Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Proceedings of SPIE, the International Society for Optical Engineering/Proceedings of SPIE

Incompleteness and limit of security theory of quantum key distribution

Osamu Hirota, Dan Murakami, Kentaro Kato, Fumio Futami

Published Oct 25, 2012• 6 citations
Publisher

Abstract

It is claimed in the many papers that a trace distance: d guarantees the universal composition security in quantum key distribution (QKD) like BB84 protocol. In this introduction paper, at first, it is explicitly explained what is the main misconception in the claim of the unconditional security for QKD theory. In general terms, the cause of the misunderstanding on the security claim is the Lemma in the paper of Renner. It suggests that the generation of the perfect random key is assured by the probability (1-d), and its failure probability is d. Thus, it concludes that the generated key provides the perfect random key sequence when the protocol is success. So the QKD provides perfect secrecy to the one time pad. This is the reason for the composition claim. However, the quantity of the trace distance (or variational distance) is not the probability for such an event. If d is not small enough, always the generated key sequence is not uniform. Now one needs the reconstruction of the evaluation of the trace distance if one wants to use it. One should first go back to the indistinguishability theory in the computational complexity based, and to clarify the meaning of the value of the variational distance. In addition, the same analysis for the information theoretic case is necessary. The recent serial papers by H.P.Yuen have given the answer on such questions. In this paper, we show more concise description of Yuen's theory, and clarify that the upper bound theories for the trace distance by Tomamichel et al and Hayashi et al are constructed by the wrong reasoning of Renner and it is unsuitable as the security analysis. Finally, we introduce a new macroscopic quantum communication to replace Q-bit QKD.

DOI
10.1117/12.929185

Related papers

Incompleteness and Limit of Quantum Key Distribution Theory

Osamu Hirota

It is claimed in the many papers that a trace distance ($d$) guarantees the universal composition security in quantum key distribution (QKD). In this introduction paper, at first, it is explicitly explained what is the main misconception in the claim of the unconditional security for QKD theory. In general terms, the cause of the misunderstanding on the security claim is the Lemma in the paper of Renner. It suggests that the generation of the perfect random key is assured by the probability $ (1-d)$, and its failure probability is $d$. Thus, it concludes that the generated key provides the perfect random key sequence when the protocol suceeds. So the QKD provides perfect secrecy to the one time pad. This is the reason for the composition claim. However, the quantity of the trace distance (or variational distance) is not the probability for such an event. If $d $ is not small enough, always the generated key sequence is not uniform. Now one needs the reconstruction of the evaluation of the trace distance if one wants to use it. One should first go back to the indistinguishability theory in the computational complexity based, and to clarify the meaning of the value of the variational distance. In addition, the same analysis for the information theoretic case is necessary. The recent serial papers by H.P.Yuen have given the answer on such questions. In this paper, we show more concise description of Yuen's theory, and clarify that the recent upper bound theories for the trace distance by Tomamichel et al and Hayashi et al are constructed based on the reasoning of Renner and it is unsuitable as the analysis for information theoretic security. Finally, we introduce a macroscopic quantum communication with different principle to replace Q-bit QKD.

arXiv:1208.2106•Aug 10, 2012•20 citations

Incompleteness and Limit of Quantum Key Distribution Theory : Yuen theory vs Renner theory

Osamu Hirota

It is claimed in the many papers that a trace distance (d) guarantees the universal composition security in quantum key distribution (QKD). In this introduction paper, at first, it is explicitly explained what is the main misconception in the claim of the unconditional security for QKD theory. In general terms, the cause of the misunderstanding on the security claim is the Lemma in the paper of Renner. It suggests that the generation of the perfect random key is assured by the probability (1 − d), and its failure probability is d. Thus, it concludes that the generated key provides the perfect random key sequence when the protocol suceeds. So the QKD provides perfect secrecy to the one time pad. This is the reason for the composition claim. However, the quantity of the trace distance (or variational distance) is not the probability for such an event. If d is not small enough, always the generated key sequence is not uniform. Now one needs the reconstruction of the evaluation of the trace distance if one wants to use it. One should first go back to the indistinguishability theory in the computational complexity based, and to clarify the meaning of the value of the variational distance. In addition, the same analysis for the information theoretic case is necessary. The recent serial papers by H.P.Yuen have given the answer on such questions. In this paper, we show more concise description of Yuen’s theory, and clarify that the recent upper bound theories for the trace distance by Tomamichel et al and Hayashi et al are constructed based on the reasoning of Renner and it is unsuitable as the analysis for information theoretic security. Finally, we introduce a macroscopic quantum communication with different principle to replace Q-bit QKD.

•Jan 1, 2012•0 citations

Misconception in Theory of Quantum Key Distribution -Reply to Renner-

Osamu Hirota

It has been pointed out by Yuen that the security theory of quantum key distribution(QKD) guided by Shor-Preskill theory has serious defects, in particular their key rate theory is not correct. Theory groups of QKD tried to improve several defects. Especially, Renner employed trace distance and quantum leftover Hash Lemma. However, the present theory encountered a problem of a quantitative evaluation of security. To cope with it, he uses a wrong interpretation on the trace distance and its level epsilon_{sec}, and justifies the unconditional security of own system when epsilon_{sec} is 10^{-6 } ~ 10^{-20}. In this paper, we discuss the following problems. What is the origin of the misconception of the present theory? How does the present theory lead to the misconception?. To show their process toward the misconception, Koashi-Preskill's theory which has a typical misconception is examined. A main point of our comment is that QKD theory ignores the security requirement against attacker which is necessary to compare whole encryption schemes from classical to quantum. To clarify it, we emphasize that the trace distance itself cannot have any operational meaning such as failure probability, and it is only mathematical tool as a measure of closeness. As a result, it is given that the security with above values derived from their formulation means nothing in the general cryptological sense. In addition, I point out that a comment by Bennett and Riedel on unconditional security of QKD is not correct. Also, I point out that the experimental systems of groups of Los Alamos, Toshiba-UK, NICT, and others cannot have security guarantee even in future.

arXiv:1306.1277•Jun 6, 2013•3 citations

Security of Quantum Key Distribution from Attacker's View

Takehisa Iwakoshi

In 2005, trace distance between an ideal quantum state to be distributed and an actual quantum state distributed was introduced as a valid security measure of Quantum Key Distribution (QKD) by R. Renner et al., then it has been perceived that the trace can be interpreted as a maximum failure probability of QKD. While such a perspective has been widely accepted, H. P. Yuen and O. Hirota have been warning that such an interpretation is not correct since 2009. The author of this study has been giving questions on the interpretation of the trace distance based on their criticisms since QIT30 in May 2014, and has been proposing Yuen's idea to evaluate the security of QKD by the probability for the attacker to guess the correct key. However, the author could not give the guessing probability concretely. In this study, the author explains how to derive the average guessing probability for the attacker, where its result equals to Yuen's derivation firstly seen in 2010. From this result, one will see the problems with the maximum failure probability interpretation of the trace distance clearly. This study also explains the indistinguishability advantage interpretation is also invalid.

arXiv:1711.03619•Jan 1, 2015•1 citation

Essential lack of security proof in quantum key distribution

Horace P. Yuen

All the currently available unconditional security proofs on quantum key distribution, in particular for the BB84 protocol and its variants including continuous-variable ones, are invalid or incomplete at many points. In this paper we discuss some of the main known problems, particularly those on operational security guarantee and error correction. Most basic are the points that there is no security parameter in such protocols and it is not the case the generated key is perfect with probability $\geq 1-ε$ under the trace distance criterion $d\leqε$, which is widely claimed in the technical and popular literature. The many serious security consequences of this error about the QKD generated key would be explained, including practical ramification on achievable security levels. It will be shown how the error correction problem alone may already defy rigorous quantitative analysis. Various other problems would be touched upon. It is pointed out that rigorous security guarantee of much more efficient quantum cryptosystems may be obtained by abandoning the disturbance-information tradeoff principle and utilizing instead the known KCQ (keyed communication in quantum noise) principle in conjunction with a new DBM (decoy bits method) principle that will be detailed elsewhere.

arXiv:1310.0842•Oct 2, 2013•10 citations

Misinterpretation of statistical distance in security of quantum key distribution shown by simulation

Takehisa Iwakoshi, Osamu Hirota

This study will test an interpretation in quantum key distribution (QKD) that trace distance between the distributed quantum state and the ideal mixed state is a maximum failure probability of the protocol. Around 2004, this interpretation was proposed and standardized to satisfy both of the key uniformity in the context of universal composability and operational meaning of the failure probability of the key extraction. However, this proposal has not been verified concretely yet for many years while H. P. Yuen and O. Hirota have thrown doubt on this interpretation since 2009. To ascertain this interpretation, a physical random number generator was employed to evaluate key uniformity in QKD. In this way, we calculated statistical distance which correspond to trace distance in quantum theory after a quantum measurement is done, then we compared it with the failure probability whether universal composability was obtained. As a result, the degree of statistical distance of the probability distribution of the physical random numbers and the ideal uniformity was very large. It is also explained why trace distance is not suitable to guarantee the security in QKD from the view point of quantum binary decision theory.

Proceedings of SPIE, the International Society for Optical Engineering/Proceedings of SPIE•Oct 13, 2014•2 citations
It is claimed in the many papers that a trace distance: d guarantees the universal composition security in quantum key distribution (QKD) like BB84 protocol. In this introduction paper, at first, it is explicitly explained what is the main misconception in the claim of the unconditional security for QKD theory. In general terms, the cause of the misunderstanding on the security claim is the Lemma in the paper of Renner. It suggests that the generation of the perfect random key is assured by the probability (1-d), and its failure probability is d. Thus, it concludes that the generated key provides the perfect random key sequence when the protocol is success. So the QKD provides perfect secrecy to the one time pad. This is the reason for the composition claim. However, the quantity of the trace distance (or variational distance) is not the probability for such an event. If d is not small enough, always the generated key sequence is not uniform. Now one needs the reconstruction of the evaluation of the trace distance if one wants to use it. One should first go back to the indistinguishability theory in the computational complexity based, and to clarify the meaning of the value of the variational distance. In addition, the same analysis for the information theoretic case is necessary. The recent serial papers by H.P.Yuen have given the answer on such questions. In this paper, we show more concise description of Yuen's theory, and clarify that the upper bound theories for the trace distance by Tomamichel et al and Hayashi et al are constructed by the wrong reasoning of Renner and it is unsuitable as the security analysis. Finally, we introduce a new macroscopic quantum communication to replace Q-bit QKD.
It is claimed in the many papers that a trace distance (ddd) guarantees the universal composition security in quantum key distribution (QKD). In this introduction paper, at first, it is explicitly explained what is the main misconception in the claim of the unconditional security for QKD theory. In general terms, the cause of the misunderstanding on the security claim is the Lemma in the paper of Renner. It suggests that the generation of the perfect random key is assured by the probability $ (1-d)$, and its failure probability is ddd. Thus, it concludes that the generated key provides the perfect random key sequence when the protocol suceeds. So the QKD provides perfect secrecy to the one time pad. This is the reason for the composition claim. However, the quantity of the trace distance (or variational distance) is not the probability for such an event. If $d $ is not small enough, always the generated key sequence is not uniform. Now one needs the reconstruction of the evaluation of the trace distance if one wants to use it. One should first go back to the indistinguishability theory in the computational complexity based, and to clarify the meaning of the value of the variational distance. In addition, the same analysis for the information theoretic case is necessary. The recent serial papers by H.P.Yuen have given the answer on such questions. In this paper, we show more concise description of Yuen's theory, and clarify that the recent upper bound theories for the trace distance by Tomamichel et al and Hayashi et al are constructed based on the reasoning of Renner and it is unsuitable as the analysis for information theoretic security. Finally, we introduce a macroscopic quantum communication with different principle to replace Q-bit QKD.
It is claimed in the many papers that a trace distance (d) guarantees the universal composition security in quantum key distribution (QKD). In this introduction paper, at first, it is explicitly explained what is the main misconception in the claim of the unconditional security for QKD theory. In general terms, the cause of the misunderstanding on the security claim is the Lemma in the paper of Renner. It suggests that the generation of the perfect random key is assured by the probability (1 − d), and its failure probability is d. Thus, it concludes that the generated key provides the perfect random key sequence when the protocol suceeds. So the QKD provides perfect secrecy to the one time pad. This is the reason for the composition claim. However, the quantity of the trace distance (or variational distance) is not the probability for such an event. If d is not small enough, always the generated key sequence is not uniform. Now one needs the reconstruction of the evaluation of the trace distance if one wants to use it. One should first go back to the indistinguishability theory in the computational complexity based, and to clarify the meaning of the value of the variational distance. In addition, the same analysis for the information theoretic case is necessary. The recent serial papers by H.P.Yuen have given the answer on such questions. In this paper, we show more concise description of Yuen’s theory, and clarify that the recent upper bound theories for the trace distance by Tomamichel et al and Hayashi et al are constructed based on the reasoning of Renner and it is unsuitable as the analysis for information theoretic security. Finally, we introduce a macroscopic quantum communication with different principle to replace Q-bit QKD.
It has been pointed out by Yuen that the security theory of quantum key distribution(QKD) guided by Shor-Preskill theory has serious defects, in particular their key rate theory is not correct. Theory groups of QKD tried to improve several defects. Especially, Renner employed trace distance and quantum leftover Hash Lemma. However, the present theory encountered a problem of a quantitative evaluation of security. To cope with it, he uses a wrong interpretation on the trace distance and its level epsilon_{sec}, and justifies the unconditional security of own system when epsilon_{sec} is 10^{-6 } ~ 10^{-20}. In this paper, we discuss the following problems. What is the origin of the misconception of the present theory? How does the present theory lead to the misconception?. To show their process toward the misconception, Koashi-Preskill's theory which has a typical misconception is examined. A main point of our comment is that QKD theory ignores the security requirement against attacker which is necessary to compare whole encryption schemes from classical to quantum. To clarify it, we emphasize that the trace distance itself cannot have any operational meaning such as failure probability, and it is only mathematical tool as a measure of closeness. As a result, it is given that the security with above values derived from their formulation means nothing in the general cryptological sense. In addition, I point out that a comment by Bennett and Riedel on unconditional security of QKD is not correct. Also, I point out that the experimental systems of groups of Los Alamos, Toshiba-UK, NICT, and others cannot have security guarantee even in future.
In 2005, trace distance between an ideal quantum state to be distributed and an actual quantum state distributed was introduced as a valid security measure of Quantum Key Distribution (QKD) by R. Renner et al., then it has been perceived that the trace can be interpreted as a maximum failure probability of QKD. While such a perspective has been widely accepted, H. P. Yuen and O. Hirota have been warning that such an interpretation is not correct since 2009. The author of this study has been giving questions on the interpretation of the trace distance based on their criticisms since QIT30 in May 2014, and has been proposing Yuen's idea to evaluate the security of QKD by the probability for the attacker to guess the correct key. However, the author could not give the guessing probability concretely. In this study, the author explains how to derive the average guessing probability for the attacker, where its result equals to Yuen's derivation firstly seen in 2010. From this result, one will see the problems with the maximum failure probability interpretation of the trace distance clearly. This study also explains the indistinguishability advantage interpretation is also invalid.
All the currently available unconditional security proofs on quantum key distribution, in particular for the BB84 protocol and its variants including continuous-variable ones, are invalid or incomplete at many points. In this paper we discuss some of the main known problems, particularly those on operational security guarantee and error correction. Most basic are the points that there is no security parameter in such protocols and it is not the case the generated key is perfect with probability ≥1−ε\geq 1-ε≥1−ε under the trace distance criterion d≤εd\leqεd≤ε, which is widely claimed in the technical and popular literature. The many serious security consequences of this error about the QKD generated key would be explained, including practical ramification on achievable security levels. It will be shown how the error correction problem alone may already defy rigorous quantitative analysis. Various other problems would be touched upon. It is pointed out that rigorous security guarantee of much more efficient quantum cryptosystems may be obtained by abandoning the disturbance-information tradeoff principle and utilizing instead the known KCQ (keyed communication in quantum noise) principle in conjunction with a new DBM (decoy bits method) principle that will be detailed elsewhere.
This study will test an interpretation in quantum key distribution (QKD) that trace distance between the distributed quantum state and the ideal mixed state is a maximum failure probability of the protocol. Around 2004, this interpretation was proposed and standardized to satisfy both of the key uniformity in the context of universal composability and operational meaning of the failure probability of the key extraction. However, this proposal has not been verified concretely yet for many years while H. P. Yuen and O. Hirota have thrown doubt on this interpretation since 2009. To ascertain this interpretation, a physical random number generator was employed to evaluate key uniformity in QKD. In this way, we calculated statistical distance which correspond to trace distance in quantum theory after a quantum measurement is done, then we compared it with the failure probability whether universal composability was obtained. As a result, the degree of statistical distance of the probability distribution of the physical random numbers and the ideal uniformity was very large. It is also explained why trace distance is not suitable to guarantee the security in QKD from the view point of quantum binary decision theory.