Many researchers have contributed to creating Quantum Key Distribution (QKD) since the first protocol BB84 was proposed in 1984.One of the crucial problems in QKD is to guarantee its security with finite-key lengths by Privacy Amplification (PA).However, finite-key analyses show a trade-off between the security of BB84 and the secure key rates.This study analyses two examples to show concrete trade-offs.Furthermore, even though the QKD keys have been perceived to be arbitrarily secure, this study shows a fundamental limitation in the security of the keys by connecting Leftover Hash Lemma and Guessing Secrecy on the QKD keys.
Many researchers have contributed to creating Quantum Key Distribution (QKD) since the first protocol BB84 was proposed in 1984.One of the crucial problems in QKD is to guarantee its security with finite-key lengths by Privacy Amplification (PA).However, finite-key analyses show a trade-off between the security of BB84 and the secure key rates.This study analyses two examples to show concrete trade-offs.Furthermore, even though the QKD keys have been perceived to be arbitrarily secure, this study shows a fundamental limitation in the security of the keys by connecting Leftover Hash Lemma and Guessing Secrecy on the QKD keys.
Quantum key distribution (QKD) in principle can provide unconditional secure communication between distant parts. However, when finite-key length is taken into account, the security can only be ensured within certain security level. In this paper, we adopt the Chernoff bound analysis method to deal with finite-key-size effects, carrying out corresponding investigations on the relationship between the key generation rate and security parameters for different protocols, including BB84, measurement-device-independent and twin-field QKD protocols. Simulation results show that there exists a fundamental limit between the key rate and the security parameters. Therefore, this study can provide valuable references for practical application of QKD, getting a nice balance between the key generation rate and the security level.
Privacy amplification is a necessary step in all quantum key distribution protocols, and error correction is needed in each except when signals of many photons are used in the key communication in quantum noise approach. No security analysis of error correcting code information leak to the attacker has ever been provided, while an ad hoc formula is currently employed to account for such leak in the key generation rate. It is also commonly believed that privacy amplification allows the users to at least establish a short key of arbitrarily close to perfect security. In this paper we show how the lack of rigorous error correction analysis makes the otherwise valid privacy amplification results invalid, and that there exists a limit on how close to perfect a generated key can be obtained from privacy amplification. In addition, there is a necessary tradeoff between key rate and security, and the best theoretical values from current theories would not generate enough near-uniform key bits to cover the message authentication key cost in disturbance-information tradeoff protocols of the BB84 variety.
It is pointed out that treatments of the error correcting code in current quantum key distribution protocols of the BB84 type are not correct under joint attack, and the general interpretation of the trace distance security criterion is also incorrect. With correct interpretation of the criterion as well as a correct treatment of the error correcting code and privacy amplification code, it is shown that even for an ideal system under just collective attack, the maximum tolerable quantum bit error rate is about 1.5% and a net key cannot actually be generated with practical error correcting codes even at such low rates, contrary to claims in the literature.
We introduce list privacy amplification (LPA), a relaxation of the final step of quantum key distribution (QKD) in which Alice and Bob extract a list of L candidate keys from a raw string correlated with an eavesdropper Eve, with the guarantee that at least one key is perfectly secret while Eve cannot identify which. This parallels list decoding in error-correcting codes: relaxing unique decoding to list decoding increases the decoding radius; analogously, list extraction increases achievable key length beyond the standard quantum leftover hash lemma (QLHL). Within the abstract cryptography framework, we formalise LPA and prove the \emph{Quantum List Leftover Hash Lemma} (QLLHL): an L-list of ℓ-bit keys can be extracted from an n-bit source with smooth min-entropy k iff ℓ≤k+logL−2log(1/ε)−3, yielding a tight additive logL gain over QLHL. This gain arises because the index of the secure key is chosen after hashing and hidden from Eve, effectively contributing logL bits of entropy. Applying QLLHL to BB84-type QKD, a list size L=2αn′ increases the tolerable phase-error threshold from h−1(1−h(eb)) to h−1(1−h(eb)+α), exceeding the standard ≈11% bound for any α>0. We prove tightness via a matching intercept-resend attack, establish composability with Wegman--Carter authentication, and present two constructions: a polynomial inner-product hash over F2m and a Toeplitz-based variant, running in O(nL) and O(nLlogn) time.
Abstract Quantum key distribution (QKD) protocols allow for information theoretically secure distribution of (classical) cryptographic key material. However, due to practical limitations the performance of QKD implementations is somewhat restricted. For this reason, it is crucial to find optimal protocol parameters, while guaranteeing information theoretic security. The performance of a QKD implementation is determined by the tightness of the underlying security analysis. In particular, the security analyses determines thekey-rate, i.e., the amount of cryptographic key material that can be distributed per time unit. Nowadays, the security analyses of various QKD protocols are well understood. It is known that optimal protocol parameters, such as the number of decoy states and their intensities, can be found by solving a nonlinear optimization problem. The complexity of this optimization problem is typically handled by making a number of heuristic assumptions. For instance, the number of decoy states is restricted to only one or two, with one of the decoy intensities set to a fixed value, and vacuum states are ignored as they are assumed to contribute only marginally to the secure key-rate. These assumptions simplify the optimization problem and reduce the size of search space significantly. However, they also cause the security analysis to be non-tight, and thereby result in sub-optimal performance. In this work, we follow a more rigorous approach using both linear and nonlinear programs describing the optimization problem. Our approach, focusing on the decoy-state BB84 protocol, allows heuristic assumptions to be omitted, and therefore results in a tighter security analysis with better protocol parameters. We show an improved performance for the decoy-state BB84 QKD protocol, demonstrating that the heuristic assumptions typically made are too restrictive. Moreover, our improved optimization frameworks shows that the complexity of the performance optimization problem can also be handled without making heuristic assumptions, even with limited computational resources available.
Key generation is one of the basic techniques used to realize secure channels in this digital world. This article compares both Quantum Key Distribution (QKD) and Physical Layer Key Generation (PLKG). While QKD can give information-theoretic security by invoking principles of quantum mechanics, PLKG is based on exploiting inherent randomness and reciprocity in wireless channels to extract the key. This study, through simulations, provides a comparative analysis of the security and performance aspects of QKD and PLKG against key rate, error rate, bandwidth, channel loss, and Signal-to-Noise Ratio (SNR). The results demonstrate strong trade-offs between QKD and PLKG in terms of security, practicality, and efficiency, with QKD bringing better guarantees for security but both inherently limited in terms of distance and key rate. On the other hand, PLKG is more readily deployable with higher key rates, based on computational security assumptions. This work provides practical guidelines concerning the applicability of both approaches for specific communication applications based on system requirements for communication security.