Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:1612.07734 · Physical Review A

Numerical evidence for bound secrecy from two-way postprocessing in quantum key distribution

Sumeet Khatri, Norbert Lütkenhaus

Published Apr 14, 2017• 17 citations
arXivHTMLPDF

Abstract

Bound secret information is classical information that contains secrecy but from which secrecy cannot be extracted. The existence of bound secrecy has been conjectured but is currently unproven, and in this work we provide analytical and numerical evidence for its existence. Specifically, we consider two-way postprocessing protocols in prepare-and-measure quantum key distribution based on the well-known six-state signal states. In terms of the quantum bit-error rate $Q$ of the classical data, such protocols currently exist for $Q<\frac{5\ensuremath{-}\sqrt{5}}{10}\ensuremath{\approx}27.6%$. On the other hand, for $Q\ensuremath{\ge}\frac{1}{3}$ no such protocol can exist as the observed data are compatible with an intercept-resend attack. This leaves the interesting question of whether successful protocols exist in the interval $\frac{5\ensuremath{-}\sqrt{5}}{10}\ensuremath{\le}Q<\frac{1}{3}$. Previous work has shown that a necessary condition for the existence of two-way postprocessing protocols for distilling secret keys is breaking the symmetric extendability of the underlying quantum state shared by Alice and Bob. Using this result, it has been proven that symmetric extendability can be broken up to the $27.6%$ lower bound using the advantage distillation protocol. In this work, we first show that to break symmetric extendability it is sufficient to consider a generalized form of advantage distillation consisting of one round of postselection by Bob on a block of his data. We then provide evidence that such generalized protocols cannot break symmetric extendability beyond $27.6%$. We thus have evidence to believe that $27.6%$ is an upper bound on two-way postprocessing and that the interval $\frac{5\ensuremath{-}\sqrt{5}}{10}\ensuremath{\le}Q<\frac{1}{3}$ is a domain of bound secrecy.

DOI
10.1103/physreva.95.042320

Related papers

Symmetric Extendability of Quantum States and the Extreme Limits of Quantum Key Distribution

Sumeet Khatri

We investigate QKD protocols with two-way classical post-processing that are based on the well-known six-state and BB84 signal states. In these QKD protocols, the source (Alice) sends quantum signals to the receiver (Bob), who measures them, leaving only classical data on both sides. Our goal is to find the highest value of the quantum bit-error rate (QBER) $Q$ for which two-way classical post-processing protocols on the data can distill secret keys. Using the BB84 signal states, such protocols currently exist for $Q<\\frac{1}{5}$. On the other hand, for $Q\\geq\\frac{1}{4}$ no such protocol can exist as the observed data is compatible with an intercept-resend attack. This leaves the interesting question of whether successful two-way protocols exist in the interval $\\frac{1}{5}\\leq Q<\\frac{1}{4}$. For the six-state signal states, the corresponding interval is known to be $\\frac{5-\\sqrt{5}}{10}\\leq Q<\\frac{1}{3}$. \n\t \n\tWe search for two-way protocols because it turns out that within these intervals Alice and Bob's correlations are symmetrically extendable, meaning that Bob and the eavesdropper (Eve) are completely indistinguishable from Alice's point of view, making any one-way Alice-to-Bob post-processing protocol insecure. A two-way protocol might be able to break the symmetry between Bob and Eve, and it must do so in order to distill a secret key because any two-way protocol will necessarily terminate with a one-way communication step, at which point the symmetric extendability of Alice and Bob's updated correlations must be checked again. \n \nWe first show that the search for two-way protocols breaking the symmetric extendability of Alice and Bob's correlations can be restricted to a search over post-selection protocols if all we care about is whether secret key can at all be distilled and not about the rate of distillation. We then provide strong analytical and numerical evidence to suggest that no two-way classical post-processing protocol exists within the gap when the six-state signal states are used. \n\t \n\tUnder quantum entanglement distillation protocols, it is known that secret key can be distilled right up to the intercept-resend bounds of $\\frac{1}{4}$ and $\\frac{1}{3}$ for the BB84 and six-state signal states, respectively. We therefore want to know whether classical post-processing protocols are just as good at distilling secret keys as quantum ones. Our results appear to indicate that they are not.

•Oct 13, 2016•3 citations

Entropy Bounds via Hypothesis Testing and Its Applications to Two-Way Key Distillation in Quantum Cryptography

Rutvij Bhavsar, Junguk Moon, Joonwoo Bae

Quantum key distribution (QKD) achieves information-theoretic security for a shared secret key, using distributed quantum states. To establish secret bits, two honest parties apply key distillation protocols to the resulting measurement outcomes. In this work, we establish a rigorous connection between the key rate achievable by applying two-way key distillation, such as advantage distillation, and quantum hypothesis testing, via an integral representation of the conditional entropy in terms of the error probabilities of binary state discrimination. This connection significantly improves bounds on key rates at finite blocklengths relative to existing fidelity-based bounds. Moreover, in an important special case, it closes the gap between the known sufficient and conjectured necessary conditions for key generation in the large-blocklength limit. More generally, it establishes a matching asymptotic necessary condition, leaving the corresponding finite-blocklength result open. More broadly, our work shows how results in quantum hypothesis testing can directly sharpen the security analysis of QKD.

quant-pharXiv:2602.05870•Feb 6, 2026•0 citations

One-way quantum key distribution: Simple upper bound on the secret key rate

Tobias Moroder, Marcos Curty, Norbert Lütkenhaus

We present a simple method to obtain an upper bound on the achievable secret key rate in quantum key distribution (QKD) protocols that use only unidirectional classical communication during the public-discussion phase. This method is based on a necessary precondition for one-way secret key distillation; the legitimate users need to prove that there exists no quantum state having a symmetric extension that is compatible with the available measurements results. The main advantage of the obtained upper bound is that it can be formulated as a semidefinite program, which can be efficiently solved. We illustrate our results by analyzing two well-known qubit-based QKD protocols: the four-state protocol and the six-state protocol.

arXiv:quant-ph/0603270•Physical Review A•Nov 1, 2006•28 citations

Symmetric extension of bipartite quantum states and its use in quantum key distribution with two-way postprocessing

Geir Ove Myhr

We investigate which bipartite quantum states admit a symmetric extension and apply the results in the analysis of noise thresholds in quantum key distribution protocols with two-way postprocessing. We find that states that admit a symmetric extension can be decomposed into a convex combination of states that admit a_pure_ symmetric extension. For a state to have a pure symmetric extension, its nonzero eigenvalues must be equal to the nonzero eigenvalues of one of the subsystems. While this does not fully characterize the set of states with a pure symmetric extension in all dimensions, it is a full characterization for two qubits. A conjectured formula characterizing two-qubit states with a (mixed or pure) symmetric extension is presented. Proofs are given for some special classes. For multi-qubit Bell-diagonal states, the symmetric extension is simplified using the symmetries of the states and formulated as a semidefinite program. Quantum key distribution with two-way advantage distillation steps is then analyzed. For the commonly used repetition code advantage distillation, the failure to distill a secret key beyond the currently known noise thresholds is explained by a failure to break a symmetric extension. More general linear advantage distillation schemes are analyzed, but for those schemes analyzed, we find that they tolerate strictly less noise than repetition code advantage distillation before they fail to break a symmetric extension. The results suggest that no other linear advantage distillation scheme can reach the noise threshold of 27.6 % for the six-state protocol which is achieved by repetition code advantage distillation.

arXiv:1103.0766•Mar 3, 2011•11 citations

Limits of adaptive two-way linear postprocessing in six-state quantum key distribution

Toyohiro Tsurumaru

Two-way classical communication improves the noise tolerance of quantum key distribution, but the limits of adaptive parity processing remain unclear. For the six-state protocol with equal three-basis error rate $p\in[p_*,1/2]$, where $p_*=(5-\sqrt5)/10\simeq27.64\%$, we construct a single compatible collective attack that defeats a broad class of linear postprocessing. Each public message may be a linear function of the sender's raw key, chosen adaptively from the public history. For every finite input length and every accepted transcript of positive probability, Eve's optimal probability of recovering any linear function of Alice's raw key is at least Bob's. Consequently, reliable agreement on a linear final key is incompatible with secrecy. The same conclusion holds for arbitrary publicly seeded privacy amplification after reliable recovery of a linear candidate. The proof conditions on the complete transcript, which restricts the two raw keys to affine subspaces. A local degradation of Eve's state, a known Rényi-entropy comparison, and a coset-probability inequality then give the recovery comparison. Both inequalities are proved in self-contained appendices. The result allows block splitting, regrouping, nonzero-syndrome selection, and adaptive linear reconciliation.

quant-pharXiv:2610.21469•Oct 16, 2026•0 citations

Upper bounds for the secure key rate of the decoy-state quantum key distribution

Marcos Curty, Tobias Moroder, Xiongfeng Ma +2 more

The use of decoy states in quantum key distribution (QKD) has provided a method for substantially increasing the secret key rate and distance that can be covered by QKD protocols with practical signals. The security analysis of these schemes, however, leaves open the possibility that the development of better proof techniques or better classical postprocessing methods might further improve their performance in realistic scenarios. In this paper, we derive upper bounds on the secure key rate for decoy-state QKD. These bounds are based basically only on the classical correlations established by the legitimate users during the quantum communication phase of the protocol. The only assumption about the possible postprocessing methods is that double click events are randomly assigned to single click events. Further, we consider only secure key rates based on the uncalibrated device scenario which assigns imperfections such as detection inefficiency to the eavesdropper. Our analysis relies on two preconditions for secure two-way and one-way QKD. The legitimate users need to prove that there exists no separable state (in the case of two-way QKD) or that there exists no quantum state having a symmetric extension (one-way QKD) that is compatible with the available measurements results. Both criteria have been previously applied to evaluate single-photon implementations of QKD. Here we use them to investigate a realistic source of weak coherent pulses. The resulting upper bounds can be formulated as a convex optimization problem known as a semidefinite program which can be efficiently solved. For the standard four-state QKD protocol, they are quite close to known lower bounds, thus showing that there are clear limits to the further improvement of classical postprocessing techniques in decoy-state QKD.

arXiv:0901.4669•Physical Review A•Mar 26, 2009•10 citations
Bound secret information is classical information that contains secrecy but from which secrecy cannot be extracted. The existence of bound secrecy has been conjectured but is currently unproven, and in this work we provide analytical and numerical evidence for its existence. Specifically, we consider two-way postprocessing protocols in prepare-and-measure quantum key distribution based on the well-known six-state signal states. In terms of the quantum bit-error rate QQQ of the classical data, such protocols currently exist for Q<5\ensuremath−510\ensuremath≈27.6Q<\frac{5\ensuremath{-}\sqrt{5}}{10}\ensuremath{\approx}27.6%Q<105\ensuremath−5​​\ensuremath≈27.6. On the other hand, for Q\ensuremath≥13Q\ensuremath{\ge}\frac{1}{3}Q\ensuremath≥31​ no such protocol can exist as the observed data are compatible with an intercept-resend attack. This leaves the interesting question of whether successful protocols exist in the interval 5\ensuremath−510\ensuremath≤Q<13\frac{5\ensuremath{-}\sqrt{5}}{10}\ensuremath{\le}Q<\frac{1}{3}105\ensuremath−5​​\ensuremath≤Q<31​. Previous work has shown that a necessary condition for the existence of two-way postprocessing protocols for distilling secret keys is breaking the symmetric extendability of the underlying quantum state shared by Alice and Bob. Using this result, it has been proven that symmetric extendability can be broken up to the 27.627.6%27.6 lower bound using the advantage distillation protocol. In this work, we first show that to break symmetric extendability it is sufficient to consider a generalized form of advantage distillation consisting of one round of postselection by Bob on a block of his data. We then provide evidence that such generalized protocols cannot break symmetric extendability beyond 27.627.6%27.6. We thus have evidence to believe that 27.627.6%27.6 is an upper bound on two-way postprocessing and that the interval 5\ensuremath−510\ensuremath≤Q<13\frac{5\ensuremath{-}\sqrt{5}}{10}\ensuremath{\le}Q<\frac{1}{3}105\ensuremath−5​​\ensuremath≤Q<31​ is a domain of bound secrecy.
We investigate QKD protocols with two-way classical post-processing that are based on the well-known six-state and BB84 signal states. In these QKD protocols, the source (Alice) sends quantum signals to the receiver (Bob), who measures them, leaving only classical data on both sides. Our goal is to find the highest value of the quantum bit-error rate (QBER) QQQ for which two-way classical post-processing protocols on the data can distill secret keys. Using the BB84 signal states, such protocols currently exist for Q<frac15Q<\\frac{1}{5}Q<frac15. On the other hand, for Qgeqfrac14Q\\geq\\frac{1}{4}Qgeqfrac14 no such protocol can exist as the observed data is compatible with an intercept-resend attack. This leaves the interesting question of whether successful two-way protocols exist in the interval frac15leqQ<frac14\\frac{1}{5}\\leq Q<\\frac{1}{4}frac15leqQ<frac14. For the six-state signal states, the corresponding interval is known to be frac5−sqrt510leqQ<frac13\\frac{5-\\sqrt{5}}{10}\\leq Q<\\frac{1}{3}frac5−sqrt510leqQ<frac13. \n\t \n\tWe search for two-way protocols because it turns out that within these intervals Alice and Bob's correlations are symmetrically extendable, meaning that Bob and the eavesdropper (Eve) are completely indistinguishable from Alice's point of view, making any one-way Alice-to-Bob post-processing protocol insecure. A two-way protocol might be able to break the symmetry between Bob and Eve, and it must do so in order to distill a secret key because any two-way protocol will necessarily terminate with a one-way communication step, at which point the symmetric extendability of Alice and Bob's updated correlations must be checked again. \n \nWe first show that the search for two-way protocols breaking the symmetric extendability of Alice and Bob's correlations can be restricted to a search over post-selection protocols if all we care about is whether secret key can at all be distilled and not about the rate of distillation. We then provide strong analytical and numerical evidence to suggest that no two-way classical post-processing protocol exists within the gap when the six-state signal states are used. \n\t \n\tUnder quantum entanglement distillation protocols, it is known that secret key can be distilled right up to the intercept-resend bounds of frac14\\frac{1}{4}frac14 and frac13\\frac{1}{3}frac13 for the BB84 and six-state signal states, respectively. We therefore want to know whether classical post-processing protocols are just as good at distilling secret keys as quantum ones. Our results appear to indicate that they are not.
Quantum key distribution (QKD) achieves information-theoretic security for a shared secret key, using distributed quantum states. To establish secret bits, two honest parties apply key distillation protocols to the resulting measurement outcomes. In this work, we establish a rigorous connection between the key rate achievable by applying two-way key distillation, such as advantage distillation, and quantum hypothesis testing, via an integral representation of the conditional entropy in terms of the error probabilities of binary state discrimination. This connection significantly improves bounds on key rates at finite blocklengths relative to existing fidelity-based bounds. Moreover, in an important special case, it closes the gap between the known sufficient and conjectured necessary conditions for key generation in the large-blocklength limit. More generally, it establishes a matching asymptotic necessary condition, leaving the corresponding finite-blocklength result open. More broadly, our work shows how results in quantum hypothesis testing can directly sharpen the security analysis of QKD.
We present a simple method to obtain an upper bound on the achievable secret key rate in quantum key distribution (QKD) protocols that use only unidirectional classical communication during the public-discussion phase. This method is based on a necessary precondition for one-way secret key distillation; the legitimate users need to prove that there exists no quantum state having a symmetric extension that is compatible with the available measurements results. The main advantage of the obtained upper bound is that it can be formulated as a semidefinite program, which can be efficiently solved. We illustrate our results by analyzing two well-known qubit-based QKD protocols: the four-state protocol and the six-state protocol.
We investigate which bipartite quantum states admit a symmetric extension and apply the results in the analysis of noise thresholds in quantum key distribution protocols with two-way postprocessing. We find that states that admit a symmetric extension can be decomposed into a convex combination of states that admit a_pure_ symmetric extension. For a state to have a pure symmetric extension, its nonzero eigenvalues must be equal to the nonzero eigenvalues of one of the subsystems. While this does not fully characterize the set of states with a pure symmetric extension in all dimensions, it is a full characterization for two qubits. A conjectured formula characterizing two-qubit states with a (mixed or pure) symmetric extension is presented. Proofs are given for some special classes. For multi-qubit Bell-diagonal states, the symmetric extension is simplified using the symmetries of the states and formulated as a semidefinite program. Quantum key distribution with two-way advantage distillation steps is then analyzed. For the commonly used repetition code advantage distillation, the failure to distill a secret key beyond the currently known noise thresholds is explained by a failure to break a symmetric extension. More general linear advantage distillation schemes are analyzed, but for those schemes analyzed, we find that they tolerate strictly less noise than repetition code advantage distillation before they fail to break a symmetric extension. The results suggest that no other linear advantage distillation scheme can reach the noise threshold of 27.6 % for the six-state protocol which is achieved by repetition code advantage distillation.
Two-way classical communication improves the noise tolerance of quantum key distribution, but the limits of adaptive parity processing remain unclear. For the six-state protocol with equal three-basis error rate p∈[p∗,1/2]p\in[p_*,1/2]p∈[p∗​,1/2], where p∗=(5−5)/10≃27.64%p_*=(5-\sqrt5)/10\simeq27.64\%p∗​=(5−5​)/10≃27.64%, we construct a single compatible collective attack that defeats a broad class of linear postprocessing. Each public message may be a linear function of the sender's raw key, chosen adaptively from the public history. For every finite input length and every accepted transcript of positive probability, Eve's optimal probability of recovering any linear function of Alice's raw key is at least Bob's. Consequently, reliable agreement on a linear final key is incompatible with secrecy. The same conclusion holds for arbitrary publicly seeded privacy amplification after reliable recovery of a linear candidate. The proof conditions on the complete transcript, which restricts the two raw keys to affine subspaces. A local degradation of Eve's state, a known Rényi-entropy comparison, and a coset-probability inequality then give the recovery comparison. Both inequalities are proved in self-contained appendices. The result allows block splitting, regrouping, nonzero-syndrome selection, and adaptive linear reconciliation.
The use of decoy states in quantum key distribution (QKD) has provided a method for substantially increasing the secret key rate and distance that can be covered by QKD protocols with practical signals. The security analysis of these schemes, however, leaves open the possibility that the development of better proof techniques or better classical postprocessing methods might further improve their performance in realistic scenarios. In this paper, we derive upper bounds on the secure key rate for decoy-state QKD. These bounds are based basically only on the classical correlations established by the legitimate users during the quantum communication phase of the protocol. The only assumption about the possible postprocessing methods is that double click events are randomly assigned to single click events. Further, we consider only secure key rates based on the uncalibrated device scenario which assigns imperfections such as detection inefficiency to the eavesdropper. Our analysis relies on two preconditions for secure two-way and one-way QKD. The legitimate users need to prove that there exists no separable state (in the case of two-way QKD) or that there exists no quantum state having a symmetric extension (one-way QKD) that is compatible with the available measurements results. Both criteria have been previously applied to evaluate single-photon implementations of QKD. Here we use them to investigate a realistic source of weak coherent pulses. The resulting upper bounds can be formulated as a convex optimization problem known as a semidefinite program which can be efficiently solved. For the standard four-state QKD protocol, they are quite close to known lower bounds, thus showing that there are clear limits to the further improvement of classical postprocessing techniques in decoy-state QKD.