Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

On problems in security of quantum key distribution raised by Yuen

Takehisa Iwakoshi

Published Oct 5, 2017• 6 citations
Publisher

Abstract

In 2007, it was found that Known-Plaintext-Attack would reveal whole the string of the distributed key by Quantum Key Distribution (QKD) when the part of the plaintext was known to the eavesdropper, Eve, under the mutual information security criterion between Eve and legitimate users, Alice and Bob. To overcome, the trace distance criterion was introduced in the paper that the distance between the distributed quantum state and the ideal quantum state with Eve’s quantum system decoupled from the quantum systems shared by Alice and Bob. On the other hand, Shor and Preskill proved in 2000 that entanglement-based QKDs are equivalent to prepare-and-measure QKDs, such as the first QKD, BB84. Their proof employed the mutual information criterion, therefore M. Koashi applied Shor-Preskill approach to the trace distance criterion in 2009. However, H. P. Yuen started criticisms on the security of QKDs from 2009, then completed his criticisms in 2016. He warned the security of QKDs are not sufficient. Furthermore, the trace distance would not provide “universal composability”, which is supposed to guarantee Independent and Identically Distributed (IID) keys. He also proposed a new security criterion “Bit-Error-Rate (BER) guarantee,” to evaluate the BER in the decoded message by Eve with her key close to the correct key. In this work, the author explains Yuen’s criticisms and shows an example of the BER guarantee on BB84. Furthermore, the study revisits whether Shor-Preskill security proof approach really worked.

DOI
10.1117/12.2278625

Related papers

Bit-error-rate guarantee for quantum key distribution and its characteristics compared to leftover hash lemma

Takehisa Iwakoshi

The trace distance criterion for security of Quantum Key Distribution (QKD) has been widely perceived that its upperbound is the maximum failure probability in distributing an ideal quantum state that the quantum system shared by legitimate users is decoupled from the quantum system the eavesdropper possesses, therefore the eavesdropper would not obtain any hints on the key shared by the legitimate users no matter how much her measurement is optimal. However, there an arbitrariness in the definition of the trace distance with the decoupled quantum system the eavesdropper possesses as the previous work pointed out, and such an arbitrariness would be confusions in guaranteeing the security of QKD. In this work, from the framework of Bit-Error-Rate (BER) Guarantee discussed also in the previous work, such an arbitrariness is removed from the definition of the trace distance criterion by discussing the similarities and differences between the security of QKD and classical information-theoretic cryptography by Leftover Hash Lemma (LHL). However, in the previous work BER Guarantee was derived under the assumption that the eavesdropper launches the weakest class of attack, so-called “Individual Attacks.” Therefore, it is still unknown whether direct upper-bounding of the term would give tighter upper-bound in general, such as “Collective Attacks” or “Coherent Attacks”, compared to the upper-bound by LHL, as well as the secure-key generation rate. This study also revisits the security proof of QKD given by P. Shor and J. Preskill in 2000.

SPIE Quantum Information Science and Technology•Oct 8, 2018•2 citations

Yuen's Criticisms on Security of Quantum Key Distribution and Onward

Takehisa Iwakoshi

Quantum Key Distribution (QKD) has been attracting researchers that it would provide provable security to distribute secret keys since its birth in 1984. Since 2005, the trace distance between an ideal quantum state and an actually distributed state has been employed to evaluate its security level, and the trace distance was given an interpretation that it would be a maximum failure probability in distributing perfectly secure keys. However, in 2009, H. P. Yuen criticized that the trace distance would not have such an interpretation. Since then, O. Hirota, K. Kato, and T. Iwakoshi have been warning to make people pay attention to Yuen's criticisms. In 2015, T. Iwakoshi precisely explained why Yuen has been correct. In 2016, Yuen himself published a paper to explain the potentially unsolved problems in QKD. This study precisely explains the most important problems given in Yuen's paper, and gives recent topics around QKD and other quantum cryptographic protocols.

arXiv:1711.03617•Jan 1, 2017•1 citation

Security of Quantum Key Distribution from Attacker's View

Takehisa Iwakoshi

In 2005, trace distance between an ideal quantum state to be distributed and an actual quantum state distributed was introduced as a valid security measure of Quantum Key Distribution (QKD) by R. Renner et al., then it has been perceived that the trace can be interpreted as a maximum failure probability of QKD. While such a perspective has been widely accepted, H. P. Yuen and O. Hirota have been warning that such an interpretation is not correct since 2009. The author of this study has been giving questions on the interpretation of the trace distance based on their criticisms since QIT30 in May 2014, and has been proposing Yuen's idea to evaluate the security of QKD by the probability for the attacker to guess the correct key. However, the author could not give the guessing probability concretely. In this study, the author explains how to derive the average guessing probability for the attacker, where its result equals to Yuen's derivation firstly seen in 2010. From this result, one will see the problems with the maximum failure probability interpretation of the trace distance clearly. This study also explains the indistinguishability advantage interpretation is also invalid.

arXiv:1711.03619•Jan 1, 2015•1 citation

Misconception in Theory of Quantum Key Distribution -Reply to Renner-

Osamu Hirota

It has been pointed out by Yuen that the security theory of quantum key distribution(QKD) guided by Shor-Preskill theory has serious defects, in particular their key rate theory is not correct. Theory groups of QKD tried to improve several defects. Especially, Renner employed trace distance and quantum leftover Hash Lemma. However, the present theory encountered a problem of a quantitative evaluation of security. To cope with it, he uses a wrong interpretation on the trace distance and its level epsilon_{sec}, and justifies the unconditional security of own system when epsilon_{sec} is 10^{-6 } ~ 10^{-20}. In this paper, we discuss the following problems. What is the origin of the misconception of the present theory? How does the present theory lead to the misconception?. To show their process toward the misconception, Koashi-Preskill's theory which has a typical misconception is examined. A main point of our comment is that QKD theory ignores the security requirement against attacker which is necessary to compare whole encryption schemes from classical to quantum. To clarify it, we emphasize that the trace distance itself cannot have any operational meaning such as failure probability, and it is only mathematical tool as a measure of closeness. As a result, it is given that the security with above values derived from their formulation means nothing in the general cryptological sense. In addition, I point out that a comment by Bennett and Riedel on unconditional security of QKD is not correct. Also, I point out that the experimental systems of groups of Los Alamos, Toshiba-UK, NICT, and others cannot have security guarantee even in future.

arXiv:1306.1277•Jun 6, 2013•3 citations

Security Significance of the Trace Distance Criterion in Quantum Key Distribution

Horace P. Yuen

The security significance of the trace distance security criterion $d$ is analyzed in terms of operational probabilities of an attacker's success in identifying different subsets of the generated key, both during the key generation process and when the key is used in one-time pad data encryption under known-plaintext attacks. The difference between Eve's sequence error rate and bit error rate is brought out. It is shown with counter-examples that the strong security claim maintained in the literature is incorrect. Other than the whole key error rates that can be quantified at the levels d^{1/3} and d^{1/4} which are much worse than $d$ itself, the attacker's success probabilities in estimating various subsets of the key and in known-plaintext attacks are yet to be quantified from $d$ if possible. It is demonstrated in realistic numerical examples of concrete protocols that drastic breach of security cannot yet be ruled out.

arXiv:1109.2675•Sep 13, 2011•11 citations

Essential lack of security proof in quantum key distribution

Horace P. Yuen

All the currently available unconditional security proofs on quantum key distribution, in particular for the BB84 protocol and its variants including continuous-variable ones, are invalid or incomplete at many points. In this paper we discuss some of the main known problems, particularly those on operational security guarantee and error correction. Most basic are the points that there is no security parameter in such protocols and it is not the case the generated key is perfect with probability $\geq 1-ε$ under the trace distance criterion $d\leqε$, which is widely claimed in the technical and popular literature. The many serious security consequences of this error about the QKD generated key would be explained, including practical ramification on achievable security levels. It will be shown how the error correction problem alone may already defy rigorous quantitative analysis. Various other problems would be touched upon. It is pointed out that rigorous security guarantee of much more efficient quantum cryptosystems may be obtained by abandoning the disturbance-information tradeoff principle and utilizing instead the known KCQ (keyed communication in quantum noise) principle in conjunction with a new DBM (decoy bits method) principle that will be detailed elsewhere.

arXiv:1310.0842•Oct 2, 2013•10 citations
In 2007, it was found that Known-Plaintext-Attack would reveal whole the string of the distributed key by Quantum Key Distribution (QKD) when the part of the plaintext was known to the eavesdropper, Eve, under the mutual information security criterion between Eve and legitimate users, Alice and Bob. To overcome, the trace distance criterion was introduced in the paper that the distance between the distributed quantum state and the ideal quantum state with Eve’s quantum system decoupled from the quantum systems shared by Alice and Bob. On the other hand, Shor and Preskill proved in 2000 that entanglement-based QKDs are equivalent to prepare-and-measure QKDs, such as the first QKD, BB84. Their proof employed the mutual information criterion, therefore M. Koashi applied Shor-Preskill approach to the trace distance criterion in 2009. However, H. P. Yuen started criticisms on the security of QKDs from 2009, then completed his criticisms in 2016. He warned the security of QKDs are not sufficient. Furthermore, the trace distance would not provide “universal composability”, which is supposed to guarantee Independent and Identically Distributed (IID) keys. He also proposed a new security criterion “Bit-Error-Rate (BER) guarantee,” to evaluate the BER in the decoded message by Eve with her key close to the correct key. In this work, the author explains Yuen’s criticisms and shows an example of the BER guarantee on BB84. Furthermore, the study revisits whether Shor-Preskill security proof approach really worked.
The trace distance criterion for security of Quantum Key Distribution (QKD) has been widely perceived that its upperbound is the maximum failure probability in distributing an ideal quantum state that the quantum system shared by legitimate users is decoupled from the quantum system the eavesdropper possesses, therefore the eavesdropper would not obtain any hints on the key shared by the legitimate users no matter how much her measurement is optimal. However, there an arbitrariness in the definition of the trace distance with the decoupled quantum system the eavesdropper possesses as the previous work pointed out, and such an arbitrariness would be confusions in guaranteeing the security of QKD. In this work, from the framework of Bit-Error-Rate (BER) Guarantee discussed also in the previous work, such an arbitrariness is removed from the definition of the trace distance criterion by discussing the similarities and differences between the security of QKD and classical information-theoretic cryptography by Leftover Hash Lemma (LHL). However, in the previous work BER Guarantee was derived under the assumption that the eavesdropper launches the weakest class of attack, so-called “Individual Attacks.” Therefore, it is still unknown whether direct upper-bounding of the term would give tighter upper-bound in general, such as “Collective Attacks” or “Coherent Attacks”, compared to the upper-bound by LHL, as well as the secure-key generation rate. This study also revisits the security proof of QKD given by P. Shor and J. Preskill in 2000.
Quantum Key Distribution (QKD) has been attracting researchers that it would provide provable security to distribute secret keys since its birth in 1984. Since 2005, the trace distance between an ideal quantum state and an actually distributed state has been employed to evaluate its security level, and the trace distance was given an interpretation that it would be a maximum failure probability in distributing perfectly secure keys. However, in 2009, H. P. Yuen criticized that the trace distance would not have such an interpretation. Since then, O. Hirota, K. Kato, and T. Iwakoshi have been warning to make people pay attention to Yuen's criticisms. In 2015, T. Iwakoshi precisely explained why Yuen has been correct. In 2016, Yuen himself published a paper to explain the potentially unsolved problems in QKD. This study precisely explains the most important problems given in Yuen's paper, and gives recent topics around QKD and other quantum cryptographic protocols.
In 2005, trace distance between an ideal quantum state to be distributed and an actual quantum state distributed was introduced as a valid security measure of Quantum Key Distribution (QKD) by R. Renner et al., then it has been perceived that the trace can be interpreted as a maximum failure probability of QKD. While such a perspective has been widely accepted, H. P. Yuen and O. Hirota have been warning that such an interpretation is not correct since 2009. The author of this study has been giving questions on the interpretation of the trace distance based on their criticisms since QIT30 in May 2014, and has been proposing Yuen's idea to evaluate the security of QKD by the probability for the attacker to guess the correct key. However, the author could not give the guessing probability concretely. In this study, the author explains how to derive the average guessing probability for the attacker, where its result equals to Yuen's derivation firstly seen in 2010. From this result, one will see the problems with the maximum failure probability interpretation of the trace distance clearly. This study also explains the indistinguishability advantage interpretation is also invalid.
It has been pointed out by Yuen that the security theory of quantum key distribution(QKD) guided by Shor-Preskill theory has serious defects, in particular their key rate theory is not correct. Theory groups of QKD tried to improve several defects. Especially, Renner employed trace distance and quantum leftover Hash Lemma. However, the present theory encountered a problem of a quantitative evaluation of security. To cope with it, he uses a wrong interpretation on the trace distance and its level epsilon_{sec}, and justifies the unconditional security of own system when epsilon_{sec} is 10^{-6 } ~ 10^{-20}. In this paper, we discuss the following problems. What is the origin of the misconception of the present theory? How does the present theory lead to the misconception?. To show their process toward the misconception, Koashi-Preskill's theory which has a typical misconception is examined. A main point of our comment is that QKD theory ignores the security requirement against attacker which is necessary to compare whole encryption schemes from classical to quantum. To clarify it, we emphasize that the trace distance itself cannot have any operational meaning such as failure probability, and it is only mathematical tool as a measure of closeness. As a result, it is given that the security with above values derived from their formulation means nothing in the general cryptological sense. In addition, I point out that a comment by Bennett and Riedel on unconditional security of QKD is not correct. Also, I point out that the experimental systems of groups of Los Alamos, Toshiba-UK, NICT, and others cannot have security guarantee even in future.
The security significance of the trace distance security criterion ddd is analyzed in terms of operational probabilities of an attacker's success in identifying different subsets of the generated key, both during the key generation process and when the key is used in one-time pad data encryption under known-plaintext attacks. The difference between Eve's sequence error rate and bit error rate is brought out. It is shown with counter-examples that the strong security claim maintained in the literature is incorrect. Other than the whole key error rates that can be quantified at the levels d^{1/3} and d^{1/4} which are much worse than ddd itself, the attacker's success probabilities in estimating various subsets of the key and in known-plaintext attacks are yet to be quantified from ddd if possible. It is demonstrated in realistic numerical examples of concrete protocols that drastic breach of security cannot yet be ruled out.
All the currently available unconditional security proofs on quantum key distribution, in particular for the BB84 protocol and its variants including continuous-variable ones, are invalid or incomplete at many points. In this paper we discuss some of the main known problems, particularly those on operational security guarantee and error correction. Most basic are the points that there is no security parameter in such protocols and it is not the case the generated key is perfect with probability ≥1−ε\geq 1-ε≥1−ε under the trace distance criterion d≤εd\leqεd≤ε, which is widely claimed in the technical and popular literature. The many serious security consequences of this error about the QKD generated key would be explained, including practical ramification on achievable security levels. It will be shown how the error correction problem alone may already defy rigorous quantitative analysis. Various other problems would be touched upon. It is pointed out that rigorous security guarantee of much more efficient quantum cryptosystems may be obtained by abandoning the disturbance-information tradeoff principle and utilizing instead the known KCQ (keyed communication in quantum noise) principle in conjunction with a new DBM (decoy bits method) principle that will be detailed elsewhere.