We introduce symmetric extensions of bipartite quantum states as a tool for analyzing protocols that distill secret key from quantum correlations. Whether the correlations are coming from a prepare-and-measure quantum key distribution scheme or from an entanglement-based scheme, the protocol has to produce effective states without a symmetric extension in order to succeed. By formulating the symmetric extension problem as a semidefinite program, we solve the problem for Bell-diagonal states. Applying this result to the six-state and Bennett-Brassard 1984 schemes, we show that for the entangled states that cannot be distilled by current key distillation procedures, the failure can be understood in terms of a failure to break a symmetric extension.
We investigate which bipartite quantum states admit a symmetric extension and apply the results in the analysis of noise thresholds in quantum key distribution protocols with two-way postprocessing. We find that states that admit a symmetric extension can be decomposed into a convex combination of states that admit a_pure_ symmetric extension. For a state to have a pure symmetric extension, its nonzero eigenvalues must be equal to the nonzero eigenvalues of one of the subsystems. While this does not fully characterize the set of states with a pure symmetric extension in all dimensions, it is a full characterization for two qubits. A conjectured formula characterizing two-qubit states with a (mixed or pure) symmetric extension is presented. Proofs are given for some special classes. For multi-qubit Bell-diagonal states, the symmetric extension is simplified using the symmetries of the states and formulated as a semidefinite program. Quantum key distribution with two-way advantage distillation steps is then analyzed. For the commonly used repetition code advantage distillation, the failure to distill a secret key beyond the currently known noise thresholds is explained by a failure to break a symmetric extension. More general linear advantage distillation schemes are analyzed, but for those schemes analyzed, we find that they tolerate strictly less noise than repetition code advantage distillation before they fail to break a symmetric extension. The results suggest that no other linear advantage distillation scheme can reach the noise threshold of 27.6 % for the six-state protocol which is achieved by repetition code advantage distillation.
We investigate QKD protocols with two-way classical post-processing that are based on the well-known six-state and BB84 signal states. In these QKD protocols, the source (Alice) sends quantum signals to the receiver (Bob), who measures them, leaving only classical data on both sides. Our goal is to find the highest value of the quantum bit-error rate (QBER)
Q for which two-way classical post-processing protocols on the data can distill secret keys. Using the BB84 signal states, such protocols currently exist for
Q<frac15. On the other hand, for
Qgeqfrac14 no such protocol can exist as the observed data is compatible with an intercept-resend attack. This leaves the interesting question of whether successful two-way protocols exist in the interval
frac15leqQ<frac14. For the six-state signal states, the corresponding interval is known to be
frac5−sqrt510leqQ<frac13. \n\t \n\tWe search for two-way protocols because it turns out that within these intervals Alice and Bob's correlations are symmetrically extendable, meaning that Bob and the eavesdropper (Eve) are completely indistinguishable from Alice's point of view, making any one-way Alice-to-Bob post-processing protocol insecure. A two-way protocol might be able to break the symmetry between Bob and Eve, and it must do so in order to distill a secret key because any two-way protocol will necessarily terminate with a one-way communication step, at which point the symmetric extendability of Alice and Bob's updated correlations must be checked again. \n \nWe first show that the search for two-way protocols breaking the symmetric extendability of Alice and Bob's correlations can be restricted to a search over post-selection protocols if all we care about is whether secret key can at all be distilled and not about the rate of distillation. We then provide strong analytical and numerical evidence to suggest that no two-way classical post-processing protocol exists within the gap when the six-state signal states are used. \n\t \n\tUnder quantum entanglement distillation protocols, it is known that secret key can be distilled right up to the intercept-resend bounds of
frac14 and
frac13 for the BB84 and six-state signal states, respectively. We therefore want to know whether classical post-processing protocols are just as good at distilling secret keys as quantum ones. Our results appear to indicate that they are not.
Bound secret information is classical information that contains secrecy but from which secrecy cannot be extracted. The existence of bound secrecy has been conjectured but is currently unproven, and in this work we provide analytical and numerical evidence for its existence. Specifically, we consider two-way postprocessing protocols in prepare-and-measure quantum key distribution based on the well-known six-state signal states. In terms of the quantum bit-error rate
Q of the classical data, such protocols currently exist for $Q<\frac{5\ensuremath{-}\sqrt{5}}{10}\ensuremath{\approx}27.6%$. On the other hand, for $Q\ensuremath{\ge}\frac{1}{3}$ no such protocol can exist as the observed data are compatible with an intercept-resend attack. This leaves the interesting question of whether successful protocols exist in the interval $\frac{5\ensuremath{-}\sqrt{5}}{10}\ensuremath{\le}Q<\frac{1}{3}$. Previous work has shown that a necessary condition for the existence of two-way postprocessing protocols for distilling secret keys is breaking the symmetric extendability of the underlying quantum state shared by Alice and Bob. Using this result, it has been proven that symmetric extendability can be broken up to the
27.6 lower bound using the advantage distillation protocol. In this work, we first show that to break symmetric extendability it is sufficient to consider a generalized form of advantage distillation consisting of one round of postselection by Bob on a block of his data. We then provide evidence that such generalized protocols cannot break symmetric extendability beyond
27.6. We thus have evidence to believe that
27.6 is an upper bound on two-way postprocessing and that the interval $\frac{5\ensuremath{-}\sqrt{5}}{10}\ensuremath{\le}Q<\frac{1}{3}$ is a domain of bound secrecy.
We present a simple method to obtain an upper bound on the achievable secret key rate in quantum key distribution (QKD) protocols that use only unidirectional classical communication during the public-discussion phase. This method is based on a necessary precondition for one-way secret key distillation; the legitimate users need to prove that there exists no quantum state having a symmetric extension that is compatible with the available measurements results. The main advantage of the obtained upper bound is that it can be formulated as a semidefinite program, which can be efficiently solved. We illustrate our results by analyzing two well-known qubit-based QKD protocols: the four-state protocol and the six-state protocol.
We study and solve the problem of distilling a secret key from quantum states representing correlation between two parties (Alice and Bob) and an eavesdropper (Eve) via one–way public discussion: we prove a coding theorem to achieve the ‘wire–tapper’ bound, the difference of the mutual information Alice–Bob and that of Alice–Eve, for so–called classical–quantum–quantum–correlations, via one–way public communication. This result yields information–theoretic formulae for the distillable secret key, giving ‘ultimate’ key rate bounds if Eve is assumed to possess a purification of Alice and Bob's joint state. Specializing our protocol somewhat and making it coherent leads us to a protocol of entanglement distillation via one–way LOCC (local operations and classical communication) which is asymptotically optimal: in fact we prove the so–called ‘hashing inequality’, which says that the coherent information (i.e. the negative conditional von Neumann entropy) is an achievable Einstein–Podolsky–Rosen rate. This result is known to imply a whole set of distillation and capacity formulae, which we briefly review.