Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:2507.21416 · Physical Review Research

Security loophole in error verification in quantum key distribution

Toyohiro Tsurumaru, Akihiro Mizutani, Toshihiko Sasaki

Published Nov 10, 2025• 0 citations
arXivHTMLPDF

Abstract

The security of quantum key distribution (QKD) is evaluated based on the secrecy of Alice's key and the correctness of the keys held by Alice and Bob. A practical method for ensuring correctness is known as error verification, in which Alice and Bob reveal a portion of their reconciled keys and check whether the revealed information matches. In this paper, we point out that when error verification is performed in a QKD protocol, the definition of secrecy must be revised accordingly. We illustrate the necessity of this revision with a counterexample, showing that neglecting it can lead to an incorrect security claim. In particular, we observe that in the case of the security proof method based on phase error correction, which is one of the mainstream approaches and also known as Koashi's approach, no explicit method has been established to properly incorporate the revised secrecy definition. To resolve this issue, we present a way to translate the phase error correction-based approach into another mainstream approach, called the leftover hash lemma-based approach, also known as Renner's approach, where a solution has already been formulated. As a consequence, security proofs under the phase error correction-based approach automatically remain valid without any change in the secret key length, even if they implicitly consider error verification without revising the secrecy definition.

DOI
10.1103/3vms-bx5d

Related papers

Secure and Efficient Verification Protocol for Quantum Key Distribution

Ching‐Nung Yang, Chih-Yueh Tseng, Po-Cheng Yu +1 more

Quantum key distribution (QKD) is a secure communication protocol that uses quantum bits (qubits) to ensure the security of key exchange between two entities (Alice and Bob). Their shared qubits may suffer from errors due to noise and eavesdropping in the quantum channels. After the QKD key agreement phase, Alice's key may not be different from Bob's key. Therefore, we need key verification to deal with the inconsistent qubits (i.e. the wrong qubits at receiver end). This key verification process is also known as information reconciliation. Recently, Kurt et al. proposed a reconciliation in QKD (RQKD) by using the polynomial consistency property. In this paper, we propose an enhanced RQKD (ERQKD) to improve key verification. Our method is still based on polynomial consistency, but uses the properties of consistency in a different way to obtain better key verification efficiency.

International Conference on Communications, Circuits and Systems•May 23, 2025•1 citation

Error estimation, error correction and verification in quantum key distribution

Øystein Marøy, Magne Gudmundsen, Lars Lydersen +1 more

The authors consider error correction in quantum key distribution. To avoid that Alice and Bob unwittingly end up with different keys, precautions must be taken. Before running the error correction protocol, Bob and Alice normally sacrifice some bits to estimate the error rate. To reduce the probability that they end up with different keys to an acceptable level, the authors show that a large number of bits must be sacrificed. Instead, if Alice and Bob can make a good guess about the error rate before the error correction, they can verify that their keys are similar after the error correction protocol. In this study, the authors show that this verification can be done by utilising properties of low‐density parity check codes used in the error correction. The authors compare the different methods and show that by verification it is often possible to sacrifice less bits without compromising security. The improvement is heavily dependent on the error rate and the block length, but for a key produced by the IdQuantique system Clavis 2 , the increase in the key rate is ∼5%. The authors also show that for systems with large fluctuations in the error rate, a combination of the two methods is optimal.

arXiv:1210.6520•IET Information Security•Jul 25, 2014•7 citations

Leftover Hashing From Quantum Error Correction: Unifying the Two Approaches to the Security Proof of Quantum Key Distribution

Toyohiro Tsurumaru

We show that the Mayers-Shor-Preskill approach and Renner's approach to proving the security of quantum key distribution (QKD) are essentially the same. We begin our analysis by considering a special case of QKD called privacy amplification (PA). PA itself is an important building block of cryptography, both classical and quantum. The standard theoretical tool used for its security proof is called the leftover hashing lemma (LHL). We present a direct connection between the LHL and the coding theorem of a certain quantum error correction code. Then we apply this result to proving the equivalence between the two approaches to proving the security of QKD.

arXiv:1809.05479•IEEE Transactions on Information Theory•Jan 27, 2020•19 citations

Combining Error Verification and Privacy Amplification in Quantum Key Distribution

Devashish Tupkary, Zhiyao Wang, Ernest Y. -Z. Tan

Quantum Key Distribution (QKD) protocols typically involve two separate steps of error-verification and privacy amplification. Both steps involve the application of a hash function sampled from a suitable hash family to classical data. A potentially simpler alternative is to implement a single-step hashing procedure, announce and compare a fixed number of bits of its output for error-verification, and retain the remaining bits as the final output key. This reduces the complexity of classical postprocessing, the amount of classical communication, and the amount of randomness needed in the protocol. While this construction has appeared in the literature, a suitable mathematical justification is lacking. In this work, we show that the security of such protocols, under certain simple conditions, follows from a slightly modified notion of secrecy of the protocol without the final error-verification step. In particular, we show that for most entropy-based proofs, the combined protocol can be implemented with no change to the key rate, and a minor change to the security parameter.

quant-pharXiv:2610.10702•Oct 9, 2026•0 citations

Error Estimation, Error Correction and Verification In Quantum Key Distribution

Øystein Marøy, Magne Gudmundsen, Lars Lydersen +1 more

We consider error correction in quantum key distribu-tion. To avoid that Alice and Bob unwittingly end up with different keys precautions must be taken. Before running the error correction protocol, Bob and Al-ice normally sacrifice some bits to estimate the error rate. To reduce the probability that they end up with different keys to an acceptable level, we show that a large number of bits must be sacrificed. Instead, if Alice and Bob can make a good guess about the er-ror rate before the error correction, they can verify that their keys are similar after the error correction protocol. This verification can be done by utilizing properties of Low Density Parity Check codes used in the error correction. We compare the methods and show that by verification it is often possible to sac-rifice less bits without compromising security. The improvement is heavily dependent on the error rate and the block length, but for a key produced by the IdQuantique system Clavis2, the increase in the key rate is approximately 5 percent. We also show that for systems with large fluctuations in the error rate a combination of the two methods is optimal.

•Jan 1, 2014•1 citation

Essential lack of security proof in quantum key distribution

Horace P. Yuen

All the currently available unconditional security proofs on quantum key distribution, in particular for the BB84 protocol and its variants including continuous-variable ones, are invalid or incomplete at many points. In this paper we discuss some of the main known problems, particularly those on operational security guarantee and error correction. Most basic are the points that there is no security parameter in such protocols and it is not the case the generated key is perfect with probability $\geq 1-ε$ under the trace distance criterion $d\leqε$, which is widely claimed in the technical and popular literature. The many serious security consequences of this error about the QKD generated key would be explained, including practical ramification on achievable security levels. It will be shown how the error correction problem alone may already defy rigorous quantitative analysis. Various other problems would be touched upon. It is pointed out that rigorous security guarantee of much more efficient quantum cryptosystems may be obtained by abandoning the disturbance-information tradeoff principle and utilizing instead the known KCQ (keyed communication in quantum noise) principle in conjunction with a new DBM (decoy bits method) principle that will be detailed elsewhere.

arXiv:1310.0842•Oct 2, 2013•10 citations
The security of quantum key distribution (QKD) is evaluated based on the secrecy of Alice's key and the correctness of the keys held by Alice and Bob. A practical method for ensuring correctness is known as error verification, in which Alice and Bob reveal a portion of their reconciled keys and check whether the revealed information matches. In this paper, we point out that when error verification is performed in a QKD protocol, the definition of secrecy must be revised accordingly. We illustrate the necessity of this revision with a counterexample, showing that neglecting it can lead to an incorrect security claim. In particular, we observe that in the case of the security proof method based on phase error correction, which is one of the mainstream approaches and also known as Koashi's approach, no explicit method has been established to properly incorporate the revised secrecy definition. To resolve this issue, we present a way to translate the phase error correction-based approach into another mainstream approach, called the leftover hash lemma-based approach, also known as Renner's approach, where a solution has already been formulated. As a consequence, security proofs under the phase error correction-based approach automatically remain valid without any change in the secret key length, even if they implicitly consider error verification without revising the secrecy definition.
Quantum key distribution (QKD) is a secure communication protocol that uses quantum bits (qubits) to ensure the security of key exchange between two entities (Alice and Bob). Their shared qubits may suffer from errors due to noise and eavesdropping in the quantum channels. After the QKD key agreement phase, Alice's key may not be different from Bob's key. Therefore, we need key verification to deal with the inconsistent qubits (i.e. the wrong qubits at receiver end). This key verification process is also known as information reconciliation. Recently, Kurt et al. proposed a reconciliation in QKD (RQKD) by using the polynomial consistency property. In this paper, we propose an enhanced RQKD (ERQKD) to improve key verification. Our method is still based on polynomial consistency, but uses the properties of consistency in a different way to obtain better key verification efficiency.
The authors consider error correction in quantum key distribution. To avoid that Alice and Bob unwittingly end up with different keys, precautions must be taken. Before running the error correction protocol, Bob and Alice normally sacrifice some bits to estimate the error rate. To reduce the probability that they end up with different keys to an acceptable level, the authors show that a large number of bits must be sacrificed. Instead, if Alice and Bob can make a good guess about the error rate before the error correction, they can verify that their keys are similar after the error correction protocol. In this study, the authors show that this verification can be done by utilising properties of low‐density parity check codes used in the error correction. The authors compare the different methods and show that by verification it is often possible to sacrifice less bits without compromising security. The improvement is heavily dependent on the error rate and the block length, but for a key produced by the IdQuantique system Clavis 2 , the increase in the key rate is ∼5%. The authors also show that for systems with large fluctuations in the error rate, a combination of the two methods is optimal.
We show that the Mayers-Shor-Preskill approach and Renner's approach to proving the security of quantum key distribution (QKD) are essentially the same. We begin our analysis by considering a special case of QKD called privacy amplification (PA). PA itself is an important building block of cryptography, both classical and quantum. The standard theoretical tool used for its security proof is called the leftover hashing lemma (LHL). We present a direct connection between the LHL and the coding theorem of a certain quantum error correction code. Then we apply this result to proving the equivalence between the two approaches to proving the security of QKD.
Quantum Key Distribution (QKD) protocols typically involve two separate steps of error-verification and privacy amplification. Both steps involve the application of a hash function sampled from a suitable hash family to classical data. A potentially simpler alternative is to implement a single-step hashing procedure, announce and compare a fixed number of bits of its output for error-verification, and retain the remaining bits as the final output key. This reduces the complexity of classical postprocessing, the amount of classical communication, and the amount of randomness needed in the protocol. While this construction has appeared in the literature, a suitable mathematical justification is lacking. In this work, we show that the security of such protocols, under certain simple conditions, follows from a slightly modified notion of secrecy of the protocol without the final error-verification step. In particular, we show that for most entropy-based proofs, the combined protocol can be implemented with no change to the key rate, and a minor change to the security parameter.
We consider error correction in quantum key distribu-tion. To avoid that Alice and Bob unwittingly end up with different keys precautions must be taken. Before running the error correction protocol, Bob and Al-ice normally sacrifice some bits to estimate the error rate. To reduce the probability that they end up with different keys to an acceptable level, we show that a large number of bits must be sacrificed. Instead, if Alice and Bob can make a good guess about the er-ror rate before the error correction, they can verify that their keys are similar after the error correction protocol. This verification can be done by utilizing properties of Low Density Parity Check codes used in the error correction. We compare the methods and show that by verification it is often possible to sac-rifice less bits without compromising security. The improvement is heavily dependent on the error rate and the block length, but for a key produced by the IdQuantique system Clavis2, the increase in the key rate is approximately 5 percent. We also show that for systems with large fluctuations in the error rate a combination of the two methods is optimal.
All the currently available unconditional security proofs on quantum key distribution, in particular for the BB84 protocol and its variants including continuous-variable ones, are invalid or incomplete at many points. In this paper we discuss some of the main known problems, particularly those on operational security guarantee and error correction. Most basic are the points that there is no security parameter in such protocols and it is not the case the generated key is perfect with probability ≥1−ε\geq 1-ε≥1−ε under the trace distance criterion d≤εd\leqεd≤ε, which is widely claimed in the technical and popular literature. The many serious security consequences of this error about the QKD generated key would be explained, including practical ramification on achievable security levels. It will be shown how the error correction problem alone may already defy rigorous quantitative analysis. Various other problems would be touched upon. It is pointed out that rigorous security guarantee of much more efficient quantum cryptosystems may be obtained by abandoning the disturbance-information tradeoff principle and utilizing instead the known KCQ (keyed communication in quantum noise) principle in conjunction with a new DBM (decoy bits method) principle that will be detailed elsewhere.