The problem of security of quantum key protocols is examined. In addition to the distribution of classical keys, the problem of encrypting quantum data and the structure of the operators which perform quantum encryption is studied. It is found that unitary bases are central to both encryption of quantum information, as well as the generation of states used in generalized quantum key distribution (which are called mutually unbiased bases). A one-to-one correspondence between certain unitary bases and mutually unbiased bases is found. Finally, a new protocol for making anonymous classical broadcasts is given along with a security proof. An experimental procedure to implement this protocol is also given. In order to prove these new results, some new bounds for accessible information of quantum sources are obtained.
We prove the security of a high-capacity quantum key distribution protocol over noisy channels. By using entanglement purification protocol, we construct a modified version of the protocol in which we separate it into two consecutive stages. We prove their securities respectively and hence the security of the whole protocol.
We prove the security of the 1984 protocol of Bennett and Brassard (BB84) for quantum key distribution. We first give a key distribution protocol based on entanglement purification, which can be proven secure using methods from Lo and Chau's proof of security for a similar protocol. We then show that the security of this protocol implies the security of BB84. The entanglement-purification based protocol uses Calderbank-Shor-Steane (CSS) codes, and properties of these codes are used to remove the use of quantum computation from the Lo-Chau protocol.
We briefly review the security of the ping-pong protocol in light of several attack scenarios suggested by various authors since the proposal of the protocol. We refute one recent attack on an ideal quantum channel, and show that a recent claim of falseness of our original security proof is erroneous.
Two-way Gaussian protocols have the potential to increase quantum key distribution (QKD) protocols' secret-key rates by orders of magnitudes~[Phys.~Rev.~A {\bf 94}, 012322 (2016)]. Security proofs for two-way protocols, however, are underdeveloped at present. In this paper, we establish a security proof framework for the general coherent attack on two-way Gaussian protocols in the asymptotic regime. We first prove that coherent-attack security can be reduced to collective-attack security for all two-way QKD protocols. Next, we identify two different constraints that each provide intrusion para…
We discuss long code problems in the Bennett-Brassard 1984 (BB84) quantum key distribution protocol and describe how they can be overcome by concatenation of the protocol. Observing that concatenated modified Lo-Chau protocol finally reduces to the concatenated BB84 protocol, we give the unconditional security of the concatenated BB84 protocol.
Quantum key distribution protocols constitute an important part of quantum cryptography, where the security of sensitive information arises from the laws of physics. In this paper we introduce a new family of key distribution protocols and we compare its key with the well-known protocols such as BB84, PBC0 and generation rate to the well-known protocols such as BB84, PBC0 and R04. We also state the security analysis of these protocols based on the entanglement distillation and CSS codes techniques.
Ping-Pong protocol is a type of quantum key distribution which makes use of two entangled photons in the EPR state. Its security is based on the randomization of the operations that Alice performs on the travel photon (qubit), and on the anti-correlation between the two photons in the EPR state. In this paper, we study the security of this protocol against some known quantum attacks, and present a scheme that may enhance its security to some degree.
New quantum cryptography, often called Y-00 protocol, has much higher performance than the conventional quantum cryptographies. It seems that the conventional quantum cryptographic attacks are inefficient at Y-00 protocol as its security is based on the different grounds from that of the conventional ones. We have, then, tried to cryptoanalyze Y-00 protocol in the view of cryptographic communication system. As a result, it turns out that the security of Y-00 protocol is equivalent to that of classical stream cipher.
We use the noisy entanglement-assisted classical capacity formula [arXiv:1609.08592] to create a coherent-attack security framework for Gaussian two-way quantum key distribution protocols in the asymptotic region.
Two-way quantum key distribution protocols utilize bi-directional quantum communication to establish a shared secret key. Due to the increased attack surface, security analyses remain challenging. Here we investigate a high-dimensional variant of the Ping Pong protocol and perform an information theoretic security analysis in the finite-key setting. Our methods may be broadly applicable to other QKD protocols, especially those relying on two-way channels. Along the way, we show some fascinating benefits to high-dimensional quantum states applied to two-way quantum communication.
Quantum key distribution (QKD) protocols are cryptographic techniques with security based only on the laws of quantum mechanics. Two prominent QKD schemes are the BB84 and B92 protocols that use four and two quantum states, respectively. In 2000, Phoenix et al. proposed a new family of three state protocols that offers advantages over the previous schemes. Until now, an error rate threshold for security of the symmetric trine spherical code QKD protocol has only been shown for the trivial intercept/resend eavesdropping strategy. In this paper, we prove the unconditional security of the trine s…
We review the current status of the AlphaEta direct encryption protocol. After describing AlphaEta, we summarize the main security claims made on it. We then describe recent attacks developed against it in the literature, and suggest security enhancements and future research directions based on our results.
Several kinds of qubit-string-based(QS-based) bit commitment protocols are presented, and a definition of information-theoretic concealing is given. All the protocols presented here are proved to be secure under this definition. We suggest an attack algorithm to obtain the local unitary transformation introduced in no-go theorem, which is used to attack the binding condition, then study the security of our QS-based bit commitment protocols under this attack via introducing a new concept "physical security of protocol". At last we present a practical QS-based bit commitment scheme against chann…
We derive a bound for the security of QKD with finite resources under one-way post-processing, based on a definition of security that is composable and has an operational meaning. While our proof relies on the assumption of collective attacks, unconditional security follows immediately for standard protocols like Bennett-Brassard 1984 and six-states. For single-qubit implementations of such protocols, we find that the secret key rate becomes positive when at least N\sim 10^5 signals are exchanged and processed. For any other discrete-variable protocol, unconditional security can be obtained us…
Arbitrated quantum signatures (AQS), for signing quantum message, have been proposed. It was claimed that the AQS schemes could guarantee unconditional security. However, in this paper, we show that all the presented AQS protocols are insecure if quantum one-time pad encryption is used where the signer Alice can always successfully acquire Bob's secret key and disavow any of her signatures. The detailed attack strategies and security analysis are described. Furthermore, the original version of the protocols is revised and accordingly the security of the AQS protocols are improved. And meanwhil…
Designing a quantum key agreement (QKA) protocol is always a challenging task, because both the security and the fairness properties have to be considered simultaneously. Recently, Zhu et al. (Quantum Inf Process 14(11): 4245-4254) pointed out that Shukla et al.'s QKA protocol (Quantum Inf Process 13(11): 2391-2405) has some security flaws (which lead to the Participant Attack). Moreover, they proposed an improvement to avoid these weaknesses. However this study points out that the improved protocol also suffers from a colluding attack, i.e., two dishonest participants in the protocol can coll…
In this paper we review a number of issues on the security of quantum key distribution (QKD) protocols that bear directly on the relevant physics or mathematical representation of the QKD cryptosystem. It is shown that the cryptosystem representation itself may miss out many possible attacks which are not accounted for in the security analysis and proofs. Hence the final security claims drawn from such analysis are not reliable, apart from foundational issues about the security criteria that are discussed elsewhere. The cases of continuous-variable QKD and multi-photon sources are elaborated u…
Inspired by the semi-quantum protocols, this paper defines the lightweight quantum security protocols, in which lightweight participants can only operate two out of four very lightweight quantum operations. Subsequently, this study proposes a Lightweight Mediated Quantum Key Distribution (LMQKD) protocol as an example to disclose the feasibility and advantage of the lightweight quantum protocol. In the proposed protocol, a dishonest third party (TP) with complete quantum capabilities helps two lightweight quantum users establish a secure key. The lightweight quantum users are allowed to perfor…
The "Ping-Pong" (PP) protocol is a two-way quantum key protocol based on entanglement. In this protocol, Bob prepares one maximally entangled pair of qubits, and sends one qubit to Alice. Then, Alice performs some necessary operations on this qubit and sends it back to Bob. Although this protocol was proposed in 2002, its security in the noisy and lossy channel has not been proven. In this report, we add a simple and experimentally feasible modification to the original PP protocol, and prove the security of this modified PP protocol against collective attacks when the noisy and lossy channel i…
The security of quantum key distribution (QKD) has been proven for different protocols, in particular for the BB84 protocol. It has been shown that this scheme is robust against eventual imperfections in the state preparation, and sending only three different states delivers the same secret key rate achievable with four states. In this work, we prove, in a finite-key scenario, that the security of this protocol can be maintained even with less measurement operators on the receiver. This allows us to implement a time-bin encoding scheme with a minimum amount of resources.
We analyze the security against collective attacks for a homodyne-based continuous-variable quantum key distribution protocol using binary coherent states and postselection. We derive a lower bound of the secret key rate in an asymptotic scenario, and numerically optimize it for the case of a symmetric Gaussian channel.
We analyse security costs in one segment of nested purification protocol in a large quantum cryptography network, employing the quantum switchers and repeaters. We demonstrate that exponential or even super-exponential grow of entanglement resources occurs in dependence on number of the network switchers. For this reason, an optimization in the nested strategy is suggested, preventing a stronger than the exponential grow of entanglement resources.
Semi-quantum key distribution protocols are designed to allow two users to establish a secure secret key when one of the two users is limited to performing certain "classical" operations. There have been several such protocols developed recently, however, due to their reliance on a two-way quantum communication channel (and thus, the attacker's opportunity to interact with the qubit twice), their security analysis is difficult and little is known concerning how secure they are compared to their fully quantum counterparts. In this paper we prove the unconditional security of a particular semi-q…
It is generally believed that unconditionally secure quantum bit commitment is impossible, due to widespread acceptance of an impossibility proof that utilizes quantum entaglement cheating. In this paper, we delineate how the impossibiliy proof formulation misses various types of quantum bit commitment protocols based on two-way quantum communications. We point out some of the gaps in the impossibility proof reasoning, and present corresponding counterexamples. Four different types of bit commitment protocols are constructed with several new protocol techniques. A specific Type 4 protocol is d…
We consider two-party quantum protocols starting with a transmission of some random BB84 qubits followed by classical messages. We show a general "compiler" improving the security of such protocols: if the original protocol is secure against an "almost honest" adversary, then the compiled protocol is secure against an arbitrary computationally bounded (quantum) adversary. The compilation preserves the number of qubits sent and the number of rounds up to a constant factor. The compiler also preserves security in the bounded-quantum-storage model (BQSM), so if the original protocol was BQSM-secu…
The original two-way continuous-variable quantum-key-distribution (CV QKD) protocols [S. Pirandola, S. Mancini, S. Lloyd, and S. L. Braunstein, Nature Physics 4, 726 (2008)] give the security against the collective attack on the condition of the tomography of the quantum channels. We propose a family of new two-way CV QKD protocols and prove their security against collective entangling cloner attacks without the tomography of the quantum channels. The simulation result indicates that the new protocols maintain the same advantage as the original two-way protocols whose tolerable excess noise su…
We report the security analysis of time-coding quantum key distribution protocols. The protocols make use of coherent single-photon pulses. The key is encoded in the photon time-detection. The use of coherent superposition of states allows to detect eavesdropping of the key. We give a mathematical model of a first protocol from which we derive a second, simpler, protocol. We derive the security analysis of both protocols and find that the secure rates can be similar to those obtained with the BB84 protocol. We then calculate the secure distance for those protocols over standard fibre links. Wh…
The round-robin differential phase shift (RRDPS) quantum key distribution (QKD) protocol is a unique quantum key distribution protocol whose security has not been understood through an information-disturbance trade-off relation, and a sufficient amount of privacy amplification was given independently of signal disturbance. Here, we discuss the security of the RRDPS protocol in the asymptotic regime when a good estimate of the bit error rate is available as a measure of signal disturbance. The uniqueness of the RRDPS protocol shows up as a peculiar form of information-disturbance trade-off curv…
In optical implementations of the phase-encoded BB84 protocol, the bit information is usually encoded in the phase of two consecutive photon pulses generated in a Mach-Zehnder interferometer. In the actual experimental realization, the loss in the arms of the Mach-Zehnder interferometer is not balanced, for example because only one arm contains a lossy phase modulator. Therefore, the amplitudes of the pulses is not balanced, and the structure of the signals and measurements no longer corresponds to the (balanced) ideal BB84 protocol. Hence, the BB84 security analysis no longer applies in this …
We prove the unconditional security of coherent-state-based differential phase shift quantum key distribution protocol (DPSQKD) with block-wise phase randomization. Our proof is based on the conversion of DPSQKD to an equivalent entanglement-distillation protocol where the estimated phase error rate determines the amount of the privacy amplification. The generated final key has a contribution from events where the sender emits two or more photons, indicating the robustness of DPSQKD against photon-number-splitting attacks.
Within the broad research scenario of quantum secure communication, Two-Way Quantum Key Distribution (TWQKD) is a relatively new proposal for sharing secret keys that is not fully explored yet. We analyse the security of TWQKD schemes that use qubits prepared in non-orthogonal states to transmit the key. Investigating protocols that employ an arbitrary number of bases for the channel preparation, we show, in particular, that the security of the LM05 protocol can not be improved by the use of more than two preparation bases. We also provide a new proof of unconditional security for a determinis…
We describe the popular BB84 protocol and critically examine its security proof as presented by Shor and Preskill. The proof requires the use of quantum error correcting codes called the Calderbank-Shor-Steanne (CSS) quantum codes. These quantum codes are constructed in the quantum domain from two suitable classical linear codes, one used to correct for bit-flip errors and the other for phase-flip errors. Consequently, as a prelude to the security proof, the report reviews the essential properties of linear codes, especially the concept of cosets, before building the quantum codes that are uti…
This paper provides a formula for the sacrifice bit-length for privacy amplification with the Bennett-Brassard 1984 protocol for finite key lengths when we employ the decoy method. Using the formula, we can guarantee the security parameter for realizable quantum key distribution system. The key generation rates with finite key lengths are numerically evaluated. The proposed method improves the existing key generation rate even in the asymptotic setting.
Among various quantum key distribution (QKD) protocols, the round-robin differential-phase-shift (RRDPS) protocol has a unique feature that its security is guaranteed without monitoring any statistics. Moreover, this protocol has a remarkable property of being robust against source imperfections assuming that the emitted pulses are independent. Unfortunately, some experiments confirmed the violation of the independence due to pulse correlations, and therefore the lack of a security proof without taking into account this effect is an obstacle for the security. In this paper, we prove that the R…
Blind quantum computing [A. Broadbent, J. Fitzsimons, and E. Kashefi, Proceedings of the 50th Annual IEEE Symposium on Foundations of Computer Science 517 (2009)] is a secure cloud quantum computing protocol which enables a client (who does not have enough quantum technology at her disposal) to delegate her quantum computation to a server (who has a universal quantum computer) without leaking any relevant information to the server. In [T. Morimae and K. Fujii, Phys. Rev. A {\bf87}, 050301(R) (2013)], a new blind quantum computing protocol, so called the measuring-Alice protocol, was proposed. …
Blind quantum computation (BQC) protocol allows a client having partial quantum ability to delegate his quantum computation to a remote quantum server without leaking any information about the input, the output and the intended computation to the server. Several BQC protocols have been proposed, e.g., Li et al. in [1] proposed a triple-server BQC protocol and Xu et al. in [2] proposed a single-server BQC protocol. Though both papers claimed that their protocols can satisfy the requirement of privacy, this paper points out a security loophole in their protocols. With that the server can reveal …
We present a new technique for proving the security of quantum key distribution (QKD) protocols. It is based on direct information-theoretic arguments and thus also applies if no equivalent entanglement purification scheme can be found. Using this technique, we investigate a general class of QKD protocols with one-way classical post-processing. We show that, in order to analyze the full security of these protocols, it suffices to consider collective attacks. Indeed, we give new lower and upper bounds on the secret-key rate which only involve entropies of two-qubit density operators and which a…
In this work we present a security analysis for quantum key distribution, establishing a rigorous tradeoff between various protocol and security parameters for a class of entanglement-based and prepare-and-measure protocols. The goal of this paper is twofold: 1) to review and clarify the state-of-the-art security analysis based on entropic uncertainty relations, and 2) to provide an accessible resource for researchers interested in a security analysis of quantum cryptographic protocols that takes into account finite resource effects. For this purpose we collect and clarify several arguments sp…
In this paper we provide a proof of unconditional security for a semi-quantum key distribution protocol introduced in a previous work. This particular protocol demonstrated the possibility of using $X$ basis states to contribute to the raw key of the two users (as opposed to using only direct measurement results) even though a semi-quantum participant cannot directly manipulate such states. In this work we provide a complete proof of security by deriving a lower bound of the protocol's key rate in the asymptotic scenario. Using this bound we are able to find an error threshold value such that …
Security of passive entanglement-based key distribution protocols
Network Innovation Laboratories, NTT, Inc.（NTT网络创新实验室）；NTT Research Center for Theoretical Quantum Information, NTT, Inc.（NTT理论量子信息研究中心）；Basic Research Laboratories, NTT, Inc.（NTT基础研究所）
We generalize the universally composable definition of Canetti to the Quantum World. The basic idea is the same as in the classical world. The main contribution is that we unfold the result in a new model which is well adapted to quantum protocols. We also simplify some aspects of the classical case. In particular, the case of protocols with an arbitrary number of layers of sub-protocols is naturally covered in the proposed model.
We present a general framework encompassing a number of continuous-variable quantum key distribution protocols, including standard one-way protocols, measurement-device-independent protocols as well as some two-way protocols, or any other continuous-variable protocol involving only a Gaussian modulation of coherent states and heterodyne detection. The main interest of this framework is that the corresponding protocols are all covariant with respect to the action of the unitary group $U(n)$, implying that their security can be established thanks to a Gaussian de Finetti reduction. In particular…
We apply the techniques introduced in [Kraus et. al., Phys. Rev. Lett. 95, 080501, 2005] to prove security of quantum key distribution (QKD) schemes using two-way classical post-processing as well as QKD schemes based on weak coherent pulses instead of single-photon pulses. As a result, we obtain improved bounds on the secret-key rate of these schemes.
Security against simple eavesdropping attacks is demonstrated for a recently proposed quantum key distribution protocol which uses the Fibonacci recursion relation to enable high-capacity key generation with entangled photon pairs. No transmitted pairs need to be discarded in reconciliation; the only pairs not used for key generation are those used for security-checking. Although the proposed approach does not allow eavesdropper-induced errors to be detected on single trials, it can nevertheless reveal the eavesdropper's action on the quantum channel by detecting changes in the distribution of…
Decoy-state protocols provide a way to defeat photon-number splitting attacks in quantum cryptography implemented with weak coherent pulses. We point out that previous security analyses of such protocols relied on assumptions about eavesdropping attacks that considered treating each pulse equally and independently. We give an example to demonstrate that, without such assumptions, the security parameters of previous decoy-state implementations could be worse than the ones claimed. Next we consider more general photon-number splitting attacks, which correlate different pulses, and give an estima…
Twin-field (TF) quantum key distribution (QKD) was conjectured to beat the private capacity of a point-to-point QKD link by using single-photon interference in a central measuring station. This remarkable conjecture has recently triggered an intense research activity to prove its security. Here, we introduce a TF-type QKD protocol which is conceptually simpler than the original proposal. It relies on local phase randomization, instead of global phase randomization, which significantly simplifies its security analysis and is arguably less demanding experimentally. We demonstrate that the secure…
The Differential-Phase-Shift (DPS) and the Coherent-One-Way (COW) are among the most practical protocols for quantum cryptography, and are therefore the object of fast-paced experimental developments. The assessment of their security is also a challenge for theorists: the existing tools, that allow to prove security against the most general attacks, do not apply to these two protocols in any straightforward way. We present new upper bounds for their security in the limit of large distances ($d \gtrsim 50$km with typical values in optical fibers) by considering a large class of collective attac…
We show the information-theoretic security proof of the differential-phase-shift (DPS) quantum key distribution (QKD) protocol based on the complementarity approach [arXiv:0704.3661 (2007)]. Our security proof provides a slightly better key generation rate compared to the one derived in the previous security proof in [arXiv:1208.1995 (2012)] that is based on the Shor-Preskill approach [Phys. Rev. Lett. ${\bf 85}$, 441 (2000)]. This improvement is obtained because the complementarity approach can employ more detailed information on Alice's sending state in estimating the leaked information to a…
Standard security proofs of quantum key distribution (QKD) protocols often rely on symmetry arguments. In this paper, we prove the security of a three-state protocol that does not possess rotational symmetry. The three-state QKD protocol we consider involves three qubit states, where the first two states, |0_z> and |1_z>, can contribute to key generation and the third state, |+>=(|0_z>+|1_z>)/\sqrt{2}, is for channel estimation. This protocol has been proposed and implemented experimentally in some frequency-based QKD systems where the three states can be prepared easily. Thus, by founding on …
We establish a security proof of frequency-time coding quantum key distribution (FT-QKD) protocol by showing its connection to the squeezed state quantum key distribution protocol, which has been proven to be unconditionally secure. We also extend the prepare-and-measure FT-QKD protocol to an entanglement based FT-QKD protocol which is more appealing in practice. Furthermore, we propose a correlated frequency measurement scheme of entangled photon pair by using time resolving single photon detector. Simulation results show that the FT-QKD protocol can be implemented with today's technology.
Quantum key distribution protocols typically make use of a one-way quantum channel to distribute a shared secret string to two distant users. However, protocols exploiting a two-way quantum channel have been proposed as an alternative route to the same goal, with the potential advantage of outperforming one-way protocols. Here we provide a strategy to prove security for two-way quantum key distribution protocols against the most general quantum attack possible by an eavesdropper. We utilize an entropic uncertainty relation, and only a few assumptions need to be made about the devices used in t…
The SARG04 protocol is one of the most frequently used protocol in commercial plug-and-play quantum key distribution (QKD) system, where an eavesdropper can completely control or change the photon number statistics of the QKD source. To ensure the security of SARG04 protocol in plug-and-play QKD system with an unknown and untrusted source, the bounds of a few statistical parameters of the source need to be monitored. An active or a passive source monitor schemes are proposed to verify these parameters. Furthermore, the practical issues due to statistical fluctuation and detection noise in the …
We prove the unconditional security of the six-state protocol with threshold detectors and one-way classical communication. Unlike the four-state protocol (BB84), it has been proven that the squash operator for the six-state does not exist, i.e., the statistics of the measurements cannot be obtained via measurement on qubits. We propose a technique to determine which photon number states are important, and we consider a fictitious measurement on a qubit, which is defined through the squash operator of BB84, for the better estimation of Eve's information. As a result, we prove that the bit erro…
We consider discrete-modulation protocols for continuous-variable quantum key distribution (CV-QKD) that employ a modulation constellation consisting of a finite number of coherent states and that use a homodyne or a heterodyne-detection receiver. We establish a security proof for collective attacks in the asymptotic regime, and we provide a formula for an achievable secret-key rate. Previous works established security proofs for discrete-modulation CV-QKD protocols that use two or three coherent states. The main constituents of our approach include approximating a complex, isotropic Gaussian …
