The security issues facing quantum key distribution (QKD) are explained, herein focusing on those issues that are cryptographic and information theoretic in nature and not those based on physics. The problem of security criteria is addressed. It is demonstrated that an attacker's success probabilities are the fundamental criteria of security that any theoretic security criterion must relate to in order to have operational significance. The errors committed in the prevalent interpretation of the trace distance criterion are analyzed. The security proofs of QKD protocols are discussed and assessed in regard to three main features: their validity, completeness, and adequacy of the achieved numerical security level. Problems are identified in all these features. It appears that the QKD security situation is quite different from the common perception that a QKD-generated key is nearly perfectly secure. Built into our discussion is a simple but complete quantitative description of the information theoretic security of classical key distribution that is also applicable to the quantum situation. In the appendices, we provide a brief outline of the history of some major QKD security proofs, a rather unfavorable comparison of current QKD proven security with that of conventional symmetric key ciphers, and a list of objections and answers concerning some major points of the paper.The security issues facing quantum key distribution (QKD) are explained, herein focusing on those issues that are cryptographic and information theoretic in nature and not those based on physics. The problem of security criteria is addressed. It is demonstrated that an attacker's success probabilities are the fundamental criteria of security that any theoretic security criterion must relate to in order to have operational significance. The errors committed in the prevalent interpretation of the trace distance criterion are analyzed. The security proofs of QKD protocols are discussed and assessed in regard to three main features: their validity, completeness, and adequacy of the achieved numerical security level. Problems are identified in all these features. It appears that the QKD security situation is quite different from the common perception that a QKD-generated key is nearly perfectly secure. Built into our discussion is a simple but complete quantitative description of the information theoretic security of classical key distribution that is also applicable to the quantum situation. In the appendices, we provide a brief outline of the history of some major QKD security proofs, a rather unfavorable comparison of current QKD proven security with that of conventional symmetric key ciphers, and a list of objections and answers concerning some major points of the paper.

arXiv:1602.07602Feb 24, 20160 citations

Fundamental quantitative security in quantum key generation

Horace P. Yuen

We analyze the fundamental security significance of the quantitative criteria on the final generated key $K$ in quantum key generation including the quantum criterion $d$ , the attacker's mutual information on $K$ , and the statistical distance between her distribution on $K$ and the uniform distribution. For operational significance a criterion has to produce a guarantee on the attacker's probability of correctly estimating some portions of $K$ from her measurement, in particular her maximum probability of identifying the whole $K$ . We distinguish between the raw security of $K$ when the attacker just gets at $K$ before it is used in a cryptographic context and its composition security when the attacker may gain further information during its actual use to help get at $K$ . We compare both of these securities of $K$ to those obtainable from conventional key expansion with a symmetric key cipher. It is pointed out that a common belief in the superior security of a quantum generated $K$ is based on an incorrect interpretation of $d$ which cannot be true, and the security significance of $d$ is uncertain. Generally, the quantum key distribution key $K$ has no composition security guarantee and its raw security guarantee from concrete protocols is worse than that of conventional ciphers. Furthermore, for both raw and composition security there is an exponential catch-up problem that would make it difficult to quantitatively improve the security of $K$ in a realistic protocol. Some possible ways to deal with the situation are suggested.We analyze the fundamental security significance of the quantitative criteria on the final generated key $K$ in quantum key generation including the quantum criterion $d$, the attacker's mutual information on $K$, and the statistical distance between her distribution on $K$ and the uniform distribution. For operational significance a criterion has to produce a guarantee on the attacker's probability of correctly estimating some portions of $K$ from her measurement, in particular her maximum probability of identifying the whole $K$. We distinguish between the raw security of $K$ when the attacker just gets at $K$ before it is used in a cryptographic context and its composition security when the attacker may gain further information during its actual use to help get at $K$. We compare both of these securities of $K$ to those obtainable from conventional key expansion with a symmetric key cipher. It is pointed out that a common belief in the superior security of a quantum generated $K$ is based on an incorrect interpretation of $d$ which cannot be true, and the security significance of $d$ is uncertain. Generally, the quantum key distribution key $K$ has no composition security guarantee and its raw security guarantee from concrete protocols is worse than that of conventional ciphers. Furthermore, for both raw and composition security there is an exponential catch-up problem that would make it difficult to quantitatively improve the security of $K$ in a realistic protocol. Some possible ways to deal with the situation are suggested.

arXiv:1008.0623Physical Review ADec 7, 201029 citations

Cryptographic security of quantum key distribution

Christopher Portmann, Renato Renner

This work is intended as an introduction to cryptographic security and a motivation for the widely used Quantum Key Distribution (QKD) security definition. We review the notion of security necessary for a protocol to be usable in a larger cryptographic context, i.e., for it to remain secure when composed with other secure protocols. We then derive the corresponding security criterion for QKD. We provide several examples of QKD composed in sequence and parallel with different cryptographic schemes to illustrate how the error of a composed protocol is the sum of the errors of the individual protocols. We also discuss the operational interpretations of the distance metric used to quantify these errors.This work is intended as an introduction to cryptographic security and a motivation for the widely used Quantum Key Distribution (QKD) security definition. We review the notion of security necessary for a protocol to be usable in a larger cryptographic context, i.e., for it to remain secure when composed with other secure protocols. We then derive the corresponding security criterion for QKD. We provide several examples of QKD composed in sequence and parallel with different cryptographic schemes to illustrate how the error of a composed protocol is the sum of the errors of the individual protocols. We also discuss the operational interpretations of the distance metric used to quantify these errors.

arXiv:1409.3525Sep 11, 201482 citations

Essential lack of security proof in quantum key distribution

Horace P. Yuen

All the currently available unconditional security proofs on quantum key distribution, in particular for the BB84 protocol and its variants including continuous-variable ones, are invalid or incomplete at many points. In this paper we discuss some of the main known problems, particularly those on operational security guarantee and error correction. Most basic are the points that there is no security parameter in such protocols and it is not the case the generated key is perfect with probability $\geq 1-ε$ under the trace distance criterion $d\leqε$ , which is widely claimed in the technical and popular literature. The many serious security consequences of this error about the QKD generated key would be explained, including practical ramification on achievable security levels. It will be shown how the error correction problem alone may already defy rigorous quantitative analysis. Various other problems would be touched upon. It is pointed out that rigorous security guarantee of much more efficient quantum cryptosystems may be obtained by abandoning the disturbance-information tradeoff principle and utilizing instead the known KCQ (keyed communication in quantum noise) principle in conjunction with a new DBM (decoy bits method) principle that will be detailed elsewhere.All the currently available unconditional security proofs on quantum key distribution, in particular for the BB84 protocol and its variants including continuous-variable ones, are invalid or incomplete at many points. In this paper we discuss some of the main known problems, particularly those on operational security guarantee and error correction. Most basic are the points that there is no security parameter in such protocols and it is not the case the generated key is perfect with probability $\geq 1-ε$ under the trace distance criterion $d\leqε$, which is widely claimed in the technical and popular literature. The many serious security consequences of this error about the QKD generated key would be explained, including practical ramification on achievable security levels. It will be shown how the error correction problem alone may already defy rigorous quantitative analysis. Various other problems would be touched upon. It is pointed out that rigorous security guarantee of much more efficient quantum cryptosystems may be obtained by abandoning the disturbance-information tradeoff principle and utilizing instead the known KCQ (keyed communication in quantum noise) principle in conjunction with a new DBM (decoy bits method) principle that will be detailed elsewhere.

arXiv:1310.0842Oct 2, 201310 citations

Essential elements lacking in security proofs for quantum key distribution

Horace P. Yuen

All the currently available unconditional security proofs on quantum key distribution, in particular for the BB84 protocol and its variants including continuous-variable ones, are invalid or incomplete at many points. In this paper we discuss some of the main known problems, particularly those on operational security guarantee and error correction. Most basic are the points that there is no security parameter in such protocols and it is not the case the generated key is perfect with probability ≥ 1 - ϵ under the trace distance criterion d ≤ ϵ, which is widely claimed in the technical and popular literature. The many serious security consequences of this error about the QKD generated key would be explained, including practical ramification on achievable security levels. It will be shown how the error correction problem alone may already defy rigorous quantitative analysis. Various other problems would be touched upon. It is pointed out that rigorous security guarantee of much more efficient quantum cryptosystems may be obtained by abandoning the disturbance-information tradeoff principle and utilizing instead the known KCQ (keyed communication in quantum noise) principle in conjunction with a new DBM (decoy bits method) principle that will be detailed elsewhere.All the currently available unconditional security proofs on quantum key distribution, in particular for the BB84 protocol and its variants including continuous-variable ones, are invalid or incomplete at many points. In this paper we discuss some of the main known problems, particularly those on operational security guarantee and error correction. Most basic are the points that there is no security parameter in such protocols and it is not the case the generated key is perfect with probability ≥ 1 - ϵ under the trace distance criterion d ≤ ϵ, which is widely claimed in the technical and popular literature. The many serious security consequences of this error about the QKD generated key would be explained, including practical ramification on achievable security levels. It will be shown how the error correction problem alone may already defy rigorous quantitative analysis. Various other problems would be touched upon. It is pointed out that rigorous security guarantee of much more efficient quantum cryptosystems may be obtained by abandoning the disturbance-information tradeoff principle and utilizing instead the known KCQ (keyed communication in quantum noise) principle in conjunction with a new DBM (decoy bits method) principle that will be detailed elsewhere.

Proceedings of SPIE, the International Society for Optical Engineering/Proceedings of SPIEOct 29, 201316 citations

A survey of quantum key distribution protocols

Mobin Javed, Khurram Aziz

Quantum cryptography offers a promising unbreakable cryptographic solution as it ensures perfect secrecy in applications such as quantum key distribution and bit commitment. The focus of this paper is to trace the development of quantum key distribution protocols and discuss the state of the art and open issues in this field. Although the protocols have mathematically proven to be totally secure, it must be emphasized that any real world implementation suffers the limitations of physical devices which can serve as vulnerability for an eavesdropper to exploit. In this paper, we survey the quantum key distribution protocols which exist in literature and explore the attacks to which they are vulnerable. We highlight the main implementation bottlenecks related with each implementation and the solutions proposed thereof.Quantum cryptography offers a promising unbreakable cryptographic solution as it ensures perfect secrecy in applications such as quantum key distribution and bit commitment. The focus of this paper is to trace the development of quantum key distribution protocols and discuss the state of the art and open issues in this field. Although the protocols have mathematically proven to be totally secure, it must be emphasized that any real world implementation suffers the limitations of physical devices which can serve as vulnerability for an eavesdropper to exploit. In this paper, we survey the quantum key distribution protocols which exist in literature and explore the attacks to which they are vulnerable. We highlight the main implementation bottlenecks related with each implementation and the solutions proposed thereof.

International Conference on Frontiers of Information Technology (FIT)Dec 16, 20097 citations

We analyze the fundamental security significance of the quantitative criteria on the final generated key

K

in quantum key generation including the quantum criterion

d

, the attacker's mutual information on

K

, and the statistical distance between her distribution on

K

and the uniform distribution. For operational significance a criterion has to produce a guarantee on the attacker's probability of correctly estimating some portions of

K

from her measurement, in particular her maximum probability of identifying the whole

K

. We distinguish between the raw security of

K

when the attacker just gets at

K

before it is used in a cryptographic context and its composition security when the attacker may gain further information during its actual use to help get at

K

. We compare both of these securities of

K

to those obtainable from conventional key expansion with a symmetric key cipher. It is pointed out that a common belief in the superior security of a quantum generated

K

is based on an incorrect interpretation of

d

which cannot be true, and the security significance of

d

is uncertain. Generally, the quantum key distribution key

K

has no composition security guarantee and its raw security guarantee from concrete protocols is worse than that of conventional ciphers. Furthermore, for both raw and composition security there is an exponential catch-up problem that would make it difficult to quantitatively improve the security of

K

in a realistic protocol. Some possible ways to deal with the situation are suggested.

\geq 1-ε

under the trace distance criterion

d\leqε

, which is widely claimed in the technical and popular literature. The many serious security consequences of this error about the QKD generated key would be explained, including practical ramification on achievable security levels. It will be shown how the error correction problem alone may already defy rigorous quantitative analysis. Various other problems would be touched upon. It is pointed out that rigorous security guarantee of much more efficient quantum cryptosystems may be obtained by abandoning the disturbance-information tradeoff principle and utilizing instead the known KCQ (keyed communication in quantum noise) principle in conjunction with a new DBM (decoy bits method) principle that will be detailed elsewhere.