Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Annual Symposium on Foundations of Computer Science

Generalised entropy accumulation

Tony Metger, Omar Fawzi, David Sutter, Renato Renner

Published Oct 1, 2022• 35 citations
Publisher

Abstract

The min-entropy of a quantum system A conditioned on another quantum system E describes how much randomness can be extracted from A with respect to an adversary in possession of E. This quantity plays a crucial role in quantum cryptography: the security proofs of many quantum cryptographic protocols reduce to showing a lower bound on such a min-entropy. Here, we develop a new tool, called generalised entropy accumulation, for computing such bounds. Concretely, we consider a sequential process in which each step outputs a system Aiand updates a side information register E. We prove that if this process satisfies a natural “non-signalling” condition between past outputs and future side information, the min-entropy of the outputs $A_{1},\ldots,\ A_{n}$ conditioned on the side information E at the end of the process can be bounded from below by a sum of von Neumann entropies associated with the individual steps. This is a generalisation of the entropy accumulation theorem (EAT) [1], which deals with a more restrictive model of side information: there, past side information cannot be updated in subsequent rounds, and newly generated side information has to satisfy a Markov condition.Due to its more general model of side-information, our generalised EAT can be applied more easily and to a broader range of cryptographic protocols. In particular, it is the first general tool that is applicable to mistrustful device-independent cryptography. To demonstrate this, we give the first security proof for blind randomness expansion [2] against general adversaries. Furthermore, our generalised EAT can be used to give improved security proofs for quantum key distribution [3], and also has applications beyond quantum cryptography.

DOI
10.1109/focs54457.2022.00085

Related papers

Generalised Entropy Accumulation

Tony Metger, Omar Fawzi, David Sutter +1 more

Abstract Consider a sequential process in which each step outputs a system $$A_i$$ A i and updates a side information register E . We prove that if this process satisfies a natural “non-signalling” condition between past outputs and future side information, the min-entropy of the outputs $$A_1, \dots , A_n$$ A 1 , ⋯ , A n conditioned on the side information E at the end of the process can be bounded from below by a sum of von Neumann entropies associated with the individual steps. This is a generalisation of the entropy accumulation theorem (EAT) (Dupuis et al. in Commun Math Phys 379: 867–913, 2020), which deals with a more restrictive model of side information: there, past side information cannot be updated in subsequent rounds, and newly generated side information has to satisfy a Markov condition. Due to its more general model of side-information, our generalised EAT can be applied more easily and to a broader range of cryptographic protocols. As examples, we give the first multi-round security proof for blind randomness expansion and a simplified analysis of the E91 QKD protocol. The proof of our generalised EAT relies on a new variant of Uhlmann’s theorem and new chain rules for the Rényi divergence and entropy, which might be of independent interest.

Communications in Mathematical Physics•Oct 12, 2024•24 citations

Generalised entropy accumulation

Tony Metger, Omar Fawzi, David Sutter +1 more

Consider a sequential process in which each step outputs a system $A_i$ and updates a side information register $E$. We prove that if this process satisfies a natural "non-signalling" condition between past outputs and future side information, the min-entropy of the outputs $A_1, \dots, A_n$ conditioned on the side information $E$ at the end of the process can be bounded from below by a sum of von Neumann entropies associated with the individual steps. This is a generalisation of the entropy accumulation theorem (EAT), which deals with a more restrictive model of side information: there, past side information cannot be updated in subsequent rounds, and newly generated side information has to satisfy a Markov condition. Due to its more general model of side-information, our generalised EAT can be applied more easily and to a broader range of cryptographic protocols. As examples, we give the first multi-round security proof for blind randomness expansion and a simplified analysis of the E91 QKD protocol. The proof of our generalised EAT relies on a new variant of Uhlmann's theorem and new chain rules for the Renyi divergence and entropy, which might be of independent interest.

arXiv:2203.04989•Mar 9, 2022•4 citations

Entropy Accumulation With Improved Second-Order Term

Frédéric Dupuis, Omar Fawzi

The entropy accumulation theorem states that the smooth min-entropy of an n-partite system A = (A1, ..., An) is lower-bounded by the sum of the von Neumann entropies of suitably chosen conditional states up to corrections that are sublinear in n. This theorem is particularly suited to proving the security of quantum cryptographic protocols, and in particular so-called device-independent protocols for randomness expansion and key distribution, where the devices can be built and preprogrammed by a malicious supplier. However, while the bounds provided by this theorem are optimal in the first order, the second-order term is bounded more crudely, in such a way that the bounds deteriorate significantly when the theorem is applied directly to protocols where parameter estimation is done by sampling a small fraction of the positions, as is done in most QKD protocols. The objective of this paper is to improve this second-order sublinear term and remedy this problem. On the way, we prove various bounds on the divergence variance, which might be of independent interest.

arXiv:1805.11652•IEEE Transactions on Information Theory•Jul 18, 2019•84 citations

Entropy accumulation with improved second-order

Frédéric Dupuis, Omar Fawzi

The entropy accumulation theorem states that the smooth min-entropy of an n-partite system A = (A_1 ,. .. , A_n) is lower-bounded by the sum of the von Neumann entropies of suitably chosen conditional states up to corrections that are sublinear in n. This theorem is particularly suited to proving the security of quantum cryptographic protocols, and in particular so-called device-independent protocols for randomness expansion and key distribution, where the devices can be built and preprogrammed by a malicious supplier. However, while the bounds provided by this theorem are optimal in the first order, the second-order term is bounded more crudely, in such a way that the bounds deteriorate significantly when the theorem is applied directly to protocols where parameter estimation is done by sampling a small fraction of the positions, as is done in most QKD protocols. The objective of this paper is to improve this second-order sublinear term and remedy this problem. On the way, we prove various bounds on the divergence variance, which might be of independent interest.

•Nov 18, 2018•0 citations

Certified Randomness Generation against Quantum Adversaries via Energy Constraints

Thomas A. Hahn, Efrat Gerchkovitz, Ester Yehuda +1 more

For quantum random number generators (QRNGs), strong security guarantees can be obtained under various assumptions. The most well-known assumptions are the non-signalling assumption (needed for device-independent (DI) QRNG) and post-quantum computational assumptions (needed for computationally bounded single-prover QRNG protocols). In this work, we study a third model: a simple prepare-and-measure QRNG whose security relies on physically motivated energy constraints. This physically motivated set-up allows for easier implementations of QRNGs and can supply better rates. So far, previous works that studied the energy-constrained model either assumed that the adversary is classical in their security proof or supplied relatively weak bounds on the certified randomness, by bounding the conditional min-entropy. In this work, we prove a new, essentially tight, lower bound on the single-round von Neumann entropy against adversaries holding both classical and quantum side-information. Our work reveals that working with the von Neumann entropy, rather than the min-entropy, in the quantum case can lead to a major improvement, nearly matching the classical bound in many cases. We further study the robustness of our entropy bound. Since the single-round von Neumann entropy is the main quantity of interest when characterizing the key rate of QRNGs, our bound establishes the main ingredient for rigorous security proofs against general quantum attacks in this framework.

quant-pharXiv:2610.05766•Oct 6, 2026•0 citations

Chain rules for conditional entropies in quantum cryptography: limitations and improvements

Lewis Wooltorton, Peter Brown, Omar Fawzi

Security proofs in quantum cryptography rely on conditional entropies. In a many-round protocol, their estimation is a challenging task; one must account for the most general attacks by an eavesdropper, including those that are not independently and identically distributed (i.i.d.) across all rounds. Chain rules address this problem by relating the conditional entropy of a structured, but non-i.i.d. process to a sum of entropy contributions from each round. They are a key ingredient in entropy accumulation theorems (EATs), which provide a versatile security proof framework for many protocols in quantum cryptography. Recently, chain rules in the setting of trusted devices have lead to tight i.i.d. reductions at a finite number of rounds, and whether analogous results can be recovered in the device-independent (DI) setting has not been addressed. Surprisingly, we show that a natural tightening of the chain rule of Dupuis et al. [Commun. Math. Phys. 379, 867-913, (2020)] that would answer this question affirmatively cannot hold, highlighting a limitation of the current DI security proof approach. Nonetheless, we show that an intermediate improvement is possible by proving a new chain rule in this setting. Following the framework of Arqand et al. [Phys. Rev. X 15, 041013 (2025)], we use our chain rule to provide a slightly tighter version of the Rényi EAT in certain contexts. In addition, we provide a self-contained framework that unifies existing chain rules and compares their applications, framing our results in a broader context.

quant-pharXiv:2605.29787•May 29, 2026•0 citations
The min-entropy of a quantum system A conditioned on another quantum system E describes how much randomness can be extracted from A with respect to an adversary in possession of E. This quantity plays a crucial role in quantum cryptography: the security proofs of many quantum cryptographic protocols reduce to showing a lower bound on such a min-entropy. Here, we develop a new tool, called generalised entropy accumulation, for computing such bounds. Concretely, we consider a sequential process in which each step outputs a system Aiand updates a side information register E. We prove that if this process satisfies a natural “non-signalling” condition between past outputs and future side information, the min-entropy of the outputs A1,…, AnA_{1},\ldots,\ A_{n}A1​,…, An​ conditioned on the side information E at the end of the process can be bounded from below by a sum of von Neumann entropies associated with the individual steps. This is a generalisation of the entropy accumulation theorem (EAT) [1], which deals with a more restrictive model of side information: there, past side information cannot be updated in subsequent rounds, and newly generated side information has to satisfy a Markov condition.Due to its more general model of side-information, our generalised EAT can be applied more easily and to a broader range of cryptographic protocols. In particular, it is the first general tool that is applicable to mistrustful device-independent cryptography. To demonstrate this, we give the first security proof for blind randomness expansion [2] against general adversaries. Furthermore, our generalised EAT can be used to give improved security proofs for quantum key distribution [3], and also has applications beyond quantum cryptography.
Abstract Consider a sequential process in which each step outputs a system AiA_iAi​ A i and updates a side information register E . We prove that if this process satisfies a natural “non-signalling” condition between past outputs and future side information, the min-entropy of the outputs A1,…,AnA_1, \dots , A_nA1​,…,An​ A 1 , ⋯ , A n conditioned on the side information E at the end of the process can be bounded from below by a sum of von Neumann entropies associated with the individual steps. This is a generalisation of the entropy accumulation theorem (EAT) (Dupuis et al. in Commun Math Phys 379: 867–913, 2020), which deals with a more restrictive model of side information: there, past side information cannot be updated in subsequent rounds, and newly generated side information has to satisfy a Markov condition. Due to its more general model of side-information, our generalised EAT can be applied more easily and to a broader range of cryptographic protocols. As examples, we give the first multi-round security proof for blind randomness expansion and a simplified analysis of the E91 QKD protocol. The proof of our generalised EAT relies on a new variant of Uhlmann’s theorem and new chain rules for the Rényi divergence and entropy, which might be of independent interest.
Consider a sequential process in which each step outputs a system AiA_iAi​ and updates a side information register EEE. We prove that if this process satisfies a natural "non-signalling" condition between past outputs and future side information, the min-entropy of the outputs A1,…,AnA_1, \dots, A_nA1​,…,An​ conditioned on the side information EEE at the end of the process can be bounded from below by a sum of von Neumann entropies associated with the individual steps. This is a generalisation of the entropy accumulation theorem (EAT), which deals with a more restrictive model of side information: there, past side information cannot be updated in subsequent rounds, and newly generated side information has to satisfy a Markov condition. Due to its more general model of side-information, our generalised EAT can be applied more easily and to a broader range of cryptographic protocols. As examples, we give the first multi-round security proof for blind randomness expansion and a simplified analysis of the E91 QKD protocol. The proof of our generalised EAT relies on a new variant of Uhlmann's theorem and new chain rules for the Renyi divergence and entropy, which might be of independent interest.
The entropy accumulation theorem states that the smooth min-entropy of an n-partite system A = (A1, ..., An) is lower-bounded by the sum of the von Neumann entropies of suitably chosen conditional states up to corrections that are sublinear in n. This theorem is particularly suited to proving the security of quantum cryptographic protocols, and in particular so-called device-independent protocols for randomness expansion and key distribution, where the devices can be built and preprogrammed by a malicious supplier. However, while the bounds provided by this theorem are optimal in the first order, the second-order term is bounded more crudely, in such a way that the bounds deteriorate significantly when the theorem is applied directly to protocols where parameter estimation is done by sampling a small fraction of the positions, as is done in most QKD protocols. The objective of this paper is to improve this second-order sublinear term and remedy this problem. On the way, we prove various bounds on the divergence variance, which might be of independent interest.
The entropy accumulation theorem states that the smooth min-entropy of an n-partite system A = (A_1 ,. .. , A_n) is lower-bounded by the sum of the von Neumann entropies of suitably chosen conditional states up to corrections that are sublinear in n. This theorem is particularly suited to proving the security of quantum cryptographic protocols, and in particular so-called device-independent protocols for randomness expansion and key distribution, where the devices can be built and preprogrammed by a malicious supplier. However, while the bounds provided by this theorem are optimal in the first order, the second-order term is bounded more crudely, in such a way that the bounds deteriorate significantly when the theorem is applied directly to protocols where parameter estimation is done by sampling a small fraction of the positions, as is done in most QKD protocols. The objective of this paper is to improve this second-order sublinear term and remedy this problem. On the way, we prove various bounds on the divergence variance, which might be of independent interest.
For quantum random number generators (QRNGs), strong security guarantees can be obtained under various assumptions. The most well-known assumptions are the non-signalling assumption (needed for device-independent (DI) QRNG) and post-quantum computational assumptions (needed for computationally bounded single-prover QRNG protocols). In this work, we study a third model: a simple prepare-and-measure QRNG whose security relies on physically motivated energy constraints. This physically motivated set-up allows for easier implementations of QRNGs and can supply better rates. So far, previous works that studied the energy-constrained model either assumed that the adversary is classical in their security proof or supplied relatively weak bounds on the certified randomness, by bounding the conditional min-entropy. In this work, we prove a new, essentially tight, lower bound on the single-round von Neumann entropy against adversaries holding both classical and quantum side-information. Our work reveals that working with the von Neumann entropy, rather than the min-entropy, in the quantum case can lead to a major improvement, nearly matching the classical bound in many cases. We further study the robustness of our entropy bound. Since the single-round von Neumann entropy is the main quantity of interest when characterizing the key rate of QRNGs, our bound establishes the main ingredient for rigorous security proofs against general quantum attacks in this framework.
Security proofs in quantum cryptography rely on conditional entropies. In a many-round protocol, their estimation is a challenging task; one must account for the most general attacks by an eavesdropper, including those that are not independently and identically distributed (i.i.d.) across all rounds. Chain rules address this problem by relating the conditional entropy of a structured, but non-i.i.d. process to a sum of entropy contributions from each round. They are a key ingredient in entropy accumulation theorems (EATs), which provide a versatile security proof framework for many protocols in quantum cryptography. Recently, chain rules in the setting of trusted devices have lead to tight i.i.d. reductions at a finite number of rounds, and whether analogous results can be recovered in the device-independent (DI) setting has not been addressed. Surprisingly, we show that a natural tightening of the chain rule of Dupuis et al. [Commun. Math. Phys. 379, 867-913, (2020)] that would answer this question affirmatively cannot hold, highlighting a limitation of the current DI security proof approach. Nonetheless, we show that an intermediate improvement is possible by proving a new chain rule in this setting. Following the framework of Arqand et al. [Phys. Rev. X 15, 041013 (2025)], we use our chain rule to provide a slightly tighter version of the Rényi EAT in certain contexts. In addition, we provide a self-contained framework that unifies existing chain rules and compares their applications, framing our results in a broader context.