It has been pointed out by Yuen that the security theory of quantum key distribution(QKD) guided by Shor-Preskill theory has serious defects, in particular their key rate theory is not correct. Theory groups of QKD tried to improve several defects. Especially, Renner employed trace distance and quantum leftover Hash Lemma. However, the present theory encountered a problem of a quantitative evaluation of security. To cope with it, he uses a wrong interpretation on the trace distance and its level epsilon_{sec}, and justifies the unconditional security of own system when epsilon_{sec} is 10^{-6 } ~ 10^{-20}. In this paper, we discuss the following problems. What is the origin of the misconception of the present theory? How does the present theory lead to the misconception?. To show their process toward the misconception, Koashi-Preskill's theory which has a typical misconception is examined. A main point of our comment is that QKD theory ignores the security requirement against attacker which is necessary to compare whole encryption schemes from classical to quantum. To clarify it, we emphasize that the trace distance itself cannot have any operational meaning such as failure probability, and it is only mathematical tool as a measure of closeness. As a result, it is given that the security with above values derived from their formulation means nothing in the general cryptological sense. In addition, I point out that a comment by Bennett and Riedel on unconditional security of QKD is not correct. Also, I point out that the experimental systems of groups of Los Alamos, Toshiba-UK, NICT, and others cannot have security guarantee even in future.
It has been pointed out by Yuen that the security theory of quantum key distribution(QKD) guided by Shor-Preskill theory has serious defects, in particular their key rate theory is not correct. Theory groups of QKD tried to improve several defects. Especially, Renner employed trace distance and quantum leftover Hash Lemma. However, the present theory encountered a problem of a quantitative evaluation of security. To cope with it, he uses a wrong interpretation on the trace distance and its level epsilon_{sec}, and justifies the unconditional security of own system when epsilon_{sec} is 10^{-6 } ~ 10^{-20}. In this paper, we discuss the following problems. What is the origin of the misconception of the present theory? How does the present theory lead to the misconception?. To show their process toward the misconception, Koashi-Preskill's theory which has a typical misconception is examined. A main point of our comment is that QKD theory ignores the security requirement against attacker which is necessary to compare whole encryption schemes from classical to quantum. To clarify it, we emphasize that the trace distance itself cannot have any operational meaning such as failure probability, and it is only mathematical tool as a measure of closeness. As a result, it is given that the security with above values derived from their formulation means nothing in the general cryptological sense. In addition, I point out that a comment by Bennett and Riedel on unconditional security of QKD is not correct. Also, I point out that the experimental systems of groups of Los Alamos, Toshiba-UK, NICT, and others cannot have security guarantee even in future.
It is claimed in the many papers that a trace distance: d guarantees the universal composition security in quantum key distribution (QKD) like BB84 protocol. In this introduction paper, at first, it is explicitly explained what is the main misconception in the claim of the unconditional security for QKD theory. In general terms, the cause of the misunderstanding on the security claim is the Lemma in the paper of Renner. It suggests that the generation of the perfect random key is assured by the probability (1-d), and its failure probability is d. Thus, it concludes that the generated key provides the perfect random key sequence when the protocol is success. So the QKD provides perfect secrecy to the one time pad. This is the reason for the composition claim. However, the quantity of the trace distance (or variational distance) is not the probability for such an event. If d is not small enough, always the generated key sequence is not uniform. Now one needs the reconstruction of the evaluation of the trace distance if one wants to use it. One should first go back to the indistinguishability theory in the computational complexity based, and to clarify the meaning of the value of the variational distance. In addition, the same analysis for the information theoretic case is necessary. The recent serial papers by H.P.Yuen have given the answer on such questions. In this paper, we show more concise description of Yuen's theory, and clarify that the upper bound theories for the trace distance by Tomamichel et al and Hayashi et al are constructed by the wrong reasoning of Renner and it is unsuitable as the security analysis. Finally, we introduce a new macroscopic quantum communication to replace Q-bit QKD.
It is claimed in the many papers that a trace distance (d) guarantees the universal composition security in quantum key distribution (QKD). In this introduction paper, at first, it is explicitly explained what is the main misconception in the claim of the unconditional security for QKD theory. In general terms, the cause of the misunderstanding on the security claim is the Lemma in the paper of Renner. It suggests that the generation of the perfect random key is assured by the probability (1 − d), and its failure probability is d. Thus, it concludes that the generated key provides the perfect random key sequence when the protocol suceeds. So the QKD provides perfect secrecy to the one time pad. This is the reason for the composition claim. However, the quantity of the trace distance (or variational distance) is not the probability for such an event. If d is not small enough, always the generated key sequence is not uniform. Now one needs the reconstruction of the evaluation of the trace distance if one wants to use it. One should first go back to the indistinguishability theory in the computational complexity based, and to clarify the meaning of the value of the variational distance. In addition, the same analysis for the information theoretic case is necessary. The recent serial papers by H.P.Yuen have given the answer on such questions. In this paper, we show more concise description of Yuen’s theory, and clarify that the recent upper bound theories for the trace distance by Tomamichel et al and Hayashi et al are constructed based on the reasoning of Renner and it is unsuitable as the analysis for information theoretic security. Finally, we introduce a macroscopic quantum communication with different principle to replace Q-bit QKD.
It is claimed in the many papers that a trace distance (d) guarantees the universal composition security in quantum key distribution (QKD). In this introduction paper, at first, it is explicitly explained what is the main misconception in the claim of the unconditional security for QKD theory. In general terms, the cause of the misunderstanding on the security claim is the Lemma in the paper of Renner. It suggests that the generation of the perfect random key is assured by the probability $ (1-d)$, and its failure probability is d. Thus, it concludes that the generated key provides the perfect random key sequence when the protocol suceeds. So the QKD provides perfect secrecy to the one time pad. This is the reason for the composition claim. However, the quantity of the trace distance (or variational distance) is not the probability for such an event. If $d $ is not small enough, always the generated key sequence is not uniform. Now one needs the reconstruction of the evaluation of the trace distance if one wants to use it. One should first go back to the indistinguishability theory in the computational complexity based, and to clarify the meaning of the value of the variational distance. In addition, the same analysis for the information theoretic case is necessary. The recent serial papers by H.P.Yuen have given the answer on such questions. In this paper, we show more concise description of Yuen's theory, and clarify that the recent upper bound theories for the trace distance by Tomamichel et al and Hayashi et al are constructed based on the reasoning of Renner and it is unsuitable as the analysis for information theoretic security. Finally, we introduce a macroscopic quantum communication with different principle to replace Q-bit QKD.
The trace distance criterion for security of Quantum Key Distribution (QKD) has been widely perceived that its upperbound is the maximum failure probability in distributing an ideal quantum state that the quantum system shared by legitimate users is decoupled from the quantum system the eavesdropper possesses, therefore the eavesdropper would not obtain any hints on the key shared by the legitimate users no matter how much her measurement is optimal. However, there an arbitrariness in the definition of the trace distance with the decoupled quantum system the eavesdropper possesses as the previous work pointed out, and such an arbitrariness would be confusions in guaranteeing the security of QKD. In this work, from the framework of Bit-Error-Rate (BER) Guarantee discussed also in the previous work, such an arbitrariness is removed from the definition of the trace distance criterion by discussing the similarities and differences between the security of QKD and classical information-theoretic cryptography by Leftover Hash Lemma (LHL). However, in the previous work BER Guarantee was derived under the assumption that the eavesdropper launches the weakest class of attack, so-called “Individual Attacks.” Therefore, it is still unknown whether direct upper-bounding of the term would give tighter upper-bound in general, such as “Collective Attacks” or “Coherent Attacks”, compared to the upper-bound by LHL, as well as the secure-key generation rate. This study also revisits the security proof of QKD given by P. Shor and J. Preskill in 2000.
In 2005, trace distance between an ideal quantum state to be distributed and an actual quantum state distributed was introduced as a valid security measure of Quantum Key Distribution (QKD) by R. Renner et al., then it has been perceived that the trace can be interpreted as a maximum failure probability of QKD. While such a perspective has been widely accepted, H. P. Yuen and O. Hirota have been warning that such an interpretation is not correct since 2009. The author of this study has been giving questions on the interpretation of the trace distance based on their criticisms since QIT30 in May 2014, and has been proposing Yuen's idea to evaluate the security of QKD by the probability for the attacker to guess the correct key. However, the author could not give the guessing probability concretely. In this study, the author explains how to derive the average guessing probability for the attacker, where its result equals to Yuen's derivation firstly seen in 2010. From this result, one will see the problems with the maximum failure probability interpretation of the trace distance clearly. This study also explains the indistinguishability advantage interpretation is also invalid.
In 2007, it was found that Known-Plaintext-Attack would reveal whole the string of the distributed key by Quantum Key Distribution (QKD) when the part of the plaintext was known to the eavesdropper, Eve, under the mutual information security criterion between Eve and legitimate users, Alice and Bob. To overcome, the trace distance criterion was introduced in the paper that the distance between the distributed quantum state and the ideal quantum state with Eve’s quantum system decoupled from the quantum systems shared by Alice and Bob. On the other hand, Shor and Preskill proved in 2000 that entanglement-based QKDs are equivalent to prepare-and-measure QKDs, such as the first QKD, BB84. Their proof employed the mutual information criterion, therefore M. Koashi applied Shor-Preskill approach to the trace distance criterion in 2009. However, H. P. Yuen started criticisms on the security of QKDs from 2009, then completed his criticisms in 2016. He warned the security of QKDs are not sufficient. Furthermore, the trace distance would not provide “universal composability”, which is supposed to guarantee Independent and Identically Distributed (IID) keys. He also proposed a new security criterion “Bit-Error-Rate (BER) guarantee,” to evaluate the BER in the decoded message by Eve with her key close to the correct key. In this work, the author explains Yuen’s criticisms and shows an example of the BER guarantee on BB84. Furthermore, the study revisits whether Shor-Preskill security proof approach really worked.