Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Cambridge University Press eBooks

General results on secret-key distillation

Gilles Van Assche

Published Jun 29, 2006• 0 citations
Publisher

Abstract

Secret-key distillation (SKD) is the technique used to convert some given random variables, shared among the legitimate parties and a potential eavesdropper Eve, into a secret key. Secret-key distillation is generally described as a protocol between the legitimate parties, who exchange messages over the public classical authenticated channel as a function of their key elements X and Y , aiming to agree on a common secret key K . We assume here that the eavesdropper's knowledge can be modeled as a classical random variable. For more general assumptions on the eavesdropping techniques, please refer to Chapter 12. The quantum transmission is assumed to be from Alice to Bob. In order to be able to specify another direction for secret-key distillation, we use the Claude-and-Dominique naming convention. Here, the random variables X and Y model the variables obtained by Claude and Dominique, respectively, using the quantum channel, and the random variable Z contains anything that Eve was able to infer from eavesdropping on the quantum channel. As detailed in Section 11.3.2, both assignments (Alice = Claude ∧ Bob = Dominique) and (Alice = Dominique ∧ Bob = Claude) are useful. In this chapter, I first propose a general description of the reconciliation and privacy amplification approach. I then list the different characteristics that a SKD protocol can have. And finally, I overview several important classes of known results and treat the specific case of SKD with continuous variables.

DOI
10.1017/cbo9780511617744.008

Related papers

Reconciliation

Gilles Van Assche

Reconciliation is the technique needed to ensure that Claude's and Dominique's key elements are equal. Starting from outcomes of the random variables X and Y , they wish to agree on an equal string Ψ. In this chapter, I will first give some general properties and then overview and introduce several classes of reconciliation techniques. Problem description The goal of the legitimate parties is to distill a secret key, i.e., to end up with a shared binary string that is unknown to Eve. We assume as a convention that Claude's outcomes of X will determine the shared key K . The common string Ψ before privacy amplification can thus be expressed as a function Ψ( X ). Reconciliation consists in exchanging messages over the public classical authenticated channel, collectively denoted M , so that Dominique can recover Ψ from M and the outcomes of Y . If we denote as x 1… l a vector of l independent outcomes of X , the string can be compressed to obtain about lH (Ψ( X )) common uniform bits. As explained in Chapter 6, the impact of reconciliation on privacy amplification is a decrease of | M | bits in the key length, where | M | is the number of bits exchanged during reconciliation. Our goal is thus to maximize lH (Ψ( X ))-| M |, or if Ψ is given, to minimize the number | M | of disclosed bits. Characteristics of reconciliation protocols Before dealing with the details of reconciliation, let us here review some of its characteristics. First, reconciliation can be either one-way or interactive . The first case is obviously only possible with one-way secret-key distillation, as information is sent only from Claude to Dominique.

Cambridge University Press eBooks•Jun 29, 2006•0 citations

Security analysis of quantum key distribution

Gilles Van Assche

So far, the knowledge of Eve has been modeled by a classical random variable. The aim of this chapter is first to discuss how the previous results apply to QKD, where Eve's action may not necessarily be classically described by the random variable Z . Then, we explain the equivalence between BB84 and so-called entanglement purification protocols as a tool to encompass general eavesdropping strategies. Finally, we apply this equivalence to the case of the coherent-state protocol GG02. Eavesdropping strategies and secret-key distillation In Chapters 10 and 11, I analyzed the security of the protocols with regard to individual eavesdropping strategies only. In this particular case, the result of Alice's, Bob's and Eve's measurements can be described classically and the results of Section 6.4 apply. Let us review other kinds of eavesdropping strategies and discuss how the concepts of Chapter 6 can be applied. Note that the individual eavesdropping strategy, the simplest class of strategies, is still technologically very challenging to achieve today in an optimal way. Nevertheless, we do not want the security of quantum cryptography to rely only on technological barriers. By considering more general eavesdropping strategies, we make sure quantum cryptography lies on strong grounds. Following Gisin et al. [64], we divide the possible eavesdropping strategies into three categories: individual attacks, collective attacks and joint attacks .

Cambridge University Press eBooks•Jun 29, 2006•3 citations

Reconciliation of a Quantum-Distributed Gaussian Key

G. VanAssche, Jean Cardinal, Nicolas J. Cerf

Two parties, Alice and Bob, wish to distill a binary secret key out of a list of correlated variables that they share after running a quantum key distribution (QKD) protocol based on continuous-spectrum quantum carriers. We present a novel construction that allows the legitimate parties to get equal bit strings out of correlated variables by using a classical channel, with as little leaked information as possible. This opens the way to securely correcting nonbinary key elements. In particular, the construction is refined to the case of Gaussian variables as it applies directly to recent continuous-variable protocols for QKD.

arXiv:cs/0107030•IEEE Transactions on Information Theory•Feb 1, 2004•212 citations

Distillation of secret key and entanglement from quantum states

Igor Devetak, Andreas Winter

We study and solve the problem of distilling a secret key from quantum states representing correlation between two parties (Alice and Bob) and an eavesdropper (Eve) via one–way public discussion: we prove a coding theorem to achieve the ‘wire–tapper’ bound, the difference of the mutual information Alice–Bob and that of Alice–Eve, for so–called classical–quantum–quantum–correlations, via one–way public communication. This result yields information–theoretic formulae for the distillable secret key, giving ‘ultimate’ key rate bounds if Eve is assumed to possess a purification of Alice and Bob's joint state. Specializing our protocol somewhat and making it coherent leads us to a protocol of entanglement distillation via one–way LOCC (local operations and classical communication) which is asymptotically optimal: in fact we prove the so–called ‘hashing inequality’, which says that the coherent information (i.e. the negative conditional von Neumann entropy) is an achievable Einstein–Podolsky–Rosen rate. This result is known to imply a whole set of distillation and capacity formulae, which we briefly review.

arXiv:quant-ph/0306078•Proceedings of the Royal Society A Mathematical Physical and Engineering Sciences•Oct 19, 2004•1,016 citations

Secret-Key-Agreement Advantage Distillation With Quantization Correction

Francesco Ardizzon, Francesco Giurisato, Stefano Tomasin

We consider a physical layer-based secret-key-agreement (SKA) scenario where Alice and Bob aim at extracting a common bit sequence, which should remain secret to Eve, by quantizing a random number obtained from measurements of their communication channel. We propose an asymmetric advantage distillation protocol where i) Alice quantizes her measurement and sends partial information on it over an authenticated public side channel, and ii) Bob (and Eve) quantizes his measurement by exploiting the partial information. The partial information on the position of the measurement in the quantization interval allows Bob to obtain a quantized value closer to that of Alice. Such strategies are shown to increase the lower bound of the secret key rate.

arXiv:2304.10312•IEEE Communications Letters•Aug 1, 2023•7 citations

Quantum Versus Classical Advantages in Secret Key Distillation (and Their Links to Quantum Entanglement)

Eric Chitambar, Ben Fortescue, Min-Hsiu Hsieh

We consider the extraction of shared secret key from correlations that are generated by either a classical or quantum source. In the classical setting, two honest parties (Alice and Bob) use public discussion and local randomness to distill secret key from some distribution $p_{XYZ}$ that is shared with an unwanted eavesdropper (Eve). In the quantum settings, the correlations $p_{XYZ}$ are delivered to the parties as either an \textit{incoherent} mixture of orthogonal quantum states or as \textit{coherent} superposition of such states; in both cases, Alice and Bob use public discussion and local quantum operations to distill secret key. While the power of quantum mechanics increases Alice and Bob's ability to generate shared randomness, it also equips Eve with a greater arsenal of eavesdropping attacks. Therefore, it is not obvious who gains the greatest advantage for distilling secret key when replacing a classical source with a quantum one. In this paper we first demonstrate that the classical key rate is equivalent to the quantum key rate when the correlations are generated incoherently in the quantum setting. For coherent sources, we next show that the rates are incomparable, and in fact, their difference can be arbitrarily large in either direction. However, we identify a large class of non-trivial distributions $p_{XYZ}$ that possess the following properties: (i) Eve's advantage is always greater in the quantum source than in its classical counterpart, and (ii) for the quantum entanglement shared between Alice and Bob in the coherent source, the so-called entanglement cost/squashed entanglement/relative entropy of entanglement can all be computed. With property (ii), we thus present a rare instance in which the various entropic entanglement measures of a quantum state can be explicitly calculated.

arXiv:1510.07344•Oct 26, 2015•0 citations
Secret-key distillation (SKD) is the technique used to convert some given random variables, shared among the legitimate parties and a potential eavesdropper Eve, into a secret key. Secret-key distillation is generally described as a protocol between the legitimate parties, who exchange messages over the public classical authenticated channel as a function of their key elements X and Y , aiming to agree on a common secret key K . We assume here that the eavesdropper's knowledge can be modeled as a classical random variable. For more general assumptions on the eavesdropping techniques, please refer to Chapter 12. The quantum transmission is assumed to be from Alice to Bob. In order to be able to specify another direction for secret-key distillation, we use the Claude-and-Dominique naming convention. Here, the random variables X and Y model the variables obtained by Claude and Dominique, respectively, using the quantum channel, and the random variable Z contains anything that Eve was able to infer from eavesdropping on the quantum channel. As detailed in Section 11.3.2, both assignments (Alice = Claude ∧ Bob = Dominique) and (Alice = Dominique ∧ Bob = Claude) are useful. In this chapter, I first propose a general description of the reconciliation and privacy amplification approach. I then list the different characteristics that a SKD protocol can have. And finally, I overview several important classes of known results and treat the specific case of SKD with continuous variables.
Reconciliation is the technique needed to ensure that Claude's and Dominique's key elements are equal. Starting from outcomes of the random variables X and Y , they wish to agree on an equal string Ψ. In this chapter, I will first give some general properties and then overview and introduce several classes of reconciliation techniques. Problem description The goal of the legitimate parties is to distill a secret key, i.e., to end up with a shared binary string that is unknown to Eve. We assume as a convention that Claude's outcomes of X will determine the shared key K . The common string Ψ before privacy amplification can thus be expressed as a function Ψ( X ). Reconciliation consists in exchanging messages over the public classical authenticated channel, collectively denoted M , so that Dominique can recover Ψ from M and the outcomes of Y . If we denote as x 1… l a vector of l independent outcomes of X , the string can be compressed to obtain about lH (Ψ( X )) common uniform bits. As explained in Chapter 6, the impact of reconciliation on privacy amplification is a decrease of | M | bits in the key length, where | M | is the number of bits exchanged during reconciliation. Our goal is thus to maximize lH (Ψ( X ))-| M |, or if Ψ is given, to minimize the number | M | of disclosed bits. Characteristics of reconciliation protocols Before dealing with the details of reconciliation, let us here review some of its characteristics. First, reconciliation can be either one-way or interactive . The first case is obviously only possible with one-way secret-key distillation, as information is sent only from Claude to Dominique.
So far, the knowledge of Eve has been modeled by a classical random variable. The aim of this chapter is first to discuss how the previous results apply to QKD, where Eve's action may not necessarily be classically described by the random variable Z . Then, we explain the equivalence between BB84 and so-called entanglement purification protocols as a tool to encompass general eavesdropping strategies. Finally, we apply this equivalence to the case of the coherent-state protocol GG02. Eavesdropping strategies and secret-key distillation In Chapters 10 and 11, I analyzed the security of the protocols with regard to individual eavesdropping strategies only. In this particular case, the result of Alice's, Bob's and Eve's measurements can be described classically and the results of Section 6.4 apply. Let us review other kinds of eavesdropping strategies and discuss how the concepts of Chapter 6 can be applied. Note that the individual eavesdropping strategy, the simplest class of strategies, is still technologically very challenging to achieve today in an optimal way. Nevertheless, we do not want the security of quantum cryptography to rely only on technological barriers. By considering more general eavesdropping strategies, we make sure quantum cryptography lies on strong grounds. Following Gisin et al. [64], we divide the possible eavesdropping strategies into three categories: individual attacks, collective attacks and joint attacks .
Two parties, Alice and Bob, wish to distill a binary secret key out of a list of correlated variables that they share after running a quantum key distribution (QKD) protocol based on continuous-spectrum quantum carriers. We present a novel construction that allows the legitimate parties to get equal bit strings out of correlated variables by using a classical channel, with as little leaked information as possible. This opens the way to securely correcting nonbinary key elements. In particular, the construction is refined to the case of Gaussian variables as it applies directly to recent continuous-variable protocols for QKD.
We study and solve the problem of distilling a secret key from quantum states representing correlation between two parties (Alice and Bob) and an eavesdropper (Eve) via one–way public discussion: we prove a coding theorem to achieve the ‘wire–tapper’ bound, the difference of the mutual information Alice–Bob and that of Alice–Eve, for so–called classical–quantum–quantum–correlations, via one–way public communication. This result yields information–theoretic formulae for the distillable secret key, giving ‘ultimate’ key rate bounds if Eve is assumed to possess a purification of Alice and Bob's joint state. Specializing our protocol somewhat and making it coherent leads us to a protocol of entanglement distillation via one–way LOCC (local operations and classical communication) which is asymptotically optimal: in fact we prove the so–called ‘hashing inequality’, which says that the coherent information (i.e. the negative conditional von Neumann entropy) is an achievable Einstein–Podolsky–Rosen rate. This result is known to imply a whole set of distillation and capacity formulae, which we briefly review.
We consider a physical layer-based secret-key-agreement (SKA) scenario where Alice and Bob aim at extracting a common bit sequence, which should remain secret to Eve, by quantizing a random number obtained from measurements of their communication channel. We propose an asymmetric advantage distillation protocol where i) Alice quantizes her measurement and sends partial information on it over an authenticated public side channel, and ii) Bob (and Eve) quantizes his measurement by exploiting the partial information. The partial information on the position of the measurement in the quantization interval allows Bob to obtain a quantized value closer to that of Alice. Such strategies are shown to increase the lower bound of the secret key rate.
We consider the extraction of shared secret key from correlations that are generated by either a classical or quantum source. In the classical setting, two honest parties (Alice and Bob) use public discussion and local randomness to distill secret key from some distribution pXYZp_{XYZ}pXYZ​ that is shared with an unwanted eavesdropper (Eve). In the quantum settings, the correlations pXYZp_{XYZ}pXYZ​ are delivered to the parties as either an \textit{incoherent} mixture of orthogonal quantum states or as \textit{coherent} superposition of such states; in both cases, Alice and Bob use public discussion and local quantum operations to distill secret key. While the power of quantum mechanics increases Alice and Bob's ability to generate shared randomness, it also equips Eve with a greater arsenal of eavesdropping attacks. Therefore, it is not obvious who gains the greatest advantage for distilling secret key when replacing a classical source with a quantum one. In this paper we first demonstrate that the classical key rate is equivalent to the quantum key rate when the correlations are generated incoherently in the quantum setting. For coherent sources, we next show that the rates are incomparable, and in fact, their difference can be arbitrarily large in either direction. However, we identify a large class of non-trivial distributions pXYZp_{XYZ}pXYZ​ that possess the following properties: (i) Eve's advantage is always greater in the quantum source than in its classical counterpart, and (ii) for the quantum entanglement shared between Alice and Bob in the coherent source, the so-called entanglement cost/squashed entanglement/relative entropy of entanglement can all be computed. With property (ii), we thus present a rare instance in which the various entropic entanglement measures of a quantum state can be explicitly calculated.