We analyze the fundamental security significance of the quantitative criteria on the final generated key
K in quantum key generation including the quantum criterion
d, the attacker's mutual information on
K, and the statistical distance between her distribution on
K and the uniform distribution. For operational significance a criterion has to produce a guarantee on the attacker's probability of correctly estimating some portions of
K from her measurement, in particular her maximum probability of identifying the whole
K. We distinguish between the raw security of
K when the attacker just gets at
K before it is used in a cryptographic context and its composition security when the attacker may gain further information during its actual use to help get at
K. We compare both of these securities of
K to those obtainable from conventional key expansion with a symmetric key cipher. It is pointed out that a common belief in the superior security of a quantum generated
K is based on an incorrect interpretation of
d which cannot be true, and the security significance of
d is uncertain. Generally, the quantum key distribution key
K has no composition security guarantee and its raw security guarantee from concrete protocols is worse than that of conventional ciphers. Furthermore, for both raw and composition security there is an exponential catch-up problem that would make it difficult to quantitatively improve the security of
K in a realistic protocol. Some possible ways to deal with the situation are suggested.
The security issues facing quantum key distribution (QKD) are explained, herein focusing on those issues that are cryptographic and information theoretic in nature and not those based on physics. The problem of security criteria is addressed. It is demonstrated that an attacker's success probabilities are the fundamental criteria of security that any theoretic security criterion must relate to in order to have operational significance. The errors committed in the prevalent interpretation of the trace distance criterion are analyzed. The security proofs of QKD protocols are discussed and assessed in regard to three main features: their validity, completeness, and adequacy of the achieved numerical security level. Problems are identified in all these features. It appears that the QKD security situation is quite different from the common perception that a QKD-generated key is nearly perfectly secure. Built into our discussion is a simple but complete quantitative description of the information theoretic security of classical key distribution that is also applicable to the quantum situation. In the appendices, we provide a brief outline of the history of some major QKD security proofs, a rather unfavorable comparison of current QKD proven security with that of conventional symmetric key ciphers, and a list of objections and answers concerning some major points of the paper.
The security issues facing quantum key distribution (QKD) are explained, herein focusing on those issues that are cryptographic and information theoretic in nature and not those based on physics. The problem of security criteria is addressed. It is demonstrated that an attacker's success probabilities are the fundamental criteria of security that any theoretic security criterion must relate to in order to have operational significance. The errors committed in the prevalent interpretation of the trace distance criterion are analyzed. The security proofs of QKD protocols are discussed and assessed in regard to three main features: their validity, completeness, and adequacy of the achieved numerical security level. Problems are identified in all these features. It appears that the QKD security situation is quite different from the common perception that a QKD-generated key is nearly perfectly secure. Built into our discussion is a simple but complete quantitative description of the information theoretic security of classical key distribution that is also applicable to the quantum situation. In the Appendixes, we provide a brief outline of the history of some major QKD security proofs, a rather unfavorable comparison of current QKD proven security with that of conventional symmetric key ciphers, and a list of objections and answers concerning some major points of this paper.
It is repeatedly and persistently claimed in the literature that a specific trace criterion
d would guarantee universal composition security in quantum cryptography. Currently that is the sole basis of unconditional security claim in quantum key distribution. In this paper, it is shown that just security against known-plaintext attacks when the generated key is used in direct encryption is not provided by
d. The problem is directly connected with several general problems in the existing unconditional security proofs in quantum key distribution. A number of issues will be clarified concerning the nature of true security, privacy amplification, key generation rate and the mathematical approach needed for their determination in concrete protocols.
All the currently available unconditional security proofs on quantum key distribution, in particular for the BB84 protocol and its variants including continuous-variable ones, are invalid or incomplete at many points. In this paper we discuss some of the main known problems, particularly those on operational security guarantee and error correction. Most basic are the points that there is no security parameter in such protocols and it is not the case the generated key is perfect with probability
≥1−ε under the trace distance criterion
d≤ε, which is widely claimed in the technical and popular literature. The many serious security consequences of this error about the QKD generated key would be explained, including practical ramification on achievable security levels. It will be shown how the error correction problem alone may already defy rigorous quantitative analysis. Various other problems would be touched upon. It is pointed out that rigorous security guarantee of much more efficient quantum cryptosystems may be obtained by abandoning the disturbance-information tradeoff principle and utilizing instead the known KCQ (keyed communication in quantum noise) principle in conjunction with a new DBM (decoy bits method) principle that will be detailed elsewhere.
If we combine two secure cryptographic systems, is the resulting system still secure?Answering this question is highly nontrivial and has recently sparked a considerable research effort, in particular, in the area of classical cryptography.A central insight was that the answer to the question is yes, but only within a well-specified composability framework and for carefully chosen security definitions.In this article, we review several aspects of composability in the context of quantum cryptography.The first part is devoted to key distribution.We discuss the security criteria that a quantum key distribution (QKD) protocol must fulfill to allow its safe use within a larger security application (e.g. for secure message transmission); and we demonstrate-by an explicit example-what can go wrong if conventional (non-composable) security definitions are used.Finally, to illustrate the practical use of composability, we show how to generate a continuous key stream by sequentially composing rounds of a QKD protocol.In the second part, we take a more general point of view, which is necessary for the study of cryptographic situations involving, for example, mutually distrustful parties.We explain the universal composability (UC) framework and state the composition theorem that guarantees that secure protocols can securely be composed to larger applications.We focus on the secure composition of quantum protocols into unconditionally secure classical protocols.However, the resulting security definition is so strict that some tasks become impossible without additional security assumptions.Quantum bit commitment is impossible in the UC framework even with mere computational security.Similar problems arise in the quantum bounded storage model and we observe a trade-off between the UC and the use of the weakest possible security assumptions.