Security Against Collective Attacks of a Modified BB84 QKD Protocol with Information only in One Basis

TL;DR

This paper proves that a modified BB84 quantum key distribution protocol, which sends information only in one basis and tests in both, maintains security against collective attacks, with some trade-offs in testing bits.

Contribution

It demonstrates the security of a modified BB84 protocol against collective attacks without classical information-theoretical analysis, improving understanding of protocol robustness.

Findings

The modified protocol is as secure as the original BB84 against collective attacks.

It requires more bits for testing than the original protocol.

The security proof avoids classical information-theoretical issues with composability.

Abstract

The Quantum Key Distribution (QKD) protocol BB84 has been proven secure against several important types of attacks: the collective attacks and the joint attacks. Here we analyze the security of a modified BB84 protocol, for which information is sent only in the z basis while testing is done in both the z and the x bases, against collective attacks. The proof follows the framework of a previous paper (Boyer, Gelles, and Mor, 2009), but it avoids the classical information-theoretical analysis that caused problems with composability. We show that this modified BB84 protocol is as secure against collective attacks as the original BB84 protocol, and that it requires more bits for testing.

Equations

$$d_{r,m}\triangleq \underset{r\le r^{\prime }<r+m}{\min }{d}_H(v_{r^{\prime }+1},V_{r^{\prime }})=\underset{r\le r^{\prime }<r+m}{\min }{d}_{r^{\prime },1}.$$

$${\hat{\rho }}_k$$

$$\frac{1}{2}\mathrm{tr}|{\tilde{\rho }}_0-{\tilde{\rho }}_1|\le 2\sqrt{P\left[|{\mathbf{C}}_I|\ge \frac{d_{r,1}}{2}\mid {\mathbf{B}}_I=\overline{{\mathbf{b}}^{\prime }},\mathbf{s}\right]},$$

$$\frac{1}{2}\mathrm{tr}|{\hat{\rho }}_0-{\hat{\rho }}_1|\le 2\sqrt{P\left[|{\mathbf{C}}_I|\ge \frac{d_{r,1}}{2}\mid {\mathbf{B}}_I=\overline{{\mathbf{b}}^{\prime }},\mathbf{s}\right]}.$$

$$\frac{1}{2}\mathrm{tr}|{\hat{\rho }}_0-{\hat{\rho }}_1|$$

$$=2\sqrt{P\left[|\widetilde{{\mathbf{C}}_I}|\ge \frac{d_{r,1}}{2}\mid {\mathbf{c}}_{\mathbf{z}},{\mathbf{c}}_{\mathbf{b}},\mathcal{P}\right]},$$

$${\hat{\rho }}_{\mathbf{k}}$$

$$\frac{1}{2}\mathrm{tr}|{\hat{\rho }}_{\mathbf{k}}-{\hat{\rho }}_{{\mathbf{k}}^{\prime }}|$$

$$\le 2m\sqrt{P\left[|\widetilde{{\mathbf{C}}_I}|\ge \frac{d_{r,m}}{2}\mid {\mathbf{c}}_{\mathbf{z}},{\mathbf{c}}_{\mathbf{b}},\mathcal{P}\right]}.$$

$$\frac{1}{2}\mathrm{tr}|{\hat{\rho }}_{{\mathbf{k}}_{j-1}}-{\hat{\rho }}_{{\mathbf{k}}_j}|$$

$$\le 2\sqrt{P\left[|\widetilde{{\mathbf{C}}_I}|\ge \frac{d_j}{2}\mid {\mathbf{c}}_{\mathbf{z}},{\mathbf{c}}_{\mathbf{b}},\mathcal{P}\right]}$$

$$\frac{1}{2}\mathrm{tr}|{\hat{\rho }}_{{\mathbf{k}}_{j-1}}-{\hat{\rho }}_{{\mathbf{k}}_j}|$$

$$\le 2\sqrt{P\left[|\widetilde{{\mathbf{C}}_I}|\ge \frac{d_{r,m}}{2}\mid {\mathbf{c}}_{\mathbf{z}},{\mathbf{c}}_{\mathbf{b}},\mathcal{P}\right]}.$$

$$\frac{1}{2}\mathrm{tr}|{\hat{\rho }}_{\mathbf{k}}-{\hat{\rho }}_{{\mathbf{k}}^{\prime }}|$$

$$=\frac{1}{2}\mathrm{tr}|{\hat{\rho }}_{{\mathbf{k}}_0}-{\hat{\rho }}_{{\mathbf{k}}_m}|\le \sum _{j=1}^m\frac{1}{2}\mathrm{tr}|{\hat{\rho }}_{{\mathbf{k}}_{j-1}}-{\hat{\rho }}_{{\mathbf{k}}_j}|$$

$$\le 2m\sqrt{P\left[|\widetilde{{\mathbf{C}}_I}|\ge \frac{d_{r,m}}{2}\mid {\mathbf{c}}_{\mathbf{z}},{\mathbf{c}}_{\mathbf{b}},\mathcal{P}\right]}.$$

$${\Delta }_{\mathrm{Eve}}^{(p_{a,z},p_{a,x})}(\mathbf{k},{\mathbf{k}}^{\prime }|\mathcal{P},\mathbf{\xi },{\mathbf{c}}_{\mathbf{z}},{\mathbf{c}}_{\mathbf{b}})$$

$$\triangleq \{\begin{array}{ll}\frac{1}{2}\mathrm{tr}|{\hat{\rho }}_{\mathbf{k}}-{\hat{\rho }}_{{\mathbf{k}}^{\prime }}|& \text{if nz∣cz∣≤pa,z and nx∣cb∣≤pa,x}\\ 0& \text{otherwise}\end{array}$$

$$⟨{\Delta }_{\mathrm{Eve}}^{(p_{a,z},p_{a,x})}(\mathbf{k},{\mathbf{k}}^{\prime })⟩$$

$${\Delta }_{\mathrm{Eve}}^{(p_{a,z},p_{a,x})}(\mathbf{k},{\mathbf{k}}^{\prime }|\mathcal{P},\mathbf{\xi },{\mathbf{c}}_{\mathbf{z}},{\mathbf{c}}_{\mathbf{b}})$$

$$\cdot p(\mathcal{P},\mathbf{\xi },{\mathbf{c}}_{\mathbf{z}},{\mathbf{c}}_{\mathbf{b}})$$

$$⟨{\Delta }_{\mathrm{Eve}}^{(p_{a,z},p_{a,x})}(\mathbf{k},{\mathbf{k}}^{\prime })⟩$$

$$\overline{\wedge \left(\frac{|{\mathbf{C}}_{T_Z}|}{n_z}\le p_{a,z}\right)}$$

$$\displaystyle\overline{\textstyle\wedge\left(\frac{|\mathbf{C}_{T_{X}}|}{n_{x}}\leq p_{a,x}\right)\Big{]}}$$

$$⟨{\Delta }_{\mathrm{Eve}}^{(p_{a,z},p_{a,x})}(\mathbf{k},{\mathbf{k}}^{\prime }){⟩}^2$$

$$=$$

$$\displaystyle\cdot p(\mathcal{P},{\boldsymbol{\xi}},\mathbf{c}_{\mathbf{z}},\mathbf{c}_{\mathbf{b}})\Big{]}^{2}\qquad\qquad\qquad\text{(by \eqref{eqipa})}$$

$$\le$$

$$\cdot p(\mathcal{P},\mathbf{\xi },{\mathbf{c}}_{\mathbf{z}},{\mathbf{c}}_{\mathbf{b}})\text{(by convexity of x2)}$$

$$=$$

$$\cdot p(\mathcal{P},\mathbf{\xi },{\mathbf{c}}_{\mathbf{z}},{\mathbf{c}}_{\mathbf{b}})\text{(by eqrefdefipa)}$$

$$\le$$

$$\cdot p(\mathcal{P},\mathbf{\xi },{\mathbf{c}}_{\mathbf{z}},{\mathbf{c}}_{\mathbf{b}})\text{(by eqrefeqlemma)}$$

$$=$$

$$\cdot p(\mathcal{P},{\mathbf{c}}_{\mathbf{z}},{\mathbf{c}}_{\mathbf{b}})$$

$$=$$

$$\displaystyle\textstyle\wedge\left(\frac{|\mathbf{C}_{T_{Z}}|}{n_{z}}\leq p_{a,z}\right)\wedge\left(\frac{|\mathbf{C}_{T_{X}}|}{n_{x}}\leq p_{a,x}\right)\mid\mathcal{P}\Big{]}\cdot p(\mathcal{P})$$

$$=$$

$$\displaystyle\textstyle\wedge\left(\frac{|\mathbf{C}_{T_{Z}}|}{n_{z}}\leq p_{a,z}\right)\wedge\left(\frac{|\mathbf{C}_{T_{X}}|}{n_{x}}\leq p_{a,x}\right)\Big{]}$$

$$P\left[\left(\frac{|\widetilde{{\mathbf{C}}_I}|}{n}\ge \frac{d_{r,m}}{2n}\right)\wedge \left(\frac{|{\mathbf{C}}_{T_Z}|}{n_z}\le p_{a,z}\right)\wedge \left(\frac{|{\mathbf{C}}_{T_X}|}{n_x}\le p_{a,x}\right)\right]$$

$$\le P\left[\left(\frac{|\widetilde{{\mathbf{C}}_I}|}{n}>p_{a,x}+ϵ\right)\wedge \left(\frac{|{\mathbf{C}}_{T_X}|}{n_x}\le p_{a,x}\right)\right].$$

$$\left(\overline{X}-\mu >ϵ+p_{a,x}-\mu \right)$$

$$\wedge \left(\frac{n}{n_x}\cdot (\overline{X}-\mu )\ge \mu -p_{a,x}\right),$$

$$P\left[\left(\frac{|\widetilde{{\mathbf{C}}_I}|}{n}>p_{a,x}+ϵ\right)\wedge \left(\frac{|{\mathbf{C}}_{T_X}|}{n_x}\le p_{a,x}\right)\right]$$

Full text

I Introduction

Quantum Key Distribution (QKD) protocols take advantage of the laws of quantum mechanics, and most of them can be proven secure even against powerful adversaries limited only by the laws of physics. The two parties (Alice and Bob) want to create a shared random key, using an insecure quantum channel and an unjammable classical channel (to which the adversary may listen, but not interfere). The adversary (eavesdropper), Eve, tries to get as much information as she can on the final shared key. The first and most important QKD protocol is BB84 Bennett and Brassard (1984).

Boyer, Gelles, and Mor Boyer et al. (2009) discussed the security of the BB84 protocol against collective attacks. Collective attacks Biham and Mor (1997a, b); Biham et al. (2002) are a subclass of the joint attacks; joint attacks are the most powerful theoretical attacks. Boyer et al. (2009) improved the security proof of Biham, Boyer, Brassard, van de Graaf, and Mor Biham et al. (2002) against collective attacks, by using some techniques of Biham, Boyer, Boykin, Mor, and Roychowdhury Biham et al. (2006) (that proved security against joint attacks). In this paper, too, we restrict the analysis to collective attacks, because security against collective attacks is conjectured (and, in some security notions, proved Renner (2008); Christandl et al. (2009)) to imply security against joint attacks. In addition, proving security against collective attacks is much simpler than proving security against joint attacks.

In many QKD protocols, including BB84, Alice and Bob exchange several types of bits (encoded as quantum systems, usually qubits): INFO bits, that are secret bits shared by Alice and Bob and are used for generating the final key (via classical processes of error correction and privacy amplification); and TEST bits, that are publicly exposed by Alice and Bob (by using the classical channel) and are used for estimating the error rate. In BB84, each bit is sent from Alice to Bob in a random basis (the $z$ basis or the $x$ basis).

In this paper, we extend the analysis of BB84 done in Boyer et al. (2009) and prove the security of a QKD protocol we shall name BB84-INFO-$z$. This protocol is almost identical to BB84, except that all its INFO bits are in the $z$ basis. In other words, the $x$ basis is used only for testing. The bits are thus partitioned into three disjoint sets: INFO, TEST-Z, and TEST-X. The sizes of these sets are arbitrary ($n$ INFO bits, $n_{z}$ TEST-Z bits, and $n_{x}$ TEST-X bits).

We note that, while this paper follows a line of research that mainly discusses a specific approach of security proof for BB84 and similar protocols (this approach, notably, considers finite-key effects and not only the asymptotic error rate), many other approaches have also been suggested: see for example Mayers (2001); Shor and Preskill (2000); Renner (2008); Renner et al. (2005).

In contrast to the line of research adopted here (of Biham and Mor (1997a, b); Biham et al. (2002, 2006); Boyer et al. (2009)), in which a classical information-theoretical analysis caused problems with composability (see definition in Renner (2008)), in this paper we suggest a method to avoid those problems: we calculate the trace distance between any two density matrices Eve may hold, instead of calculating the classical mutual information between Eve and the final key (as done in those previous papers). This method is implemented in this paper for the proof of BB84-INFO-$z$; it also directly applies to the BB84 security proof in Boyer et al. (2009), and it may be extended in the future to show that the BB84 security proofs of Boyer et al. (2009), Biham et al. (2002), and Biham et al. (2006) prove the composable security of BB84.

The “qubit space”, $\mathscr{H}_{2}$, is a $2$-dimensional Hilbert space. The states $\lvert{0^{0}}\rangle,\lvert{1^{0}}\rangle$ form an orthonormal basis of $\mathscr{H}_{2}$, called “the computational basis” or “the $z$ basis”. The states $\lvert{0^{1}}\rangle\triangleq\frac{1}{\sqrt{2}}[\lvert{0^{0}}\rangle+\lvert{1^{0}}\rangle]$ and $\lvert{1^{1}}\rangle\triangleq\frac{1}{\sqrt{2}}[\lvert{0^{0}}\rangle-\lvert{1^{0}}\rangle]$ form another orthonormal basis of $\mathscr{H}_{2}$, called “the $x$ basis”. Those two bases are said to be conjugate bases.

In this paper, bit strings of some length $t$ are denoted by a bold letter (e.g., $\mathbf{i}=i_{1}\ldots i_{t}$ with $i_{1},\ldots,i_{t}\in\{0,1\}$) and are identified to elements of the $t$-dimensional $\mathbf{F}_{2}$-vector space $\mathbf{F}_{2}^{t}$, where $\mathbf{F}_{2}=\{0,1\}$ and the addition of two vectors corresponds to a XOR operation. The number of $1$-bits in a bit string $\mathbf{s}$ is denoted by $|\mathbf{s}|$, and the Hamming distance between two strings $\mathbf{s}$ and $\mathbf{s}^{\prime}$ is $d_{H}(\mathbf{s},\mathbf{s}^{\prime})=|\mathbf{s}+\mathbf{s}^{\prime}|$.

II Formal Description

of the BB84-INFO-$z$ Protocol

Below we describe the BB84-INFO-$z$ protocol used in this paper.

Alice and Bob pre-agree on numbers $n$, $n_{z}$, and $n_{x}$ (we denote $N\triangleq n+n_{z}+n_{x}$), on error thresholds $p_{a,z}$ and $p_{a,x}$, on a linear error-correcting code $C$ with an $r\times n$ parity check matrix $P_{C}$, and on a linear key-generation function (privacy amplification) represented by an $m\times n$ matrix $P_{K}$. It is required that all the $r+m$ rows of the matrices $P_{C}$ and $P_{K}$ put together are linearly independent. 2. 2.

Alice randomly chooses a partition $\mathcal{P}=(\mathbf{s},\mathbf{z},\mathbf{b})$ of the $N$ bits by randomly choosing three $N$-bit strings $\mathbf{s},\mathbf{z},\mathbf{b}\in\mathbf{F}^{N}_{2}$ that satisfy $|\mathbf{s}|=n,|\mathbf{z}|=n_{z},|\mathbf{b}|=n_{x}$, and $|\mathbf{s}+\mathbf{z}+\mathbf{b}|=N$. $\mathcal{P}$ thus partitions the set of indexes $\{1,2,...,N\}$ into three disjoint sets:

• •

$I$ (INFO bits, where $s_{j}=1$) of size $n$;

• •

$T_{Z}$ (TEST-Z bits, where $z_{j}=1$) of size $n_{z}$; and

• •

$T_{X}$ (TEST-X bits, where $b_{j}=1$) of size $n_{x}$. 3. 3.

Alice randomly chooses an $N$-bit string $\mathbf{i}\in\mathbf{F}^{N}_{2}$, and sends the $N$ qubit states $\lvert{i_{1}^{b_{1}}}\rangle,\lvert{i_{2}^{b_{2}}}\rangle,\ldots,\lvert{i_{N}^{b_{N}}}\rangle$, one after the other, to Bob using the quantum channel. Notice that the INFO and TEST-Z bits are encoded in the $z$ basis, while the TEST-X bits are encoded in the $x$ basis. Bob keeps each received qubit in quantum memory, not measuring it yet 111 Here we assume that Bob has a quantum memory and can delay his measurement. In practical implementations, Bob usually cannot do that, but is assumed to measure in a randomly-chosen basis ($z$ or $x$), so that Alice and Bob later discard the qubits measured in the wrong basis. We assume that Alice sends more than $N$ qubits, so that $N$ qubits are finally detected by Bob and measured in the correct basis.. 4. 4.

Alice publicly sends to Bob the string $\mathbf{b}=b_{1}\cdots b_{N}$. Bob measures each saved qubit in the correct basis (namely, if $b_{i}=0$ then he measures the $i$-th qubit in the $z$ basis, and if $b_{i}=1$ then he measures it in the $x$ basis).

The bit string measured by Bob is denoted by $\mathbf{i}^{B}$. If there is no noise and no eavesdropping, then $\mathbf{i}^{B}=\mathbf{i}$. 5. 5.

Alice publicly sends to Bob the string $\mathbf{s}$. The INFO bits, used for generating the final key, are the $n$ bits with $s_{j}=1$, while the TEST-Z and TEST-X bits are the $n_{z}+n_{x}$ bits with $s_{j}=0$. The substrings of $\mathbf{i},\mathbf{b}$ that correspond to the INFO bits are denoted by $\mathbf{i}_{\mathbf{s}}$ and $\mathbf{b}_{\mathbf{s}}$. 6. 6.

Alice and Bob both publish their values of all the TEST-Z and TEST-X bits, and compare the bit values. If more than $n_{z}\cdot p_{a,z}$ of the TEST-Z bits are different between Alice and Bob or more than $n_{x}\cdot p_{a,x}$ of the TEST-X bits are different between them, they abort the protocol. We note that $p_{a,z}$ and $p_{a,x}$ (the pre-agreed error thresholds) are the maximal allowed error rates on the TEST-Z and TEST-X bits, respectively – namely, in each basis ($z$ and $x$) separately. 7. 7.

Alice and Bob keep the values of the remaining $n$ bits (the INFO bits, with $s_{j}=1$) secret. The bit string of Alice is denoted $\mathbf{x}=\mathbf{i}_{\mathbf{s}}$, and the bit string of Bob is denoted $\mathbf{x}^{B}$. 8. 8.

Alice sends to Bob the $r$-bit string ${\boldsymbol{\xi}}=\mathbf{x}P_{C}^{\mathrm{T}}$, that is called the syndrome of $\mathbf{x}$ (with respect to the error-correcting code $C$ and to its corresponding parity check matrix $P_{C}$). By using ${\boldsymbol{\xi}}$, Bob corrects the errors in his $\mathbf{x}^{B}$ string (so that it is the same as $\mathbf{x}$). 9. 9.

Alice and Bob compute the $m$-bit final key ${\bf k}=\mathbf{x}P_{K}^{\mathrm{T}}$.

The protocol is defined similarly to BB84 (and to its description in Boyer et al. (2009)), except that it uses the generalized bit numbers $n$, $n_{z}$, and $n_{x}$ (numbers of INFO, TEST-Z, and TEST-X bits, respectively); that it uses the partition $\mathcal{P}=(\mathbf{s},\mathbf{z},\mathbf{b})$ for dividing the $N$-bit string $\mathbf{i}$ into three disjoint sets of indexes ($I$, $T_{Z}$, and $T_{X}$); and that it uses two separate thresholds ($p_{a,z}$ and $p_{a,x}$) instead of one ($p_{a}$).

III Security Proof of BB84-INFO-$z$ Against Collective Attacks

III.1 Results from Boyer et al. (2009)

The security proof of BB84-INFO-$z$ against collective attacks is very similar to the security proof of BB84 itself against collective attacks, that was detailed in Boyer et al. (2009). Most parts of the proof are not affected at all by the changes made to BB84 to get the BB84-INFO-$z$ protocol (changes detailed in Section II of the current paper), because those parts assume fixed strings $\mathbf{s}$ and $\mathbf{b}$, and because the attack is collective (so the analysis is restricted to the INFO bits).

Therefore, the reader is referred to the proof in Section 2 and Subsections 3.1 to 3.5 of Boyer et al. (2009), that applies to BB84-INFO-$z$ without any changes (except changing the total number of bits, $2n$, to $N$, which does not affect the proof at all), and that will not be repeated here.

We denote the rows of the error-correction parity check matrix $P_{C}$ as the vectors $v_{1},\ldots,v_{r}$ in $\mathbf{F}_{2}^{n}$, and the rows of the privacy amplification matrix $P_{K}$ as the vectors $v_{r+1},\ldots,v_{r+m}$. We also define, for every $r^{\prime}$, $V_{r^{\prime}}\triangleq{\operatorname{Span}}\{v_{1},...,v_{r^{\prime}}\}$; and we define

[TABLE]

For a $1$-bit final key $k\in\{0,1\}$, we define $\widehat{\rho}_{k}$ to be the state of Eve corresponding to the final key $k$, given that she knows ${\boldsymbol{\xi}}$. Thus,

[TABLE]

where $\rho_{\mathbf{x}}^{\mathbf{b}^{\prime}}$ is Eve’s state after the attack, given that Alice sent the INFO bits $\mathbf{x}$ encoded in the bases $\mathbf{b}^{\prime}=\mathbf{b}_{\mathbf{s}}$. We also defined in Boyer et al. (2009) the state $\widetilde{\rho}_{k}$, that is a lift-up of $\widehat{\rho}_{k}$ (which means that $\widehat{\rho}_{k}$ is a partial trace of $\widetilde{\rho}_{k}$).

In the end of Subsection 3.5 of Boyer et al. (2009), it was found that (in the case of a $1$-bit final key, i.e., $m=1$)

[TABLE]

where $\mathbf{C}_{I}$ is the random variable corresponding to the $n$-bit string of errors on the $n$ INFO bits; $\mathbf{B}_{I}$ is the random variable corresponding to the $n$-bit string of bases of the $n$ INFO bits; $\overline{\mathbf{b}^{\prime}}$ is the bit-flipped string of $\mathbf{b}^{\prime}=\mathbf{b}_{\mathbf{s}}$; and $d_{r,1}$ (and, in general, $d_{r,m}$) was defined above.

Now, according to (Nielsen and Chuang, 2010, Theorem 9.2 and page 407), and using the fact that $\widehat{\rho}_{k}$ is a partial trace of $\widetilde{\rho}_{k}$, we find that $\frac{1}{2}\operatorname{tr}|\widehat{\rho}_{0}-\widehat{\rho}_{1}|\leq\frac{1}{2}\operatorname{tr}|\widetilde{\rho}_{0}-\widetilde{\rho}_{1}|$. From this result and from inequality (3) we deduce that

[TABLE]

III.2 Bounding the Differences Between Eve’s States

We define $\mathbf{c}\triangleq\mathbf{i}+\mathbf{i}^{B}$: namely, $\mathbf{c}$ is the XOR of the $N$-bit string $\mathbf{i}$ sent by Alice and of the $N$-bit string $\mathbf{i}^{B}$ measured by Bob. For each index $1\leq l\leq N$, $c_{l}=1$ if and only if Bob’s $l$-th bit value is different from the $l$-th bit sent by Alice. The partition $\mathcal{P}$ divides the $N$ bits into $n$ INFO bits, $n_{z}$ TEST-Z bits, and $n_{x}$ TEST-X bits. The corresponding substrings of the error string $\mathbf{c}$ are $\mathbf{c}_{\mathbf{s}}$ (the string of errors on the INFO bits), $\mathbf{c}_{\mathbf{z}}$ (the string of errors on the TEST-Z bits), and $\mathbf{c}_{\mathbf{b}}$ (the string of errors on the TEST-X bits). The random variables that correspond to $\mathbf{c}_{\mathbf{s}}$, $\mathbf{c}_{\mathbf{z}}$, and $\mathbf{c}_{\mathbf{b}}$ are denoted by $\mathbf{C}_{I}$, $\mathbf{C}_{T_{Z}}$, and $\mathbf{C}_{T_{X}}$, respectively.

We define $\widetilde{\mathbf{C}_{I}}$ to be the random variable corresponding to the string of errors on the INFO bits if Alice had encoded and sent the INFO bits in the $x$ basis (instead of the $z$ basis dictated by the protocol). In those notations, inequality (4) reads as

[TABLE]

using the fact that Eve’s attack is collective, so the qubits are attacked independently, and, therefore, the errors on the INFO bits are independent of the errors on the TEST-Z and TEST-X bits (namely, of $\mathbf{c}_{\mathbf{z}}$ and $\mathbf{c}_{\mathbf{b}}$).

As described in Boyer et al. (2009), inequality (5) was not derived for the actual attack $U=U_{1}\otimes\ldots\otimes U_{N}$ applied by Eve, but for a virtual flat attack (that depends on $\mathbf{b}$ and therefore could not have been applied by Eve). That flat attack gives the same states $\widehat{\rho}_{0}$ and $\widehat{\rho}_{1}$ as the original attack $U$, and gives a lower (or the same) error rate in the conjugate basis. Therefore, inequality (5) also holds for the original attack $U$. This means that, from now on, all our results apply to the original attack $U$ and not the flat attack.

So far, we have discussed a $1$-bit key. We will now discuss a general $m$-bit key $\mathbf{k}$. We define $\widehat{\rho}_{\mathbf{k}}$ to be the state of Eve corresponding to the final key $\mathbf{k}$, given that she knows ${\boldsymbol{\xi}}$:

[TABLE]

Proposition 1**.**

For any two $m$-bit keys $\mathbf{k},\mathbf{k}^{\prime}$,

[TABLE]

Proof.

We define the key $\mathbf{k}_{j}$, for $0\leq j\leq m$, to consist of the first $j$ bits of $\mathbf{k}^{\prime}$ and the last $m-j$ bits of $\mathbf{k}$. This means that $\mathbf{k}_{0}=\mathbf{k}$, $\mathbf{k}_{m}=\mathbf{k}^{\prime}$, and $\mathbf{k}_{j-1}$ differs from $\mathbf{k}_{j}$ at most on a single bit (the $j$-th bit).

First, we find a bound on $\frac{1}{2}\operatorname{tr}|\widehat{\rho}_{\mathbf{k}_{j-1}}-\widehat{\rho}_{\mathbf{k}_{j}}|$: since $\mathbf{k}_{j-1}$ differs from $\mathbf{k}_{j}$ at most on a single bit (the $j$-th bit, given by the formula $\mathbf{x}\cdot v_{r+j}$), we can use the same proof that gave us inequality (5), attaching the other (identical) key bits to ${\boldsymbol{\xi}}$ of the original proof; and we find that:

[TABLE]

where we define $d_{j}$ as $d_{H}(v_{r+j},V^{\prime}_{j})$, and $V^{\prime}_{j}\triangleq{\operatorname{Span}}\{v_{1},v_{2},\ldots,v_{r+j-1},v_{r+j+1},\ldots,v_{r+m}\}$.

Now we notice that $d_{j}$ is the Hamming distance between $v_{r+j}$ and some vector in $V^{\prime}_{j}$, which means that $d_{j}=|\sum_{i=1}^{r+m}a_{i}v_{i}|$ with $a_{i}\in\mathbf{F}_{2}$ and $a_{r+j}\neq 0$. The properties of Hamming distance assure us that $d_{j}$ is at least $d_{H}(v_{r^{\prime}+1},V_{r^{\prime}})$ for some $r\leq r^{\prime}<r+m$. Therefore, we find that $d_{r,m}=\min_{r\leq r^{\prime}<r+m}d_{H}(v_{r^{\prime}+1},V_{r^{\prime}})\leq d_{j}$.

The result $d_{r,m}\leq d_{j}$ implies that if $|\widetilde{\mathbf{C}_{I}}|\geq\frac{d_{j}}{2}$ then $|\widetilde{\mathbf{C}_{I}}|\geq\frac{d_{r,m}}{2}$. Therefore, inequality (8) implies

[TABLE]

Now we use the triangle inequality for norms to find

[TABLE]

∎

The value we want to bound is the expected value of difference between two states of Eve corresponding to two final keys. However, we should take into account that if the test fails, no final key is generated, and the difference between all of Eve’s states becomes [math] for any purpose. We thus define the random variable $\Delta_{\operatorname{Eve}}^{(p_{a,z},p_{a,x})}(\mathbf{k},\mathbf{k}^{\prime})$ for any two final keys $\mathbf{k},\mathbf{k}^{\prime}$:

[TABLE]

We need to bound the expected value $\langle\Delta_{\operatorname{Eve}}^{(p_{a,z},p_{a,x})}(\mathbf{k},\mathbf{k}^{\prime})\rangle$, that is given by:

[TABLE]

Theorem 2**.**

[TABLE]

where $\frac{|\widetilde{\mathbf{C}_{I}}|}{n}$ is the random variable corresponding to the error rate on the INFO bits if they had been encoded in the $x$ basis, $\frac{|\mathbf{C}_{T_{Z}}|}{n_{z}}$ is the random variable corresponding to the error rate on the TEST-Z bits, and $\frac{|\mathbf{C}_{T_{X}}|}{n_{x}}$ is the random variable corresponding to the error rate on the TEST-X bits.

Proof.

We use the convexity of $x^{2}$, namely, the fact that for all $\{p_{i}\}_{i}$ satisfying $p_{i}\geq 0$ and $\sum_{i}p_{i}=1$, it holds that $(\sum_{i}p_{i}x_{i})^{2}\leq\sum_{i}p_{i}x_{i}^{2}$. We find that:

[TABLE]

∎

III.3 Proof of Security

Following Boyer et al. (2009) and Biham et al. (2006), we choose matrices $P_{C}$ and $P_{K}$ such that the inequality $\frac{d_{r,m}}{2n}>p_{a,x}+\epsilon$ is satisfied for some $\epsilon$ (we will explain in Subsection III.5 why this is possible). This means that

[TABLE]

We will now prove the right-hand-side of (III.3) to be exponentially small in $n$.

As said earlier, the random variable $\widetilde{\mathbf{C}_{I}}$ corresponds to the bit string of errors on the INFO bits if they had been encoded in the $x$ basis. The TEST-X bits are also encoded in the $x$ basis, and the random variable $\mathbf{C}_{T_{X}}$ corresponds to the bit string of errors on those bits. Therefore, we can treat the selection of the $n$ INFO bits and of the $n_{x}$ TEST-X bits as a random sampling (after the numbers $n$, $n_{z}$, and $n_{x}$ and the TEST-Z bits have all already been chosen), and use Hoeffding’s theorem (that is described in Appendix A of Boyer et al. (2009)).

Therefore, for each bit string $c_{1}\ldots c_{n+n_{x}}$ that consists of the errors in the $n+n_{x}$ INFO and TEST-X bits if the INFO bits had been encoded in the $x$ basis, we apply Hoeffding’s theorem: namely, we take a sample of size $n$ without replacement from the population $c_{1},\ldots,c_{n+n_{x}}$ (this corresponds to the random selection of the INFO bits and the TEST-X bits, as defined above, given that the TEST-Z bits have already been chosen). Let $\overline{X}=\frac{|\widetilde{\mathbf{C}_{I}}|}{n}$ be the average of the sample (this is exactly the error rate on the INFO bits, assuming, again, the INFO bits had been encoded in the $x$ basis); and let $\mu=\frac{|\widetilde{\mathbf{C}_{I}}|+|\mathbf{C}_{T_{X}}|}{n+n_{x}}$ be the expectancy of $\overline{X}$ (this is exactly the error rate on the INFO bits and TEST-X bits together). Then $\frac{|\mathbf{C}_{T_{X}}|}{n_{x}}\leq p_{a,x}$ is equivalent to $(n+n_{x})\mu-n\overline{X}\leq n_{x}\cdot p_{a,x}$, and, therefore, to $n\cdot(\overline{X}-\mu)\geq n_{x}\cdot(\mu-p_{a,x})$. This means that the conditions $\left(\frac{|\widetilde{\mathbf{C}_{I}}|}{n}>p_{a,x}+\epsilon\right)$ and $\left(\frac{|\mathbf{C}_{T_{X}}|}{n_{x}}\leq p_{a,x}\right)$ rewrite to

[TABLE]

which implies $\left(1+\frac{n}{n_{x}}\right)(\overline{X}-\mu)>\epsilon$, which is equivalent to $\overline{X}-\mu>\frac{n_{x}}{n+n_{x}}\epsilon$. Using Hoeffding’s theorem (from Appendix A of Boyer et al. (2009)), we get:

[TABLE]

In the above discussion, we have actually proved the following Theorem:

Theorem 3**.**

Let us be given $\delta>0$, $R>0$, and, for infinitely many values of $n$, a family $\{v^{n}_{1},\ldots,v^{n}_{r_{n}+m_{n}}\}$ of linearly independent vectors in $\mathbf{F}_{2}^{n}$ such that $\delta<\frac{d_{r_{n},m_{n}}}{n}$ and $\frac{m_{n}}{n}\leq R$. Then for any $p_{a,z},p_{a,x}>0$ and $\epsilon_{\mathrm{sec}}>0$ such that $p_{a,x}+\epsilon_{\mathrm{sec}}\leq\frac{\delta}{2}$, and for any $n,n_{z},n_{x}>0$ and two $m_{n}$-bit final keys $\mathbf{k},\mathbf{k}^{\prime}$, Eve’s difference between her states corresponding to $\mathbf{k}$ and $\mathbf{k}^{\prime}$ satisfies the following bound:

[TABLE]

In Subsection III.5 we explain why this Theorem guarantees security.

We note that the quantity $\langle\Delta_{\operatorname{Eve}}^{(p_{a,z},p_{a,x})}(\mathbf{k},\mathbf{k}^{\prime})\rangle$ bounds the expected values of the Shannon Distinguishability and of the mutual information between Eve and the final key, as done in Boyer et al. (2009) and Biham et al. (2006), which is sufficient for proving non-composable security; but it also avoids composability problems: Eve is not required to measure immediately after the protocol ends, but she is allowed to wait until she gets more information; and equation (17) bounds the trace distance between any two of Eve’s possible states.

III.4 Reliability

Security itself is not sufficient; we also need the key to be reliable (namely, to be the same for Alice and Bob). This means that we should make sure that the number of errors on the INFO bits is less than the maximal number of errors that can be corrected by the error-correcting code. We demand that our error-correcting code can correct $n(p_{a,z}+\epsilon_{\mathrm{rel}})$ errors. Therefore, reliability of the final key with exponentially small probability of failure is guaranteed by the following inequality: (as said, $\mathbf{C}_{I}$ corresponds to the actual bit string of errors on the INFO bits in the protocol, when they are encoded in the $z$ basis)

[TABLE]

This inequality is proved by an argument similar to the one used in Subsection III.3: the selection of the INFO bits and TEST-Z bits is a random partition of $n+n_{z}$ bits into two subsets of sizes $n$ and $n_{z}$, respectively (assuming that the TEST-X bits have already been chosen), and thus it corresponds to Hoeffding’s sampling.

III.5 Security, Reliability,

and Error Rate Threshold

According to Theorem 3 and to the discussion in Subsection III.4, to get both security and reliability we only need vectors $\{v^{n}_{1},\ldots,v^{n}_{r_{n}+m_{n}}\}$ satisfying both the conditions of the Theorem (distance $\frac{d_{r_{n},m_{n}}}{2n}>\frac{\delta}{2}\geq p_{a,x}+\epsilon_{\mathrm{sec}}$) and the reliability condition (the ability to correct $n(p_{a,z}+\epsilon_{\mathrm{rel}})$ errors). Such families were proven to exist in Appendix E of Biham et al. (2006), giving the bit-rate:

[TABLE]

where $H_{2}(x)\triangleq-x\log_{2}(x)-(1-x)\log_{2}(1-x)$.

Note that we use here the error thresholds $p_{a,x}$ for security and $p_{a,z}$ for reliability. This is possible, because in Biham et al. (2006) those conditions (security and reliability) on the codes are discussed separately.

To get the asymptotic error rate thresholds, we require $R_{\mathrm{secret}}>0$, and we get the condition:

[TABLE]

The secure asymptotic error rate thresholds zone is shown in Figure 1 (it is below the curve), assuming that $\frac{1}{n}$ is negligible. Note the trade-off between the error rates $p_{a,z}$ and $p_{a,x}$. Also note that in the case $p_{a,z}=p_{a,x}$, we get the same threshold as BB84 (Biham et al. (2006) and Boyer et al. (2009)), which is 7.56%.

IV Conclusion

In this paper, we have analyzed the security of the BB84-INFO-$z$ protocol against any collective attack. We have discovered that the results of BB84 hold very similarly for BB84-INFO-$z$, with only two exceptions:

The error rates must be separately checked to be below the thresholds $p_{a,z}$ and $p_{a,x}$ for the TEST-Z and TEST-X bits, respectively, while in BB84 the error rate threshold $p_{a}$ applies to all the TEST bits together. 2. 2.

The exponents of Eve’s information (security) and of the failure probability of the error-correcting code (reliability) are different than in Boyer et al. (2009), because different numbers of test bits are now allowed ($n_{z}$ and $n_{x}$ are arbitrary). This implies that the exponents may decrease more slowly (or more quickly) as a function of $n$. However, if we choose $n_{z}=n_{x}=n$ (thus sending $N=3n$ qubits from Alice to Bob), then we get exactly the same exponents as in Boyer et al. (2009).

The asymptotic error rate thresholds found in this paper are more flexible than in BB84, because they allow us to tolerate a higher threshold for a specific basis (say, the $x$ basis) if we demand a lower threshold for the other basis ($z$). If we choose the same error rate threshold for both bases, then the asymptotic bound is 7.56%, exactly the bound found for BB84 in Biham et al. (2006) and Boyer et al. (2009).

We conclude that even if we change the BB84 protocol to have INFO bits only in the $z$ basis, this does not harm its security and reliability (at least against collective attacks). This does not even change the asymptotic error rate threshold, and allows more flexibility when choosing the thresholds for both bases. The only drawbacks of this change are the need to check the error rate for the two bases separately, and the need to either send more qubits ($3n$ qubits in total, rather than $2n$) or get a slower exponential decrease of the exponents required for security and reliability.

We thus find that the feature of BB84, that both bases are used for information, is not very important for security and reliability, and that BB84-INFO-$z$ (that lacks this feature) is almost as useful as BB84. This may have important implications on the security and reliability of other protocols that also only use one basis for information qubits, as done in some two-way protocols.

We also present a better approach for the proof, that uses a quantum distance between two states rather than the classical information. In Boyer et al. (2009), Biham et al. (2002), and Biham et al. (2006), the classical mutual information between Eve’s information (after an optimal measurement) and the final key was calculated (by using the trace distance between two quantum states); although we should note that in Boyer et al. (2009) and Biham et al. (2006), the trace distance was used for the proof of security of a single bit of the final key even when all other bits are given to Eve, and only the last stages of the proof discussed bounding the classical mutual information. In the current paper, on the other hand, we use the trace distance between the two quantum states until the end of the proof, which avoids composability problems that existed in the previous works.

Therefore, this proof makes a step towards making Boyer et al. (2009), Biham et al. (2002), and Biham et al. (2006) prove composable security of BB84 (namely, security even if Eve keeps her quantum states until she gets more information when Alice and Bob use the key, rather than measuring them in the end of the protocol). This approach also applies (similarly) to the BB84 security proof in Boyer et al. (2009).

Acknowledgements.

The work of TM and RL was partly supported by the Israeli MOD Research and Technology Unit.