Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Does hiding the post-processing from a memory-limited eavesdropper raise the noise tolerance of QKD? Timelocked advantage distillation and the 20% barrier

Hikaru Wakaura

Published Oct 22, 2026• 0 citations
Publisher

Abstract

Abstract Advantage distillation (AD) raises the finite-key threshold QBER of decoy-state BB84 from 9.5% to 17.3% [1]; asymptotically two-way post-processing tolerates 20%, and Bae and Ac´ın showed that an adversary who stores her probes until the AD parities are announced attains this limit, while one forced to measure each probe beforehand is held off until the 25% entanglement limit. We ask what a quantum computational timelock on the post-processing announcements can buy for this protocol, treating the parities, the block partition and the bases separately. Hiding the parities buys nothing: we prove that for every block size the best measurement made before the parities are known attains the adaptive Helstrom value, so the key length in the min-entropy accounting is the collective-attack value, 17.66% at 1014 pulses against the 17.30% certified by the entropic- uncertainty bound of Ref. [1]. Hiding the partition is different: the protocol of Ref. [1] partitions the sifted key at random after the quantum phase, so an adversary whose memory is shorter than the time between the probes of a block cannot bring them together. Modelling her by role-blind per-probe measurements, an assumption we state rather than derive, the Helstrom benchmark, which a numerical search over identical measurements does not improve at odd block sizes, gives 20.8% (Shannon) and 20.7% (min-entropy) at b= 9, 19.4% and 20.6% in a post-selection sensitivity check, with 25% as asymptote. Whether a memory holding many probes without the partition can do better is open; at up to six probes a joint measurement recovers most of the adaptive value, so at these sizes the gain rests on locality. Hiding the basis leaves the BB84 guessing probability unchanged at one- and two-bit blocks and, for six-state, shrinks the memoryless gain by an order of magnitude at two- and three-bit blocks.

DOI
10.21203/rs.3.rs-11453979/v1

Related papers

Towards a Finite Size Analysis of Decoy-State Quantum Key Distribution with Advantage Distillation

Kleinpaß, Philipp, Treplin, Jonas, Orsucci, Davide

Quantum Key Distribution (QKD) allows two legitimate parties, Alice and Bob, to share a secret key with information-theoretic security, ensuring that an eavesdropper, Eve, cannot obtain any information about the key. A QKD protocol is provably secure only when the Quantum Bit Error Rate (QBER) is below a certain threshold and, therefore, the presence of noise inherently limits the maximum transmission distance. Advantage Distillation (AD) is a classical post-processing technique that enhances QKD protocols by increasing the maximum acceptable QBER and, thus, allows extending the communication range. AD operates by post-selecting blocks of bits and extracting fewer but highly correlated bits between Alice and Bob, which exhibit a reduced QBER, thus lowering the amount of information that has to be disclosed during the information reconciliation step. In this study, we present a new analytical expression for the secure key rate. This will enable a finite-size secure key length analysis of the decoy state version of the BB84 protocol including AD post-processing.

•Sep 1, 2024•0 citations

Finite Size Analysis of Decoy-State BB84 with Advantage Distillation

Jonas Treplin, Philipp Kleinpaß, Davide Orsucci

Advantage Distillation (AD) is a classical post-processing technique that enhances Quantum Key Distribution (QKD) protocols by increasing the maximum acceptable Quantum Bit Error Rate (QBER) and thus extending the distance at which QKD links can be securely established. AD operates by post-selecting blocks of bits and extracting fewer high-fidelity bits, exhibiting a reduced QBER and thus lowering the amount of information that has to be disclosed during the information reconciliation step. In this work we present the first comprehensive finite key-size analysis of decoy-state BB84 enhanced via AD post-processing. We demonstrate that through the use of AD the maximum acceptable QBER increases from around $9.5\%$ to around $17.3\%$ for realistic key sizes. This result shows that substantial performance enhancements can be achieved in scenarios which are constrained by the maximum tolerable QBER via improvements of the post-processing method alone.

quant-pharXiv:2511.21665•Nov 27, 2025•0 citations

Further Improving the Decoy State Quantum Key Distribution Protocol with Advantage Distillation

Walter O. Krawec

In this paper, we revisit the application of classical advantage distillation (CAD) to the decoy-state BB84 protocol. Prior work has shown that CAD can greatly improve maximal distances and noise tolerances of the practical decoy state protocol. However, past work in deriving key-rate bounds for this protocol with CAD have assumed a trivial bound on the quantum entropy, whenever Alice sends a vacuum state in a CAD block (i.e., the entropy of such blocks is taken to be zero). Since such rounds contribute, negatively, to the error correction leakage, this results in a correct, though sub-optimal bound. Here, we derive a new proof of security for CAD applied to the decoy state BB84 protocol, computing a bound on Eve's uncertainty in all possible single and vacuum photon events. We use this to derive a new asymptotic key-rate bound which, we show, outperforms prior work, allowing for increased distances and noise tolerances.

quant-pharXiv:2601.02565•Jan 7, 2026•0 citations

Optimal eavesdropping on QKD without quantum memory

Aurélien Bocquet, Anthony Leverrier, Romain Alléaume

We consider the security of the BB84, six-state and SARG04 quantum key distribution protocols when the eavesdropper doesn't have access to a quantum memory. In this case, Eve's most general strategy is to measure her ancilla with an appropriate POVM designed to take advantage of the post-measurement information that will be released during the sifting phase of the protocol. After an optimization on all the parameters accessible to Eve, our method provides us with new bounds for the security of six-state and SARG04 against a memoryless adversary. In particular, for the six-state protocol we show that the maximum QBER for which a secure key can be extracted is increased from 12.6% (for collective attacks) to 20.4% with the memoryless assumption.

•Jul 27, 2011•1 citation

Symmetric Extendability of Quantum States and the Extreme Limits of Quantum Key Distribution

Sumeet Khatri

We investigate QKD protocols with two-way classical post-processing that are based on the well-known six-state and BB84 signal states. In these QKD protocols, the source (Alice) sends quantum signals to the receiver (Bob), who measures them, leaving only classical data on both sides. Our goal is to find the highest value of the quantum bit-error rate (QBER) $Q$ for which two-way classical post-processing protocols on the data can distill secret keys. Using the BB84 signal states, such protocols currently exist for $Q<\\frac{1}{5}$. On the other hand, for $Q\\geq\\frac{1}{4}$ no such protocol can exist as the observed data is compatible with an intercept-resend attack. This leaves the interesting question of whether successful two-way protocols exist in the interval $\\frac{1}{5}\\leq Q<\\frac{1}{4}$. For the six-state signal states, the corresponding interval is known to be $\\frac{5-\\sqrt{5}}{10}\\leq Q<\\frac{1}{3}$. \n\t \n\tWe search for two-way protocols because it turns out that within these intervals Alice and Bob's correlations are symmetrically extendable, meaning that Bob and the eavesdropper (Eve) are completely indistinguishable from Alice's point of view, making any one-way Alice-to-Bob post-processing protocol insecure. A two-way protocol might be able to break the symmetry between Bob and Eve, and it must do so in order to distill a secret key because any two-way protocol will necessarily terminate with a one-way communication step, at which point the symmetric extendability of Alice and Bob's updated correlations must be checked again. \n \nWe first show that the search for two-way protocols breaking the symmetric extendability of Alice and Bob's correlations can be restricted to a search over post-selection protocols if all we care about is whether secret key can at all be distilled and not about the rate of distillation. We then provide strong analytical and numerical evidence to suggest that no two-way classical post-processing protocol exists within the gap when the six-state signal states are used. \n\t \n\tUnder quantum entanglement distillation protocols, it is known that secret key can be distilled right up to the intercept-resend bounds of $\\frac{1}{4}$ and $\\frac{1}{3}$ for the BB84 and six-state signal states, respectively. We therefore want to know whether classical post-processing protocols are just as good at distilling secret keys as quantum ones. Our results appear to indicate that they are not.

•Oct 13, 2016•3 citations

Limits of adaptive two-way linear postprocessing in six-state quantum key distribution

Toyohiro Tsurumaru

Two-way classical communication improves the noise tolerance of quantum key distribution, but the limits of adaptive parity processing remain unclear. For the six-state protocol with equal three-basis error rate $p\in[p_*,1/2]$, where $p_*=(5-\sqrt5)/10\simeq27.64\%$, we construct a single compatible collective attack that defeats a broad class of linear postprocessing. Each public message may be a linear function of the sender's raw key, chosen adaptively from the public history. For every finite input length and every accepted transcript of positive probability, Eve's optimal probability of recovering any linear function of Alice's raw key is at least Bob's. Consequently, reliable agreement on a linear final key is incompatible with secrecy. The same conclusion holds for arbitrary publicly seeded privacy amplification after reliable recovery of a linear candidate. The proof conditions on the complete transcript, which restricts the two raw keys to affine subspaces. A local degradation of Eve's state, a known Rényi-entropy comparison, and a coset-probability inequality then give the recovery comparison. Both inequalities are proved in self-contained appendices. The result allows block splitting, regrouping, nonzero-syndrome selection, and adaptive linear reconciliation.

quant-pharXiv:2610.21469•Oct 16, 2026•0 citations
Abstract Advantage distillation (AD) raises the finite-key threshold QBER of decoy-state BB84 from 9.5% to 17.3% [1]; asymptotically two-way post-processing tolerates 20%, and Bae and Ac´ın showed that an adversary who stores her probes until the AD parities are announced attains this limit, while one forced to measure each probe beforehand is held off until the 25% entanglement limit. We ask what a quantum computational timelock on the post-processing announcements can buy for this protocol, treating the parities, the block partition and the bases separately. Hiding the parities buys nothing: we prove that for every block size the best measurement made before the parities are known attains the adaptive Helstrom value, so the key length in the min-entropy accounting is the collective-attack value, 17.66% at 1014 pulses against the 17.30% certified by the entropic- uncertainty bound of Ref. [1]. Hiding the partition is different: the protocol of Ref. [1] partitions the sifted key at random after the quantum phase, so an adversary whose memory is shorter than the time between the probes of a block cannot bring them together. Modelling her by role-blind per-probe measurements, an assumption we state rather than derive, the Helstrom benchmark, which a numerical search over identical measurements does not improve at odd block sizes, gives 20.8% (Shannon) and 20.7% (min-entropy) at b= 9, 19.4% and 20.6% in a post-selection sensitivity check, with 25% as asymptote. Whether a memory holding many probes without the partition can do better is open; at up to six probes a joint measurement recovers most of the adaptive value, so at these sizes the gain rests on locality. Hiding the basis leaves the BB84 guessing probability unchanged at one- and two-bit blocks and, for six-state, shrinks the memoryless gain by an order of magnitude at two- and three-bit blocks.
Quantum Key Distribution (QKD) allows two legitimate parties, Alice and Bob, to share a secret key with information-theoretic security, ensuring that an eavesdropper, Eve, cannot obtain any information about the key. A QKD protocol is provably secure only when the Quantum Bit Error Rate (QBER) is below a certain threshold and, therefore, the presence of noise inherently limits the maximum transmission distance. Advantage Distillation (AD) is a classical post-processing technique that enhances QKD protocols by increasing the maximum acceptable QBER and, thus, allows extending the communication range. AD operates by post-selecting blocks of bits and extracting fewer but highly correlated bits between Alice and Bob, which exhibit a reduced QBER, thus lowering the amount of information that has to be disclosed during the information reconciliation step. In this study, we present a new analytical expression for the secure key rate. This will enable a finite-size secure key length analysis of the decoy state version of the BB84 protocol including AD post-processing.
Advantage Distillation (AD) is a classical post-processing technique that enhances Quantum Key Distribution (QKD) protocols by increasing the maximum acceptable Quantum Bit Error Rate (QBER) and thus extending the distance at which QKD links can be securely established. AD operates by post-selecting blocks of bits and extracting fewer high-fidelity bits, exhibiting a reduced QBER and thus lowering the amount of information that has to be disclosed during the information reconciliation step. In this work we present the first comprehensive finite key-size analysis of decoy-state BB84 enhanced via AD post-processing. We demonstrate that through the use of AD the maximum acceptable QBER increases from around 9.5%9.5\%9.5% to around 17.3%17.3\%17.3% for realistic key sizes. This result shows that substantial performance enhancements can be achieved in scenarios which are constrained by the maximum tolerable QBER via improvements of the post-processing method alone.
In this paper, we revisit the application of classical advantage distillation (CAD) to the decoy-state BB84 protocol. Prior work has shown that CAD can greatly improve maximal distances and noise tolerances of the practical decoy state protocol. However, past work in deriving key-rate bounds for this protocol with CAD have assumed a trivial bound on the quantum entropy, whenever Alice sends a vacuum state in a CAD block (i.e., the entropy of such blocks is taken to be zero). Since such rounds contribute, negatively, to the error correction leakage, this results in a correct, though sub-optimal bound. Here, we derive a new proof of security for CAD applied to the decoy state BB84 protocol, computing a bound on Eve's uncertainty in all possible single and vacuum photon events. We use this to derive a new asymptotic key-rate bound which, we show, outperforms prior work, allowing for increased distances and noise tolerances.
We consider the security of the BB84, six-state and SARG04 quantum key distribution protocols when the eavesdropper doesn't have access to a quantum memory. In this case, Eve's most general strategy is to measure her ancilla with an appropriate POVM designed to take advantage of the post-measurement information that will be released during the sifting phase of the protocol. After an optimization on all the parameters accessible to Eve, our method provides us with new bounds for the security of six-state and SARG04 against a memoryless adversary. In particular, for the six-state protocol we show that the maximum QBER for which a secure key can be extracted is increased from 12.6% (for collective attacks) to 20.4% with the memoryless assumption.
We investigate QKD protocols with two-way classical post-processing that are based on the well-known six-state and BB84 signal states. In these QKD protocols, the source (Alice) sends quantum signals to the receiver (Bob), who measures them, leaving only classical data on both sides. Our goal is to find the highest value of the quantum bit-error rate (QBER) QQQ for which two-way classical post-processing protocols on the data can distill secret keys. Using the BB84 signal states, such protocols currently exist for Q<frac15Q<\\frac{1}{5}Q<frac15. On the other hand, for Qgeqfrac14Q\\geq\\frac{1}{4}Qgeqfrac14 no such protocol can exist as the observed data is compatible with an intercept-resend attack. This leaves the interesting question of whether successful two-way protocols exist in the interval frac15leqQ<frac14\\frac{1}{5}\\leq Q<\\frac{1}{4}frac15leqQ<frac14. For the six-state signal states, the corresponding interval is known to be frac5−sqrt510leqQ<frac13\\frac{5-\\sqrt{5}}{10}\\leq Q<\\frac{1}{3}frac5−sqrt510leqQ<frac13. \n\t \n\tWe search for two-way protocols because it turns out that within these intervals Alice and Bob's correlations are symmetrically extendable, meaning that Bob and the eavesdropper (Eve) are completely indistinguishable from Alice's point of view, making any one-way Alice-to-Bob post-processing protocol insecure. A two-way protocol might be able to break the symmetry between Bob and Eve, and it must do so in order to distill a secret key because any two-way protocol will necessarily terminate with a one-way communication step, at which point the symmetric extendability of Alice and Bob's updated correlations must be checked again. \n \nWe first show that the search for two-way protocols breaking the symmetric extendability of Alice and Bob's correlations can be restricted to a search over post-selection protocols if all we care about is whether secret key can at all be distilled and not about the rate of distillation. We then provide strong analytical and numerical evidence to suggest that no two-way classical post-processing protocol exists within the gap when the six-state signal states are used. \n\t \n\tUnder quantum entanglement distillation protocols, it is known that secret key can be distilled right up to the intercept-resend bounds of frac14\\frac{1}{4}frac14 and frac13\\frac{1}{3}frac13 for the BB84 and six-state signal states, respectively. We therefore want to know whether classical post-processing protocols are just as good at distilling secret keys as quantum ones. Our results appear to indicate that they are not.
Two-way classical communication improves the noise tolerance of quantum key distribution, but the limits of adaptive parity processing remain unclear. For the six-state protocol with equal three-basis error rate p∈[p∗,1/2]p\in[p_*,1/2]p∈[p∗​,1/2], where p∗=(5−5)/10≃27.64%p_*=(5-\sqrt5)/10\simeq27.64\%p∗​=(5−5​)/10≃27.64%, we construct a single compatible collective attack that defeats a broad class of linear postprocessing. Each public message may be a linear function of the sender's raw key, chosen adaptively from the public history. For every finite input length and every accepted transcript of positive probability, Eve's optimal probability of recovering any linear function of Alice's raw key is at least Bob's. Consequently, reliable agreement on a linear final key is incompatible with secrecy. The same conclusion holds for arbitrary publicly seeded privacy amplification after reliable recovery of a linear candidate. The proof conditions on the complete transcript, which restricts the two raw keys to affine subspaces. A local degradation of Eve's state, a known Rényi-entropy comparison, and a coset-probability inequality then give the recovery comparison. Both inequalities are proved in self-contained appendices. The result allows block splitting, regrouping, nonzero-syndrome selection, and adaptive linear reconciliation.