Privacy amplification (PA) is an essential postprocessing step in quantum key distribution (QKD) for removing any information an eavesdropper may have on the final secret key. In this paper, we consider delaying PA of the final key after its use in one-time pad encryption and prove its security. We prove that the security and the key generation rate are not affected by delaying PA. Delaying PA has two applications: it serves as a tool for significantly simplifying the security proof of QKD with a two-way quantum channel, and also it is useful in QKD networks with trusted relays. To illustrate the power of the delayed PA idea, we use it to prove the security of a qubit-based two-way deterministic QKD protocol which uses four states and four encoding operations.
Privacy amplification (PA) is an essential postprocessing step in quantum key distribution (QKD) for removing any information an eavesdropper may have on the final secret key. In this paper, we consider delaying PA of the final key after its use in one-time pad encryption and prove its security. We prove that the security and the key generation rate are not affected by delaying PA. Delaying PA has two applications: it serves as a tool for significantly simplifying the security proof of QKD with a two-way quantum channel, and also it is useful in QKD networks with trusted relays. To illustrate the power of the delayed PA idea, we use it to prove the security of a qubit-based two-way deterministic QKD protocol which uses four states and four encoding operations.
Abstract Privacy amplification is the key step to guarantee the security of quantum communication. The existing security proofs require accumulating a large number of raw key bits for privacy amplification. This is similar to block ciphers in classical cryptography that would delay the final key generation since an entire block must be accumulated before privacy amplification. Moreover, any leftover errors after information reconciliation would corrupt the entire block. By modifying the security proof based on quantum error correction, we develop a stream privacy amplification scheme, which resembles the classical stream cipher, to solve the problems of final key generation delay and error spread. The stream scheme can also help to enhance the security of trusted-relay quantum networks. Inspired by the connection between stream ciphers and quantum error correction in our security analysis, we further develop a generic information-theoretic tool to study the security of classical encryption algorithms.
Quantum Key Distribution (QKD) protocols typically involve two separate steps of error-verification and privacy amplification. Both steps involve the application of a hash function sampled from a suitable hash family to classical data. A potentially simpler alternative is to implement a single-step hashing procedure, announce and compare a fixed number of bits of its output for error-verification, and retain the remaining bits as the final output key. This reduces the complexity of classical postprocessing, the amount of classical communication, and the amount of randomness needed in the protocol. While this construction has appeared in the literature, a suitable mathematical justification is lacking. In this work, we show that the security of such protocols, under certain simple conditions, follows from a slightly modified notion of secrecy of the protocol without the final error-verification step. In particular, we show that for most entropy-based proofs, the combined protocol can be implemented with no change to the key rate, and a minor change to the security parameter.
Abstract Privacy Amplification (PA) is indispensable in Quantum Key Distribution (QKD), ensuring security against eavesdropping by eliminating information leakage. For Discrete-Variable QKD (DV-QKD) protocols, a large input block size exceeding 108 bits is preferred to achieve the secure key rate approaching the asymptotic limit. However, in state-of-the-art quantum key distribution systems operating at multi-GHz pulse rates, PA becomes a critical bottleneck due to the conflicting requirements of large input block sizes and high throughput. To address this challenge, we propose a novel PA algorithm utilizing a newly constructed universal hash family DM3H and prove its cryptographic security rigorously. Based on the PA algorithm, we design and implement an efficient PA scheme which is capable of processing input block sizes up to 10 10 bits while achieving high throughput performance. For an input block size of 1010 bits, the implementation on the i9-14900 platform demonstrates a throughput of 112 Mbps with a retention ratio of 0.33. This breakthrough significantly enhances the secure key rate and maximum transmission distance of DV-QKD systems.
In quantum key distribution (QKD), public discussion over the authenticated classical channel inevitably leaks information about the raw key to a potential adversary, which must later be mitigated by privacy amplification. To limit this leakage, a one-time pad (OTP) has been proposed to protect message exchanges in various settings. Building on the security proof of Tomamichel and Leverrier, which is based on a non-asymptotic framework and considers the effects of finite resources, we extend the analysis to the OTP-protected scheme. We show that when the OTP key is drawn from the entropy pool of the same QKD session, the achievable quantum key rate is identical to that of the reference protocol with unprotected error-correction exchange. This equivalence holds for a fixed security level, defined via the diamond distance between the real and ideal protocols modeled as completely positive trace-preserving maps. At the same time, the proposed approach reduces the computational requirements: for non-interactive low-density parity-check codes, the encoding problem size is reduced by the square of the syndrome length, while privacy amplification requires less compression. The technique preserves security, avoids the use of QKD keys between sessions, and has the potential to improve performance.
Privacy amplification (PA) is a vital step in the postprocessing stage of quantum key distribution, which can extract a secure key from a source partially leaked to the environment. We propose a PA scheme that uses the square hash (SQH)--modular arithmetic hash (MH) function. In consideration of a potential quantum attacker, we use the trace distance as a metric to measure the closeness between two classical-quantum states. We transform a raw key state to a processed state using this scheme and derive the trace distance between the processed state and the ideal target state. It is proven that the trace distance can be reached as small as desired. Additionally, our approach accelerates the SQH-MH function through the number-theoretic transform, reducing the computational complexity to O(nlogn). On the basis of a CPU, a maximum throughput rate of 1.06 Gbit/s is achieved, and the results show that our algorithm demonstrates good stability of the throughput rate when handling tasks with different compression ratios.
We present a technique for proving the security of quantum-key-distribution (QKD) protocols. It is based on direct information-theoretic arguments and thus also applies if no equivalent entanglement purification scheme can be found. Using this technique, we investigate a general class of QKD protocols with one-way classical post-processing. We show that, in order to analyze the full security of these protocols, it suffices to consider collective attacks. Indeed, we give new lower and upper bounds on the secret-key rate which only involve entropies of two-qubit density operators and which are thus easy to compute. As an illustration of our results, we analyze the Bennett-Brassard 1984, the six-state, and the Bennett 1992 protocols with one-way error correction and privacy amplification. Surprisingly, the performance of these protocols is increased if one of the parties adds noise to the measurement data before the error correction. In particular, this additional noise makes the protocols more robust against noise in the quantum channel.