Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:1506.07502 · New Journal of Physics

Sifting attacks in finite-size quantum key distribution

Corsin Pfister, Norbert Lütkenhaus, Stephanie Wehner, Patrick J. Coles

Published Apr 29, 2016• 24 citations
arXivHTMLPDF

Abstract

A central assumption in quantum key distribution (QKD) is that Eve has no knowledge about which rounds will be used for parameter estimation or key distillation. Here we show that this assumption is violated for iterative sifting , a sifting procedure that has been employed in some (but not all) of the recently suggested QKD protocols in order to increase their efficiency. We show that iterative sifting leads to two security issues: (1) some rounds are more likely to be key rounds than others, (2) the public communication of past measurement choices changes this bias round by round. We analyze these two previously unnoticed problems, present eavesdropping strategies that exploit them, and find that the two problems are independent. We discuss some sifting protocols in the literature that are immune to these problems. While some of these would be inefficient replacements for iterative sifting, we find that the sifting subroutine of an asymptotically secure protocol suggested by Lo et al (2005 J. Cryptol. 18 133–65 ), which we call LCA sifting, has an efficiency on par with that of iterative sifting. One of our main results is to show that LCA sifting can be adapted to achieve secure sifting in the finite -key regime. More precisely, we combine LCA sifting with a certain parameter estimation protocol, and we prove the finite-key security of this combination. Hence we propose that LCA sifting should replace iterative sifting in future QKD implementations. More generally, we present two formal criteria for a sifting protocol that guarantee its finite-key security. Our criteria may guide the design of future protocols and inspire a more rigorous QKD analysis, which has neglected sifting-related attacks so far.

DOI
10.1088/1367-2630/18/5/053001

Related papers

Security of quantum key distribution with iterative sifting

Kiyoshi Tamaki, Hoi‐Kwong Lo, Akihiro Mizutani +4 more

Abstract Several quantum key distribution (QKD) protocols employ iterative sifting. After each quantum transmission round, Alice and Bob disclose part of their setting information (including their basis choices) for the detected signals. This quantum phase then ends when the basis dependent termination conditions are met, i.e., the numbers of detected signals per basis exceed certain pre-agreed threshold values. Recently, however, Pfister et al (2016 New J. Phys. 18 053001) showed that the basis dependent termination condition makes QKD insecure, especially in the finite key regime, and they suggested to disclose all the setting information after finishing the quantum phase. However, this protocol has two main drawbacks: it requires that Alice possesses a large memory, and she also needs to have some a priori knowledge about the transmission rate of the quantum channel. Here we solve these two problems by introducing a basis-independent termination condition to the iterative sifting in the finite key regime. The use of this condition, in combination with Azuma’s inequality, provides a precise estimation on the amount of privacy amplification that needs to be applied, thus leading to the security of QKD protocols, including the loss-tolerant protocol (Tamaki et al 2014 Phys. Rev. A 90 052314), with iterative sifting. Our analysis indicates that to announce the basis information after each quantum transmission round does not compromise the key generation rate of the loss-tolerant protocol. Our result allows the implementation of wider classes of classical post-processing techniques in QKD with quantified security.

arXiv:1610.06499•Quantum Science and Technology•Sep 1, 2017•12 citations

Numerical method for finite-size security analysis of quantum key distribution

Hongyi Zhou, Toshihiko Sasaki, Masato Koashi

Quantum key distribution (QKD) enables secure information exchange with untrusted quantum links between remote communication parties. A central task in the studies of QKD protocols is security analysis, which aims at deriving the length of the final key such that it is secure regardless of the eavesdropper's computational power. In literature, the security analysis has been done both analytically and numerically. Compared to analytical methods which tend to require techniques specific to each QKD protocol, numerical ones are more general since they can be directly applied to many QKD protocols with little adaptation. However, current numerical methods are carried out based on some assumptions such as working in the asymptotic limit and collective attacks from eavesdroppers. In this work, we remove these assumptions and develop a numerical finite-size security analysis against general attacks for a large class of QKD protocols. We also give an example of applying the method to the recent phase-matching QKD protocol with a simplified protocol design. Our result shows that the finite-size key rate can surpass the linear key-rate bound with a practical QKD system operated for only several hours.

arXiv:2111.08315•Physical Review Research•Aug 12, 2022•12 citations

Self-Sifting quantum key distribution

Saman Sarshar, Mostafa Annabestani

In this paper, we introduce a novel two-way quantum key distribution (QKD) protocol in which the sender (Alice) and receiver (Bob) employ one qubit of a maximally entangled Bell state as the quantum channel for key exchange. The protocol incorporates a new security mechanism based on a scrambling operator. Unlike conventional two-way QKD protocols, all sifting operations and eavesdropper detection procedures are postponed until the completion of the quantum communication stage and are performed exclusively by Bob. Since the control mode is never publicly announced, attacks that rely on mode-dependent adaptations or attempt to remain hidden within the control mode are inherently prevented. Furthermore, the traveling qubit does not directly encode key information, substantially limiting the information that can be extracted from attacks targeting the quantum channel alone. An additional distinctive feature of the protocol is that rounds that would ordinarily be discarded can instead be utilized to detect the presence of an eavesdropper. We analyze a broad class of ancilla-based attacks, in which an eavesdropper couples an ancillary system to the transmitted qubit in an attempt to gain information about the key, and show that such attacks are detectable in their most general form.

quant-pharXiv:2606.27299•Jun 26, 2026•0 citations

Quantum Key Distribution with Imperfections: Recent Advances in Security Proofs

Patrick Andriolo, Esteban Vasquez, Elizabeth Agudelo +3 more

In contrast to classical public-key cryptosystems, where the security of encoded messages relies on on computational assumptions, Quantum Key Distribution (QKD) enables two distant parties to establish a shared secret key that, when combined with a one-time pad, provides information-theoretically secure encryption, provided that the QKD protocol is supported by a rigorous security proof. In the last decades, security proofs robust against a wide range of eavesdropping strategies have established the theoretical soundness of several QKD protocols. However, most proofs are based on idealized models of the physical systems involved in such protocols and often include assumptions that are not satisfied in practical implementations. This mismatch creates a gap between theoretical security guarantees and actual experimental realizations, making QKD protocols vulnerable to attacks. To ensure the security of real-world QKD systems, it is therefore essential to account for imperfections in security analyses. In this article, we present an overview of recent analytical and numerical developments in QKD security proofs, which provide a versatile approach for incorporating imperfections and re-establishing the security of quantum communication protocols under realistic conditions.

quant-pharXiv:2602.05057•Brazilian Journal of Physics•Feb 6, 2026•1 citation

A Standardized Design for Sifting in Quantum Key Distribution Software

Omar Amer, Vaibhav Garg, Walter O. Krawec

With 5G communication networks enjoying commercial adoption, work has begun towards defining future 6G networks. The emergence of commercially viable quantum communication technologies offer these future communication networks information-theoretic key agreement techniques enabling provably quantum resistant secure communications through quantum key distribution protocols. However, commercial quantum key distribution systems rely on independent software implementations of key agreement protocols. Thus, while these systems may be mathematically secure they may incur security vulnerabilities in software. To address this we design a standardized sifting module, which can be used to generalize the description and execution of the necessary sifting in most if not all discrete variable quantum key distribution protocols, including entanglement based protocols. We give a general description of the software stack underlying implementations of the post-processing stage of quantum key distribution protocols, including our formalization of the two-way sifting stage of said protocols and the machinery required to realize it in a completely general manner. Finally, we give some example configurations for some common quantum key distribution protocols.

IEEE Globecom Workshops (GC Wkshps)•Dec 4, 2022•2 citations

Security Analysis of Quantum Key Distribution: Methods and Applications

Jie Lin

Quantum key distribution (QKD) can be proved to be secure by laws of quantum mechanics. In this thesis, we review security proof methods in Renner's framework and discuss numerical methods to calculate asymptotic and finite key rates. These methods are highly versatile and applicable to general device-dependent QKD protocols. We also discuss analytical tools that extend the applicability of these numerical methods. We then present the asymptotic security proof against collective attacks for a variant of the twin-field QKD protocol, which can overcome the repeaterless secret-key capacity bound. Our variant reduces the sifting cost and uses non-phase-randomized coherent states as both signals and test states. We confirm the loss scaling of this protocol. Another important family of protocols that we investigate here are discrete-modulated continuous-variable QKD protocols. They are interesting due to their experimental simplicity and their great potential for massive deployment in the quantum-secured networks. Our security proof method can provide tight asymptotic key rates. We demonstrate that the postselection of data in combination with reverse reconciliation can improve the key rates. We analyze both untrusted and trusted detector noise scenarios. Our results in the trusted detector noise scenario show that we can thus cut out most of the effect of detector noise and obtain asymptotic key rates similar to those had we access to ideal detectors. Finally, we present several simple examples to illustrate our newly developed method for the numerical finite-key analysis against the most general attacks via the entropy accumulation theorem.

•Sep 27, 2021•2 citations
A central assumption in quantum key distribution (QKD) is that Eve has no knowledge about which rounds will be used for parameter estimation or key distillation. Here we show that this assumption is violated for iterative sifting , a sifting procedure that has been employed in some (but not all) of the recently suggested QKD protocols in order to increase their efficiency. We show that iterative sifting leads to two security issues: (1) some rounds are more likely to be key rounds than others, (2) the public communication of past measurement choices changes this bias round by round. We analyze these two previously unnoticed problems, present eavesdropping strategies that exploit them, and find that the two problems are independent. We discuss some sifting protocols in the literature that are immune to these problems. While some of these would be inefficient replacements for iterative sifting, we find that the sifting subroutine of an asymptotically secure protocol suggested by Lo et al (2005 J. Cryptol. 18 133–65 ), which we call LCA sifting, has an efficiency on par with that of iterative sifting. One of our main results is to show that LCA sifting can be adapted to achieve secure sifting in the finite -key regime. More precisely, we combine LCA sifting with a certain parameter estimation protocol, and we prove the finite-key security of this combination. Hence we propose that LCA sifting should replace iterative sifting in future QKD implementations. More generally, we present two formal criteria for a sifting protocol that guarantee its finite-key security. Our criteria may guide the design of future protocols and inspire a more rigorous QKD analysis, which has neglected sifting-related attacks so far.
Abstract Several quantum key distribution (QKD) protocols employ iterative sifting. After each quantum transmission round, Alice and Bob disclose part of their setting information (including their basis choices) for the detected signals. This quantum phase then ends when the basis dependent termination conditions are met, i.e., the numbers of detected signals per basis exceed certain pre-agreed threshold values. Recently, however, Pfister et al (2016 New J. Phys. 18 053001) showed that the basis dependent termination condition makes QKD insecure, especially in the finite key regime, and they suggested to disclose all the setting information after finishing the quantum phase. However, this protocol has two main drawbacks: it requires that Alice possesses a large memory, and she also needs to have some a priori knowledge about the transmission rate of the quantum channel. Here we solve these two problems by introducing a basis-independent termination condition to the iterative sifting in the finite key regime. The use of this condition, in combination with Azuma’s inequality, provides a precise estimation on the amount of privacy amplification that needs to be applied, thus leading to the security of QKD protocols, including the loss-tolerant protocol (Tamaki et al 2014 Phys. Rev. A 90 052314), with iterative sifting. Our analysis indicates that to announce the basis information after each quantum transmission round does not compromise the key generation rate of the loss-tolerant protocol. Our result allows the implementation of wider classes of classical post-processing techniques in QKD with quantified security.
Quantum key distribution (QKD) enables secure information exchange with untrusted quantum links between remote communication parties. A central task in the studies of QKD protocols is security analysis, which aims at deriving the length of the final key such that it is secure regardless of the eavesdropper's computational power. In literature, the security analysis has been done both analytically and numerically. Compared to analytical methods which tend to require techniques specific to each QKD protocol, numerical ones are more general since they can be directly applied to many QKD protocols with little adaptation. However, current numerical methods are carried out based on some assumptions such as working in the asymptotic limit and collective attacks from eavesdroppers. In this work, we remove these assumptions and develop a numerical finite-size security analysis against general attacks for a large class of QKD protocols. We also give an example of applying the method to the recent phase-matching QKD protocol with a simplified protocol design. Our result shows that the finite-size key rate can surpass the linear key-rate bound with a practical QKD system operated for only several hours.
In this paper, we introduce a novel two-way quantum key distribution (QKD) protocol in which the sender (Alice) and receiver (Bob) employ one qubit of a maximally entangled Bell state as the quantum channel for key exchange. The protocol incorporates a new security mechanism based on a scrambling operator. Unlike conventional two-way QKD protocols, all sifting operations and eavesdropper detection procedures are postponed until the completion of the quantum communication stage and are performed exclusively by Bob. Since the control mode is never publicly announced, attacks that rely on mode-dependent adaptations or attempt to remain hidden within the control mode are inherently prevented. Furthermore, the traveling qubit does not directly encode key information, substantially limiting the information that can be extracted from attacks targeting the quantum channel alone. An additional distinctive feature of the protocol is that rounds that would ordinarily be discarded can instead be utilized to detect the presence of an eavesdropper. We analyze a broad class of ancilla-based attacks, in which an eavesdropper couples an ancillary system to the transmitted qubit in an attempt to gain information about the key, and show that such attacks are detectable in their most general form.
In contrast to classical public-key cryptosystems, where the security of encoded messages relies on on computational assumptions, Quantum Key Distribution (QKD) enables two distant parties to establish a shared secret key that, when combined with a one-time pad, provides information-theoretically secure encryption, provided that the QKD protocol is supported by a rigorous security proof. In the last decades, security proofs robust against a wide range of eavesdropping strategies have established the theoretical soundness of several QKD protocols. However, most proofs are based on idealized models of the physical systems involved in such protocols and often include assumptions that are not satisfied in practical implementations. This mismatch creates a gap between theoretical security guarantees and actual experimental realizations, making QKD protocols vulnerable to attacks. To ensure the security of real-world QKD systems, it is therefore essential to account for imperfections in security analyses. In this article, we present an overview of recent analytical and numerical developments in QKD security proofs, which provide a versatile approach for incorporating imperfections and re-establishing the security of quantum communication protocols under realistic conditions.
With 5G communication networks enjoying commercial adoption, work has begun towards defining future 6G networks. The emergence of commercially viable quantum communication technologies offer these future communication networks information-theoretic key agreement techniques enabling provably quantum resistant secure communications through quantum key distribution protocols. However, commercial quantum key distribution systems rely on independent software implementations of key agreement protocols. Thus, while these systems may be mathematically secure they may incur security vulnerabilities in software. To address this we design a standardized sifting module, which can be used to generalize the description and execution of the necessary sifting in most if not all discrete variable quantum key distribution protocols, including entanglement based protocols. We give a general description of the software stack underlying implementations of the post-processing stage of quantum key distribution protocols, including our formalization of the two-way sifting stage of said protocols and the machinery required to realize it in a completely general manner. Finally, we give some example configurations for some common quantum key distribution protocols.
Quantum key distribution (QKD) can be proved to be secure by laws of quantum mechanics. In this thesis, we review security proof methods in Renner's framework and discuss numerical methods to calculate asymptotic and finite key rates. These methods are highly versatile and applicable to general device-dependent QKD protocols. We also discuss analytical tools that extend the applicability of these numerical methods. We then present the asymptotic security proof against collective attacks for a variant of the twin-field QKD protocol, which can overcome the repeaterless secret-key capacity bound. Our variant reduces the sifting cost and uses non-phase-randomized coherent states as both signals and test states. We confirm the loss scaling of this protocol. Another important family of protocols that we investigate here are discrete-modulated continuous-variable QKD protocols. They are interesting due to their experimental simplicity and their great potential for massive deployment in the quantum-secured networks. Our security proof method can provide tight asymptotic key rates. We demonstrate that the postselection of data in combination with reverse reconciliation can improve the key rates. We analyze both untrusted and trusted detector noise scenarios. Our results in the trusted detector noise scenario show that we can thus cut out most of the effect of detector noise and obtain asymptotic key rates similar to those had we access to ideal detectors. Finally, we present several simple examples to illustrate our newly developed method for the numerical finite-key analysis against the most general attacks via the entropy accumulation theorem.