliation however, much of this advantage can …
We analyze the security of the two-way continuous-variable quantum key distribution protocol in reverse reconciliation against general two-mode attacks, which represent all accessible attacks at fixed channel parameters. Rather than against one specific attack model, the expression of secret key rates of the two-way protocol are derived against all accessible attack models. It is found that there is an optimal two-mode attack to minimize the performance of the protocol in terms of both secret key rates and maximal transmission distances. We identify the optimal two-mode attack, give the specif…
We discuss quantum key distribution protocols using quantum continuous variables. We show that such protocols can be made secure against individual gaussian attacks regardless the transmission of the optical line between Alice and Bob. This is achieved by reversing the reconciliation procedure subsequent to the quantum transmission, that is, using Bob's instead of Alice's data to build the key. Although squeezing or entanglement may be helpful to improve the resistance to noise, they are not required for the protocols to remain secure with high losses. Therefore, these protocols can be impleme…
We expand the recently discussed continuous-variable quantum key distribution scheme of Heid and Luetkenhaus (2006) to qudits with a lossy but noiseless quantum channel. Postselection methods are used. Secret key rates are calculated in the presence of loss for the direct and the reverse reconciliation method. In the case of reverse reconciliation the secret key rate increases with higher dimensions, in the case of direct reconciliation the result is reverse. Several ways of optimising the amplitude are discussed. In a next step the used states are generalised to squeezed states. Again secret …
Quantum Cryptography is on the verge of commercial application. One of its greatest limitations is over long distance - secret key rates are low and the longest fibre over which any key has been exchanged is currently 100 km. We investigate the quantum relay, which can increase the maximum distance at which quantum cryptography is possible. The relay splits the channel into sections, and sends a different photon across each section, increasing the signal to noise ratio. The photons are linked as in teleportation, with entangled photon pairs and Bell measurements. We show that such a scheme cou…
It is widely accepted in the quantum cryptography community that interactive information reconciliation protocols, such as cascade, are ineffcient due to the communication overhead. Instead, non-interactive information reconciliation protocols based on i.e. LDPC codes or, more recently, polar codes have been proposed. In this work, we argue that interactive protocols should be taken into consideration in modern quantum key distribution systems. In particular, we demonstrate how to improve the performance of cascade by proper implementation and use. Our implementation of cascade reaches a throu…
Privacy amplification is the key step to guarantee the security of quantum communication. The existing security proofs require accumulating a large number of raw key bits for privacy amplification. This is similar to block ciphers in classical cryptography that would delay the final key generation since an entire block must be accumulated before privacy amplification. Moreover, any leftover errors after information reconciliation would corrupt the entire block. By modifying the security proof based on quantum error correction, we develop a stream privacy amplification scheme, which resembles t…
We present a continuous variable (CV) quantum key distribution (QKD) scheme based on the CV quantum teleportation of coherent states that yields a raw secret key made up of discrete variables for both Alice and Bob. This protocol preserves the efficient detection schemes of current CV technology (no single-photon detection techniques) and, at the same time, has efficient error correction and privacy amplification schemes due to the binary modulation of the key. We show that for a certain type of incoherent attack it is secure for almost any value of the transmittance of the optical line used b…
We study the security of two-way quantum cryptography at different wavelengths of the electromagnetic spectrum, from the optical range down to the microwave range. In particular, we consider a two-way quantum communication protocol where Gaussian-modulated thermal states are subject to random Gaussian displacements and finally homodyned. We show how its security threshold (in reverse reconciliation) is extremely robust with respect to the preparation noise and able to outperform the security thresholds of one-way protocols at any wavelength. As a result, improved security distances are now acc…
We analyze the security of quantum cryptography schemes for $d$-level systems using 2 or $d+1$ maximally conjugated bases, under individual eavesdropping attacks based on cloning machines and measurement after the basis reconciliation. We consider classical advantage distillation protocols, that allow to extract a key even in situations where the mutual information between the honest parties is smaller than the eavesdropper's information. In this scenario, advantage distillation protocols are shown to be as powerful as quantum distillation: key distillation is possible using classical techniqu…
A quantum cryptographic protocol based in public key cryptography combinations and private key cryptography is presented. Unlike the BB84 protocol [1] and its many variants [2,3] two quantum channels are used. The present research does not make reconciliation mechanisms of information to derive the key. A three related system of key distribution are described.
Recently, we have shown the advantages of two-way quantum communications in continuous variable quantum cryptography. Thanks to this new approach, two honest users can achieve a non-trivial security enhancement as long as the Gaussian interactions of an eavesdropper are independent and identical. In this work, we consider asymmetric strategies where the Gaussian interactions can be different and classically correlated. For several attacks of this kind, we prove that the enhancement of security still holds when the two-way protocols are used in direct reconciliation.
The speed at which two remote parties can exchange secret keys over a fixed-length fiber-optic cable in continuous-variable quantum key distribution (CV-QKD) is currently limited by the computational complexity of post-processing algorithms for key reconciliation. Multi-edge low-density parity-check (LDPC) codes with low code rates and long block lengths were proposed for CV-QKD, in order to extend the maximum reconciliation distance between the two remote parties. Key reconciliation over multiple dimensions has been shown to further improve the error-correction performance of multi-edge LDPC …
We investigate the security against collective attacks of a continuous variable quantum key distribution scheme in the asymptotic key limit for a realistic setting. The quantum channel connecting the two honest parties is assumed to be lossy and imposes Gaussian noise on the observed quadrature distributions. Secret key rates are given for direct and reverse reconciliation schemes including postselection in the collective attack scenario. The effect of a non-ideal error correction and two-way communication in the classical post-processing step is also taken into account.
The security of quantum key distribution protocols is guaranteed by the laws of quantum mechanics. However, a precise analysis of the security properties requires tools from both classical cryptography and information theory. Here, we employ recent results in non-asymptotic classical information theory to show that one-way information reconciliation imposes fundamental limitations on the amount of secret key that can be extracted in the finite key regime. In particular, we find that an often used approximation for the information leakage during information reconciliation is not generally valid…
We address the role of the phase-insensitive trusted preparation and detection noise in the security of a continuous-variable quantum key distribution, considering the Gaussian protocols on the basis of coherent and squeezed states and studying them in the conditions of Gaussian lossy and noisy channels. The influence of such a noise on the security of Gaussian quantum cryptography can be crucial, even despite the fact that a noise is trusted, due to a strongly nonlinear behavior of the quantum entropies involved in the security analysis. We recapitulate the known effect of the preparation noi…
We consider two remote parties connected to a relay by two quantum channels. To generate a secret key, they transmit coherent states to the relay, where the states are subject to a continuous-variable (CV) Bell detection. We study the ideal case where Alice's channel is lossless, i.e., the relay is locally situated in her lab and the Bell detection is performed with unit efficiency. This configuration allows us to explore the optimal performances achievable by CV measurement-device-independent (MDI) quantum key distribution (QKD). This corresponds to the limit of a trusted local relay, where t…
A practical quantum key distribution (QKD) protocol necessarily runs in finite time and, hence, only a finite amount of communication is exchanged. This is in contrast to most of the standard results on the security of QKD, which only hold in the limit where the number of transmitted signals approaches infinity. Here, we analyze the security of QKD under the realistic assumption that the amount of communication is finite. At the level of the general formalism, we present new results that help simplifying the actual implementation of QKD protocols: in particular, we show that symmetrization ste…
A well-known empirical rule for the demand of wireless communication systems is that of Edholm's law of bandwidth. It states that the demand for bandwidth in wireless short-range communications doubles every 18 months. With the growing demand for bandwidth and the decreasing cell size of wireless systems, terahertz (THz) communication systems are expected to become increasingly important in modern day applications. With this expectation comes the need for protecting users' privacy and security in the best way possible. With that in mind, we show that quantum key distribution can operate in the…
Cascade is an information reconciliation protocol proposed in the context of secret key agreement in quantum cryptography. This protocol allows removing discrepancies in two partially correlated sequences that belong to distant parties, connected through a public noiseless channel. It is highly interactive, thus requiring a large number of channel communications between the parties to proceed and, although its efficiency is not optimal, it has become the de-facto standard for practical implementations of information reconciliation in quantum key distribution. The aim of this work is to analyze…
Information reconciliation (IR) ensures the correctness of quantum key distribution systems, by correcting the error bits existed in the sifted keys. In this article, we propose a polar codes-based IR scheme with the frozen bits erasure strategy, where an equivalent transmission of sifted keys is conducted, so that the frozen bits in the decoding procedure is erased to 0. Thus, our IR scheme can be implemented efficiently without the assumption of true random numbers. Furthermore, we implement the proposed IR scheme with the fast simplified successive cancellation list decoder and its throughp…
We have designed and realized a prototype that implements a continuous-variable quantum key distribution protocol based on coherent states and reverse reconciliation. The system uses time and polarization multiplexing for optimal transmission and detection of the signal and phase reference, and employs sophisticated error-correction codes for reconciliation. The security of the system is guaranteed against general coherent eavesdropping attacks. The performance of the prototype was tested over preinstalled optical fibres as part of a quantum cryptography network combining different quantum key…
Quantum key distribution (QKD) is a promising technique for secure communication based on quantum mechanical principles. To improve the secure key rate of a QKD system, most studies on reconciliation primarily focused on improving the efficiency. With the increasing performance of QKD systems, the research priority has shifted to the improvement of both throughput and efficiency. In this paper, we propose a high performance solution of Cascade reconciliation, including a high-throughput-oriented framework and an integrated-optimization-oriented scheme. Benefiting from the fully utilizing compu…
We present a new protocol for practical quantum cryptography, tailored for an implementation with weak coherent pulses. The key is obtained by a very simple time-of-arrival measurement on the data line; an interferometer is built on an additional monitoring line, allowing to monitor the presence of a spy (who would break coherence by her intervention). Against zero-error attacks (the analog of photon-number-splitting attacks), this protocol performs as well as standard protocols with strong reference pulses: the key rate decreases only as the transmission $t$ of the quantum channel. We present…
Quantum key distribution (QKD) relies on quantum and classical procedures in order to achieve the growing of a secret random string -the key- known only to the two parties executing the protocol. Limited intrinsic efficiency of the protocol, imperfect devices and eavesdropping produce errors and information leakage from which the set of measured signals -the raw key- must be stripped in order to distill a final, information theoretically secure, key. The key distillation process is a classical one in which basis reconciliation, error correction and privacy amplification protocols are applied t…
Quantum cryptography could well be the first application of quantum mechanics at the individual quanta level. The very fast progress in both theory and experiments over the recent years are reviewed, with emphasis on open questions and technological issues.
Quantum key distribution (QKD) is a quantum-proof key-exchange scheme which is fast approaching the communication industry. An essential component in QKD is the information reconciliation step, which is used for correcting the quantum-channel noise errors. The recently suggested blind reconciliation technique, based on low-density parity-check (LDPC) codes, offers remarkable prospectives for efficient information reconciliation without an a priori error rate estimation. We suggest an improvement of the blind-information-reconciliation protocol promoting a significant increase in the efficiency…
The secure distribution of the secret random bit sequences known as "key" material, is an essential precursor to their use for the encryption and decryption of confidential communications. Quantum cryptography is a new technique for secure key distribution with single-photon transmissions: Heisenberg's uncertainty principle ensures that an adversary can neither successfully tap the key transmissions, nor evade detection (eavesdropping raises the key error rate above a threshold value). We have developed experimental quantum cryptography systems based on the transmission of non-orthogonal photo…
We present a setup for quantum cryptography based on photon pairs in energy-time Bell states and show its feasability in a laboratory experiment. Our scheme combines the advantages of using photon pairs instead of faint laser pulses and the possibility to preserve energy-time entanglement over long distances. Moreover, using 4-dimensional energy-time states, no fast random change of bases is required in our setup : Nature itself decides whether to measure in the energy or in the time base.
It has been proven in the literature that the main technological factors limiting the communication rates of quantum cryptography systems by single photon are mainly related to the choice of the encoding method. In fact, the efficiency of the used sources is very limited, at best of the order of a few percent for the single photon sources and the photon counters can not be operated beyond a certain speed and with a low order of detection efficiency. In order to overcome partially these drawbacks, it is advantageous to use continuous quantum states as an alternative to standard encodings based …
This is a study of the security of the Coherent One-Way (COW) protocol for quantum cryptography, proposed recently as a simple and fast experimental scheme. In the zero-error regime, the eavesdropper Eve can only take advantage of the losses in the transmission. We consider new attacks, based on unambiguous state discrimination, which perform better than the basic beam-splitting attack, but which can be detected by a careful analysis of the detection statistics. These results stress the importance of testing several statistical parameters in order to achieve higher rates of secret bits.
We propose a variational quantum attack algorithm (VQAA) for classical AES-like symmetric cryptography, as exemplified the simplified-data encryption standard (S-DES). In the VQAA, the known ciphertext is encoded as the ground state of a Hamiltonian that is constructed through a regular graph, and the ground state can be found using a variational approach. We designed the ansatz and cost function for the S-DES's variational quantum attack. It is surprising that sometimes the VQAA is even faster than Grove's algorithm as demonstrated by our simulation results. The relationships of the entanglem…
Existing quantum cryptography is resistant against secrecy-breaking quantum computers but suffers fast decay of the signal at long distances. The various types of repeaters of propagating quantum states have been developed to meet the challenge, but the problem is far from being solved. We step in the breach and put forth long-distance high secrecy optical cryptography, creating the fast quantum key distribution over distances up to 40,000 kilometers. The key element of the proposed protocol is the physical control over the transmission line.
The Differential-Phase-Shift (DPS) and the Coherent-One-Way (COW) are among the most practical protocols for quantum cryptography, and are therefore the object of fast-paced experimental developments. The assessment of their security is also a challenge for theorists: the existing tools, that allow to prove security against the most general attacks, do not apply to these two protocols in any straightforward way. We present new upper bounds for their security in the limit of large distances ($d \gtrsim 50$km with typical values in optical fibers) by considering a large class of collective attac…
We investigate the performance of several continuous-variable quantum key distribution protocols in the presence of fading channels. These are lossy channels whose transmissivity changes according to a probability distribution. This is typical in communication scenarios where remote parties are connected by free-space links subject to atmospheric turbulence. In this work, we assume the worst-case scenario where an eavesdropper has full control of a fast fading process, so that she chooses the instantaneous transmissivity of a channel, while the remote parties can only detect the mean statistic…
We present and demonstrate a new protocol for practical quantum cryptography, tailored for an implementation with weak coherent pulses to obtain a high key generation rate. The key is obtained by a simple time-of-arrival measurement on the data line; the presence of an eavesdropper is checked by an interferometer on an additional monitoring line. The setup is experimentally simple; moreover, it is tolerant to reduced interference visibility and to photon number splitting attacks, thus featuring a high efficiency in terms of distilled secret bit per qubit.
Commercial photon-counting modules based on actively quenched solid-state avalanche photodiode sensors are used in a wide variety of applications. Manufacturers characterize their detectors by specifying a small set of parameters, such as detection efficiency, dead time, dark counts rate, afterpulsing probability and single-photon arrival-time resolution (jitter). However, they usually do not specify the range of conditions over which these parameters are constant or present a sufficient description of the characterization process. In this work, we perform a few novel tests on two commercial d…
In this thesis we study the finite-size analysis of two continuous-variables quantum key distribution schemes. The first one is the one-way protocol using Gaussian modulation of thermal states and the other is the measurement-device-independent protocol. To do so, we adopt an efficient channel parameter estimation method based on the assumption of the Gaussian variables and the central limit theorem introduced by Ruppert et al. [Phys. Rev. A 90, 062310 (2014)]. Furthermore, we present a composable security analysis of the measurement device independent protocol for coherent attacks with a chan…
Secure random numbers are a fundamental element of many applications in science, statistics, cryptography and more in general in security protocols. We present a method that enables the generation of high-speed unpredictable random numbers from the quadratures of an electromag- netic field without any assumption on the input state. The method allows to eliminate the numbers that can be predict due the presence of classical and quantum side information. In particular, we introduce a procedure to estimate a bound on the conditional min-entropy based on the Entropic Uncertainty Principle for posi…
We report on the implementation of a reverse-reconciliated coherent-state continuous-variable quantum key distribution system, with which we generated secret keys at a rate of more than 2 kb/s over 25 km of optical fiber. Time multiplexing is used to transmit both the signal and phase reference in the same optical fiber. Our system includes all experimental aspects required for a field implementation of a quantum key distribution setup. Real-time reverse reconciliation is achieved by using fast and efficient LDPC error correcting codes.
In August 2015 the cryptographic world was shaken by a sudden and surprising announcement by the US National Security Agency NSA concerning plans to transition to post-quantum algorithms. Since this announcement post-quantum cryptography has become a topic of primary interest for several standardization bodies. The transition from the currently deployed public-key algorithms to post-quantum algorithms has been found to be challenging in many aspects. In particular the problem of evaluating the quantum-bit security of such post-quantum cryptosystems remains vastly open. Of course this question …
We describe a continuous variables coherent states quantum key distribution system working at 1550 nm, and entirely made of standard fiber optics and telecom components, such as integrated-optics modulators, couplers and fast InGaAs photodiodes. The setup is composed of an emitter randomly modulating a coherent state in the complex plane with a doubly Gaussian distribution, and a receiver based on a shot noise limited time-resolved homodyne detector. By using a reverse reconciliation protocol, the device can transfer a raw key rate up to 1 Mb/s, with a proven security against Gaussian or non-G…
Emerging communication and cryptography applications call for reliable, fast, unpredictable random number generators. Quantum random number generation (QRNG) allows for the creation of truly unpredictable numbers thanks to the inherent randomness available in quantum mechanics. A popular approach is using the quantum vacuum state to generate random numbers. While convenient, this approach was generally limited in speed compared to other schemes. Here, through custom co-design of opto-electronic integrated circuits and side-information reduction by digital filtering, we experimentally demonstra…
Random numbers are essential for our modern information based society e.g. in cryptography. Unlike frequently used pseudo-random generators, physical random number generators do not depend on complex algorithms but rather on a physical process to provide true randomness. Quantum random number generators (QRNG) do rely on a process, which can be described by a probabilistic theory only, even in principle. Here we present a conceptually simple implementation, which offers a 100% efficiency of producing a random bit upon a request and simultaneously exhibits an ultra low latency. A careful techni…
Relativistic protocols have been proposed to overcome some impossibility results in classical and quantum cryptography. In such a setting, one takes the location of honest players into account, and uses the fact that information cannot travel faster than the speed of light to limit the abilities of dishonest agents. For example, various relativistic bit commitment protocols have been proposed. Although it has been shown that bit commitment is sufficient to construct oblivious transfer and thus multiparty computation, composing specific relativistic protocols in this way is known to be insecure…
Quantum cryptography is arguably the fastest growing area in quantum information science. Novel theoretical protocols are designed on a regular basis, security proofs are constantly improving, and experiments are gradually moving from proof-of-principle lab demonstrations to in-field implementations and technological prototypes. In this review, we provide both a general introduction and a state of the art description of the recent advances in the field, both theoretically and experimentally. We start by reviewing protocols of quantum key distribution based on discrete variable systems. Next we…
Relativistic cryptography is a proposal for achieving unconditional security that exploits the fact that no information carrier can travel faster than the speed of light. It is based on space-time constraints but doesn't require quantum hardware. Nevertheless, it was unclear whether this proposal is realistic or not. Recently, Alikhani et al. [ABC+21] performed an implementation of a relativistic zero-knowledge for NP. Their implemented scheme shows the feasibility of relativistic cryptography but it is only secure against classical adversaries. In this work, we present a new relativistic prot…
Random numbers are an essential resource to many applications, including cryptography and Monte Carlo simulations. Quantum random number generators (QRNGs) represent the ultimate source of randomness, as the numbers are obtained by sampling a physical quantum process that is intrinsically probabilistic. However, they are yet to be widely employed to replace deterministic pseudo random number generators (PRNG) for practical applications. QRNGs are regarded as interesting devices. However they are slower than PRNGs for simulations and are typically seen as clumsy laboratory prototypes, prone to …
Shor's quantum algorithm is very important for cryptography, since it can factor large numbers much faster than classical algorithms. In this study, we implement a simulator for Shor's quantum algorithm on graphic processor units (GPU) and compare our results with Liquid -which is Microsoft quantum simulation platform- and two classical CPU-implementations. We evaluate 10 benchmarks for comparing our GPU implementation with Liquid and single-core implementation. The analysis shows that GPU vector operations is more suitable for Shor's quantum algorithm. Our GPU kernel function is compute-bound…
Quantum technologies hold the promise of not only faster algorithmic processing of data, via quantum computation, but also of more secure communications, in the form of quantum cryptography. In recent years, a number of protocols have emerged which seek to marry these concepts for the purpose of securing computation rather than communication. These protocols address the task of securely delegating quantum computation to an untrusted device while maintaining the privacy, and in some instances the integrity, of the computation. We present a review of the progress to date in this emerging area.
The previous work showed that the Y00 protocol could stay secure with the eavesdropper's guessing probability on the secret keys being strictly less than one under an unlimitedly long known-plaintext attack with quantum memory. However, an assumption that at least a fast correlation attack is completely disabled by irregular mapping. The present study shows that the Y00 protocol can be information-theoretic secure under any quantum-computational crypto-analyses if the Y00 system is well designed. The Y00 protocol directly encrypts messages with short secret keys expanded into pseudo-random run…
