Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:1610.06499 · Quantum Science and Technology

Security of quantum key distribution with iterative sifting

Kiyoshi Tamaki, Hoi‐Kwong Lo, Akihiro Mizutani, Go Kato, Charles Ci Wen Lim, Koji Azuma, Marcos Curty

Published Sep 1, 2017• 12 citations
arXivHTMLPDF

Abstract

Abstract Several quantum key distribution (QKD) protocols employ iterative sifting. After each quantum transmission round, Alice and Bob disclose part of their setting information (including their basis choices) for the detected signals. This quantum phase then ends when the basis dependent termination conditions are met, i.e., the numbers of detected signals per basis exceed certain pre-agreed threshold values. Recently, however, Pfister et al (2016 New J. Phys. 18 053001) showed that the basis dependent termination condition makes QKD insecure, especially in the finite key regime, and they suggested to disclose all the setting information after finishing the quantum phase. However, this protocol has two main drawbacks: it requires that Alice possesses a large memory, and she also needs to have some a priori knowledge about the transmission rate of the quantum channel. Here we solve these two problems by introducing a basis-independent termination condition to the iterative sifting in the finite key regime. The use of this condition, in combination with Azuma’s inequality, provides a precise estimation on the amount of privacy amplification that needs to be applied, thus leading to the security of QKD protocols, including the loss-tolerant protocol (Tamaki et al 2014 Phys. Rev. A 90 052314), with iterative sifting. Our analysis indicates that to announce the basis information after each quantum transmission round does not compromise the key generation rate of the loss-tolerant protocol. Our result allows the implementation of wider classes of classical post-processing techniques in QKD with quantified security.

DOI
10.1088/2058-9565/aa89bd

Related papers

Sifting attacks in finite-size quantum key distribution

Corsin Pfister, Norbert Lütkenhaus, Stephanie Wehner +1 more

A central assumption in quantum key distribution (QKD) is that Eve has no knowledge about which rounds will be used for parameter estimation or key distillation. Here we show that this assumption is violated for iterative sifting , a sifting procedure that has been employed in some (but not all) of the recently suggested QKD protocols in order to increase their efficiency. We show that iterative sifting leads to two security issues: (1) some rounds are more likely to be key rounds than others, (2) the public communication of past measurement choices changes this bias round by round. We analyze these two previously unnoticed problems, present eavesdropping strategies that exploit them, and find that the two problems are independent. We discuss some sifting protocols in the literature that are immune to these problems. While some of these would be inefficient replacements for iterative sifting, we find that the sifting subroutine of an asymptotically secure protocol suggested by Lo et al (2005 J. Cryptol. 18 133–65 ), which we call LCA sifting, has an efficiency on par with that of iterative sifting. One of our main results is to show that LCA sifting can be adapted to achieve secure sifting in the finite -key regime. More precisely, we combine LCA sifting with a certain parameter estimation protocol, and we prove the finite-key security of this combination. Hence we propose that LCA sifting should replace iterative sifting in future QKD implementations. More generally, we present two formal criteria for a sifting protocol that guarantee its finite-key security. Our criteria may guide the design of future protocols and inspire a more rigorous QKD analysis, which has neglected sifting-related attacks so far.

arXiv:1506.07502•New Journal of Physics•Apr 29, 2016•24 citations

Round-robin differential-phase-shift quantum key distribution

Zhen Zhang, Xiao Yuan, Zhu Cao +1 more

The security of quantum key distribution (QKD) relies on the Heisenberg uncertainty principle, with which legitimate users are able to estimate information leakage by monitoring the disturbance of the transmitted quantum signals. Normally, the disturbance is reflected as bit flip errors in the sifted key; thus, privacy amplification, which removes any leaked information from the key, generally depends on the bit error rate. Recently, a round-robin differential-phase-shift QKD protocol for which privacy amplification does not rely on the bit error rate [Nature 509, 475 (2014)] was proposed. The amount of leaked information can be bounded by the sender during the state-preparation stage and hence, is independent of the behaviour of the unreliable quantum channel. Considering the essence of this protocol, we present a tight bound on the key rate and employ a decoy-state method. The effects of background noise and misalignment are taken into account under practical conditions. Our simulation results show that the protocol can tolerate channel error rates of close to 50% within a typical experiment setting. That is, there is no restriction on the error rate in practice.

•May 11, 2015•5 citations

Practical round-robin differential-phase-shift quantum key distribution

Zhen Zhang, Xiao Yuan, Zhu Cao +1 more

The security of quantum key distribution (QKD) relies on the Heisenberg uncertainty principle, with which legitimate users are able to estimate information leakage by monitoring the disturbance of the transmitted quantum signals. Normally, the disturbance is reflected as bit flip errors in the sifted key; thus, privacy amplification, which removes any leaked information from the key, generally depends on the bit error rate. Recently, a round-robin differential-phase-shift QKD protocol for which privacy amplification does not rely on the bit error rate (Sasaki et al 2014 Nature 509 475) was proposed. The amount of leaked information can be bounded by the sender during the state-preparation stage and hence, is independent of the behavior of the unreliable quantum channel. In our work, we apply the tagging technique to the protocol and present a tight bound on the key rate and employ a decoy-state method. The effects of background noise and misalignment are taken into account under practical conditions. Our simulation results show that the protocol can tolerate channel error rates close to 50% within a typical experiment setting. That is, there is a negligible restriction on the error rate in practice.

arXiv:1505.02481•New Journal of Physics•Mar 9, 2017•21 citations

Self-Sifting quantum key distribution

Saman Sarshar, Mostafa Annabestani

In this paper, we introduce a novel two-way quantum key distribution (QKD) protocol in which the sender (Alice) and receiver (Bob) employ one qubit of a maximally entangled Bell state as the quantum channel for key exchange. The protocol incorporates a new security mechanism based on a scrambling operator. Unlike conventional two-way QKD protocols, all sifting operations and eavesdropper detection procedures are postponed until the completion of the quantum communication stage and are performed exclusively by Bob. Since the control mode is never publicly announced, attacks that rely on mode-dependent adaptations or attempt to remain hidden within the control mode are inherently prevented. Furthermore, the traveling qubit does not directly encode key information, substantially limiting the information that can be extracted from attacks targeting the quantum channel alone. An additional distinctive feature of the protocol is that rounds that would ordinarily be discarded can instead be utilized to detect the presence of an eavesdropper. We analyze a broad class of ancilla-based attacks, in which an eavesdropper couples an ancillary system to the transmitted qubit in an attempt to gain information about the key, and show that such attacks are detectable in their most general form.

quant-pharXiv:2606.27299•Jun 26, 2026•0 citations

Exploiting the randomness of the measurement basis in quantum cryptography: Secure Quantum Key Growing without Privacy Amplification

Hannes R. Böhm, Paul S. Böhm, Markus Aspelmeyer +2 more

We suggest that the randomness of the choices of measurement basis by Alice and Bob provides an additional important resource for quantum cryptography. As a specific application, we present a novel protocol for quantum key distribution (QKD) which enhances the BB84 scheme by encrypting the information sent over the classical channel during key sifting. We show that, in the limit of long keys, this process prevents an eavesdropper from reproducing the sifting process carried out by the legitimate users. The inability of the eavesdropper to sift the information gathered by tapping the quantum channel reduces the amount of information that an eavesdropper can gain on the sifted key. We further show that the protocol proposed is self sustaining, and thus allows the growing of a secret key.

arXiv:quant-ph/0408179•Aug 30, 2004•2 citations

Finite-key analysis of loss-tolerant quantum key distribution based on random sampling theory

Guillermo Currás-Lorenzo, Álvaro Navarrete, Margarida Pereira +1 more

The core of security proofs of quantum key distribution (QKD) is the estimation of a parameter that determines the amount of privacy amplification that the users need to apply in order to distill a secret key. To estimate this parameter using the observed data, one needs to apply concentration inequalities such as random sampling theory or Azuma's inequality. The latter can be straightforwardly employed in a wider class of QKD protocols, including those that do not rely on basis-independent sources such as the loss-tolerant (LT) protocol. However, when applied to real-life finite-length QKD experiments, Azuma's inequality typically results in substantially lower secret-key rates. Here we propose an alternative security analysis of the LT protocol against general attacks, for both its prepare-and-measure and measurement-device-independent versions, that is based on random sampling theory. Consequently, our security proof provides considerably higher secret-key rates than the previous finite-key analysis based on Azuma's inequality. This work opens up the possibility of using random sampling theory to provide alternative security proofs for other QKD protocols.

arXiv:2101.12603•Physical Review A•Jul 6, 2021•12 citations
Abstract Several quantum key distribution (QKD) protocols employ iterative sifting. After each quantum transmission round, Alice and Bob disclose part of their setting information (including their basis choices) for the detected signals. This quantum phase then ends when the basis dependent termination conditions are met, i.e., the numbers of detected signals per basis exceed certain pre-agreed threshold values. Recently, however, Pfister et al (2016 New J. Phys. 18 053001) showed that the basis dependent termination condition makes QKD insecure, especially in the finite key regime, and they suggested to disclose all the setting information after finishing the quantum phase. However, this protocol has two main drawbacks: it requires that Alice possesses a large memory, and she also needs to have some a priori knowledge about the transmission rate of the quantum channel. Here we solve these two problems by introducing a basis-independent termination condition to the iterative sifting in the finite key regime. The use of this condition, in combination with Azuma’s inequality, provides a precise estimation on the amount of privacy amplification that needs to be applied, thus leading to the security of QKD protocols, including the loss-tolerant protocol (Tamaki et al 2014 Phys. Rev. A 90 052314), with iterative sifting. Our analysis indicates that to announce the basis information after each quantum transmission round does not compromise the key generation rate of the loss-tolerant protocol. Our result allows the implementation of wider classes of classical post-processing techniques in QKD with quantified security.
A central assumption in quantum key distribution (QKD) is that Eve has no knowledge about which rounds will be used for parameter estimation or key distillation. Here we show that this assumption is violated for iterative sifting , a sifting procedure that has been employed in some (but not all) of the recently suggested QKD protocols in order to increase their efficiency. We show that iterative sifting leads to two security issues: (1) some rounds are more likely to be key rounds than others, (2) the public communication of past measurement choices changes this bias round by round. We analyze these two previously unnoticed problems, present eavesdropping strategies that exploit them, and find that the two problems are independent. We discuss some sifting protocols in the literature that are immune to these problems. While some of these would be inefficient replacements for iterative sifting, we find that the sifting subroutine of an asymptotically secure protocol suggested by Lo et al (2005 J. Cryptol. 18 133–65 ), which we call LCA sifting, has an efficiency on par with that of iterative sifting. One of our main results is to show that LCA sifting can be adapted to achieve secure sifting in the finite -key regime. More precisely, we combine LCA sifting with a certain parameter estimation protocol, and we prove the finite-key security of this combination. Hence we propose that LCA sifting should replace iterative sifting in future QKD implementations. More generally, we present two formal criteria for a sifting protocol that guarantee its finite-key security. Our criteria may guide the design of future protocols and inspire a more rigorous QKD analysis, which has neglected sifting-related attacks so far.
The security of quantum key distribution (QKD) relies on the Heisenberg uncertainty principle, with which legitimate users are able to estimate information leakage by monitoring the disturbance of the transmitted quantum signals. Normally, the disturbance is reflected as bit flip errors in the sifted key; thus, privacy amplification, which removes any leaked information from the key, generally depends on the bit error rate. Recently, a round-robin differential-phase-shift QKD protocol for which privacy amplification does not rely on the bit error rate [Nature 509, 475 (2014)] was proposed. The amount of leaked information can be bounded by the sender during the state-preparation stage and hence, is independent of the behaviour of the unreliable quantum channel. Considering the essence of this protocol, we present a tight bound on the key rate and employ a decoy-state method. The effects of background noise and misalignment are taken into account under practical conditions. Our simulation results show that the protocol can tolerate channel error rates of close to 50% within a typical experiment setting. That is, there is no restriction on the error rate in practice.
The security of quantum key distribution (QKD) relies on the Heisenberg uncertainty principle, with which legitimate users are able to estimate information leakage by monitoring the disturbance of the transmitted quantum signals. Normally, the disturbance is reflected as bit flip errors in the sifted key; thus, privacy amplification, which removes any leaked information from the key, generally depends on the bit error rate. Recently, a round-robin differential-phase-shift QKD protocol for which privacy amplification does not rely on the bit error rate (Sasaki et al 2014 Nature 509 475) was proposed. The amount of leaked information can be bounded by the sender during the state-preparation stage and hence, is independent of the behavior of the unreliable quantum channel. In our work, we apply the tagging technique to the protocol and present a tight bound on the key rate and employ a decoy-state method. The effects of background noise and misalignment are taken into account under practical conditions. Our simulation results show that the protocol can tolerate channel error rates close to 50% within a typical experiment setting. That is, there is a negligible restriction on the error rate in practice.
In this paper, we introduce a novel two-way quantum key distribution (QKD) protocol in which the sender (Alice) and receiver (Bob) employ one qubit of a maximally entangled Bell state as the quantum channel for key exchange. The protocol incorporates a new security mechanism based on a scrambling operator. Unlike conventional two-way QKD protocols, all sifting operations and eavesdropper detection procedures are postponed until the completion of the quantum communication stage and are performed exclusively by Bob. Since the control mode is never publicly announced, attacks that rely on mode-dependent adaptations or attempt to remain hidden within the control mode are inherently prevented. Furthermore, the traveling qubit does not directly encode key information, substantially limiting the information that can be extracted from attacks targeting the quantum channel alone. An additional distinctive feature of the protocol is that rounds that would ordinarily be discarded can instead be utilized to detect the presence of an eavesdropper. We analyze a broad class of ancilla-based attacks, in which an eavesdropper couples an ancillary system to the transmitted qubit in an attempt to gain information about the key, and show that such attacks are detectable in their most general form.
We suggest that the randomness of the choices of measurement basis by Alice and Bob provides an additional important resource for quantum cryptography. As a specific application, we present a novel protocol for quantum key distribution (QKD) which enhances the BB84 scheme by encrypting the information sent over the classical channel during key sifting. We show that, in the limit of long keys, this process prevents an eavesdropper from reproducing the sifting process carried out by the legitimate users. The inability of the eavesdropper to sift the information gathered by tapping the quantum channel reduces the amount of information that an eavesdropper can gain on the sifted key. We further show that the protocol proposed is self sustaining, and thus allows the growing of a secret key.
The core of security proofs of quantum key distribution (QKD) is the estimation of a parameter that determines the amount of privacy amplification that the users need to apply in order to distill a secret key. To estimate this parameter using the observed data, one needs to apply concentration inequalities such as random sampling theory or Azuma's inequality. The latter can be straightforwardly employed in a wider class of QKD protocols, including those that do not rely on basis-independent sources such as the loss-tolerant (LT) protocol. However, when applied to real-life finite-length QKD experiments, Azuma's inequality typically results in substantially lower secret-key rates. Here we propose an alternative security analysis of the LT protocol against general attacks, for both its prepare-and-measure and measurement-device-independent versions, that is based on random sampling theory. Consequently, our security proof provides considerably higher secret-key rates than the previous finite-key analysis based on Azuma's inequality. This work opens up the possibility of using random sampling theory to provide alternative security proofs for other QKD protocols.