Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:1705.10595

(Quantum) Min-Entropy Resources

Christopher Portmann

Published May 30, 2017• 3 citations
arXivHTMLPDF

Abstract

We model (interactive) resources that provide Alice with a string $X$ and a guarantee that any Eve interacting with her interface of the resource obtains a (quantum) system $E$ such that the conditional (smooth) min-entropy of $X$ given $E$ is lower bounded by some $k$. This (abstract) resource specification encompasses any setting that results in the honest players holding such a string (or aborting). For example, it could be constructed from, e.g., noisy channels, quantum key distribution (QKD), or a violation of Bell inequalities, which all may be used to derive bounds on the min-entropy of $X$. As a first application, we use this min-entropy resource to modularize key distribution (KD) schemes by dividing them in two parts, which may be analyzed separately. In the first part, a KD protocol constructs a min-entropy resource given the (physical) resources available in the specific setting considered. In the second, it distills secret key from the min-entropy resource---i.e., it constructs a secret key resource. We prove security for a generic key distillation protocol that may use any min-entropy resource. Since the notion of resource construction is composable---security of a composed protocol follows from the security of its parts--- this reduces proving security of a KD protocol (e.g., QKD) to proving that it constructs a min-entropy resource. As a second application, we provide a composable security proof for the recent Fehr-Salvail protocol [EUROCRYPT 2017] that authenticates classical messages with a quantum message authentication code (Q-MAC), and recycles all the key upon successfully verifying the authenticity of the message. This protocol uses (and recycles) a non-uniform key, which we model as consuming and constructing a min-entropy resource.

DOI
10.48550/arxiv.1705.10595

Related papers

SECURITY OF QUANTUM KEY DISTRIBUTION

Renato Renner

Quantum Information Theory is an area of physics which studies both fundamental and applied issues in quantum mechanics from an information-theoretical viewpoint. The underlying techniques are, however, often restricted to the analysis of systems which satisfy a certain independence condition. For example, it is assumed that an experiment can be repeated independently many times or that a large physical system consists of many virtually independent parts. Unfortunately, such assumptions are not always justified. This is particularly the case for practical applications — e.g. in quantum cryptography — where parts of a system might have an arbitrary and unknown behavior. We propose an approach which allows us to study general physical systems for which the above mentioned independence condition does not necessarily hold. It is based on an extension of various information-theoretical notions. For example, we introduce new uncertainty measures, called smooth min- and max-entropy, which are generalizations of the von Neumann entropy. Furthermore, we develop a quantum version of de Finetti's representation theorem, as described below. Consider a physical system consisting of n parts. These might, for instance, be the outcomes of n runs of a physical experiment. Moreover, we assume that the joint state of this n-partite system can be extended to an (n + k)-partite state which is symmetric under permutations of its parts (for some k ≫ 1). The de Finetti representation theorem then says that the original n-partite state is, in a certain sense, close to a mixture of product states. Independence thus follows (approximatively) from a symmetry condition. This symmetry condition can easily be met in many natural situations. For example, it holds for the joint state of n parts, which are chosen at random from an arbitrary (n + k)-partite system. As an application of these techniques, we prove the security of quantum key distribution (QKD), i.e. secret key agreement by communication over a quantum channel. In particular, we show that, in order to analyze QKD protocols, it is generally sufficient to consider so-called collective attacks, where the adversary is restricted to applying the same operation to each particle sent over the quantum channel separately. The proof is generic and thus applies to known protocols such as BB84 and B92 (where better bounds on the secret-key rate and on the the maximum tolerated noise level of the quantum channel are obtained) as well as to continuous variable schemes (where no full security proof has been known). Furthermore, the security holds with respect to a strong so-called universally composable definition. This implies that the keys generated by a QKD protocol can safely be used in any application, e.g. for one-time pad encryption — which, remarkably, is not the case for most standard definitions.

arXiv:quant-ph/0512258•International Journal of Quantum Information•Feb 1, 2008•1,160 citations

Eve's forgery probability from her false acceptance probability: interactive authentication, Holevo information and the min-entropy

Pete Rigas

We obtain estimates for Eve's forgery probability, namely the probability that she is able to forge a message which Alice or Bob mistakenly accept over a noisy Quantum channel for generating a shared Quantum secret key. This probability is related to Eve's success probability obtained in a previous work due to Renner and Wolf, which was obtained from assumptions on the min-entropy for characterizing asymmetric security. To demonstrate that protocols over noisy Quantum channels are dependent upon a single, unified security threshold in comparison to multiple security parameters in the Renner-Wolf interactive authentication protocol framework we upper bound Eve's forgery probability with a Holevo-type quantity that can be made negligibly small. By leveraging estimates for Eve's false acceptance probability that have previously been obtained by the author, we obtain the desired security threshold by bounding the false acceptance probability with a suitably chosen two-universal function which serves as a counterpart to two-universal hashing functions that have previously been examined for cryptographic protocols in Quantum key distribution. As a result the protocol is not only $ε$-secure, for some $ε>0$, but also composable against forgery and key leakage.

quant-pharXiv:2603.06645•Mar 2, 2026•0 citations

Quantum Cryptography : Protocols and Graphs

Jérôme Javelle

Je souhaite réaliser un modèle théorique optimal pour les protocoles de partage de secret quantique basé sur l'utilisation des états graphes. Le paramètre représentatif d'un partage de secret à seuil est, entre autres la taille du plus grand ensemble de joueurs qui ne peut pas accéder au secret. Je souhaite donc trouver un famille de protocoles pour laquelle ce paramètre est le plus petit possible. J'étudie également les liens entre les protocoles de partage de secret quantique et des familles de courbes en géométrie algébrique.

•Jun 2, 2014•0 citations

Quantum Authentication with Key Recycling

Christopher Portmann

We show that a family of quantum authentication protocols introduced in [Barnum et al., FOCS 2002] can be used to construct a secure quantum channel and additionally recycle all of the secret key if the message is successfully authenticated, and recycle part of the key if tampering is detected. We give a full security proof that constructs the secure channel given only insecure noisy channels and a shared secret key. We also prove that the number of recycled key bits is optimal for this family of protocols, i.e., there exists an adversarial strategy to obtain all non-recycled bits. Previous works recycled less key and only gave partial security proofs, since they did not consider all possible distinguishers (environments) that may be used to distinguish the real setting from the ideal secure quantum channel and secret key resource. These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

arXiv:1610.03422•Lecture notes in computer science•Jan 1, 2017•39 citations

Authentication in Security Proofs for Quantum Key Distribution

Devashish Tupkary, Shlok Nahar, Ernest Y. -Z. Tan

Quantum Key Distribution (QKD) protocols rely on authenticated classical communication. Typical QKD security proofs are carried out in an idealized setting where authentication is assumed to behave honestly: it never aborts, and all classical messages are delivered faithfully with their original timing preserved. Authenticated channels that can be constructed in practice have different properties. Most critically, such channels may abort asymmetrically, such that only the receiving party may detect an authentication failure while the sending party remains unaware. Furthermore, an adversary may delay, reorder, or block classical messages. This discrepancy means that existing security proofs under honest authentication do not directly establish security in the practical authentication setting. We address this gap using an existing security definition from the literature that permits asymmetric aborts while retaining secrecy of any key produced and agreement of the keys whenever both parties accept. Our main result is a reduction theorem showing that, under mild and easily satisfied protocol conditions, any QKD protocol proven secure under the honest authentication setting, for the standard security definition with symmetric aborts, remains secure under a practical authentication setting, for the weaker security definition that allows for asymmetric aborts. This result allows all existing QKD proofs to be retroactively lifted to the practical authentication setting (with asymmetric aborts) with a minor protocol tweak.

quant-pharXiv:2601.17960•Jan 27, 2026•1 citation

On Mixing of Quantum Key Distribution and Post-Quantum Cryptographic Keys: Min-Entropy Bounds, Provisioning Policies, and Network-Oriented Trade-Offs

Miralem Mehić, Stefan Raß, Sergej Jakovlev +3 more

IEEE Journal on Selected Areas in Communications•Jan 1, 2026•0 citations
We model (interactive) resources that provide Alice with a string XXX and a guarantee that any Eve interacting with her interface of the resource obtains a (quantum) system EEE such that the conditional (smooth) min-entropy of XXX given EEE is lower bounded by some kkk. This (abstract) resource specification encompasses any setting that results in the honest players holding such a string (or aborting). For example, it could be constructed from, e.g., noisy channels, quantum key distribution (QKD), or a violation of Bell inequalities, which all may be used to derive bounds on the min-entropy of XXX. As a first application, we use this min-entropy resource to modularize key distribution (KD) schemes by dividing them in two parts, which may be analyzed separately. In the first part, a KD protocol constructs a min-entropy resource given the (physical) resources available in the specific setting considered. In the second, it distills secret key from the min-entropy resource---i.e., it constructs a secret key resource. We prove security for a generic key distillation protocol that may use any min-entropy resource. Since the notion of resource construction is composable---security of a composed protocol follows from the security of its parts--- this reduces proving security of a KD protocol (e.g., QKD) to proving that it constructs a min-entropy resource. As a second application, we provide a composable security proof for the recent Fehr-Salvail protocol [EUROCRYPT 2017] that authenticates classical messages with a quantum message authentication code (Q-MAC), and recycles all the key upon successfully verifying the authenticity of the message. This protocol uses (and recycles) a non-uniform key, which we model as consuming and constructing a min-entropy resource.
Quantum Information Theory is an area of physics which studies both fundamental and applied issues in quantum mechanics from an information-theoretical viewpoint. The underlying techniques are, however, often restricted to the analysis of systems which satisfy a certain independence condition. For example, it is assumed that an experiment can be repeated independently many times or that a large physical system consists of many virtually independent parts. Unfortunately, such assumptions are not always justified. This is particularly the case for practical applications — e.g. in quantum cryptography — where parts of a system might have an arbitrary and unknown behavior. We propose an approach which allows us to study general physical systems for which the above mentioned independence condition does not necessarily hold. It is based on an extension of various information-theoretical notions. For example, we introduce new uncertainty measures, called smooth min- and max-entropy, which are generalizations of the von Neumann entropy. Furthermore, we develop a quantum version of de Finetti's representation theorem, as described below. Consider a physical system consisting of n parts. These might, for instance, be the outcomes of n runs of a physical experiment. Moreover, we assume that the joint state of this n-partite system can be extended to an (n + k)-partite state which is symmetric under permutations of its parts (for some k ≫ 1). The de Finetti representation theorem then says that the original n-partite state is, in a certain sense, close to a mixture of product states. Independence thus follows (approximatively) from a symmetry condition. This symmetry condition can easily be met in many natural situations. For example, it holds for the joint state of n parts, which are chosen at random from an arbitrary (n + k)-partite system. As an application of these techniques, we prove the security of quantum key distribution (QKD), i.e. secret key agreement by communication over a quantum channel. In particular, we show that, in order to analyze QKD protocols, it is generally sufficient to consider so-called collective attacks, where the adversary is restricted to applying the same operation to each particle sent over the quantum channel separately. The proof is generic and thus applies to known protocols such as BB84 and B92 (where better bounds on the secret-key rate and on the the maximum tolerated noise level of the quantum channel are obtained) as well as to continuous variable schemes (where no full security proof has been known). Furthermore, the security holds with respect to a strong so-called universally composable definition. This implies that the keys generated by a QKD protocol can safely be used in any application, e.g. for one-time pad encryption — which, remarkably, is not the case for most standard definitions.
We obtain estimates for Eve's forgery probability, namely the probability that she is able to forge a message which Alice or Bob mistakenly accept over a noisy Quantum channel for generating a shared Quantum secret key. This probability is related to Eve's success probability obtained in a previous work due to Renner and Wolf, which was obtained from assumptions on the min-entropy for characterizing asymmetric security. To demonstrate that protocols over noisy Quantum channels are dependent upon a single, unified security threshold in comparison to multiple security parameters in the Renner-Wolf interactive authentication protocol framework we upper bound Eve's forgery probability with a Holevo-type quantity that can be made negligibly small. By leveraging estimates for Eve's false acceptance probability that have previously been obtained by the author, we obtain the desired security threshold by bounding the false acceptance probability with a suitably chosen two-universal function which serves as a counterpart to two-universal hashing functions that have previously been examined for cryptographic protocols in Quantum key distribution. As a result the protocol is not only εεε-secure, for some ε>0ε>0ε>0, but also composable against forgery and key leakage.
Je souhaite réaliser un modèle théorique optimal pour les protocoles de partage de secret quantique basé sur l'utilisation des états graphes. Le paramètre représentatif d'un partage de secret à seuil est, entre autres la taille du plus grand ensemble de joueurs qui ne peut pas accéder au secret. Je souhaite donc trouver un famille de protocoles pour laquelle ce paramètre est le plus petit possible. J'étudie également les liens entre les protocoles de partage de secret quantique et des familles de courbes en géométrie algébrique.
We show that a family of quantum authentication protocols introduced in [Barnum et al., FOCS 2002] can be used to construct a secure quantum channel and additionally recycle all of the secret key if the message is successfully authenticated, and recycle part of the key if tampering is detected. We give a full security proof that constructs the secure channel given only insecure noisy channels and a shared secret key. We also prove that the number of recycled key bits is optimal for this family of protocols, i.e., there exists an adversarial strategy to obtain all non-recycled bits. Previous works recycled less key and only gave partial security proofs, since they did not consider all possible distinguishers (environments) that may be used to distinguish the real setting from the ideal secure quantum channel and secret key resource. These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.
Quantum Key Distribution (QKD) protocols rely on authenticated classical communication. Typical QKD security proofs are carried out in an idealized setting where authentication is assumed to behave honestly: it never aborts, and all classical messages are delivered faithfully with their original timing preserved. Authenticated channels that can be constructed in practice have different properties. Most critically, such channels may abort asymmetrically, such that only the receiving party may detect an authentication failure while the sending party remains unaware. Furthermore, an adversary may delay, reorder, or block classical messages. This discrepancy means that existing security proofs under honest authentication do not directly establish security in the practical authentication setting. We address this gap using an existing security definition from the literature that permits asymmetric aborts while retaining secrecy of any key produced and agreement of the keys whenever both parties accept. Our main result is a reduction theorem showing that, under mild and easily satisfied protocol conditions, any QKD protocol proven secure under the honest authentication setting, for the standard security definition with symmetric aborts, remains secure under a practical authentication setting, for the weaker security definition that allows for asymmetric aborts. This result allows all existing QKD proofs to be retroactively lifted to the practical authentication setting (with asymmetric aborts) with a minor protocol tweak.