Cryptographic security of quantum key distribution is currently based on a trace distance criterion. The widespread misinterpretation of the criterion as failure probability and also its actual scope have been discussed previously. Recently its distinguishability advantage interpretation is re-emphasized as an operational guarantee, and the failure probability misinterpretation is maintained with a further failure probability per bit interpretation. In this paper we explain the basic perpetuating error as a confusion on the correspondence between mathematics and reality. We note that the assignment of equal a priori probability of 1/2 to the real and ideal situations for distinguishability advantage would not lead to operational guarantee. We explain why operational guarantee in terms of Eve's probabilities of getting various key bits is necessary for security, and why the failure probability interpretation misrepresents the security situation. The scope and limits of the trace distance guarantee are summarized. It is shown that there would have been no security problem to begin with if the failure probability per bit interpretation validity.
Cryptographic security of quantum key distribution is currently based on a trace distance criterion. The widespread misinterpretation of the criterion as failure probability and also its actual scope have been discussed previously. Recently its distinguishability advantage interpretation is re-emphasized as an operational guarantee, and the failure probability misinterpretation is maintained with a further failure probability per bit interpretation. In this paper we explain the basic perpetuating error as a confusion on the correspondence between mathematics and reality. We note that the assignment of equal a priori probability of 1/2 to the real and ideal situations for distinguishability advantage would not lead to operational guarantee. We explain why operational guarantee in terms of Eve's probabilities of getting various key bits is necessary for security, and why the failure probability interpretation misrepresents the security situation. The scope and limits of the trace distance guarantee are summarized. It is shown that there would have been no security problem to begin with if the failure probability per bit interpretation validity.
This study will test an interpretation in quantum key distribution (QKD) that trace distance between the distributed quantum state and the ideal mixed state is a maximum failure probability of the protocol. Around 2004, this interpretation was proposed and standardized to satisfy both of the key uniformity in the context of universal composability and operational meaning of the failure probability of the key extraction. However, this proposal has not been verified concretely yet for many years while H. P. Yuen and O. Hirota have thrown doubt on this interpretation since 2009. To ascertain this interpretation, a physical random number generator was employed to evaluate key uniformity in QKD. In this way, we calculated statistical distance which correspond to trace distance in quantum theory after a quantum measurement is done, then we compared it with the failure probability whether universal composability was obtained. As a result, the degree of statistical distance of the probability distribution of the physical random numbers and the ideal uniformity was very large. It is also explained why trace distance is not suitable to guarantee the security in QKD from the view point of quantum binary decision theory.
This study will test an interpretation in quantum key distribution (QKD) that trace distance between the distributed
quantum state and the ideal mixed state is a maximum failure probability of the protocol. Around 2004, this
interpretation was proposed and standardized to satisfy both of the key uniformity in the context of universal
composability and operational meaning of the failure probability of the key extraction. However, this proposal has not
been verified concretely yet for many years while H. P. Yuen and O. Hirota have thrown doubt on this interpretation
since 2009. To ascertain this interpretation, a physical random number generator was employed to evaluate key
uniformity in QKD. In this way, we calculated statistical distance which correspond to trace distance in quantum theory
after a quantum measurement is done, then we compared it with the failure probability whether universal composability
was obtained. As a result, the degree of statistical distance of the probability distribution of the physical random numbers
and the ideal uniformity was very large. It is also explained why trace distance is not suitable to guarantee the security in
QKD from the view point of quantum binary decision theory.
In 2005, trace distance between an ideal quantum state to be distributed and an actual quantum state distributed was introduced as a valid security measure of Quantum Key Distribution (QKD) by R. Renner et al., then it has been perceived that the trace can be interpreted as a maximum failure probability of QKD. While such a perspective has been widely accepted, H. P. Yuen and O. Hirota have been warning that such an interpretation is not correct since 2009. The author of this study has been giving questions on the interpretation of the trace distance based on their criticisms since QIT30 in May 2014, and has been proposing Yuen's idea to evaluate the security of QKD by the probability for the attacker to guess the correct key. However, the author could not give the guessing probability concretely. In this study, the author explains how to derive the average guessing probability for the attacker, where its result equals to Yuen's derivation firstly seen in 2010. From this result, one will see the problems with the maximum failure probability interpretation of the trace distance clearly. This study also explains the indistinguishability advantage interpretation is also invalid.
The security issues facing quantum key distribution (QKD) are explained, herein focusing on those issues that are cryptographic and information theoretic in nature and not those based on physics. The problem of security criteria is addressed. It is demonstrated that an attacker's success probabilities are the fundamental criteria of security that any theoretic security criterion must relate to in order to have operational significance. The errors committed in the prevalent interpretation of the trace distance criterion are analyzed. The security proofs of QKD protocols are discussed and assessed in regard to three main features: their validity, completeness, and adequacy of the achieved numerical security level. Problems are identified in all these features. It appears that the QKD security situation is quite different from the common perception that a QKD-generated key is nearly perfectly secure. Built into our discussion is a simple but complete quantitative description of the information theoretic security of classical key distribution that is also applicable to the quantum situation. In the Appendixes, we provide a brief outline of the history of some major QKD security proofs, a rather unfavorable comparison of current QKD proven security with that of conventional symmetric key ciphers, and a list of objections and answers concerning some major points of this paper.
The security significance of the trace distance security criterion d is analyzed in terms of operational probabilities of an attacker's success in identifying different subsets of the generated key, both during the key generation process and when the key is used in one-time pad data encryption under known-plaintext attacks. The difference between Eve's sequence error rate and bit error rate is brought out. It is shown with counter-examples that the strong security claim maintained in the literature is incorrect. Other than the whole key error rates that can be quantified at the levels d^{1/3} and d^{1/4} which are much worse than d itself, the attacker's success probabilities in estimating various subsets of the key and in known-plaintext attacks are yet to be quantified from d if possible. It is demonstrated in realistic numerical examples of concrete protocols that drastic breach of security cannot yet be ruled out.
The trace distance criterion for security of Quantum Key Distribution (QKD) has been widely perceived that its upperbound is the maximum failure probability in distributing an ideal quantum state that the quantum system shared by legitimate users is decoupled from the quantum system the eavesdropper possesses, therefore the eavesdropper would not obtain any hints on the key shared by the legitimate users no matter how much her measurement is optimal. However, there an arbitrariness in the definition of the trace distance with the decoupled quantum system the eavesdropper possesses as the previous work pointed out, and such an arbitrariness would be confusions in guaranteeing the security of QKD. In this work, from the framework of Bit-Error-Rate (BER) Guarantee discussed also in the previous work, such an arbitrariness is removed from the definition of the trace distance criterion by discussing the similarities and differences between the security of QKD and classical information-theoretic cryptography by Leftover Hash Lemma (LHL). However, in the previous work BER Guarantee was derived under the assumption that the eavesdropper launches the weakest class of attack, so-called “Individual Attacks.” Therefore, it is still unknown whether direct upper-bounding of the term would give tighter upper-bound in general, such as “Collective Attacks” or “Coherent Attacks”, compared to the upper-bound by LHL, as well as the secure-key generation rate. This study also revisits the security proof of QKD given by P. Shor and J. Preskill in 2000.