All the currently available unconditional security proofs on quantum key distribution, in particular for the BB84 protocol and its variants including continuous-variable ones, are invalid or incomplete at many points. In this paper we discuss some of the main known problems, particularly those on operational security guarantee and error correction. Most basic are the points that there is no security parameter in such protocols and it is not the case the generated key is perfect with probability
≥1−ε under the trace distance criterion
d≤ε, which is widely claimed in the technical and popular literature. The many serious security consequences of this error about the QKD generated key would be explained, including practical ramification on achievable security levels. It will be shown how the error correction problem alone may already defy rigorous quantitative analysis. Various other problems would be touched upon. It is pointed out that rigorous security guarantee of much more efficient quantum cryptosystems may be obtained by abandoning the disturbance-information tradeoff principle and utilizing instead the known KCQ (keyed communication in quantum noise) principle in conjunction with a new DBM (decoy bits method) principle that will be detailed elsewhere.
All the currently available unconditional security proofs on quantum key distribution, in particular for the BB84 protocol and its variants including continuous-variable ones, are invalid or incomplete at many points. In this paper we discuss some of the main known problems, particularly those on operational security guarantee and error correction. Most basic are the points that there is no security parameter in such protocols and it is not the case the generated key is perfect with probability ≥ 1 - ϵ under the trace distance criterion d ≤ ϵ, which is widely claimed in the technical and popular literature. The many serious security consequences of this error about the QKD generated key would be explained, including practical ramification on achievable security levels. It will be shown how the error correction problem alone may already defy rigorous quantitative analysis. Various other problems would be touched upon. It is pointed out that rigorous security guarantee of much more efficient quantum cryptosystems may be obtained by abandoning the disturbance-information tradeoff principle and utilizing instead the known KCQ (keyed communication in quantum noise) principle in conjunction with a new DBM (decoy bits method) principle that will be detailed elsewhere.
It is repeatedly and persistently claimed in the literature that a specific trace criterion
d would guarantee universal composition security in quantum cryptography. Currently that is the sole basis of unconditional security claim in quantum key distribution. In this paper, it is shown that just security against known-plaintext attacks when the generated key is used in direct encryption is not provided by
d. The problem is directly connected with several general problems in the existing unconditional security proofs in quantum key distribution. A number of issues will be clarified concerning the nature of true security, privacy amplification, key generation rate and the mathematical approach needed for their determination in concrete protocols.
It is pointed out that treatments of the error correcting code in current quantum key distribution protocols of the BB84 type are not correct under joint attack, and the general interpretation of the trace distance security criterion is also incorrect. With correct interpretation of the criterion as well as a correct treatment of the error correcting code and privacy amplification code, it is shown that even for an ideal system under just collective attack, the maximum tolerable quantum bit error rate is about 1.5% and a net key cannot actually be generated with practical error correcting codes even at such low rates, contrary to claims in the literature.
Standard security proofs of quantum-key-distribution (QKD) protocols often rely on symmetry arguments. In this paper, we prove the security of a three-state protocol that does not possess rotational symmetry. The three-state QKD protocol we consider involves three qubit states, where the first two states $\ensuremath{\mid}{0}_{z}⟩$ and $\ensuremath{\mid}{1}_{z}⟩$ can contribute to key generation, and the third state $\ensuremath{\mid}+⟩=(\ensuremath{\mid}{0}_{z}⟩+\ensuremath{\mid}{1}_{z}⟩)∕\sqrt{2}$ is for channel estimation. This protocol has been proposed and implemented experimentally in some frequency-based QKD systems where the three states can be prepared easily. Thus, by founding on the security of this three-state protocol, we prove that these QKD schemes are, in fact, unconditionally secure against any attacks allowed by quantum mechanics. The main task in our proof is to upper bound the phase error rate of the qubits given the bit error rates observed. Unconditional security can then be proved not only for the ideal case of a single-photon source and perfect detectors, but also for the realistic case of a phase-randomized weak coherent light source and imperfect threshold detectors. Our result in the phase error rate upper bound is independent of the loss in the channel. Also, we compare the three-state protocol with the Bennett-Brassard 1984 (BB84) protocol. For the single-photon source case, our result proves that the BB84 protocol strictly tolerates a higher quantum bit error rate than the three-state protocol, while for the coherent-source case, the BB84 protocol achieves a higher key generation rate and secure distance than the three-state protocol when a decoy-state method is used.
We analyze the fundamental security significance of the quantitative criteria on the final generated key
K in quantum key generation including the quantum criterion
d, the attacker's mutual information on
K, and the statistical distance between her distribution on
K and the uniform distribution. For operational significance a criterion has to produce a guarantee on the attacker's probability of correctly estimating some portions of
K from her measurement, in particular her maximum probability of identifying the whole
K. We distinguish between the raw security of
K when the attacker just gets at
K before it is used in a cryptographic context and its composition security when the attacker may gain further information during its actual use to help get at
K. We compare both of these securities of
K to those obtainable from conventional key expansion with a symmetric key cipher. It is pointed out that a common belief in the superior security of a quantum generated
K is based on an incorrect interpretation of
d which cannot be true, and the security significance of
d is uncertain. Generally, the quantum key distribution key
K has no composition security guarantee and its raw security guarantee from concrete protocols is worse than that of conventional ciphers. Furthermore, for both raw and composition security there is an exponential catch-up problem that would make it difficult to quantitatively improve the security of
K in a realistic protocol. Some possible ways to deal with the situation are suggested.