Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Symmetric Extendability of Quantum States and the Extreme Limits of Quantum Key Distribution

Sumeet Khatri

Published Oct 13, 2016• 3 citations
OpenAlex

Abstract

We investigate QKD protocols with two-way classical post-processing that are based on the well-known six-state and BB84 signal states. In these QKD protocols, the source (Alice) sends quantum signals to the receiver (Bob), who measures them, leaving only classical data on both sides. Our goal is to find the highest value of the quantum bit-error rate (QBER) $Q$ for which two-way classical post-processing protocols on the data can distill secret keys. Using the BB84 signal states, such protocols currently exist for $Q<\\frac{1}{5}$. On the other hand, for $Q\\geq\\frac{1}{4}$ no such protocol can exist as the observed data is compatible with an intercept-resend attack. This leaves the interesting question of whether successful two-way protocols exist in the interval $\\frac{1}{5}\\leq Q<\\frac{1}{4}$. For the six-state signal states, the corresponding interval is known to be $\\frac{5-\\sqrt{5}}{10}\\leq Q<\\frac{1}{3}$. \n\t \n\tWe search for two-way protocols because it turns out that within these intervals Alice and Bob's correlations are symmetrically extendable, meaning that Bob and the eavesdropper (Eve) are completely indistinguishable from Alice's point of view, making any one-way Alice-to-Bob post-processing protocol insecure. A two-way protocol might be able to break the symmetry between Bob and Eve, and it must do so in order to distill a secret key because any two-way protocol will necessarily terminate with a one-way communication step, at which point the symmetric extendability of Alice and Bob's updated correlations must be checked again. \n \nWe first show that the search for two-way protocols breaking the symmetric extendability of Alice and Bob's correlations can be restricted to a search over post-selection protocols if all we care about is whether secret key can at all be distilled and not about the rate of distillation. We then provide strong analytical and numerical evidence to suggest that no two-way classical post-processing protocol exists within the gap when the six-state signal states are used. \n\t \n\tUnder quantum entanglement distillation protocols, it is known that secret key can be distilled right up to the intercept-resend bounds of $\\frac{1}{4}$ and $\\frac{1}{3}$ for the BB84 and six-state signal states, respectively. We therefore want to know whether classical post-processing protocols are just as good at distilling secret keys as quantum ones. Our results appear to indicate that they are not.

Related papers

Numerical evidence for bound secrecy from two-way postprocessing in quantum key distribution

Sumeet Khatri, Norbert Lütkenhaus

Bound secret information is classical information that contains secrecy but from which secrecy cannot be extracted. The existence of bound secrecy has been conjectured but is currently unproven, and in this work we provide analytical and numerical evidence for its existence. Specifically, we consider two-way postprocessing protocols in prepare-and-measure quantum key distribution based on the well-known six-state signal states. In terms of the quantum bit-error rate $Q$ of the classical data, such protocols currently exist for $Q<\frac{5\ensuremath{-}\sqrt{5}}{10}\ensuremath{\approx}27.6%$. On the other hand, for $Q\ensuremath{\ge}\frac{1}{3}$ no such protocol can exist as the observed data are compatible with an intercept-resend attack. This leaves the interesting question of whether successful protocols exist in the interval $\frac{5\ensuremath{-}\sqrt{5}}{10}\ensuremath{\le}Q<\frac{1}{3}$. Previous work has shown that a necessary condition for the existence of two-way postprocessing protocols for distilling secret keys is breaking the symmetric extendability of the underlying quantum state shared by Alice and Bob. Using this result, it has been proven that symmetric extendability can be broken up to the $27.6%$ lower bound using the advantage distillation protocol. In this work, we first show that to break symmetric extendability it is sufficient to consider a generalized form of advantage distillation consisting of one round of postselection by Bob on a block of his data. We then provide evidence that such generalized protocols cannot break symmetric extendability beyond $27.6%$. We thus have evidence to believe that $27.6%$ is an upper bound on two-way postprocessing and that the interval $\frac{5\ensuremath{-}\sqrt{5}}{10}\ensuremath{\le}Q<\frac{1}{3}$ is a domain of bound secrecy.

arXiv:1612.07734•Physical Review A•Apr 14, 2017•17 citations

Towards a Finite Size Analysis of Decoy-State Quantum Key Distribution with Advantage Distillation

Kleinpaß, Philipp, Treplin, Jonas, Orsucci, Davide

Quantum Key Distribution (QKD) allows two legitimate parties, Alice and Bob, to share a secret key with information-theoretic security, ensuring that an eavesdropper, Eve, cannot obtain any information about the key. A QKD protocol is provably secure only when the Quantum Bit Error Rate (QBER) is below a certain threshold and, therefore, the presence of noise inherently limits the maximum transmission distance. Advantage Distillation (AD) is a classical post-processing technique that enhances QKD protocols by increasing the maximum acceptable QBER and, thus, allows extending the communication range. AD operates by post-selecting blocks of bits and extracting fewer but highly correlated bits between Alice and Bob, which exhibit a reduced QBER, thus lowering the amount of information that has to be disclosed during the information reconciliation step. In this study, we present a new analytical expression for the secure key rate. This will enable a finite-size secure key length analysis of the decoy state version of the BB84 protocol including AD post-processing.

•Sep 1, 2024•0 citations

Noise Resilience of Quantum Key Distribution Protocols Secured Against Independent Attacks With One-Way Communication

Adam Bílek, Ryszard Kukulski, Paulina Lewandowska +2 more

We investigate the resilience to noise of single-qubit quantum key distribution (QKD) protocols in the scenario of security against independent eavesdropping attacks and key distillation based on one-way classical communication. To this end, we introduce a noise-based metric that quantifies the efficiency of QKD protocols. Within this framework, we analyze the maximal noise levels that allow Alice and Bob to asymptotically establish a secure secret key. Using this assumption, we compare the noise tolerance of general single-qubit QKD protocols, in particular the BB84, B92, E91, and six-state protocols. Our main result determines the noise level threshold for QKD allowing one to distill an asymptotically secure secret key. Additionally, we demonstrate that the six-state protocol achieves the greatest resistance to noise while simultaneously yielding a higher post-selection efficiency than the other analyzed single-qubit protocols, confirming its robustness within the considered security model. Finally, we perform an analysis of the proposed noise-based metric and the conventional quantum bit error rate (QBER) metric.

quant-pharXiv:2607.11857•Jul 14, 2026•0 citations

One-way quantum key distribution: Simple upper bound on the secret key rate

Tobias Moroder, Marcos Curty, Norbert Lütkenhaus

We present a simple method to obtain an upper bound on the achievable secret key rate in quantum key distribution (QKD) protocols that use only unidirectional classical communication during the public-discussion phase. This method is based on a necessary precondition for one-way secret key distillation; the legitimate users need to prove that there exists no quantum state having a symmetric extension that is compatible with the available measurements results. The main advantage of the obtained upper bound is that it can be formulated as a semidefinite program, which can be efficiently solved. We illustrate our results by analyzing two well-known qubit-based QKD protocols: the four-state protocol and the six-state protocol.

arXiv:quant-ph/0603270•Physical Review A•Nov 1, 2006•28 citations

Another Look at Symmetric Incoherent Optimal Eavesdropping against BB84

Arpita Maitra, Goutam Paul

Abstract. The BB84 protocol is used by Alice (the sender) and Bob (the receiver) to settle on a secret classical bit-string by communicating qubits over an insecure quantum channel where Eve (the Eavesdropper) can have access. In this paper, we revisit a well known eavesdropping technique against BB84. We claim that there exist certain gaps in understanding the existing eavesdropping strategyin terms of cryptanalytic view and we try to bridge those gaps in this paper. First we refer to the result where it is shown that in the six-state variant of the BB84 protocol (Bruß, Phys. Rev. Lett., 1998), the mutual information between Alice (the sender) and Eve (the eavesdropper) is higher when two-bit probe is used compared to the one-bit probe and hencethetwo-bitprobeprovidesastrongereavesdroppingstrategy.However, from cryptanalytic point of view, we show that Eve has the same success probability in guessing the bit transmitted by Alice in both the cases of the two-bit and the one-bit probe. Thus, we point out that having higher mutual information may not directly lead to obtaining higher probability in guessing the key bit. It is also explained in the work of Bruß that the six-state variant of the BB84 protocol is more secure than the traditional four-state BB84. We look into this point in more detail and identify that this advantage is only achieved at the expense of communicating more qubits in the sixstate protocol. In fact, we present different scenarios, where given the same number of qubits communicated, the security comparison of the four and six-state protocols is evaluated carefully.

•Jan 1, 2012•0 citations

Limits of adaptive two-way linear postprocessing in six-state quantum key distribution

Toyohiro Tsurumaru

Two-way classical communication improves the noise tolerance of quantum key distribution, but the limits of adaptive parity processing remain unclear. For the six-state protocol with equal three-basis error rate $p\in[p_*,1/2]$, where $p_*=(5-\sqrt5)/10\simeq27.64\%$, we construct a single compatible collective attack that defeats a broad class of linear postprocessing. Each public message may be a linear function of the sender's raw key, chosen adaptively from the public history. For every finite input length and every accepted transcript of positive probability, Eve's optimal probability of recovering any linear function of Alice's raw key is at least Bob's. Consequently, reliable agreement on a linear final key is incompatible with secrecy. The same conclusion holds for arbitrary publicly seeded privacy amplification after reliable recovery of a linear candidate. The proof conditions on the complete transcript, which restricts the two raw keys to affine subspaces. A local degradation of Eve's state, a known Rényi-entropy comparison, and a coset-probability inequality then give the recovery comparison. Both inequalities are proved in self-contained appendices. The result allows block splitting, regrouping, nonzero-syndrome selection, and adaptive linear reconciliation.

quant-pharXiv:2610.21469•Oct 16, 2026•0 citations
We investigate QKD protocols with two-way classical post-processing that are based on the well-known six-state and BB84 signal states. In these QKD protocols, the source (Alice) sends quantum signals to the receiver (Bob), who measures them, leaving only classical data on both sides. Our goal is to find the highest value of the quantum bit-error rate (QBER) QQQ for which two-way classical post-processing protocols on the data can distill secret keys. Using the BB84 signal states, such protocols currently exist for Q<frac15Q<\\frac{1}{5}Q<frac15. On the other hand, for Qgeqfrac14Q\\geq\\frac{1}{4}Qgeqfrac14 no such protocol can exist as the observed data is compatible with an intercept-resend attack. This leaves the interesting question of whether successful two-way protocols exist in the interval frac15leqQ<frac14\\frac{1}{5}\\leq Q<\\frac{1}{4}frac15leqQ<frac14. For the six-state signal states, the corresponding interval is known to be frac5−sqrt510leqQ<frac13\\frac{5-\\sqrt{5}}{10}\\leq Q<\\frac{1}{3}frac5−sqrt510leqQ<frac13. \n\t \n\tWe search for two-way protocols because it turns out that within these intervals Alice and Bob's correlations are symmetrically extendable, meaning that Bob and the eavesdropper (Eve) are completely indistinguishable from Alice's point of view, making any one-way Alice-to-Bob post-processing protocol insecure. A two-way protocol might be able to break the symmetry between Bob and Eve, and it must do so in order to distill a secret key because any two-way protocol will necessarily terminate with a one-way communication step, at which point the symmetric extendability of Alice and Bob's updated correlations must be checked again. \n \nWe first show that the search for two-way protocols breaking the symmetric extendability of Alice and Bob's correlations can be restricted to a search over post-selection protocols if all we care about is whether secret key can at all be distilled and not about the rate of distillation. We then provide strong analytical and numerical evidence to suggest that no two-way classical post-processing protocol exists within the gap when the six-state signal states are used. \n\t \n\tUnder quantum entanglement distillation protocols, it is known that secret key can be distilled right up to the intercept-resend bounds of frac14\\frac{1}{4}frac14 and frac13\\frac{1}{3}frac13 for the BB84 and six-state signal states, respectively. We therefore want to know whether classical post-processing protocols are just as good at distilling secret keys as quantum ones. Our results appear to indicate that they are not.
Bound secret information is classical information that contains secrecy but from which secrecy cannot be extracted. The existence of bound secrecy has been conjectured but is currently unproven, and in this work we provide analytical and numerical evidence for its existence. Specifically, we consider two-way postprocessing protocols in prepare-and-measure quantum key distribution based on the well-known six-state signal states. In terms of the quantum bit-error rate QQQ of the classical data, such protocols currently exist for $Q<\frac{5\ensuremath{-}\sqrt{5}}{10}\ensuremath{\approx}27.6%$. On the other hand, for $Q\ensuremath{\ge}\frac{1}{3}$ no such protocol can exist as the observed data are compatible with an intercept-resend attack. This leaves the interesting question of whether successful protocols exist in the interval $\frac{5\ensuremath{-}\sqrt{5}}{10}\ensuremath{\le}Q<\frac{1}{3}$. Previous work has shown that a necessary condition for the existence of two-way postprocessing protocols for distilling secret keys is breaking the symmetric extendability of the underlying quantum state shared by Alice and Bob. Using this result, it has been proven that symmetric extendability can be broken up to the 27.627.6%27.6 lower bound using the advantage distillation protocol. In this work, we first show that to break symmetric extendability it is sufficient to consider a generalized form of advantage distillation consisting of one round of postselection by Bob on a block of his data. We then provide evidence that such generalized protocols cannot break symmetric extendability beyond 27.627.6%27.6. We thus have evidence to believe that 27.627.6%27.6 is an upper bound on two-way postprocessing and that the interval $\frac{5\ensuremath{-}\sqrt{5}}{10}\ensuremath{\le}Q<\frac{1}{3}$ is a domain of bound secrecy.
Quantum Key Distribution (QKD) allows two legitimate parties, Alice and Bob, to share a secret key with information-theoretic security, ensuring that an eavesdropper, Eve, cannot obtain any information about the key. A QKD protocol is provably secure only when the Quantum Bit Error Rate (QBER) is below a certain threshold and, therefore, the presence of noise inherently limits the maximum transmission distance. Advantage Distillation (AD) is a classical post-processing technique that enhances QKD protocols by increasing the maximum acceptable QBER and, thus, allows extending the communication range. AD operates by post-selecting blocks of bits and extracting fewer but highly correlated bits between Alice and Bob, which exhibit a reduced QBER, thus lowering the amount of information that has to be disclosed during the information reconciliation step. In this study, we present a new analytical expression for the secure key rate. This will enable a finite-size secure key length analysis of the decoy state version of the BB84 protocol including AD post-processing.
We investigate the resilience to noise of single-qubit quantum key distribution (QKD) protocols in the scenario of security against independent eavesdropping attacks and key distillation based on one-way classical communication. To this end, we introduce a noise-based metric that quantifies the efficiency of QKD protocols. Within this framework, we analyze the maximal noise levels that allow Alice and Bob to asymptotically establish a secure secret key. Using this assumption, we compare the noise tolerance of general single-qubit QKD protocols, in particular the BB84, B92, E91, and six-state protocols. Our main result determines the noise level threshold for QKD allowing one to distill an asymptotically secure secret key. Additionally, we demonstrate that the six-state protocol achieves the greatest resistance to noise while simultaneously yielding a higher post-selection efficiency than the other analyzed single-qubit protocols, confirming its robustness within the considered security model. Finally, we perform an analysis of the proposed noise-based metric and the conventional quantum bit error rate (QBER) metric.
We present a simple method to obtain an upper bound on the achievable secret key rate in quantum key distribution (QKD) protocols that use only unidirectional classical communication during the public-discussion phase. This method is based on a necessary precondition for one-way secret key distillation; the legitimate users need to prove that there exists no quantum state having a symmetric extension that is compatible with the available measurements results. The main advantage of the obtained upper bound is that it can be formulated as a semidefinite program, which can be efficiently solved. We illustrate our results by analyzing two well-known qubit-based QKD protocols: the four-state protocol and the six-state protocol.
Abstract. The BB84 protocol is used by Alice (the sender) and Bob (the receiver) to settle on a secret classical bit-string by communicating qubits over an insecure quantum channel where Eve (the Eavesdropper) can have access. In this paper, we revisit a well known eavesdropping technique against BB84. We claim that there exist certain gaps in understanding the existing eavesdropping strategyin terms of cryptanalytic view and we try to bridge those gaps in this paper. First we refer to the result where it is shown that in the six-state variant of the BB84 protocol (Bruß, Phys. Rev. Lett., 1998), the mutual information between Alice (the sender) and Eve (the eavesdropper) is higher when two-bit probe is used compared to the one-bit probe and hencethetwo-bitprobeprovidesastrongereavesdroppingstrategy.However, from cryptanalytic point of view, we show that Eve has the same success probability in guessing the bit transmitted by Alice in both the cases of the two-bit and the one-bit probe. Thus, we point out that having higher mutual information may not directly lead to obtaining higher probability in guessing the key bit. It is also explained in the work of Bruß that the six-state variant of the BB84 protocol is more secure than the traditional four-state BB84. We look into this point in more detail and identify that this advantage is only achieved at the expense of communicating more qubits in the sixstate protocol. In fact, we present different scenarios, where given the same number of qubits communicated, the security comparison of the four and six-state protocols is evaluated carefully.
Two-way classical communication improves the noise tolerance of quantum key distribution, but the limits of adaptive parity processing remain unclear. For the six-state protocol with equal three-basis error rate p∈[p∗,1/2]p\in[p_*,1/2]p∈[p∗​,1/2], where p∗=(5−5)/10≃27.64%p_*=(5-\sqrt5)/10\simeq27.64\%p∗​=(5−5​)/10≃27.64%, we construct a single compatible collective attack that defeats a broad class of linear postprocessing. Each public message may be a linear function of the sender's raw key, chosen adaptively from the public history. For every finite input length and every accepted transcript of positive probability, Eve's optimal probability of recovering any linear function of Alice's raw key is at least Bob's. Consequently, reliable agreement on a linear final key is incompatible with secrecy. The same conclusion holds for arbitrary publicly seeded privacy amplification after reliable recovery of a linear candidate. The proof conditions on the complete transcript, which restricts the two raw keys to affine subspaces. A local degradation of Eve's state, a known Rényi-entropy comparison, and a coset-probability inequality then give the recovery comparison. Both inequalities are proved in self-contained appendices. The result allows block splitting, regrouping, nonzero-syndrome selection, and adaptive linear reconciliation.