Optimal attacks on qubit-based Quantum Key Recycling

TL;DR

This paper analyzes the security of a quantum key recycling scheme with 8-state encoding, providing bounds on privacy amplification and identifying optimal attacks, showing 8-state encoding offers the highest capacity.

Contribution

It offers the first detailed security bounds for noisy channels in the 8-state QKR scheme and compares its effectiveness with 4-state and 6-state encodings.

Findings

8-state encoding achieves the highest capacity.

Shannon entropy analysis aligns with Quantum Key Distribution.

4-state and 6-state encodings have additional security leaks.

Abstract

Quantum Key Recycling (QKR) is a quantum-cryptographic primitive that allows one to re-use keys in an unconditionally secure way. By removing the need to repeatedly generate new keys it improves communication efficiency. Skoric and de Vries recently proposed a QKR scheme based on 8-state encoding (four bases). It does not require quantum computers for encryption/decryption but only single-qubit operations. We provide a missing ingredient in the security analysis of this scheme in the case of noisy channels: accurate bounds on the privacy amplification. We determine optimal attacks against the message and against the key, for 8-state encoding as well as 4-state and 6-state conjugate coding. We show that the Shannon entropy analysis for 8-state encoding reduces to the analysis of Quantum Key Distribution, whereas 4-state and 6-state suffer from additional leaks that make them less effective. We also provide results in terms of the min-entropy. Overall, 8-state encoding yields the highest capacity.

Tables

Table 1. Table 1: Shannon entropy loss I ​ ( β ) 𝐼 𝛽 I(\beta) as a function of noise β 𝛽 \beta , for the attacks M1,M2,K1,K2. The 6-state and 8-state K2 results are conjectures.

Shannon entropy leakage $I\left(\beta \right)$ per qubit
	4-state	6-state	8-state
M1	0.399	0.256	0
M2	$\beta \cdot 1+\left(1-\beta \right)\left[1-h\left(p_{\beta }\right)\right]$,   $p_{\beta }=\frac{1}{2}-\frac{\sqrt{\frac{\beta }{2}\left(1-\frac{3}{2}\beta \right)}}{1-\beta }$
K1	$3\beta \cdot 0.399$	$3\beta \cdot 0.314$	$3\beta \cdot 0.415$
K2	$1-h\left(\frac{1}{2}+\frac{1}{2}\sqrt{\beta \left(1-\frac{3}{2}\beta \right)}+\frac{\beta }{2\sqrt{2}}\right)$	$\log 3-\left[h\left(p_6\right)+1-p_6\right]$	$2-\left[h\left(p_8\right)+\left(1-p_8\right)\log 3\right]$
		$p_6=\frac{1}{3}-\frac{2\sqrt{2}}{3\sqrt{3}}\sqrt{\beta \left(1-\beta \right)}$	$p_8=\frac{1}{4}-\frac{\sqrt{6}}{4}\sqrt{\beta \left(1-\frac{3}{2}\beta \right)}$

Table 2. Table 2: Min-entropy loss as a function of noise β 𝛽 \beta , for the attacks M1,M2,K1,K2.

Min-entropy leakage per qubit
	4-state	6-state	8-state
M1	0.772	0.658	0
M2	$\log \left[1+\sqrt{2}\sqrt{\beta \left(1-\frac{3}{2}\beta \right)}+\beta \right]$
K1	$3\beta \cdot 0.772$	$3\beta \cdot 0.861$	$3\beta \cdot 1$
K2	$\log \left(1+\sqrt{\beta \left(1-\frac{3}{2}\beta \right)}+\frac{\beta }{\sqrt{2}}\right)$	$\log \left(1+\frac{2\sqrt{2}}{\sqrt{3}}\sqrt{\beta \left(1-\beta \right)}\right)$	$\log \left(1+\sqrt{6}\sqrt{\beta \left(1-\frac{3}{2}\beta \right)}\right)$

Equations

$${\mathsf{H}}_{\min }(X|{\rho }_X)=-\log \underset{\mathcal{M}}{\max }{\mathbb{E}}_{x\in \mathcal{X}}\mathrm{tr}[M_x{\rho }_x].$$

$${\forall }_{x\in \mathcal{X}}:\Lambda -{\rho }_x\ge 0,$$

$${\mathsf{H}}_{\min }(X|Y,{\rho }_X(Y))=-\log {\mathbb{E}}_{y\in \mathcal{Y}}\underset{\mathcal{M}}{\max }{\mathbb{E}}_{x\in \mathcal{X}}\mathrm{tr}[M_x{\rho }_x(y)].$$

$$X\sim (p_0,p_1):{\mathsf{H}}_{\min }(X|Y,{\rho }_X(Y))=1-\log \left(1+{\mathbb{E}}_y\mathrm{tr}\left|p_0{\rho }_0(y)-p_1{\rho }_1(y)\right|\right).$$

$$\mathsf{H}(X|{\rho }_X)\stackrel{\mathrm{def}}{=}\underset{\mathcal{M}}{\min }\mathsf{H}(X|\mathcal{M}({\rho }_X)).$$

$${\mathbf{n}}_{uwg}=\frac{(-1{)}^g}{\sqrt{3}}\left(\begin{array}{c}(-1{)}^u\\ (-1{)}^{u+w}\\ (-1{)}^w\end{array}\right),$$

$$|{\psi }_{uwg}⟩=(-1{)}^{gu}\left[(-\sqrt{i}{)}^g\cos \frac{\alpha }{2}|g\oplus w⟩+(-1{)}^u(\sqrt{i}{)}^{1-g}\sin \frac{\alpha }{2}|\overline{g\oplus w}⟩\right]$$

$${\tilde{\rho }}^{\mathrm{AB}}=(1-\frac{3}{2}\beta )|{\Psi }^{-}⟩⟨{\Psi }^{-}|+\frac{\beta }{2}\left(|{\Phi }^{-}⟩⟨{\Phi }^{-}|+|{\Psi }^{+}⟩⟨{\Psi }^{+}|+|{\Phi }^{+}⟩⟨{\Phi }^{+}|\right).$$

$$|{\Psi }^{\mathrm{ABE}}⟩=\sqrt{1-\frac{3}{2}\beta }|{\Psi }^{-}⟩\otimes |m_0⟩+\sqrt{\frac{\beta }{2}}\left(-|{\Phi }^{-}⟩\otimes |m_1⟩+i|{\Psi }^{+}⟩\otimes |m_2⟩+|{\Phi }^{+}⟩\otimes |m_3⟩\right).$$

$$|{\Psi }^{\mathrm{ABE}}⟩$$

$$|E_{01}^{\mathbf{v}}⟩$$

$$|E_{10}^{\mathbf{v}}⟩$$

$$|E_{00}^{\mathbf{v}}⟩$$

$$|E_{11}^{\mathbf{v}}⟩$$

$${\rho }_{xy}^{\mathbf{v}}\stackrel{\mathrm{def}}{=}|E_{xy}^{\mathbf{v}}⟩⟨E_{xy}^{\mathbf{v}}|,$$

$${\Omega }^{BXYE}=\frac{1}{|\mathcal{B}|}\sum _{b\in \mathcal{B}}{\mathbb{E}}_{x\in \{0,1\}}{\mathbb{E}}_{y|x}|b⟩⟨b|\otimes |x⟩⟨x|\otimes |y⟩⟨y|\otimes {\rho }_{xy}^{\mathbf{v}(b)}.$$

$${\zeta }_b\stackrel{\mathrm{def}}{=}(1-\beta ){\rho }_{01}^{\mathbf{v}(b)}+\beta {\rho }_{00}^{\mathbf{v}(b)},b\in \mathcal{B}.$$

$$I_{\mathrm{AE}}^{M1,4state}=1-h([\sin \frac{\pi }{8}{]}^2)\approx \mathrm{0.399.}$$

$$△{\mathsf{H}}_{\min }^{M1,4state}=1-\log \frac{1}{(\cos \frac{\pi }{8}{)}^2}\approx \mathrm{0.772.}$$

$$I_{\mathrm{AE}}^{M1,6state}$$

$$△{\mathsf{H}}_{\min }^{M1,6state}$$

$$\frac{1}{N}\mathsf{H}(X_i^{(1)},\dots ,X_i^{(N)}|E_i^{(1)},\dots ,E_i^{(N)})\ge \mathsf{H}(X_i^{(j)}|B_i{E}_i^{(j)})j\mathrm{arbitrary}.$$

$$|{\mu }_{01}⟩$$

$$|{\mu }_{10}⟩$$

$${\gamma }_{\pm }$$

$$p_{\beta }=|⟨E_{01}^{\mathbf{v}}|{\mu }_{10}⟩{|}^2=|⟨E_{10}^{\mathbf{v}}|{\mu }_{01}⟩{|}^2=\frac{1}{2}-\frac{1}{2}\sqrt{1-c^2}=\frac{1}{2}-(1-\beta {)}^{-1}\sqrt{\frac{\beta }{2}(1-\frac{3}{2}\beta )}.$$

$$I_{\mathrm{AE}}(\beta )=\beta \cdot [1-h(0)]+(1-\beta )[1-h(p_{\beta })].$$

$$C(\beta )=I_{\mathrm{AB}}(\beta )-I_{\mathrm{AE}}(\beta )=1-h(\beta )-I_{\mathrm{AE}}(\beta ).$$

$$\mathsf{H}(X|{\rho }_{X,\bar{X}\oplus R}^{\mathbf{v}})$$

$$\mathsf{H}(X|{\rho }_{XY}^{\mathbf{v}})=(1-\beta )h(p_{\beta })+\beta \cdot 0.$$

$${\mathsf{H}}_{\min }(X|{\rho }_{X,\overline{X}\oplus R}^{\mathbf{v}})$$

$${\omega }_{Bx}=|{\psi }_{Bx}⟩⟨{\psi }_{Bx}|$$

$$\mathsf{H}(B|{\zeta }_B)=\log |\mathcal{B}|-\underset{\mathcal{M}}{\max }\left[h(\{\mathrm{tr}{M}_m\frac{{\sum }_b{\zeta }_b}{|\mathcal{B}|}{\}}_{m\in \mathcal{B}})-\frac{1}{|\mathcal{B}|}\sum _{b\in \mathcal{B}}h(\{\mathrm{tr}{M}_m{\zeta }_b{\}}_{m\in \mathcal{B}})\right]$$

$$\mathsf{H}(B|{\zeta }_B)=\underset{\mathrm{symmetric}\mathcal{M}}{\min }\left[h(p_{\mathrm{OK}})+(1-p_{\mathrm{OK}})\log (|\mathcal{B}|-1)\right].$$

Full text

1 Introduction

1.1 Quantum Key Recycling

Quantum communication differs significantly from classical communication. On a classical channel it is trivial to read and copy all messages. On a quantum channel, on the other hand, any form of eavesdropping is detectable. This fact has been exploited by cryptographers since the 1980s, most notably by the introduction of Quantum Key Distribution (QKD). However, even before the invention of BB84 another concept was studied: information-theoretically secure re-use of encryption keys. If Bob detects no disturbance on the quantum channel, it may be safe to re-use the encryption key, in stark contrast to e.g. One Time Pad (OTP) encryption on a classical channel. This idea was proposed in the paper “Quantum Cryptography II: How to re-use a one-time pad safely even if P = NP” [1] by Bennett, Brassard and Breidbart in 1982. However, after the discovery of QKD the idea of Quantum Key Recycling (QKR) received very little attention for several decades. The thread was picked up again in 2003 by Gottesman [2] and in 2005 by Damgård, Pedersen and Salvail [3, 4]. Gottesman’s Unclonable Encryption offers a limited re-usability of key material. Damgård et al introduced a full key re-use scheme based on mutually unbiased bases in high-dimensional Hilbert space. A drawback of their scheme is that it requires a quantum computer to perform encryption and decryption. In 2016 Fehr and Salvail [5] and Škorić and de Vries [6] returned to qubit-based schemes that do not require a quantum computer. Fehr and Salvail [5] used BB84 states and introduced a new proof technique. Their scheme is provably secure when there is very little channel noise. Škorić and de Vries [6] showed that it is advantageous to switch from 4-state conjugate coding to 8-state encoding, and that 8-state encoding is equivalent to applying the Quantum One Time Pad (QOTP) [7, 8, 9]. Their scheme is designed to work at similar noise levels as QKD. The proof technique of [5] can be directly applied to it, but needs an accurate bound on the required amount of privacy amplification, which was provided only for the noiseless case.

The long neglect of QKR is undeserved. In a QKD-equipped world, QKR has an important role to play. The process of repeatedly generating new QKD keys and then using them up with classical OTP encryption is very wasteful of bandwidth. One QKD instance followed by repeated QKR runs is more communication-efficient.

1.2 Contributions and outline

• •

We determine optimal attacks against individual qubits in qubit-based QKR, such that Eve introduces channel noise parametrised by the bit error rate $\beta$. We apply the standard Shor-Preskill technique [10] to reformulate state preparation as a measurement on an EPR state. We apply noise symmetrisation [11] to Alice and Bob’s noisy EPR state, followed by purification to obtain a worst-case description of Eve’s ancilla state. We find optimal POVM measurements by which Eve extracts from her ancilla information about the plaintext, as well as POVMs for attacking the key in the known-plaintext setting. We obtain POVMs for Shannon entropy as well as min-entropy.

• •

From the optimal POVMs we determine how much privacy amplification is needed: this is dictated by the most powerful attack. We find that it depends on $\beta$ which attack ‘wins’.

• –

Shannon entropy. For 4-state and 6-state encoding, the winning attack at low $\beta$ is Eve stealing all qubits and performing a measurement to estimate the plaintext.111 This is due to the fact that conjugate coding is not a particularly good encryption.

At larger $\beta$, Eve collects ancillas from many QKR rounds and then performs a measurement on all the ancillas that are protected by the same basis key; we show that this attack is (asymptotically) as powerful as the optimal qubit-wise attack on QKD [12]. For 8-state encoding, the QKD-like attack is always the winning one.

The QKR channel capacity of 4-state encoding is always below 6-state. 8-state has higher capacity than 6-state at $\beta\in[0,0.1061]$, after which they are the same and equal to the QKD capacity.

• –

Min-entropy. For 4-state and 6-state, the winning attacks are as for the Shannon entropy case. For 8-state, however, the winning attack is an ancilla attack on the key. If capacity is computed using min-entropy loss as the measure of Eve’s knowledge, then the QKR capacity of 8-state is higher than 6-state on the range $\beta\in[0,0.0612]$. There is a tiny interval $\beta\in(0.0612,0.0638)$ where 6-state outperforms 8-state; at $\beta>0.0638$ all capacities are zero. 4-state is always worse than 6-state.

Overall, 8-state encoding requires the least privacy amplification.

• •

We notice a duality relation in the optimal POVMs for the known-plaintext attack on the key. It turns out that the POVMs which minimise Eve’s Shannon entropy are in a sense ‘dual’ to the POVMs associated with the min-entropy: The min-entropy-POVM for plaintext $x$ is the Shannon-entropy-POVM for plaintext $1-x$. It would be very useful if such dualities hold more generally. While there exists a simple test [13] to check if a POVM is optimal for min-entropy, there is no such test for Shannon entropy.

• •

As a byproduct of our analysis we find a particularly easy and insightful way to derive the QKD capacity in a scenario where Alice adds artificial preprocessing noise. By identifying conditional channels in Eve’s mixed state we are able to simplify the results of [14]. The noise-adding trick can be applied in QKR in exactly the same way as in QKD.

In Section 2 we introduce notation, and briefly recap 8-state QKR. In Section 3 we go to the EPR version of the protocol, apply noise symmetrisation and obtain Eve’s state by purification. Attacks on the plaintext are described in Section 4, and known-plaintext attacks on the key in Section 5. We aggregate all the results in Section 6 and we determine the QKR capacities. Insertion of artificial noise is discussed in Section 7.

2 Preliminaries

2.1 Notation and terminology

Classical Random Variables (RVs) are denoted with capital letters, and their realisations with lowercase letters. The probability that a RV $X$ takes value $x$ is written as ${\rm Pr}[X=x]$. The expectation with respect to RV $X$ is denoted as ${\mathbb{E}}_{x}f(x)=\sum_{x\in{\mathcal{X}}}{\rm Pr}[X=x]f(x)$. The Shannon entropy of an RV $X$ is written as ${\sf H}(X)$. Sets are denoted in calligraphic font. The notation ‘$\log$’ stands for the logarithm with base 2. The min-entropy of $X\in{\mathcal{X}}$ is ${\sf H}_{\rm min}(X)=-\log\max_{x\in{\mathcal{X}}}{\rm Pr}[X=x]$, and the conditional min-entropy is ${\sf H}_{\rm min}(X|Y)=-\log{\mathbb{E}}_{y}\max_{x\in{\mathcal{X}}}{\rm Pr}[X=x|Y=y]$. The notation $h$ stands for the binary entropy function $h(p)=p\log{\textstyle\frac{1}{p}}+(1-p)\log{\textstyle\frac{1}{1-p}}$. Sometimes we will write $h(\{p_{1},\ldots,p_{n}\})$ meaning $\sum_{i}p_{i}\log{\textstyle\frac{1}{p_{i}}}$. Bitwise XOR of binary strings is written as ‘$\oplus$’. The inverse of a bit $b\in\{0,1\}$ is written as $\bar{b}=1-b$.

For quantum states we use Dirac notation, with the standard qubit basis states $|0\rangle$ and $|1\rangle$ represented as ${1\choose 0}$ and ${0\choose 1}$ respectively. The Pauli matrices are denoted as $\sigma_{x},\sigma_{y},\sigma_{z}$, and we write ${\boldsymbol{\sigma}}=(\sigma_{x},\sigma_{y},\sigma_{z})$. The standard basis is the eigenbasis of $\sigma_{z}$, with $|0\rangle$ in the positive $z$-direction. We write ${\mathbb{1}}$ for the identity matrix. The notation ‘tr’ stands for trace. The Hermitian conjugate of an operator $A$ is written as $A^{{\dagger}}$. When $A$ is a complicated expression, we sometimes write $(A+{\rm h.c.})$ instead of $A+A^{{\dagger}}$. The complex conjugate of $z$ is denoted as $z^{*}$.

We use the Positive Operator Valued Measure (POVM) formalism. A POVM ${\mathcal{M}}$ consists of positive semidefinite operators, ${\mathcal{M}}=(M_{x})_{x\in{\mathcal{X}}}$, $M_{x}\geq 0$, and satisfies the condition $\sum_{x}M_{x}={\mathbb{1}}$. The notation ${\mathcal{M}}(\rho)$ stands for the classical RV resulting when ${\mathcal{M}}$ is applied to mixed state $\rho$. Consider a bipartite system ‘AB’ where the ‘A’ part is classical, i.e. the state is of the form $\rho^{\rm AB}={\mathbb{E}}_{x\in{\mathcal{X}}}|x\rangle\langle x|\otimes\rho_{x}$ with the $|x\rangle$ forming an orthonormal basis. The min-entropy of the classical RV $X$ given part ‘B’ of the system is [15]

[TABLE]

Here ${\mathcal{M}}$ denotes a POVM. Let $\Lambda\stackrel{{\scriptstyle\rm def}}{{=}}\sum_{x}\rho_{x}M_{x}$. If a POVM can be found that satisfies the condition222 Ref. [13] specifies a second condition, namely $\Lambda^{{\dagger}}=\Lambda$. However, the hermiticity of $\Lambda$ already follows from the condition (2). [13]

[TABLE]

then there can be no better POVM (but equally good ones may exist).

For states that also depend on a classical RV $Y\in{\mathcal{Y}}$, the min-entropy of $X$ given the quantum state and $Y$ is

[TABLE]

A simple expression can be obtained when $X$ is a binary variable. Let $X\in\{0,1\}$. Then

[TABLE]

For the Shannon entropy of a classical RV given a quantum system we have

[TABLE]

If the ensemble $(\rho_{x})_{x\in{\mathcal{X}}}$ has a symmetry, i.e. $\forall_{x\in{\mathcal{X}},g\in G}:\;U_{g}\rho_{x}U_{g}^{{\dagger}}=\rho_{g(x)}$ for some group $G$ acting on ${\mathcal{X}}$, and unitary representation $U$ of $G$, then it suffices [13] to consider only POVMs that obey the same symmetry, $U_{g}M_{x}U_{g}^{{\dagger}}=M_{g(x)}$.

2.2 Eight-state Quantum Key Recycling

We briefly review the main properties of the 8-state QKR scheme (“scheme #2” in [6]). A classical bit $g\in\{0,1\}$ is encoded into a qubit state using one of four possible bases. The basis is labeled $b\in\{0,1,2,3\}$, and for convenience the notation $b=2u+w$ is introduced, with $u,w\in\{0,1\}$. The labels $b$ and $(u,w)$ are used interchangeably. The encoding of $g$ in basis $(u,w)$ is expressed on the Bloch sphere as a unit vector

[TABLE]

i.e. the eight corner points of a cube. The corresponding states in Hilbert space are

[TABLE]

in the $z$-basis. The angle $\alpha$ is defined as $\cos\alpha=1/\sqrt{3}$. The four states $|\psi_{uwg}\rangle$, for fixed $g$, are the Quantum One-Time Pad (QOTP) encryptions of $|\psi_{00g}\rangle$.

The bit error rate (BER) on the quantum channel is denoted as $\beta\in[0,{\textstyle\frac{1}{2}}]$. The key recycling scheme makes use of a Secure Sketch $S:\{0,1\}^{n}\to\{0,1\}^{a}$, with $a>nh(\beta)$. (Asymptotically $a$ approaches $nh(\beta)$). Furthermore the scheme uses an extractor ${\tt Ext}:\{0,1\}^{n}\to\{0,1\}^{\ell}$ and a message-independent, key-private [5] MAC function that produces a tag of length $\lambda$. The message is $\mu\in\{0,1\}^{\ell}$. The key material shared between Alice and Bob consists of three parts: a basis sequence $b\in\{0,1,2,3\}^{n}$, a MAC key $K_{\rm M}$ and a classical OTP $K_{\rm SS}\in\{0,1\}^{a}$ for protecting the secure sketch.

Encryption

Alice performs the following steps. Generate random $g\in\{0,1\}^{n}$. Compute $s=K_{\rm SS}\oplus S(g)$ and $z={\tt Ext}\,g$. Compute the ciphertext $c=\mu\oplus z$ and authentication tag $T=M(K_{\rm M},g||c||s)$. Prepare the quantum state $|\Psi\rangle=\bigotimes_{i=1}^{n}|\psi_{b_{i}g_{i}}\rangle$. Send $|\Psi\rangle$, $s$, $c$, $T$.

Decryption

(Bob gets $|\Psi^{\prime}\rangle$, $s^{\prime}$, $c^{\prime}$, $T^{\prime}$). Bob performs the following steps. Measure $|\Psi^{\prime}\rangle$ in the b-basis. This yields $g^{\prime}\in\{0,1\}^{n}$. Recover $\hat{g}$ from $g^{\prime}$ and $K_{\rm SS}\oplus s^{\prime}$ (by the syndrome decoding procedure of the Secure Sketch primitive). Compute $\hat{z}={\tt Ext}\,\hat{g}$ and $\hat{\mu}=c^{\prime}\oplus\hat{z}$. Accept the message $\hat{\mu}$ if the syndrome decoding succeeded and $T^{\prime}=M(K_{\rm M},\hat{g}||c^{\prime}||s^{\prime})$. Communicate Accept/Reject to Alice.

Key update

Alice and Bob perform the following actions. If Bob Accepts, replace $K_{\rm SS}$. If Bob Rejects, replace $K_{\rm SS}$ and compute the updated key $b^{\prime}$ as a function of $b$ and $n$ fresh secret bits.

In case of Bob accepting the transmission, an $\ell$-bit message has been communicated while only $a\approx nh(\beta)$ bits of key material have been spent.333 “Scheme #3” in [6] greatly reduces the key material expenditure.

The aim of the current paper is to find out how large $\ell$ is allowed to be as a function of the noise parameter $\beta$.

3 EPR formulation, noise symmetrisation, and purification

Apart from QKR employing the 8-state (QOTP) encoding as described above, we also investigate 4-state (BB84) and 6-state conjugate coding. For the security analysis of qubit-based QKR we piggyback on (i) proof techniques [16] that use e.g. quantum de Finetti [17] to reduce the analysis to individual-qubit attacks; (ii) the proof technique for qubit-based QKR introduced in [5], which can directly be applied to the scheme of [6] provided that correct values are known for the required amount of privacy amplification as a function of the noise parameter $\beta$.

We study optimal attacks against individual qubits, making use of the standard Shor-Preskill technique [10] and the noise symmetrisation technique introduced by [11].

3.1 EPR version of the QKR protocol

We follow the standard Shor-Preskill technique [10] and re-formulate the QKR protocol (Section 2.2) using EPR pairs. The step where Alice prepares the state $|\Psi\rangle$ and sends it to Bob is replaced by the following procedure.

Alice prepares a two-qubit singlet state. She keeps one qubit (‘A’) and sends the other qubit (‘B’) to Bob. Eve is allowed to manipulate the whole ‘AB’ system444 Note that this attacker model gives Eve more power than she can actually have in real life. Realistically, she would be able to manipulate only the ‘B’ subsystem. in any way, including coupling to ancillas. Then Alice and Bob perform their projective measurements in the correct basis (basis $b_{i}$ for the $i$’th bit). Let the outcome of Alice’s measurement be $x\in\{0,1\}$, and Bob’s outcome $y\in\{0,1\}$. Alice sends $e=x\oplus g$ to Bob. Bob computes $\hat{g}=\bar{y}\oplus e$, which is guaranteed to equal $g$ if Eve has done nothing ($\beta=0$).555 In the singlet state the $x$ and $y$ are anti-correlated, i.e. $y=\bar{x}$.

Security of this EPR-version of the protocol implies security of the original protocol.

Note that the above description is agnostic of the number of bases used in the encoding. We will use the notation ${\mathcal{B}}$ to denote the set of bases in an encoding scheme. For 4-state encoding we write ${\mathcal{B}}=\{0,1\}$, and the states are the spin states $|\pm z\rangle$ (at $b=0$) and $|\pm x\rangle$ (at $b=1$). For 6-state we write ${\mathcal{B}}=\{1,2,3\}$, with spin states $|\pm x\rangle$ (at $b=1$), $|\pm y\rangle$ (at $b=2$) and $|\pm z\rangle$ (at $b=3$). For 8-state we have ${\mathcal{B}}=\{00,01,10,11\}$, and the states are defined in (7). The number of bases is $|{\mathcal{B}}|$.

3.2 Noise symmetrisation

After Eve’s interference, the bipartite system held by Alice and Bob is no longer a pure singlet state but a general mixed state $\rho^{\rm AB}$. As the singlet state is invariant under unitary transformations of the form $\rho^{\rm AB}\mapsto U\otimes U\rho^{\rm AB}U^{{\dagger}}\otimes U^{{\dagger}}$ (where $U$ acts on a single qubit), Alice and Bob are ‘allowed’ to perform the following sequence of actions.

Preparation phase, before the protocol

Alice and Bob agree on a single basis $b^{*}\in{\mathcal{B}}$.

During the protocol

For each bit, just before they execute their measurement

• •

Alice and Bob publicly draw a random number $\gamma\in\{0,1,2,3\}$.

• •

They both apply to their own qubit the Pauli operator $\sigma_{\gamma}$, defined with respect to the $b^{*}$ basis. Here $\sigma_{0}$ is the identity matrix.

• •

They forget $\gamma$.

These actions have no effect on the original state (the desired singlet) but they dramatically simplify the noise in $\rho^{\rm AB}$.

Lemma 3.1

Consider 6-state or 8-state encoding. Let $|\Psi^{\pm}\rangle=\frac{|01\rangle_{*}\pm|10\rangle_{*}}{\sqrt{2}}$ and $|\Phi^{\pm}\rangle=\frac{|00\rangle_{*}\pm|11\rangle_{*}}{\sqrt{2}}$ denote the Bell basis states with respect to the $b^{*}$ basis. Let Eve introduce a bit error rate of exactly $\beta$ between Alice and Bob’s measurement results. Then the mixed state of the ‘AB’ system after the above described symmetrisation procedure is given by

[TABLE]

Proof: In [18] it was shown that the AB state reduces to the form $\tilde{\rho}=\lambda_{0}|\Psi^{-}\rangle\langle\Psi^{-}|+\lambda_{1}|\Phi^{-}\rangle\langle\Phi^{-}|+\lambda_{2}|\Psi^{+}\rangle\langle\Psi^{+}|+\lambda_{3}|\Phi^{+}\rangle\langle\Phi^{+}|$, with $\lambda_{0}+\lambda_{1}+\lambda_{2}+\lambda_{3}=1$. We impose the constraint $(|\psi_{bg}\rangle\otimes|\psi_{bg}\rangle)^{{\dagger}}\tilde{\rho}|\psi_{bg}\rangle\otimes|\psi_{bg}\rangle=\beta/2$ for all $b\in{\mathcal{B}}$, $g\in\{0,1\}$.666 From the above constraints and ${\rm tr}\,\tilde{\rho}=1$ it follows that $(|\psi_{bg}\rangle\otimes|\psi_{b\bar{g}}\rangle)^{{\dagger}}\tilde{\rho}|\psi_{bg}\rangle\otimes|\psi_{b\bar{g}}\rangle=\frac{1-\beta}{2}$.

For the 6-state case it was shown in [11] that these constraints yield (8). We next study the 8-state case. Taking $b=b^{*}$, the above constraints yield ${\textstyle\frac{1}{2}}\lambda_{2}+{\textstyle\frac{1}{2}}\lambda_{3}={\textstyle\frac{\beta}{2}}$. The case $b\neq b^{*}$ is more complicated. Without loss of generality we take $b^{*}=00$. Then the $b=01$ and $b=11$ constraints each give, after some algebra, ${\textstyle\frac{1}{18}}(7\lambda_{1}+8\lambda_{2}+3\lambda_{3})={\textstyle\frac{\beta}{2}}$. The $b=10$ constraint gives ${\textstyle\frac{1}{18}}(\lambda_{1}+8\lambda_{2}+9\lambda_{3})={\textstyle\frac{\beta}{2}}$. Solving for the $\lambda$-parameters finally yields $\lambda_{1}=\lambda_{2}=\lambda_{3}={\textstyle\frac{\beta}{2}}$. $\square$

Note that setting $b^{*}\in{\mathcal{B}}$ is important: if the Pauli operators $\sigma_{\gamma}\otimes\sigma_{\gamma}$ are chosen with respect to a different basis, then Lemma 3.1 does not necessarily hold.

Also note that Lemma 3.1 usually does not hold for 4-state (BB84) conjugate coding. 4-state encoding has fewer noise-related constraints, and hence Eve has more freedom. However, one can imagine a protocol variant where Alice and Bob spend some extra key material777 This key has to be refreshed every time, otherwise Eve may find out which positions are test positions.

in order to agree on qubit positions which they sacrifice for noise testing purposes. With Lemma 3.1 holding for 4-state too, we can now treat all three encoding methods on an equal footing. We will see in Section 6 that even with this advantage given to Alice and Bob for 4-state, the 4-state encoding still performs worst.

3.3 Purification

The $\tilde{\rho}^{\rm AB}$ can be purified as follows, under the worst-case assumption that all noise is caused by Eve. Denoting Eve’s four-dimensional subsystem as ‘E’, with orthonormal basis $|m_{i}\rangle$, we can write

[TABLE]

Alice and Bob know in which basis to measure. They both do a projective measurement on their own subsystem. They measure the spin component in the direction ${\boldsymbol{v}}=(v_{x},v_{y},v_{z})=(\sin\theta\cos\varphi,\sin\theta\sin\varphi,\cos\theta)$. The eigenstates of this measurement are $|{\boldsymbol{v}}\rangle=e^{-i\varphi/2}\cos{\textstyle\frac{\theta}{2}}|0\rangle+e^{i\varphi/2}\sin{\textstyle\frac{\theta}{2}}|1\rangle$ (with eigenvalue ‘0’) and $|\overline{\boldsymbol{v}}\rangle=-e^{-i\varphi/2}\sin{\textstyle\frac{\theta}{2}}|0\rangle+e^{i\varphi/2}\cos{\textstyle\frac{\theta}{2}}|1\rangle$ (with eigenvalue ‘1’).

We rewrite the state (9) using $|{\boldsymbol{v}}\rangle,|\overline{\boldsymbol{v}}\rangle$ as the basis of the A and B subsystem,

[TABLE]

A number of things are worth noting about this representation of the purification.

• •

With probability $1-\beta$, Alice and Bob’s measurement outcomes are opposite. With probability $\beta$ they are equal.

• •

$|E^{\boldsymbol{v}}_{10}\rangle=|E^{-{\boldsymbol{v}}}_{01}\rangle$ and $|E^{\boldsymbol{v}}_{11}\rangle=|E^{-{\boldsymbol{v}}}_{00}\rangle$. Furthermore $\langle E^{\boldsymbol{v}}_{00}|E^{\boldsymbol{v}}_{11}\rangle=0$, and $|E^{\boldsymbol{v}}_{00}\rangle$, $|E^{\boldsymbol{v}}_{11}\rangle$ span a subspace orthogonal to $|E^{\boldsymbol{v}}_{01}\rangle$, $|E^{\boldsymbol{v}}_{10}\rangle$. Furthermore, $\langle E^{\boldsymbol{v}}_{01}|E^{\boldsymbol{v}}_{10}\rangle=\frac{1-2\beta}{1-\beta}$. This structure makes it particularly easy to analyse QKD. See Section 4.4.1.

• •

$|\frac{-v_{x}v_{z}-iv_{y}}{\sqrt{1-v_{z}^{2}}}|^{2}=1-v_{x}^{2}$ and $|\frac{-v_{y}v_{z}+iv_{x}}{\sqrt{1-v_{z}^{2}}}|^{2}=1-v_{y}^{2}$.

In the analysis of QKD schemes, it suffices to express (10) only for a single choice of ${\boldsymbol{v}}$, because the basis is eventually revealed to Eve. In QKR the basis is not revealed. In our treatment of known plaintext attacks (Section 5) we will need to evaluate (10) for different bases.

3.4 Eve’s mixed state

After Alice and Bob have performed their measurement, Eve possesses one of the $4|{\mathcal{B}}|$ pure states $\rho^{{\boldsymbol{v}}(b)}_{xy}$, with $x,y\in\{0,1\}$, $b\in{\mathcal{B}}$

[TABLE]

coupled to the unknown (to her) classical random variables $B,X,Y$. The whole system of $B,X,Y$ and E can be represented as a four-part system in the following mixed state,

[TABLE]

At given $x$, the probability of $y\neq x$ is $1-\beta$. (Before the introduction of noise, the $x$ and $y$ were perfectly anti-correlated.)

In Section 5 we will study known plaintext attacks, i.e. Eve knows $g$ and wants to learn the basis $b$. If Eve knows that $x=0$, then she has to distinguish between the following $|{\mathcal{B}}|$ states,

[TABLE]

The case $x=1$ will not be treated separately as it is analogous to $x=0$.

4 Security of the message

4.1 Attacks targeting the message

We consider attacks by which Eve tries to gain information about Alice’s plaintext $x$.

• M1

Eve steals one whole transmission $|\Psi\rangle$ and performs a measurement. (No matter what Eve sends to Bob, Bob rejects with overwhelming probability.)

• M2

Eve couples each qubit individually to an ancilla, and transfers information into the ancilla in such a way that the bit error rate is exactly $\beta$. She does this for $N$ transmissions ($N\gg 1$) before finally performing a measurement on her ancillas.

Attack M1 is the worst case scenario given that Bob does not accept. M2 is the worst case given that Bob accepts $N$ times in a row.

Attack M1 has no effect against 8-state encoding (since it is a QOTP), but is important in the case of 4-state and 6-state encoding. Below we briefly recap the results of [6]. In Section 4.4 we will see that the analysis of M2 reduces to the analysis of QKD.

4.2 Attack M1 on 4-state encoding

Eve intercepts the whole $n$-qubit state $|\Psi\rangle$ and immediately does a measurement. She subjects each qubit $i$ individually to the spin measurement $(\sigma_{x}+\sigma_{z})/\sqrt{2}$. The probability distribution of $X_{i}$ given the outcome always consists of the numbers $(\cos{\textstyle\frac{\pi}{8}})^{2}$ and $(\sin{\textstyle\frac{\pi}{8}})^{2}$. In terms of Shannon entropy this corresponds to the following mutual information per qubit,

[TABLE]

The min-entropy loss per qubit is

[TABLE]

4.3 Attack M1 on 6-state encoding

Eve’s spin measurement is $(\sigma_{x}+\sigma_{y}+\sigma_{z})/\sqrt{3}$. The probability distribution for $X_{i}$ given the outcome always consists of the numbers $(\cos{\textstyle\frac{\alpha}{2}})^{2}$ and $(\sin{\textstyle\frac{\alpha}{2}})^{2}$. This yields

[TABLE]

4.4 Attack M2: All Your Basis Are Belong To Us.

Attack M2 is effective because Eve is attacking $N$ qubits that are encrypted with the same key $b$. Eve collects $N$ ancillas containing partial information about the message bits; these message bits are protected by a total of $\log|{\mathcal{B}}|$ key bits. Hence, for large $N$ the key $b$ offers essentially no protection of the information drawn into the ancillas. (On the other hand, the key prevents Eve from absorbing full information into her ancillas. And the key itself does not become known to Eve.)

Lemma 4.1

Let Alice and Bob take fresh keys and then run the EPR version of the QKR protocol $N$ times, with Bob Accepting each time. Let $X_{i}^{(j)}$, with $j\in\{1,\ldots,N\}$, be Alice’s measurement result in qubit position $i\in\{1,\ldots,n\}$ in the $j$’th run of the protocol and $B_{i}$ the basis key used to encode all the $X_{i}^{(j)}$. Let $E_{i}^{(j)}$ denote Eve’s corresponding ancilla system, created without knowledge of $B_{i}$. Then

[TABLE]

Proof: Let ${\mathcal{M}}$ denote a POVM. We have ${\sf H}({\boldsymbol{X}}_{i}|{\boldsymbol{E}}_{i})=$ $\min_{\mathcal{M}}{\sf H}({\boldsymbol{X}}_{i}|{\mathcal{M}}({\boldsymbol{E}}_{i}))$ $\geq\min_{\mathcal{M}}{\sf H}({\boldsymbol{X}}_{i}|B_{i}{\mathcal{M}}({\boldsymbol{E}}_{i}))$ $=N\min_{\mathcal{M}}{\sf H}(X_{i}^{(j)}|B_{i}{\mathcal{M}}(E_{i}^{(j)}))$ $=N{\sf H}(X_{i}^{(j)}|B_{i}E_{i}^{(j)})$ for arbitrary $j$. $\square$

For $N\gg 1$ the bound is tight. The left hand side of (18) is the leakage per qubit. The right hand side is precisely the quantity that determines the security of QKD: the uncertainty about $X$ given a noise-constrained ancilla and the basis $B$ revealed to Eve after she has created the ancilla states.

Lemma 4.1 allows us to obtain a tight lower bound on the QKR capacity, namely the QKD capacity, whenever M2 is the dominant attack.

4.4.1 QKD, Shannon entropy

The computation of ${\sf H}(X|BE)$ for BB84 and 6-state (or more) QKD is well known. Here we combine the two standard approaches: (i) the simplest possible description of the noise, i.e. noise symmetrisation, (ii) specifying optimal measurements instead of bounds based on von Neumann entropy. The results are of course not new, but we present the matter in a particularly clean way which helps when protocol embellishments are considered (e.g. addition of artificial noise, see Section 7).

Informal treatment

Eve knows ${\boldsymbol{v}}$. Eve does a projective measurement $|E^{\boldsymbol{v}}_{00}\rangle\langle E^{\boldsymbol{v}}_{00}|+|E^{\boldsymbol{v}}_{11}\rangle\langle E^{\boldsymbol{v}}_{11}|$. This measurement does not destroy any information. With probability $\beta$ the outcome is ‘1’; next Eve can perfectly distinguish between the orthogonal states $|E^{\boldsymbol{v}}_{00}\rangle$, $|E^{\boldsymbol{v}}_{11}\rangle$ and hence learns $X$ with 100% accuracy. With probability $1-\beta$ the outcome is ‘0’; now Eve has to handle the trickier task of distinguishing between the non-orthogonal $|E^{\boldsymbol{v}}_{01}\rangle$ and $|E^{\boldsymbol{v}}_{10}\rangle$, which have inner product $c\stackrel{{\scriptstyle\rm def}}{{=}}\langle E^{\boldsymbol{v}}_{01}|E^{\boldsymbol{v}}_{10}\rangle=\frac{1-2\beta}{1-\beta}$. This is done optimally using a projective measurement in the following orthonormal basis,

[TABLE]

and has error probability

[TABLE]

The channel capacity from Alice to Eve is

[TABLE]

The secrecy capacity is

[TABLE]

Formal treatment

Eve has to guess $X$ from a state $\rho^{\boldsymbol{v}}_{XY}=|E^{\boldsymbol{v}}_{XY}\rangle\langle E^{\boldsymbol{v}}_{XY}|$. We write $Y=\bar{X}\oplus R$, with $R\in\{0,1\}$ the noise. Eve does not know $R$. Let ${\mathcal{Q}}=(Q_{x})_{x\in\{0,1\}}$ be a POVM applied by Eve, and let ${\mathcal{Q}}(\rho^{\boldsymbol{v}}_{XY})\in\{0,1\}$ be the outcome of the measurement. The main quantity to compute is

[TABLE]

The optimal POVM is given by $Q_{0}=|E^{\boldsymbol{v}}_{00}\rangle\langle E^{\boldsymbol{v}}_{00}|+|\mu_{01}\rangle\langle\mu_{01}|$, $Q_{1}=|E^{\boldsymbol{v}}_{11}\rangle\langle E^{\boldsymbol{v}}_{11}|+|\mu_{10}\rangle\langle\mu_{10}|$. This is equivalent to the two-step procedure detailed in the informal treatment above, and yields

[TABLE]

Eve’s knowledge about $X$ is $I_{\rm AE}={\sf H}(X)-{\sf H}(X|\rho^{\boldsymbol{v}}_{XY})$, which precisely equals (21).

4.4.2 QKD, min-entropy

Expressed as min-entropy loss, Eve’s knowledge is ${\sf H}_{\rm min}(X)-{\sf H}_{\rm min}(X|\rho^{\boldsymbol{v}}_{X,\bar{X}\oplus R})$ for known ${\boldsymbol{v}}$ and unknown noise $R\in\{0,1\}$. We have

[TABLE]

5 Security of the key

5.1 Known plaintext attacks on the key

We have to take into account the possibility that Eve knows the plaintext $\mu$. Then $\Psi$ may give Eve information on the (basis) key $b$. We focus on attacks that lead Bob to Accept. (A Reject causes Alice and Bob to refresh their keys.) We look at the two types of attack available to Eve,

• K1

Eve intercepts a fraction $3\beta$ of the qubits, does a measurement on them, and sends the resulting states on to Bob.

• K2

Eve lets every qubit individually interact with an ancilla. She forwards the qubits to Bob.

In attack K1 Eve receives a state

[TABLE]

for known $x$ and unknown $B$. For attack K2 Eve’s view is the mixed state $\zeta_{B}$ as defined in (13), for unknown $B$.

Lemma 5.1

The Shannon entropy of $B$ given $\zeta_{B}$ can be written as

[TABLE]

where $\max_{\mathcal{M}}$ is maximisation over POVMs $(M_{m})_{m\in{\mathcal{B}}}$. If we impose the symmetry relations $\forall_{b\in{\mathcal{B}}}:\;{\rm tr}\,M_{b}\zeta_{b}=p_{\scriptscriptstyle{\rm OK}}$ and $\forall_{m,b\in{\mathcal{B}},m\neq b}:\;{\rm tr}\,M_{m}\zeta_{b}=\frac{1-p_{\scriptscriptstyle{\rm OK}}}{|{\mathcal{B}}|-1}$ then the expression for the entropy reduces to

[TABLE]

Proof: Let ${\mathcal{M}}(\zeta_{B})$ be the classical random variable describing the outcome of the POVM measurement ${\mathcal{M}}$ on state $\zeta_{B}$. We have ${\sf H}(B|\zeta_{B})=\min_{\mathcal{M}}{\sf H}(B|{\mathcal{M}}(\zeta_{B}))$, with ${\sf H}(B|{\mathcal{M}}(\zeta_{B}))=\sum_{m}{\rm Pr}[{\mathcal{M}}(\zeta_{B})=m]{\sf H}(B|{\mathcal{M}}(\zeta_{B})=m)$. We write ${\rm Pr}[B=b|{\mathcal{M}}(\zeta_{B})=m]=\frac{1}{|{\mathcal{B}}|}[{\rm tr}\,M_{m}\zeta_{b}]/{\rm Pr}[{\mathcal{M}}(\zeta_{B})=m]$ and ${\rm Pr}[{\mathcal{M}}(\zeta_{B})=m]=\frac{1}{|{\mathcal{B}}|}\sum_{b}{\rm tr}\,M_{m}\zeta_{b}$. After some manipulation (27) follows. In the first $h(\cdots)$ of (27) we then write ${\textstyle\frac{1}{|{\mathcal{B}}|}}\sum_{b}{\rm tr}\,\zeta_{b}M_{m}={\textstyle\frac{1}{|{\mathcal{B}}|}}[p_{\scriptscriptstyle{\rm OK}}+(|{\mathcal{B}}|-1){\textstyle\frac{1-p_{\scriptscriptstyle{\rm OK}}}{|{\mathcal{B}}|-1}}]={\textstyle\frac{1}{|{\mathcal{B}}|}}$. The $h({\textstyle\frac{1}{|{\mathcal{B}}|}})$ cancels the $\log|{\mathcal{B}}|$. The second $h(\cdots)$ in (27) is the same for all $b\in{\mathcal{B}}$, namely $h(\{p_{\scriptscriptstyle{\rm OK}},\frac{1-p_{\scriptscriptstyle{\rm OK}}}{|{\mathcal{B}}|-1},\ldots,\frac{1-p_{\scriptscriptstyle{\rm OK}}}{|{\mathcal{B}}|-1}\})$ $=-p_{\scriptscriptstyle{\rm OK}}\log p_{\scriptscriptstyle{\rm OK}}-(|{\mathcal{B}}|-1)\cdot\frac{1-p_{\scriptscriptstyle{\rm OK}}}{|{\mathcal{B}}|-1}\log\frac{1-p_{\scriptscriptstyle{\rm OK}}}{|{\mathcal{B}}|-1}$ $=h(p_{\scriptscriptstyle{\rm OK}})+(1-p_{\scriptscriptstyle{\rm OK}})\log(|{\mathcal{B}}|-1)$. $\square$

5.2 Attack K1, 4-state

Eve scrutinises $\omega_{Bx}$. If $x=0$ then the state is either the $+x$ or $+z$ spin state. If $x=1$ then the state is either $-x$ or $-z$. In both cases, the optimal way to distinguish between the states is to measure the spin $(\sigma_{x}-\sigma_{z})/\sqrt{2}$. Given the measurement outcome, the probabilities for the two key values are $(\cos{\textstyle\frac{\pi}{8}})^{2}$ and $(\sin{\textstyle\frac{\pi}{8}})^{2}$. This holds for $x=0$ as well as $x=1$. Eve’s knowledge about $B$ is

[TABLE]

The effect on the whole $n$-bit string is obtained by multiplying (29,30) times $3\beta n$.

5.3 Attack K1, 6-state

Consider $x=0$. (The analysis for $x=1$ is analogous). Eve has to distinguish between the spin states $+x$, $+y$, $+z$ using a POVM ${\mathcal{M}}=(M_{b})_{b\in\{1,2,3\}}$. For the min-entropy the best POVM is given by $M_{b}={\textstyle\frac{1}{3}}{\mathbb{1}}-{\textstyle\frac{1}{3}}{\boldsymbol{n}}_{b}\cdot{\boldsymbol{\sigma}}$, with ${\boldsymbol{n}}_{1}=(-2,1,1)^{\rm T}/\sqrt{6}$, ${\boldsymbol{n}}_{2}=(1,-2,1)^{\rm T}/\sqrt{6}$, ${\boldsymbol{n}}_{3}=(1,1,-2)^{\rm T}/\sqrt{6}$. It yields the following probability distribution for $B$: $\{{\textstyle\frac{1}{3}}+{\textstyle\frac{2}{3\sqrt{6}}}$, ${\textstyle\frac{1}{3}}-{\textstyle\frac{1}{3\sqrt{6}}}$, ${\textstyle\frac{1}{3}}-{\textstyle\frac{1}{3\sqrt{6}}}\}$.

[TABLE]

For the Shannon entropy the best POVM is of the same form as above but with ${\boldsymbol{n}}_{b}\to-{\boldsymbol{n}}_{b}$. The probability distribution for $B$ is $\{{\textstyle\frac{1}{3}}+{\textstyle\frac{1}{3\sqrt{6}}}$, ${\textstyle\frac{1}{3}}+{\textstyle\frac{1}{3\sqrt{6}}}$, ${\textstyle\frac{1}{3}}-{\textstyle\frac{2}{3\sqrt{6}}}\}$.

[TABLE]

The effect on the whole $n$-bit string is obtained by multiplying (31,32) times $3\beta n$.

5.4 Attack K1, 8-state

Consider $x=0$. (The analysis for $x=1$ is analogous). Eve has to distinguish between the four states $|\psi_{b0}\rangle$ with a POVM ${\mathcal{M}}=(M_{b})_{b\in{\mathcal{B}}}$. For the min-entropy the optimal POVM is $M_{b}={\textstyle\frac{1}{2}}|\psi_{b0}\rangle\langle\psi_{b0}|$, yielding probability distribution $\{{\textstyle\frac{1}{2}},{\textstyle\frac{1}{6}},{\textstyle\frac{1}{6}},{\textstyle\frac{1}{6}}\}$. For the Shannon entropy the optimum is $M_{b}={\textstyle\frac{1}{2}}|\psi_{b1}\rangle\langle\psi_{b1}|$, yielding distribution $\{0,{\textstyle\frac{1}{3}},{\textstyle\frac{1}{3}},{\textstyle\frac{1}{3}}\}$.

[TABLE]

The effect on the whole $n$-bit string is obtained by multiplying (33,34) times $3\beta n$.

5.5 Attack K2, 4-state

Eve has to distinguish between $B=0$ ($z$-basis) and $B=1$ ($x$-basis) by inspecting her ancilla state $\zeta_{B}$.

Theorem 5.2

In the case of 4-state encoding, the min-entropy of the basis $B$ given the mixed state $\zeta_{B}$ is

[TABLE]

The corresponding POVM ${\mathcal{M}}=(M_{b})_{b\in\{0,1\}}$ is given by

[TABLE]

Proof:

[TABLE]

[TABLE]

The two expressions between square brackets act on orthogonal two-dimensional subspaces and both have the form of a Pauli operator. It directly follows that the eigenvalues are $\pm\sqrt{\beta(1-{\textstyle\frac{3}{2}}\beta)}$ and $\pm\beta/\sqrt{2}$. Finally we apply (4) with $p_{0}=p_{1}={\textstyle\frac{1}{2}}$. $\square$

Theorem 5.3

In the case of 4-state encoding, the Shannon entropy of the basis $B$ given the mixed state $\zeta_{B}$ is

[TABLE]

Proof: For binary $B$, the POVM associated with the min-entropy maximises ${\rm tr}\,M_{0}(\zeta_{0}-\zeta_{1})$ (see Section 2.1). If we impose the symmetry ${\rm tr}\,M_{0}\zeta_{1}={\rm tr}\,M_{1}\zeta_{0}$ then this expression becomes ${\rm tr}\,M_{0}\zeta_{0}-(1-{\rm tr}\,M_{0}\zeta_{0})=2{\rm tr}\,M_{0}\zeta_{0}-1$. (Imposing this symmetry is allowed, see Section 2.1). Hence the optimisation in the min-entropy-POVM is the same as the optimisation in the Shannon-POVM, and we conclude that the POVM associated with the min-entropy also minimises the Shannon entropy. Applying the POVM from Theorem 5.2 to (28) yields (40). $\square$

5.6 Attack K2, 6-state

Eve has to distinguish between $B=1$ ($x$-basis), $B=2$ ($y$-basis), and $B=3$ ($z$-basis). We define the permutation matrix $S$ as

[TABLE]

Theorem 5.4

In the case of 6-state encoding, the min-entropy of the basis $B$ given the mixed state $\zeta_{B}$ is

[TABLE]

The associated POVM is

[TABLE]

and $M_{1}=SM_{3}S^{{\dagger}}$, $M_{2}=SM_{1}S^{{\dagger}}$.

Proof: For $b\in\{1,2,3\}$ we have

[TABLE]

where $b+1$ should be read as $b+1\!\!\mod 3\in\{1,2,3\}$.

The matrix $\Lambda$ as defined in Section 2.1 is given by

[TABLE]

With some effort it is verified that indeed $\Lambda-\zeta_{b}\geq 0$ for $b\in\{1,2,3\}$ and $\beta\in[0,{\textstyle\frac{1}{2}}]$. $\square$

Conjecture 5.5

Consider 6-state encoding. In terms of Shannon entropy, Eve’s optimal POVM ${\mathcal{Q}}=(Q_{b})_{b\in{\mathcal{B}}}$ for learning as much as possible about $B$ from $\zeta_{B}$ is given by

[TABLE]

with $|r\rangle$ as defined by (45), and $Q_{1}=SQ_{3}S^{{\dagger}}$, $Q_{2}=SQ_{1}S^{{\dagger}}$.

Evidence: The POVM ${\mathcal{Q}}$ is the ‘dual’ of ${\mathcal{M}}$ in the sense that it has ${\boldsymbol{v}}$ replaced by $-{\boldsymbol{v}}$. (This fact is not immediately evident. One can also take ${\mathcal{M}}$ and apply it to the state $\zeta_{B}$ with ${\boldsymbol{v}}\to-{\boldsymbol{v}}$; this is equivalent). It was noticed in [6] that such a ‘dual’ is the optimal POVM in the case of the intercept attack K1. We have performed numerical POVM optimisations which find a local minimum of the Shannon entropy, starting from $3^{10}$ initial points in POVM space; all combinations of a positive/zero/negative value for each of the 10 degrees of freedom that are left in the POVM after imposing $S$-symmetry.888 Imposing symmetry is allowed, see Section 2.1.

Furthermore we did a Monte Carlo sampling of $10^{11}$ random POVMs. We did not find a single POVM that performs better than ${\mathcal{Q}}$. The numerical search did find ${\mathcal{M}}$ and ${\mathcal{Q}}$, as well as $200$ POVMs with Shannon entropy between that of ${\mathcal{Q}}$ and ${\mathcal{M}}$. $\square$

Theorem 5.6

In case of the measurement ${\mathcal{Q}}$ specified in Conjecture 5.5, the entropy of $B$ is given by

[TABLE]

Proof: After some algebra it can be seen that ${\rm tr}\,\zeta_{3}Q_{3}=p_{6}$. We apply (28) from Lemma 5.1. $\square$

Some remarks on the case $\beta\geq{\textstyle\frac{1}{3}}$ can be found in the Appendix.

5.7 Attack K2, 8-state

Theorem 5.7

Let $\beta\leq{\textstyle\frac{1}{3}}$. In the 8-state case, the min-entropy of $B$ given the mixed state $\zeta_{B}$ is

[TABLE]

The associated POVM $(M_{uw})_{u,w\in\{0,1\}}$ is

[TABLE]

Proof: The states $\zeta_{uw}$ are given by

[TABLE]

and $\zeta_{01}=(\sigma_{z}\otimes{\mathbb{1}})\zeta_{00}(\sigma_{z}\otimes{\mathbb{1}})$, $\zeta_{10}=(\sigma_{z}\otimes\sigma_{z})\zeta_{00}(\sigma_{z}\otimes\sigma_{z})$, $\zeta_{11}=({\mathbb{1}}\otimes\sigma_{z})\zeta_{00}({\mathbb{1}}\otimes\sigma_{z})$. The matrix $\Lambda$ has a simple diagonal form,

[TABLE]

It is easily verified that $\Lambda-\zeta_{uw}\geq 0$ for all $\beta\in[0,{\textstyle\frac{1}{3}}]$ and $u,w\in\{0,1\}$. Furthermore we have

[TABLE]

$\square$

Conjecture 5.8

Consider 8-state encoding. Let $\beta\leq{\textstyle\frac{1}{3}}$. In terms of Shannon entropy, Eve’s optimal POVM ${\mathcal{R}}=(R_{uw})_{u,w\in\{0,1\}}$ for learning as much as possible about $U,W$ from $\zeta_{UW}$ is given by

[TABLE]

and $R_{01}=(\sigma_{z}\otimes{\mathbb{1}})R_{00}(\sigma_{z}\otimes{\mathbb{1}}),R_{10}=(\sigma_{z}\otimes\sigma_{z})R_{00}(\sigma_{z}\otimes\sigma_{z}),R_{11}=({\mathbb{1}}\otimes\sigma_{z})R_{00}({\mathbb{1}}\otimes\sigma_{z})$.

Evidence: Just as in the 6-state case, the POVM for the Shannon entropy is the ‘dual’ (${\boldsymbol{v}}\to-{\boldsymbol{v}}$) of the POVM associated with the min-entropy. Numerical optimisations (from $3^{12}$ initial points) with imposed symmetry gave us no POVM that performs better than ${\mathcal{R}}$. The numerical search did find ${\mathcal{R}}$ and ${\mathcal{M}}$, as well as 168 POVMs with Shannon entropy between that of ${\mathcal{R}}$ and ${\mathcal{M}}$. $\square$

Theorem 5.9

In case of the measurement ${\mathcal{R}}$ specified in Conjecture 5.8, the entropy of $B$ is given by

[TABLE]

Proof: A brief calculation gives ${\rm tr}\,\zeta_{uw}R_{uw}=p_{8}$ (for all $u,w$) with $p_{8}$ as defined in (61). Then we use (28). $\square$

Some remarks on the case $\beta\geq{\textstyle\frac{1}{3}}$ can be found in the Appendix.

6 Putting it all together

The amount of privacy amplification needed in the protocol (Section 2.2, Ext function) is determined by the strongest of the M1, M2, K1, K2 attacks. Below we combine all the results from Sections 4 and 5.

6.1 Combined results for Shannon entropy

Table 1 shows an overview of the Shannon entropy losses in all the attacks. The individual M1,M2,K1,K2 leakages (and the maximum) are plotted as a function of $\beta$ in Fig. 1. Fig. 2 shows the QKR capacity $1-h(\beta)-I(\beta)$.

For 4-state and 6-state encoding, the strongest attack at low $\beta$ is M1. At larger $\beta$ it is the QKD-like attack M2. For 8-state encoding, M2 is always the strongest attack. The QKR channel capacity of 4-state encoding is always below 6-state. 8-state has higher capacity than 6-state at $\beta$ up to $\approx 0.1061$, after which they are the same and equal to the QKD capacity.

Our plots do not go beyond $\beta={\textstyle\frac{1}{3}}$ because intercept-resend attacks cause noise $\beta={\textstyle\frac{1}{3}}$. In attack K1 the fraction of qubits intercepted by Eve is $3\beta$, which at $\beta>{\textstyle\frac{1}{3}}$ would exceed $1$. At $\beta>{\textstyle\frac{1}{3}}$ we have to be careful how we interpret K1. A discussion can be found in the Appendix. Note that attacks K1 and K2 at $\beta={\textstyle\frac{1}{3}}$ are not necessarily the same thing. Attack K2 restricts Eve’s options by forcing her to first perform a specific ancilla operation, whereas attack K1 allows any POVM on the intercepted qubit. Hence at $\beta={\textstyle\frac{1}{3}}$ the K2 leakage cannot exceed the K1 leakage.

6.2 Combined results for min-entropy

Table 2 shows an overview of the min-entropy entropy losses in all the attacks. The individual M1,M2,K1,K2 leakages (and the maximum) are plotted as a function of $\beta$ in Fig. 3. Fig. 4 shows the QKR capacity $1-h(\beta)-\triangle{\sf H}_{\rm min}(\beta)$. For 4-state and 6-state, the winning attacks are as for the Shannon entropy case. For 8-state, however, the winning attack is K2. If capacity is computed using min-entropy loss as the measure of Eve’s knowledge, then the QKR capacity of 8-state is higher than 6-state on the range $\beta\in[0,0.0612]$. There is a tiny interval $\beta\in(0.0612,0.0638]$ where 6-state outperforms 8-state; at $\beta>0.0638$ all capacities are zero. 4-state is always worse than 6-state.

7 Addition of artificial noise

The structure evident in the $|E^{\boldsymbol{v}}_{xy}\rangle$ vectors (10) allows us to simplify the derivation of the capacity of 6-state/8-state QKD with added artificial noise. (This also applies to attack M2.) In [14] a derivation for 6-state QKD was given without noise symmetrisation, resulting in a lengthy analysis. Moreover, the end result was presented in a less than elegant way. Here we give a shorter derivation, and we present the end result in a very intuitive form.

Alice adds artificial noise to $X$. This is represented as a binary symmetric channel with bit error rate $\varepsilon$. Let $\varepsilon\star\beta\stackrel{{\scriptstyle\rm def}}{{=}}\varepsilon(1-\beta)+(1-\varepsilon)\beta$ be the bit error rate on the concatenated channel consisting of Alice’s noise $\varepsilon$ followed by the physical noise $\beta$ introduced by Eve. The channel capacity from Alice to Bob becomes $I_{\rm AB}^{\prime}(\varepsilon,\beta)=1-h(\varepsilon\star\beta)$. Eve’s task of distinguishing between the various $|E^{\boldsymbol{v}}\rangle$ states is not affected; the weights $\beta$ and $1-\beta$ in (21) do not change. However, Eve’s inference about $X$ from her measurement outcomes has additional noise $\varepsilon$: the bit error rate of the ‘easy’ channel changes from [math] to $\varepsilon\star 0=\varepsilon$, and the bit error rate of the ‘difficult’ channel changes from $p_{\beta}$ to $\varepsilon\star p_{\beta}$. Thus the channel from Alice to Eve now has capacity $I_{\rm AE}^{\prime}(\varepsilon,\beta)=\beta[1-h(\varepsilon)]+(1-\beta)[1-h(\varepsilon\star p_{\beta})]$, with $p_{\beta}$ as defined in (20). The secrecy capacity is

[TABLE]

which is precisely the result of [14] but in simplified form. Fig. 5 shows the optimal noise $\varepsilon_{\rm opt}(\beta)$ as a function of $\beta$, and the resulting capacity $C_{\rm opt}(\beta)=C^{\prime}(\varepsilon_{\rm opt}(\beta),\beta)$. The original positive-capacity region $\beta\leq 0.156$ is extended to $\beta\leq 0.162$.

8 Discussion

The fact that M1 is the dominant attack against 4-state and 6-state encoding at low bit error rate, and M2 at larger $\beta$, comes as no surprise. The vulnerability of the message is exactly the reason why 8-state encoding was introduced in [6]. And as 8-state protects the message better, it is also not surprising that an attack on the key dominates in the 8-state min-entropy analysis.

What we did not know a priori is the relative strength of the $\beta$-dependent attacks, and their strength (at large $\beta$) compared to M1. Figs. 1 and 3 show complicated behaviour with various intersections of curves.

We were surprised to see M2 ‘winning’ in the 8-state Shannon entropy analysis. With M2 being the relevant attack, a large part of the security analysis becomes identical, or at least very similar, to well known QKD analysis. Hence the trick with Alice’s artificial noise is as relevant to QKR as it is to QKD.

When the number of qubits ($n$) is very large, the relevant quantity to look at is Shannon entropy. For small $n$ it is min-entropy. In intermediate cases it is something in between. From our results we conclude that 8-state encoding yields the highest QKR capacity under practically all circumstances.

As topics for future work we see (i) Adaptation of the protocol so that the $n$-qubit quantum state $|\Psi\rangle$ sent by Alice contains the message itself (in privacy-amplified form, as in [2]), instead of a random mask. This would further improve communication efficiency. (ii) Determine the effect of artificial noise on the min-entropy loss in the case of the K2 attack on 8-state encoding. (iii) Determine how tight the bound in Lemma 4.1 (M2 reduces to QKD analysis) is as a function of $N$.

Acknowledgments

We thank Serge Fehr for useful discussions. Part of this research was funded by NWO (CHIST-ERA project ID  IOT).

Appendix: Attack K2 at high noise levels

For the sake of completeness we present entropy results for the K2 attack at very high noise levels. As mentioned in Section 6.1, the K1 attack needs some interpreting at $\beta>{\textstyle\frac{1}{3}}$: Eve does the the optimal K1-POVM on all $n$ qubits but then forwards badly chosen states to Bob which cause $\beta>{\textstyle\frac{1}{3}}$. Attack K2 is still defined as before: Eve couples her ancilla to the AB system in such a way that noise $\beta>{\textstyle\frac{1}{3}}$ occurs. At $\beta={\textstyle\frac{1}{2}}$ the point is reached where Eve might as well send a completely random qubit state to Bob, and she extracts the maximum possible amount of information from the scrutinised qubit. Hence the K2-leakage at $\beta={\textstyle\frac{1}{2}}$ must equal the K1-leakage at $\beta={\textstyle\frac{1}{3}}$.

In the case of 4- and 6-state encoding we find that the POVMs (35) and (43,48) respectively are optimal on the whole range $\beta\in[0,{\textstyle\frac{1}{2}}]$. In the 8-state case the situation is different: we find a different POVM in the range $\beta\in[{\textstyle\frac{1}{3}},{\textstyle\frac{1}{2}}]$.

Theorem .1

Let $\frac{1}{3}\leq\beta\leq{\textstyle\frac{1}{2}}$. For 8-state encoding, the min-entropy of $B$ given the mixed state $\zeta_{B}$ is

[TABLE]

The associated POVM $(M_{uw})_{u,w\in\{0,1\}}$ is

[TABLE]

[TABLE]

Proof: After some algebra it turns out that the matrix $\Lambda$ has a simple diagonal form,

[TABLE]

It is easily verified that $\Lambda-\zeta_{uw}\geq 0$ for all $\beta\in[{\textstyle\frac{1}{3}},{\textstyle\frac{1}{2}}]$ and $u,w\in\{0,1\}$. $\square$

Lemma .2

Consider 8-state encoding. Let ${\textstyle\frac{1}{3}}\leq\beta\leq{\textstyle\frac{1}{2}}$. In terms of Shannon entropy, Eve’s optimal POVM ${\mathcal{R}}=(R_{uw})_{u,w\in\{0,1\}}$ for learning as much as possible about $U,W$ from $\zeta_{UW}$ is given by

[TABLE]

and $R_{01}=(\sigma_{z}\otimes{\mathbb{1}})R_{00}(\sigma_{z}\otimes{\mathbb{1}}),R_{10}=(\sigma_{z}\otimes\sigma_{z})R_{00}(\sigma_{z}\otimes\sigma_{z}),R_{11}=({\mathbb{1}}\otimes\sigma_{z})R_{00}({\mathbb{1}}\otimes\sigma_{z})$.

Proof: On the whole range $\beta\in[{\textstyle\frac{1}{3}},{\textstyle\frac{1}{2}}]$ the POVM ${\mathcal{R}}$ gives ${\sf H}(B|{\mathcal{R}}(\zeta_{B}))=\log 3$, which is the K1 result at $\beta={\textstyle\frac{1}{3}}$ and therefore the minimum possible value. $\square$

Just as in the 6-state case and in the 8-state for $\beta\leq\frac{1}{3}$, the POVM ${\mathcal{R}}$ for the Shannon entropy is the ‘dual’ (${\boldsymbol{v}}\to-{\boldsymbol{v}}$) of the POVM associated with the min-entropy.

Note that at $\beta={\textstyle\frac{1}{3}}$ the POVMs for $\beta\leq{\textstyle\frac{1}{3}}$ and $\beta\geq{\textstyle\frac{1}{3}}$ match, as they should. The leakages for the K1 and K2 attacks up to $\beta=\frac{1}{2}$ are plotted in Figs. 6 and 7.

For 4- and 6-state, K2 reaches it maximum at $\beta={\textstyle\frac{1}{2}}$, whereas in the 8-state case the maximum is reached already at $\beta={\textstyle\frac{1}{3}}$.