Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Laser Physics Letters

On the multiple use of quantum keys

С. Н. Молотков, Ivan S. Sushchev

Published Mar 1, 2026• 0 citations
Publisher

Abstract

Abstract In practice today, quantum keys are often reused because of practical limitations. It is clear that reusing a key weakens security compared to one-time-pad encryption, where perfect secrecy is achieved. For this reason, it is important to understand how the effort needed to find the key changes when the key is reused. We use the trace distance between two quantum states as a measure of closeness. Its maximum value is one, which means the two states are as different as possible. With simple arguments, we show that the trace distance is bounded above by several terms that capture (i) non-ideal quantum keys, (ii) plaintext redundancy, (iii) the number of key reuses, and (iv) the number of collisions of the block cipher. The trace distance approaches one exponentially fast with plaintext redundancy and with the number of key reuses; this means brute-force search becomes as easy as possible. For a random block cipher, the expected trace distance grows linearly with the number of key uses, with coefficient e −1 ( e is Euler’s constant). The result is information-theoretic in nature.

DOI
10.1088/1612-202x/ae4f89

Related papers

Transfer of Secret Keys in a Quantum Network with Trusted Intermediate Nodes and with Block Cipher Encryption

S. N. Molotkov

The quantum cryptography technology allows key distribution in individual segments of a network in a point–point configuration; then, keys in individual segments are used to protect traffic between any nodes of the network, which are not connected directly by a quantum channel. Correspondingly, the problem of negotiation (distribution) of keys between separate segments of the network appears. In this work, the problem of the transmission of an independent key through trusted nodes of the quantum network, between which keys are provided as a result of quantum key distribution, is considered. Quantum keys are used to encrypt the transmitted key. The transmitted key can be encrypted by both the block cipher and the one-time pad. It has been shown that the complexity of search for the key transmitted through the network depends on the imperfection of the external key and quantum keys as well as on the imperfection of the block cipher, i.e., on the average probability of collisions in the block cipher. The complexity in the case of the encryption of the transmitted key by the one-time pad depends only on the imperfection of the transmitted key and encryption keys. Perfect keys keep the perfectness of the transmitted key. In the block cipher, the transmitted key is no longer perfect even with the perfect keys in the measure of difference of the block cipher from the one-time pad. It has also been shown that the larger the number of collisions of the block cipher, i.e., the smaller the number of ciphertexts covered by the block cipher, the smaller the number of search steps required to find the key.

Письма в Журнал экспериментальной и теоретической физики•Mar 15, 2023•2 citations

Transfer of Secret Keys in a Quantum Network with Trusted Intermediate Nodes and with Block Cipher Encryption

S. N. Molotkov

The quantum cryptography technology allows key distribution in individual segments of a network in a point–point configuration; then, keys in individual segments are used to protect traffic between any nodes of the network, which are not connected directly by a quantum channel. Correspondingly, the problem of negotiation (distribution) of keys between separate segments of the network appears. In this work, the problem of the transmission of an independent key through trusted nodes of the quantum network, between which keys are provided as a result of quantum key distribution, is considered. Quantum keys are used to encrypt the transmitted key. The transmitted key can be encrypted by both the block cipher and the one-time pad. It has been shown that the complexity of search for the key transmitted through the network depends on the imperfection of the external key and quantum keys as well as on the imperfection of the block cipher, i.e., on the average probability of collisions in the block cipher. The complexity in the case of the encryption of the transmitted key by the one-time pad depends only on the imperfection of the transmitted key and encryption keys. Perfect keys keep the perfectness of the transmitted key. In the block cipher, the transmitted key is no longer perfect even with the perfect keys in the measure of difference of the block cipher from the one-time pad. It has also been shown that the larger the number of collisions of the block cipher, i.e., the smaller the number of ciphertexts covered by the block cipher, the smaller the number of search steps required to find the key.

Journal of Experimental and Theoretical Physics Letters•Mar 1, 2023•4 citations

On the operational meaning and practical aspects of using the security parameter in quantum key distribution

Anton Sergeevich Trushechkin

Abstract We discuss the operational meaning of a commonly accepted security parameter in quantum key distribution, which is based on the trace distance. We separately consider the cases of using a key in a one-time pad and in a computationally secure cipher. Some practical aspects of using the security parameter are also elucidated, which are usually not paid enough attention in theoretical studies and which therefore may cause difficulties for experimentalists and engineers. It is shown that a one-time pad requires not only a higher key generation rate than computationally secure ciphers, but also a significantly stronger condition on the key security parameter.

Quantum Electronics•May 1, 2020•12 citations

Security Significance of the Trace Distance Criterion in Quantum Key Distribution

Horace P. Yuen

The security significance of the trace distance security criterion $d$ is analyzed in terms of operational probabilities of an attacker's success in identifying different subsets of the generated key, both during the key generation process and when the key is used in one-time pad data encryption under known-plaintext attacks. The difference between Eve's sequence error rate and bit error rate is brought out. It is shown with counter-examples that the strong security claim maintained in the literature is incorrect. Other than the whole key error rates that can be quantified at the levels d^{1/3} and d^{1/4} which are much worse than $d$ itself, the attacker's success probabilities in estimating various subsets of the key and in known-plaintext attacks are yet to be quantified from $d$ if possible. It is demonstrated in realistic numerical examples of concrete protocols that drastic breach of security cannot yet be ruled out.

arXiv:1109.2675•Sep 13, 2011•11 citations

On the complexity of search for keys in quantum cryptography

S. N. Molotkov

The trace distance is used as a security criterion in proofs of security of keys in quantum cryptography. Some authors doubted that this criterion can be reduced to criteria used in classical cryptography. The following question has been answered in this work. Let a quantum cryptography system provide an ε-secure key such that ½‖ρ XE − ρ U ⊗ ρ E ‖1 < ε, which will be repeatedly used in classical encryption algorithms. To what extent does the ε-secure key reduce the number of search steps (guesswork) as compared to the use of ideal keys? A direct relation has been demonstrated between the complexity of the complete consideration of keys, which is one of the main security criteria in classical systems, and the trace distance used in quantum cryptography. Bounds for the minimum and maximum numbers of search steps for the determination of the actual key have been presented.

Journal of Experimental and Theoretical Physics Letters•Mar 1, 2016•7 citations

One-time pad, complexity of verification of keys, and practical security of quantum cryptography

S. N. Molotkov

A direct relation between the complexity of the complete verification of keys, which is one of the main criteria of security in classical systems, and a trace distance used in quantum cryptography is demonstrated. Bounds for the minimum and maximum numbers of verification steps required to determine the actual key are obtained.

Journal of Experimental and Theoretical Physics•Nov 1, 2016•10 citations
Abstract In practice today, quantum keys are often reused because of practical limitations. It is clear that reusing a key weakens security compared to one-time-pad encryption, where perfect secrecy is achieved. For this reason, it is important to understand how the effort needed to find the key changes when the key is reused. We use the trace distance between two quantum states as a measure of closeness. Its maximum value is one, which means the two states are as different as possible. With simple arguments, we show that the trace distance is bounded above by several terms that capture (i) non-ideal quantum keys, (ii) plaintext redundancy, (iii) the number of key reuses, and (iv) the number of collisions of the block cipher. The trace distance approaches one exponentially fast with plaintext redundancy and with the number of key reuses; this means brute-force search becomes as easy as possible. For a random block cipher, the expected trace distance grows linearly with the number of key uses, with coefficient e −1 ( e is Euler’s constant). The result is information-theoretic in nature.
The quantum cryptography technology allows key distribution in individual segments of a network in a point–point configuration; then, keys in individual segments are used to protect traffic between any nodes of the network, which are not connected directly by a quantum channel. Correspondingly, the problem of negotiation (distribution) of keys between separate segments of the network appears. In this work, the problem of the transmission of an independent key through trusted nodes of the quantum network, between which keys are provided as a result of quantum key distribution, is considered. Quantum keys are used to encrypt the transmitted key. The transmitted key can be encrypted by both the block cipher and the one-time pad. It has been shown that the complexity of search for the key transmitted through the network depends on the imperfection of the external key and quantum keys as well as on the imperfection of the block cipher, i.e., on the average probability of collisions in the block cipher. The complexity in the case of the encryption of the transmitted key by the one-time pad depends only on the imperfection of the transmitted key and encryption keys. Perfect keys keep the perfectness of the transmitted key. In the block cipher, the transmitted key is no longer perfect even with the perfect keys in the measure of difference of the block cipher from the one-time pad. It has also been shown that the larger the number of collisions of the block cipher, i.e., the smaller the number of ciphertexts covered by the block cipher, the smaller the number of search steps required to find the key.
The quantum cryptography technology allows key distribution in individual segments of a network in a point–point configuration; then, keys in individual segments are used to protect traffic between any nodes of the network, which are not connected directly by a quantum channel. Correspondingly, the problem of negotiation (distribution) of keys between separate segments of the network appears. In this work, the problem of the transmission of an independent key through trusted nodes of the quantum network, between which keys are provided as a result of quantum key distribution, is considered. Quantum keys are used to encrypt the transmitted key. The transmitted key can be encrypted by both the block cipher and the one-time pad. It has been shown that the complexity of search for the key transmitted through the network depends on the imperfection of the external key and quantum keys as well as on the imperfection of the block cipher, i.e., on the average probability of collisions in the block cipher. The complexity in the case of the encryption of the transmitted key by the one-time pad depends only on the imperfection of the transmitted key and encryption keys. Perfect keys keep the perfectness of the transmitted key. In the block cipher, the transmitted key is no longer perfect even with the perfect keys in the measure of difference of the block cipher from the one-time pad. It has also been shown that the larger the number of collisions of the block cipher, i.e., the smaller the number of ciphertexts covered by the block cipher, the smaller the number of search steps required to find the key.
Abstract We discuss the operational meaning of a commonly accepted security parameter in quantum key distribution, which is based on the trace distance. We separately consider the cases of using a key in a one-time pad and in a computationally secure cipher. Some practical aspects of using the security parameter are also elucidated, which are usually not paid enough attention in theoretical studies and which therefore may cause difficulties for experimentalists and engineers. It is shown that a one-time pad requires not only a higher key generation rate than computationally secure ciphers, but also a significantly stronger condition on the key security parameter.
The security significance of the trace distance security criterion ddd is analyzed in terms of operational probabilities of an attacker's success in identifying different subsets of the generated key, both during the key generation process and when the key is used in one-time pad data encryption under known-plaintext attacks. The difference between Eve's sequence error rate and bit error rate is brought out. It is shown with counter-examples that the strong security claim maintained in the literature is incorrect. Other than the whole key error rates that can be quantified at the levels d^{1/3} and d^{1/4} which are much worse than ddd itself, the attacker's success probabilities in estimating various subsets of the key and in known-plaintext attacks are yet to be quantified from ddd if possible. It is demonstrated in realistic numerical examples of concrete protocols that drastic breach of security cannot yet be ruled out.
The trace distance is used as a security criterion in proofs of security of keys in quantum cryptography. Some authors doubted that this criterion can be reduced to criteria used in classical cryptography. The following question has been answered in this work. Let a quantum cryptography system provide an ε-secure key such that ½‖ρ XE − ρ U ⊗ ρ E ‖1 < ε, which will be repeatedly used in classical encryption algorithms. To what extent does the ε-secure key reduce the number of search steps (guesswork) as compared to the use of ideal keys? A direct relation has been demonstrated between the complexity of the complete consideration of keys, which is one of the main security criteria in classical systems, and the trace distance used in quantum cryptography. Bounds for the minimum and maximum numbers of search steps for the determination of the actual key have been presented.