We present a new technique for proving the security of quantum key distribution (QKD) protocols. It is based on direct information-theoretic arguments and thus also applies if no equivalent entanglement purification scheme can be found. Using this technique, we investigate a general class of QKD protocols with one-way classical post-processing. We show that, in order to analyze the full security of these protocols, it suffices to consider collective attacks. Indeed, we give new lower and upper bounds on the secret-key rate which only involve entropies of two-qubit density operators and which are thus easy to compute. As an illustration of our results, we analyze the BB84, the six-state, and the B92 protocol with one-way error correction and privacy amplification. Surprisingly, the performance of these protocols is increased if one of the parties adds noise to the measurement data before the error correction. In particular, this additional noise makes the protocols more robust against noise in the quantum channel.
One of the most pressing issues in quantum key distribution (QKD) is the problem of detector side- channel attacks. To overcome this problem, researchers proposed an elegant "time-reversal" QKD protocol called measurement-device-independent QKD (MDI-QKD), which is based on time-reversed entanglement swapping. However, MDI-QKD is more challenging to implement than standard point- to-point QKD. Recently, an intermediary QKD protocol called detector-device-independent QKD (DDI-QKD) has been proposed to overcome the drawbacks of MDI-QKD, with the hope that it would eventually lead to a more effici…
Measurement-device-independent quantum key distribution (MDI-QKD) is the only known QKD scheme that can completely overcome the problem of detection side-channel attacks. Yet, despite its practical importance, there is no standard approach towards proving the security of MDI-QKD. Here, we present a simple numerical method that can efficiently compute almost-tight security bounds for any discretely modulated MDI-QKD protocol. To demonstrate the broad utility of our method, we use it to analyze the security of coherent-state MDI-QKD, decoy-state MDI-QKD with leaky sources, and a variant of twin-…
It is widely believed that quantum key distribution (QKD) has been proved unconditionally secure for realistic models applicable to various current experimental schemes. Here we summarize briefly why this is not the case, from both the viewpoints of fundamental quantitative security and applicable models of security analysis, with some morals drawn.
The majority of research to date has concentrated on the quantum key distribution (QKD) between two parties. In general, the QKD protocols proposed for the multiparty scenario often involve the usage of a maximally entangled state, such as GHZ, which is challenging to implement in practice. This paper examines the prepare and measure version of multiparty communication through quantum key distribution. It is sufficient to have the capability of preparing and measuring a single qubit state. The security of the multiparty prepare and measure QKD is demonstrated by utilizing the well-known techni…
The existing unconditional security definitions of quantum key distribution (QKD) do not apply to joint attacks over QKD and the subsequent use of the resulting key. In this paper, we close this potential security gap by using a universal composability theorem for the quantum setting. We first derive a composable security definition for QKD. We then prove that the usual security definition of QKD still implies the composable security definition. Thus, a key produced in any QKD protocol that is unconditionally secure in the usual definition can indeed be safely used, a property of QKD that is h…
Proving the unconditional security of a quantum key distribution (QKD) scheme is a highly challenging task as one needs to determine the most efficient attack compatible with experimental data. This task is even more demanding for continuous-variable QKD as the Hilbert space where the protocol is described is infinite dimensional. A very natural way to address this problem is to make an extensive use of the symmetries of the protocols. In this article, we investigate a symmetry in phase space that is particularly relevant to continuous-variable QKD, and explore the way towards a new quantum de…
The security of quantum key distribution (QKD) has been proven for different protocols, in particular for the BB84 protocol. It has been shown that this scheme is robust against eventual imperfections in the state preparation, and sending only three different states delivers the same secret key rate achievable with four states. In this work, we prove, in a finite-key scenario, that the security of this protocol can be maintained even with less measurement operators on the receiver. This allows us to implement a time-bin encoding scheme with a minimum amount of resources.
In usual security proofs of quantum protocols the adversary (Eve) is expected to have full control over any quantum communication between any communicating parties (Alice and Bob). Eve is also expected to have full access to an authenticated classical channel between Alice and Bob. Unconditional security against any attack by Eve can be proved even in the realistic setting of device and channel imperfection. In this Letter we show that the security of QKD protocols is ruined if one allows Eve to possess a very limited access to the random sources used by Alice. Such knowledge should always be …
We analyze the security and feasibility of a protocol for Quantum Key Distribution (QKD), in a context where only one of the two parties trusts his measurement apparatus. This scenario lies naturally between standard QKD, where both parties trust their measurement apparatuses, and Device-Independent QKD (DI-QKD), where neither does, and can be a natural assumption in some practical situations. We show that the requirements for obtaining secure keys are much easier to meet than for DI-QKD, which opens promising experimental opportunities. We clarify the link between the security of this one-sid…
The security issues facing quantum key distribution (QKD) are explained, herein focusing on those issues that are cryptographic and information theoretic in nature and not those based on physics. The problem of security criteria is addressed. It is demonstrated that an attacker's success probabilities are the fundamental criteria of security that any theoretic security criterion must relate to in order to have operational significance. The errors committed in the prevalent interpretation of the trace distance criterion are analyzed. The security proofs of QKD protocols are discussed and assess…
The decoy-state method is a standard enhancement to quantum key distribution (QKD) protocols that has enabled countless QKD experiments with inexpensive light sources. However, new technological advancements might require further theoretical study of this technique. In particular, the decoy-state method is typically described under the assumption of a Poisson statistical distribution for the number of photons in each QKD pulse. This is a practical choice, because prepare-and-measure QKD is often implemented with attenuated lasers, which produce exactly this distribution. However, sources that …
Device-independent quantum key distribution (DI-QKD) is often seen as the ultimate key exchange protocol in terms of security, as it can be performed securely with uncharacterised black-box devices. The advent of DI-QKD closes several loopholes and side-channels that plague current QKD systems. While implementing DI-QKD protocols is technically challenging, there have been recent proof-of-principle demonstrations, resulting from the progress made in both theory and experiments. In this review, we will provide an introduction to DI-QKD, an overview of the related experiments performed, and the …
Most security proofs of quantum key distribution (QKD) disregard the effect of information leakage from the users' devices, and, thus, do not protect against Trojan-horse attacks (THAs). In a THA, the eavesdropper injects strong light into the QKD apparatuses, and then analyzes the back-reflected light to learn information about their internal setting choices. Only a few recent works consider this security threat, but predict a rather poor performance of QKD unless the devices are strongly isolated from the channel. Here, we derive finite-key security bounds for decoy-state-based QKD schemes i…
The security of a passive plug-and-play QKD arrangement in the case of finite (resources) key lengths is analysed. It is assumed that the eavesdropper has full access to the channel so an unknown and untrusted source is assumed. To take into account the security of the BB84 protocol under collective attacks within the framework of quantum adversaries, a full treatment provides the well-known equations for the secure key rate. A numerical simulation keeping a minimum number of initial parameters constant as the total error sought and the number of pulses is carried out. The remaining parameters…
In comparison to conventional discrete-variable (DV) quantum key distribution (QKD), continuous-variable (CV) QKD with homodyne/heterodyne measurements has distinct advantages of lower-cost implementation and affinity to wavelength division multiplexing. On the other hand, its continuous nature makes it harder to accommodate to practical signal processing, which is always discretized, leading to lack of complete security proofs so far. Here we propose a tight and robust method of estimating fidelity of an optical pulse to a coherent state via heterodyne measurements. We then construct a binary…
Security proofs of quantum key distribution (QKD) typically assume that the devices of the legitimate users are perfectly shielded from the eavesdropper. This assumption is, however, very hard to meet in practice, and thus the security of current QKD implementations is not guaranteed. Here, we fill this gap by providing a finite-key security analysis for QKD which is valid against arbitrary information leakage from the state preparation process of the legitimate users. For this, we extend the techniques introduced in (New J. Phys. 18, 065008, (2016)) to the finite-key regime, and we evaluate t…
Quantum key distribution (QKD) protocols are cryptographic techniques with security based only on the laws of quantum mechanics. Two prominent QKD schemes are the BB84 and B92 protocols that use four and two quantum states, respectively. In 2000, Phoenix et al. proposed a new family of three state protocols that offers advantages over the previous schemes. Until now, an error rate threshold for security of the symmetric trine spherical code QKD protocol has only been shown for the trivial intercept/resend eavesdropping strategy. In this paper, we prove the unconditional security of the trine s…
We establish a security proof of frequency-time coding quantum key distribution (FT-QKD) protocol by showing its connection to the squeezed state quantum key distribution protocol, which has been proven to be unconditionally secure. We also extend the prepare-and-measure FT-QKD protocol to an entanglement based FT-QKD protocol which is more appealing in practice. Furthermore, we propose a correlated frequency measurement scheme of entangled photon pair by using time resolving single photon detector. Simulation results show that the FT-QKD protocol can be implemented with today's technology.
Quantum key distribution (QKD) which enables the secure distribution of symmetric keys between two legitimate parties is of great importance in future network security. Access network that connects multiple end-users with one network backbone can be combined with QKD to build security for end-users in a scalable and cost-effective way. Though previous QKD access networks are all implemented in the upstream direction, in this paper, we prove that downstream access network can also be constructed by using continuous-variable (CV) QKD. The security of the CV-QKD downstream access network is analy…
Although quantum key distribution (QKD) is theoretically secure, there is a gap between the theory and practice. In fact, real-life QKD may not be secure because component devices in QKD systems may deviate from the theoretical models assumed in security proofs. To solve this problem, it is necessary to construct the security proof under realistic assumptions on the source and measurement unit. In this paper, we prove the security of a QKD protocol under practical assumptions on the source that accommodate fluctuation of the phase and intensity modulations. As long as our assumptions hold, it …
By simulating four quantum key distribution (QKD) experiments and analyzing one decoy-state QKD experiment, we compare two data post-processing schemes based on security against individual attack by Lütkenhaus, and unconditional security analysis by Gottesman-Lo-Lütkenhaus-Preskill. Our results show that these two schemes yield close performances. Since the Holy Grail of QKD is its unconditional security, we conclude that one is better off considering unconditional security, rather than restricting to individual attacks.
Finite-key security analysis of decoy-state QKD with source and detector imperfections
University of Vigo（维戈大学）；Vigo Quantum Communication Center, University of Vigo（维戈量子通信中心，维戈大学）；Escuela de Ingeniería de Telecomunicación, Department of Signal Theory and Communications, University of Vigo（电信工程学院，信号理论与通信系，维戈大学）；atlanTTic Research Center, University of Vigo（atlanTTic研究中心，维戈大学）
A Quantum Key Distribution (QKD) network is an infrastructure capable of performing long-distance and high-rate secret key agreement with information-theoretic security. In this paper we study security properties of QKD networks based on trusted repeater nodes. Such networks can already be deployed, based on current technology. We present an example of a trusted repeater QKD network, developed within the SECOQC project. The main focus is put on the study of secure key agreement over a trusted repeater QKD network, when some nodes are corrupted. We propose an original method, able to ensure the…
In this paper we review a number of issues on the security of quantum key distribution (QKD) protocols that bear directly on the relevant physics or mathematical representation of the QKD cryptosystem. It is shown that the cryptosystem representation itself may miss out many possible attacks which are not accounted for in the security analysis and proofs. Hence the final security claims drawn from such analysis are not reliable, apart from foundational issues about the security criteria that are discussed elsewhere. The cases of continuous-variable QKD and multi-photon sources are elaborated u…
In this work, we incorporate decoy-state analysis into a well-established numerical framework for key rate calculation, and apply the numerical framework to decoy-state BB84 and measurement-device-independent (MDI) QKD protocols as examples. Additionally, we combine with these decoy-state protocols what is called "fine-grained statistics", which is a variation of existing QKD protocols that makes use of originally discarded data to get a better key rate. We show that such variations can grant protocols resilience against any unknown and slowly changing rotation along one axis, similar to refer…
Existing security proofs of quantum key distribution (QKD) suffer from two fundamental weaknesses. First, memory attacks have emerged as an important threat to the security of even device-independent quantum key distribution (DI-QKD), whenever QKD devices are re-used. This type of attacks constitutes an example of covert channels, which have attracted a lot of attention in security research in conventional cryptographic and communication systems. Second, it is often implicitly assumed that the classical post-processing units of a QKD system are trusted. This is a rather strong assumption and i…
While fully device-independent security in (BB84-like) prepare and measure Quantum Key Distribution (QKD) is impossible, it can be guaranteed against individual attacks in a semi device-independent (SDI) scenario, wherein no assumptions are made on the characteristics of the hardware used are made except for an upper bound on the the dimension of the communicated system. Studying security under such minimal assumptions is especially relevant in the context of the recent {\it quantum hacking} attacks wherein the eavesdroppers can not only construct the devices used by the communicating parties …
Twin-field (TF) quantum key distribution (QKD) was conjectured to beat the private capacity of a point-to-point QKD link by using single-photon interference in a central measuring station. This remarkable conjecture has recently triggered an intense research activity to prove its security. Here, we introduce a TF-type QKD protocol which is conceptually simpler than the original proposal. It relies on local phase randomization, instead of global phase randomization, which significantly simplifies its security analysis and is arguably less demanding experimentally. We demonstrate that the secure…
Quantum key distribution (QKD) allows two distant parties to share secret keys with the proven security even in the presence of an eavesdropper with unbounded computational power. Recently, GHz-clock decoy QKD systems have been realized by employing ultrafast optical communication devices. However, security loopholes of high-speed systems have not been fully explored yet. Here we point out a security loophole at the transmitter of the GHz-clock QKD, which is a common problem in high-speed QKD systems using practical band-width limited devices. We experimentally observe the inter-pulse intensit…
Unconditional Security of Discrete-Modulated CV-QKD from Infinite-Dimensional MEAT
University of Waterloo（滑铁卢大学）；National University of Singapore（新加坡国立大学）；Technische Universität Wien（维也纳工业大学）；AIT Austrian Institute of Technology（奥地利技术研究院）
Decoy state method quantum key distribution (QKD) is one of the promising practical solutions to BB84 QKD with coherent light pulses. In the real world, however, statistical fluctuations with the finite code length cannot be negligible, and the securities of theoretical and experimental researches of the decoy method state QKD so far are based on the asymptotic GLLP's formula which guarantees only that the limit of eavesdropper's information becomes zero as the code length approaches infinity. In this paper, we propose a substantially improved decoy state QKD in the framework of the finite cod…
Long-distance quantum key distribution (QKD) has long time seriously relied on trusted relay or quantum repeater, which either has security threat or is far from practical implementation. Recently, a solution called twin-field (TF) QKD and its variants have been proposed to overcome this challenge. However, most security proofs are complicated, a majority of which could only ensure security against collective attacks. Until now, the full and simple security proof can only be provided with asymptotic resource assumption. Here, we provide a composable finite-key analysis for coherent-state-based…
Security proofs of quantum key distribution (QKD) often require post-processing schemes to simplify the data structure, and hence the security proof. We show a generic method to improve resulting secure key rates by partially reversing the simplifying post-processing for error correction purposes. We apply our method to the security analysis of device-independent QKD schemes and of detection-device-independent QKD schemes, where in both cases one is typically required to assign binary values even to lost signals. In the device-independent case, the loss tolerance threshold is cut down by our m…
Inspired by the methodology used for classical cryptographic hardware, we consider the use of attack ratings in the context of QKD security evaluation. To illustrate the relevance of this approach, we conduct an experimental vulnerability assessment of CV-QKD against saturation attacks, for two different attack strategies. The first strategy relies on inducing detector saturation by performing a large coherent displacement. This strategy is experimentally challenging and therefore translates into a high attack rating. We also propose and experimentally demonstrate a second attack strategy that…
Phase reference calibration is a necessary procedure in practical continuous-variable measurement-device-independent quantum key distribution (CV-MDI-QKD) for the need of Bell-State Measurement (BSM). However, the phase reference calibration may become imperfect in practical applications. We explored the practical security of CV-MDI-QKD with imperfect phase reference calibration under realistic conditions of lossy and noisy quantum channel. Specifically, a comprehensive framework is developed to model and characterize the imperfection of practical phase reference calibration operation, which i…
The security of source has become an increasingly important issue in quantum cryptography. Based on the framework of measurement-device-independent quantum-key-distribution (MDI-QKD), the source becomes the only region exploitable by a potential eavesdropper (Eve). Phase randomization is a cornerstone assumption in most discrete-variable (DV-) quantum communication protocols (e.g., QKD, quantum coin tossing, weak coherent state blind quantum computing, and so on), and the violation of such an assumption is thus fatal to the security of those protocols. In this paper, we show a simple quantum h…
Despite the enormous theoretical and experimental progress made so far in quantum key distribution (QKD), the security of most existing QKD implementations is not rigorously established yet. A critical obstacle is that almost all existing security proofs make ideal assumptions on the QKD devices. Problematically, such assumptions are hard to satisfy in the experiments, and therefore it is not obvious how to apply such security proofs to practical QKD systems. Fortunately, any imperfections and security-loopholes in the measurement devices can be perfectly closed by measurement-device-independe…
Privacy amplification (PA) is an essential post-processing step in quantum key distribution (QKD) for removing any information an eavesdropper may have on the final secret key. In this paper, we consider delaying PA of the final key after its use in one-time pad encryption and prove its security. We prove that the security and the key generation rate are not affected by delaying PA. Delaying PA has two applications: it serves as a tool for significantly simplifying the security proof of QKD with a two-way quantum channel, and also it is useful in QKD networks with trusted relays. To illustrate…
By testing nonlocality, the security of entanglement-based quantum key distribution (QKD) can be enhanced to being 'device-independent'. Here we ask whether such a strong form of security could also be established for one-way (prepare and measure) QKD. While fully device-independent security is impossible, we show that security can be guaranteed against individual attacks in a semi-device-independent scenario. In the latter, the devices used by the trusted parties are non-characterized, but the dimensionality of the quantum systems used in the protocol is assumed to be bounded. Our security pr…
A practical quantum key distribution (QKD) protocol necessarily runs in finite time and, hence, only a finite amount of communication is exchanged. This is in contrast to most of the standard results on the security of QKD, which only hold in the limit where the number of transmitted signals approaches infinity. Here, we analyze the security of QKD under the realistic assumption that the amount of communication is finite. At the level of the general formalism, we present new results that help simplifying the actual implementation of QKD protocols: in particular, we show that symmetrization ste…
In this work, we study the security of coherent-state quantum key distribution with a strong reference pulse. The consideration is based on a powerful soft filtering attack and uses realistic parameters of the equipment. Our model allows us to relate the secure key generation rate and distance with the energy of signal and reference pulses. We propose a two-pass quantum key distribution phase encoding optical scheme with a strong reference pulse. This simple for realization scheme is experimentally tested showing stable operation. Here we describe the tuning technique and solution for the prob…
The security of real-world quantum key distribution (QKD) critically depends on the number of data points the system can collect in a fixed time interval. To date, state-of-the-art finite-key security analyses require block lengths in the order of 1E4 bits to obtain positive secret keys. This requirement, however, can be very difficult to achieve in practice, especially in the case of entanglement-based satellite QKD systems, where the overall channel loss can go up to 70 dB or more. Here, we provide an improved finite-key security analysis which can reduce the block length requirement by 14% …
We give a security proof of the `Round Robin Differential Phase Shift' Quantum Key Distribution scheme, and we give a tight bound on the required amount of privacy amplification. Our proof consists of the following steps. We construct an EPR variant of the scheme. We identify Eve's optimal way of coupling an ancilla to an EPR qudit pair under the constraint that the bit error rate between Alice and Bob should not exceed a value beta. As a function of beta we derive, for finite key size, the trace distance between the real state and a state in which no leakage exists. For asymptotic key size we…
