From Classical to Semi-Quantum Secure Communication

TL;DR

This paper introduces a flexible quantum key distribution protocol that transitions from classical to semi-quantum, analyzing how quantum resources impact security and revealing interesting properties of the protocol.

Contribution

It presents a novel tunable QKD protocol and provides an information-theoretic security analysis of its quantum-classical transition.

Findings

Protocol smoothly transitions between classical and semi-quantum regimes

Security depends on the level of quantum resources used

Reveals properties of quantum resource requirements for secure communication

Abstract

In this work we introduce a novel QKD protocol capable of smoothly transitioning, via user-tuneable parameter, from classical to semi-quantum in order to help understand the effect of quantum communication resources on secure key distribution. We perform an information theoretic security analysis of this protocol to determine what level of "quantumness" is sufficient to achieve security, and we discover some rather interesting properties of this protocol along the way.

Equations

$${\rho }_{ABE}=\sum _{a,b\in \{0,1{\}}^n}P(a,b){[\mathbf{a}]}_A\otimes {[\mathbf{b}]}_B\otimes {\rho }_E^{(a,b)}.$$

$$r=\underset{n\to \infty }{\lim }\frac{\ell (n)}{n}=\inf [S(A|E{)}_{\sigma }-H(A|B)],$$

$${\rho }_{AE}=\frac{1}{N}{[0]}_A\otimes \left(\sum _{i=1}^M[{\mathbf{E}}_{\mathbf{i}}]\right)+\frac{1}{N}{[1]}_A\otimes \left(\sum _{i=1}^M[{\mathbf{F}}_{\mathbf{i}}]\right),$$

$$S(A|E{)}_{\rho }$$

$$\times \left(H\left[\frac{⟨E_i⟩E_i}{⟨E_i⟩E_i+⟨F_i⟩F_i}\right]-H\left[\lambda (|E_i⟩,|F_i⟩)\right]\right),$$

$$\lambda (|x⟩,|y⟩)=\frac{1}{2}\left(1+\frac{\sqrt{(⟨x⟩x-⟨y⟩y{)}^2+4R{e}^2⟨x⟩y}}{⟨x⟩x+⟨y⟩y}\right),$$

$$H\left[\frac{⟨E_i⟩E_i}{⟨E_i⟩E_i+⟨F_i⟩F_i}\right]-H\left[\lambda (|E_i⟩,|F_i⟩)\right]$$

$$\mathcal{F}{|0⟩}_T$$

$$\mathcal{F}{|1⟩}_T$$

$$\mathcal{F}|a⟩$$

$$+{|1⟩}_T\otimes (q_1\alpha {|e⟩}_E+q_3\beta {|0⟩}_E).$$

$$\frac{1}{2}{[0]}_A\otimes ({[0]}_B\otimes q_0^2{[0,0]}_{TE}+{[1]}_B\otimes q_1^2{[1,\mathbf{e}]}_{TE})$$

$$+$$

$$+{[1]}_B\otimes P(q_1\alpha {|1,e⟩}_{TE}+q_3\beta {|1,0⟩}_{TE})),$$

$$U_R{|0,0⟩}_{TE}=|0,e_0⟩+|1,e_1⟩$$

$$U_R{|1,e⟩}_{TE}=|0,f_0⟩+|1,f_1⟩$$

$${\rho }_{ABE}$$

$$+{[1]}_B\otimes q_1^2([{\mathbf{f}}_0]+[{\mathbf{f}}_1]))$$

$$+\frac{1}{2}{[1]}_A\otimes ({[0]}_B\otimes [P(q_0\alpha |e_0⟩+q_2\beta |f_2⟩)$$

$$+P(q_0\alpha |e_1⟩+q_2\beta |f_3⟩)])$$

$$+\frac{1}{2}{[1]}_A\otimes ({[1]}_B\otimes [P(q_1\alpha |f_0⟩+q_3\beta |e_2⟩)$$

$$+P(q_1\alpha |f_1⟩+q_3\beta |e_3⟩)]).$$

$$|g_0⟩=q_1\alpha |f_1⟩+q_3\beta |e_3⟩$$

$$|g_2⟩=q_0\alpha |e_1⟩+q_2\beta |f_3⟩$$

$$S(A|E{)}_{\rho }\ge \frac{q_0^2⟨e_0⟩e_0+⟨g_0⟩g_0}{2}$$

$$\times \left(H\left[\frac{q_0^2⟨e_0⟩e_0}{q_0^2⟨e_0⟩e_0+⟨g_0⟩g_0}\right]-H\left[\lambda (q_0|e_0⟩,|g_0⟩)\right]\right)$$

$$+\frac{q_0^2⟨e_1⟩e_1+⟨g_1⟩g_1}{2}$$

$$\times \left(H\left[\frac{q_0^2⟨e_1⟩e_1}{q_0^2⟨e_1⟩e_1+⟨g_1⟩g_1}\right]-H\left[\lambda (q_0|e_1⟩,|g_1⟩)\right]\right)$$

$$+\frac{q_1^2⟨f_0⟩f_0+⟨g_2⟩g_2}{2}$$

$$\times \left(H\left[\frac{q_1^2⟨f_0⟩f_0}{q_1^2⟨f_0⟩f_0+⟨g_2⟩g_2}\right]-H\left[\lambda (q_1|f_0⟩,|g_2⟩)\right]\right)$$

$$+\frac{q_1^2⟨f_1⟩f_1+⟨g_3⟩g_3}{2}$$

$$\times \left(H\left[\frac{q_1^2⟨f_1⟩f_1}{q_1^2⟨f_1⟩f_1+⟨g_3⟩g_3}\right]-H\left[\lambda (q_1|f_1⟩,|g_3⟩)\right]\right).$$

$$S(A|E{)}_{\rho }\ge \frac{q_0^2⟨e_0⟩e_0+⟨g_0⟩g_0}{2}$$

$$\times \left(H\left[\frac{q_0^2⟨e_0⟩e_0}{q_0^2⟨e_0⟩e_0+⟨g_0⟩g_0}\right]-H\left[\lambda (q_0|e_0⟩,|g_0⟩)\right]\right).$$

$$p_{a,1}^{A\to B}$$

$$=q_1^2{\alpha }^2+q_3^2{\beta }^2+2q_1{q}_3\alpha \beta Re⟨0⟩e$$

$$=p_{0,1}^{A\to B}{\alpha }^2+q_3^2{\beta }^2+2\sqrt{p_{0,1}^{A\to B}}{q}_3\alpha \beta Re⟨0⟩e.$$

$$1\ge q_3\ge \frac{1}{\beta }\left(\sqrt{p_{a,1}^{A\to B}}-\alpha \sqrt{p_{0,1}^{A\to B}}\right).$$

$$p_{0,0,0}^{A\to A}=p\cdot (1-Q_R)$$

$$\Rightarrow ⟨e_1⟩e_1=Q_R$$

$$p_{0,1,0}^{A\to A}=p\cdot Q_R$$

$$\Rightarrow ⟨f_1⟩f_1=1-Q_R.$$

$$\frac{|0⟩(q_0\alpha {|0⟩}_E+q_2\beta {|f⟩}_E)}{\sqrt{p_{a,0}^{A\to B}}}.$$

Full text

I Introduction

A semi-quantum key distribution (SQKD) protocol’s goal is similar to that of a quantum key distribution (QKD) protocol, namely the establishment of a secret key between two parties, Alice ($A$) and Bob ($B$), secure against an all-powerful adversary Eve ($E$). Semi-quantum cryptography, first introduced in 2007 by Boyer et al., in [1], imposes the restriction, however, that one of the users (typically $B$), is limited to being “classical” or “semi-quantum.” This restriction implies $B$ is limited to working only in the computational $Z$ basis (spanned by states $\ket{0}$ and $\ket{1}$). He may not measure or prepare states in any other basis (we will discuss the exact capabilities of $B$ later in this paper).

The primary interest of these protocols is to help answer the question “how quantum must a protocol be to gain an advantage over a classical one?” We know that, if both parties are classical, key distribution is impossible unless computational assumptions are made. Thus, the question semi-quantum protocols seek to help answer is: what quantum resources are required to attain unconditional security? However, besides removing certain key quantum capabilities from the two users, there has not been a semi-quantum protocol that can smoothly transition from classical to quantum allowing us to study the effects of quantum communication on secure key distribution.

In this paper, we propose such a protocol and analyze its properties. We introduce a novel SQKD protocol with a user-tuneable parameter $\alpha$ allowing one to, in a way, set the level of “quantumness” of the entire protocol. Indeed, when $\alpha=0$, the protocol collapses to a classical one (which is insecure). As $\alpha$ increases, the protocol, in a way, becomes more quantum (in that Alice, the quantum user, is allowed to send and receive states which are less orthogonal). However, Bob’s capabilities, being classical in nature, are not affected by this $\alpha$ parameter. In fact, as the protocol becomes “more quantum” Bob has more trouble determining $A$’s key bit since $B$ is always restricted to the computational $\{\ket{0},\ket{1}\}$ basis.

Our protocol is purely of theoretical interest. We are interested in devising a way to measure the effect of quantum state generation and measurement on the security properties of a key-distribution system where one user is forced to be classical and as the other user varies in quantum capabilities. We perform an information theoretic security analysis of our protocol and look at how $\alpha$ affects the noise tolerance of the protocol (i.e., how does the secure communication rate change as $A$ becomes more or less quantum, even when an all-powerful adversary is attacking). Naturally, when $\alpha$ is too small, the protocol is “too classical” to be secure - as $\alpha$ increases the protocol can attain security for some noise levels; however once $\alpha$ increases too much, then Alice is “too quantum” for Bob to understand completely (i.e., he is unable to correctly guess what key-bit $A$ is trying to send to him).

We make several contributions in this work. We introduce a novel SQKD protocol which is interesting theoretically as it is the first such protocol, that we are aware of, to allow researchers to gauge the effect of quantum state preparation and measurement on a key-distribution protocol where one user remains classical in nature. This protocol is also highly restrictive in nature as $A$ and $B$ both have severe restrictions placed on them, yet we are still able to prove security. Second, we perform an information theoretic security analysis of this protocol and our proof technique (which extends that of [2] but to the highly restricted case where fewer noise statistics may be observed) may be of independent interest and applicable to other (S)QKD protocols where users are severely limited in their ability to measure the noise in the quantum channel (note that SQKD protocols require two-way quantum channels allowing Eve two opportunities to attack each qubit - this, in addition to the fact that $A$ and $B$ cannot observe all noise statistics due to their restrictions, greatly increases the complexity of the security analysis). Finally, we evaluate our protocol, examining the effect of the $\alpha$ parameter for various channels and noise scenarios, discovering interesting properties along the way.

I-A Notation and (S)QKD Security

We denote by $Z$ to be the computational basis consisting of states $\{\ket{0},\ket{1}\}$. We use $H(p_{1},\cdots,p_{n})$ to be the Shannon entropy of $\{p_{i}\}$ and $H(x)$ to mean the binary Shannon entropy, namely $H(x)=H(x,1-x)$. Note that all logarithms in this paper are base two.

Given a density operator $\rho$ (that is, a Hermitian positive semi-definite operator of unit trace), we write $S(\rho)$ to be the von Neumann entropy of $\rho$ defined as $S(\rho)=-tr(\rho\log\rho)$. If $\rho$ acts on Hilbert space $\mathcal{H}_{A}\otimes\mathcal{H}_{B}$, we often write $\rho_{AB}$. In this case, we define $\rho_{B}$ to be the partial trace over the $A$ system, namely $\rho_{B}=tr_{A}\rho_{AB}$. This notation extends to three or more systems. To simplify notation, given $\ket{v}$ in some Hilbert space, we will write $\mathbf{[v]}$ to mean $\ket{v}\bra{v}$.

If $\rho_{AB}$ acts on $\mathcal{H}_{A}\otimes\mathcal{H}_{B}$, then we write $S(AB)_{\rho}$ to mean $S(\rho_{AB})$. We also write $S(A|B)_{\rho}$ to mean the conditional von Neumann entropy defined to be $S(A|B)_{\rho}=S(\rho_{AB})-S(\rho_{B})$. We will forgo writing the subscript “$\rho$” if the context is clear.

Any (S)QKD protocol requires both a quantum channel and an authenticated classical channel and these protocols operate in two stages. The first, called the quantum communication stage, utilizes the quantum channel and authenticated classical channel, over numerous iterations, to agree on a so-called raw-key of size $n$-bits. Eve, who was attacking the quantum channel, and listening to the authenticated classical communication, also has an ancilla partially entangled with $A$ and $B$’s raw key. At this point, the system ($A$ and $B$’s raw key along with $E$’s ancilla) may be represented by a classical-quantum state:

[TABLE]

From this, $A$ and $B$ run an error correction protocol (leaking additional information to $E$) and a privacy amplification protocol, shrinking the $n$-bit raw key to a secret key of size $\ell(n)$ on which $E$ has negligible information (in an information theoretic sense). In the asymptotic scenario as $n\rightarrow\infty$, which we consider here, $E$’s information, and also all failure probabilities, go to zero. An important statistic in any security proof is the key-rate: $r=\ell(n)/n$. For more information on these general concepts and definitions, the reader is referred to [3].

As with almost all (S)QKD security proofs, we consider collective attacks, whereby $E$ attacks the channel in an i.i.d. manner but is free to postpone her measurement of her ancilla to any future point in time and, indeed, may later perform an optimal coherent measurement of her entire ancilla. Usually, proving security against collective attacks is sufficient to prove security against general, arbitrary, attacks [4, 5, 6]. We suspect this result also holds true for our protocol; however due to the highly restrictive nature of $A$ and $B$’s operation, a complete proof of this is outside the scope of this paper and would make for interesting future work.

Under a collective attack (in which case $\rho_{ABE}$ from Equation 1 may actually be written $\rho_{ABE}=\sigma_{ABE}^{\otimes n}$ for some classical-quantum state $\sigma$), we may employ the Devetak-Winter key-rate equation [7] which states:

[TABLE]

where the infimum is over all collective attacks which induce the observed statistics (e.g., the observed error rate, though one may also look at other statistics such as mismatched events [8, 9, 2]). It is this computation of $r$ (in particular, the computation of $S(A|E)$ since the computation of $H(A|B)$ is generally trivial) that is the key element in any (S)QKD security proof and our main focus in this work. From this, one may look at a protocol’s noise tolerance - that is for what noise levels does $r$ remain positive.

In our security proof, we will make use of the following result proven in prior work (though slightly generalized here):

Theorem 1**.**

(From [2]): Given the classical-quantum state:

[TABLE]

then:

[TABLE]

where:

[TABLE]

and $J$ is any subset $J\subset\{1,\cdots,M\}$.

Proof.

The proof for $J=\{1,\cdots,M\}$ can be found in [2]. The result also follows for arbitrary subset $J$ by noting that, in the proof, the term:

[TABLE]

is the result of computing the conditional entropy of a classical-quantum state which is known to be always non-negative. ∎

I-B Semi-Quantum Cryptography and Related Work

Since the framework’s introduction in 2007 by Boyer et al., [1, 10], numerous SQKD protocols have been proposed [1, 10, 11, 12, 13, 14, 15, 16] (just to list a few), some with information theoretic proofs of security [17, 18, 2]. Often one is interested in removing requirements on one or both users while still attempting to attain security against an all-powerful adversary - this is to study the effects of these resources and abilities on the secure communication rate of the resulting protocol. However, no prior SQKD protocols allow for the smooth transition from a purely classical protocol to a semi-quantum one.

An SQKD protocol requires a two-way quantum channel, allowing a qubit to travel from $A$ to $B$ (the forward direction) and return from $B$ to $A$ (the reverse direction). $A$, the fully quantum user, is allowed to prepare any arbitrary quantum state and send it to the “classical” user $B$, who is allowed only to directly work with the $Z$ basis. In more detail, on receiving a qubit, $B$ may choose to do one of two operations:

Measure and Resend: If he chooses this option, he performs a $Z$ basis measurement on the qubit, resulting in outcome $\ket{r}$, for $r\in\{0,1\}$. He then resends the same state $\ket{r}$ to $A$. Note that he can only measure and prepare qubits in this single basis. 2. 2.

Reflect: In this case, $B$ disconnects from the quantum channel and reflects all qubits back to $A$. If this is chosen, $A$ is, essentially, communicating with herself.

When a qubit returns to $A$, she is allowed to perform any quantum operation on it. Note that, under this scenario, Eve is allowed two opportunities to attack every qubit.

II The Protocol

Our protocol, being a semi-quantum one, requires a two-way quantum channel and forces $B$ to be “classical” in nature as described in the previous section. We also place additional restrictions on the quantum user $A$. On each iteration of the quantum communication stage, $A$ is allowed to send only one of two possible states: either $\ket{0}$ or $\ket{a}=\alpha\ket{0}+\beta\ket{1}$, where $\alpha\geq 0$ is a public, user-specified, parameter and $\beta=\sqrt{1-\alpha^{2}}$.

Bob is the classical user - as such, on receipt of a qubit from $A$, he may only directly interact with it through the $Z$ basis (by choosing Measure and Resend), or he may simply ignore the qubit and reflect it back to $A$ (by choosing Reflect).

When a qubit returns to $A$, she will perform a measurement using the three-outcome POVM $\Lambda=\{\Lambda_{0},\Lambda_{a},\Lambda_{?}\}$ defined: $\Lambda_{0}=p\ket{0}\bra{0},$ $\Lambda_{a}=p\ket{a}\bra{a},$ and where $\Lambda_{?}=I-\Lambda_{0}-\Lambda_{1}$. The parameter $p$, which is another public constant, must be chosen to ensure $\Lambda_{?}\geq 0$. Furthermore, $A$ wishes to maximize $p$ so that the probability she receives the indeterminate outcome “?” is minimized. Some algebra reveals that the maximal $p$ that satisfies this is $p\leq\frac{1}{1+\alpha}$. Note that, in this work, where we only consider the asymptotic scenario, the actual choice of $p$ is not that important so long as $0<p\leq\frac{1}{1+\alpha}$. In a finite key analysis, this choice of $p$ would be much more important, but we leave this as future work.

Notice that, when $\alpha=0$, the protocol “collapses” to a purely classical communication system where $A$ sends $\ket{0}$ and $\ket{1}$ only and where she is always measuring in the $Z$ basis (since $p$ approaches $1$ as $\alpha$ decreases and so $\Lambda_{0}=\ket{0}\bra{0}$, $\Lambda_{a}=\ket{1}\bra{1},$ and $\Lambda_{?}\equiv 0$). Of course, $B$ is classical regardless of the choice of $\alpha$ since he is only able to measure and send in the $Z$ basis (or disconnect from the quantum channel, thus causing $A$ to simply “talk to herself”). For $\alpha>0$, the protocol is inherently quantum - but the question is, how far from classical ($\alpha=0$) must the communication be before we start attaining secure communication? Our protocol in detail is described in Protocol 1.

The reader will observe that, for $\alpha>0$, our protocol always has some noise in the raw key, even when no adversary is present! Indeed, unless the protocol is purely classical ($\alpha=0$), the classical user $B$ will be unable to determine exactly the information that $A$ is trying to send. The issue is exacerbated when an adversary comes into play (adding additional noise). As mentioned in the introduction, the protocol is purely a theoretical one studied for its theoretical interest to help study the “gap” between classical and quantum communication. We do not expect this protocol to ever be implemented in practice (unless some faulty hardware forces this protocol to be used). Note that we are also not concerned with practical attacks such as photon loss or multi-photon states [3, 20, 21] - though interesting, these issues are outside the scope of this theoretical analysis.

We are interested in two questions: Given an observed noise level $Q$, for what $\alpha$ is the protocol secure? Of course when $\alpha=0$, the protocol will never be secure. Secondly, what is an optimal choice of $\alpha$? That is, how “far” from the classical case of $\alpha=0$ must the communication be to optimize the secure transfer of information between $A$ and $B$ when faced with a quantum adversary $E$.

III Security Analysis

Our goal in this section is to compute our protocol’s key-rate (specifically $S(A|E)$) as a function of $\alpha$ and those observable parameters that $A$ and $B$ may measure in the channel (which are very few). We begin by deriving a density operator description of a single “successful” iteration of the protocol (where by “successful” we mean an iteration leading to the distillation of a raw key bit). For now we assume collective attacks whereby Eve attacks each iteration in an i.i.d. manner. In this case, as shown in [22], for SQKD protocols, it suffices to only prove security against so-called restricted collective attacks. These restricted attacks consist of an isometry $\mathcal{F}:\mathcal{H}_{T}\rightarrow\mathcal{H}_{T}\otimes\mathcal{H}_{E}$ applied in the forward channel (connecting $A$ to $B$) and a unitary operator $U_{R}$ applied in the reverse channel and acting on $\mathcal{H}_{T}\otimes\mathcal{H}_{E}$. Here we use $\mathcal{H}_{T}$ to denote the two-dimensional space modeling the qubit in transit and $\mathcal{H}_{E}$ is Eve’s ancilla. The action of $\mathcal{F}$ is simply:

[TABLE]

where $q_{i}\in\mathbb{R}_{\geq 0}$ subject to $q_{0}^{2}+q_{1}^{2}=q_{2}^{2}+q_{3}^{2}=1$ and where $\ket{e}$ and $\ket{f}$ are arbitrary, normalized, vectors in $\mathcal{H}_{E}$. There are some additional restrictions that may be made on this attack (in particular $\ket{e}$ and $\ket{f}$ may exist with a two-dimensional subspace of $\mathcal{H}_{E}$ spanned by $\ket{0}_{E}$ and a second basis vector); however, this notation is sufficient for the discussion at hand. For further information on the restricted attack, and the proof that security against such attacks implies security against arbitrary collective attacks, the reader is referred to [22]. Note that, by linearity of $\mathcal{F}$, we also have the following:

[TABLE]

To build the desired density operator, we trace the evolution of an iteration of the protocol. Following $A$’s preparation (randomly sending $\ket{0}$ or $\ket{a}$), and Eve’s first attack $\mathcal{F}$, and after $B$ measures in the $Z$ basis (recall, we are currently only interested in a key-distillation iteration and so we condition on the event that $B$ chooses Measure and Resend), the joint state is found to be:

[TABLE]

where $P(\ket{z})=\mathbf{[z]}=\ket{z}\bra{z}$. Following this, the qubit returns to $A$; however, before arriving, Eve has a second opportunity to attack using operator $U_{R}$. We write the action of $U_{R}$ abstractly as:

[TABLE]

Above, the states $\ket{e_{i}}$ and $\ket{f_{i}}$ are arbitrary states in $\mathcal{H}_{E}$ (though, unitarity of $U_{R}$ imposes some restrictions on them which will be important momentarily).

Following the application of this attack, the qubit returns to $A$ who simply discards it (recall, we are conditioning on an iteration that leads to a raw-key bit). Thus, we may simply trace out the Transit space following the application of $U_{R}$. The final density operator, therefore, is found to be:

[TABLE]

To clean up the notation, we define the following vectors:

[TABLE]

From this, we may then use Theorem 1 to derive the following lower-bound:

[TABLE]

Though, by setting $J=\{0\}$ from the theorem, we also have the following (weaker) lower-bound:

[TABLE]

It is this lower-bound we will actually consider. To compute $S(A|E)$ (giving us the key-rate), we need to compute, or bound, the inner-products appearing in the above expression, based only on statistics we may observe.

Note that $q_{0}$ and $q_{1}$ are both observable parameters. Indeed, let $p^{A\rightarrow B}_{0,i}$ be the probability that $B$ measures $\ket{i}$ (for $i\in\{0,1\}$) if $A$ initially sent $\ket{0}$. This is one of the few statistics $A$ and $B$ actually can estimate and is, in fact, the only observable noise statistic in the forward channel (they cannot measure, for example, $p^{A\rightarrow B}_{1,i}$ when $\alpha>0$). It is not difficult to see, from Equation 3, that $q_{0}^{2}=p^{A\rightarrow B}_{0,0}$ and $q_{1}^{2}=p^{A\rightarrow B}_{0,1}$. Note that, by definition of the restricted attack, it is sufficient to consider non-negative $q_{i}$ [22].

As mentioned, the users cannot directly observe $q_{2}$ and $q_{3}$. However, they can estimate it by considering $p^{A\rightarrow B}_{a,1}$, the probability that $B$ measures $\ket{1}$ if $A$ initially sent $\ket{a}$ (this is something that may be observed). Note that, from Equation 4, we have:

[TABLE]

Of course, $|\braket{0}{e}|\leq 1$. We are constrained by the fact that $q_{3}\geq 0$ (since, for the restricted attack, each $q_{i}$ are non-negative real numbers [22]). We therefore have the following solution for $q_{3}$, looking for the smallest positive root of the above quadratic equation, assuming $p^{A\rightarrow B}_{a,1}\geq\alpha^{2}p^{A\rightarrow B}_{0,1}$ (which it will be in our evaluations):

[TABLE]

We therefore have values, or bounds, for all $q_{i}$ (note that $q_{2}=\sqrt{1-q_{3}^{2}}$). It is clear that we may observe $\braket{e_{0}}{e_{0}},\braket{e_{1}}{e_{1}},\braket{f_{0}}{f_{0}}$, and $\braket{f_{1}}{f_{1}}$. Indeed, let $p^{A\rightarrow A}_{i,j,k}$ denote the probability that $A$’s measurement observes “$k$” conditioned on the event $A$ initially sent $\ket{i}$ and $B$ chose Measure and Resend and actually observed $\ket{j}$. Of course, $i\in\{0,a\}$, $j\in\{0,1\}$ and $k\in\{0,a,?\}$. It is not difficult to see, then, that $p^{A\rightarrow A}_{0,0,0}=p\cdot\braket{e_{0}}{e_{0}}$ where $p$ is the POVM parameter as described in Protocol 1; as discussed, we assume $p>0$. By unitarity we also have $\braket{e_{1}}{e_{1}}=1-\braket{e_{0}}{e_{0}}$. Similarly, we have $p^{A\rightarrow A}_{0,1,0}=p\cdot\braket{f_{0}}{f_{0}}$ and $\braket{f_{1}}{f_{1}}=1-\braket{f_{0}}{f_{0}}$. To simplify notation, at this point we will assume a symmetric attack and define the following:

[TABLE]

(Note we use $Q_{R}$ to denote the noise in the Reverse channel, from $B$ to $A$.)

This assumption that the observable noise is symmetric in this manner (which may be enforced by $A$ and $B$ and is a common assumption in (S)QKD security proofs) is not necessary, and our analysis below follows without it; we only use this to simplify notation. Note that, if there is no noise in the forward channel (in which case $p^{A\rightarrow A}_{0,1,0}$ is technically undefined since we are conditioning on an event which never occurs), then $\braket{f_{0}}{f_{0}}$ and $\braket{f_{1}}{f_{1}}$ never show up in any of our computations and so we may define $p^{A\rightarrow A}_{0,1,0}$ arbitrarily; thus we assume $p^{A\rightarrow A}_{0,1,0}=p\cdot Q_{R}$ in this case regardless.

We also claim $\braket{g_{i}}{g_{i}}$ may be observed. Consider the case that $A$ sends $\ket{a}$, $B$ chooses Measure and Resend and observes $\ket{0}$. From Equation 4, we see the state collapses to:

[TABLE]

After Eve attacks the returning qubit, the state is found to be (before $A$ measures):

[TABLE]

Then, it follows that when $A$ measures we have: $p^{A\rightarrow A}_{a,0,0}=p\cdot\braket{g_{3}}{g_{3}}/p^{A\rightarrow B}_{a,0}$. Furthermore, due to unitarity of Eve’s attack, it holds that $\braket{g_{2}}{g_{2}}+\braket{g_{3}}{g_{3}}=p^{A\rightarrow B}_{a,0}$. Repeating the above analysis conditioning on $B$ observing $\ket{1}$, we conclude:

[TABLE]

Note that, above, we assumed $p^{A\rightarrow B}_{a,0,0}=p\cdot(1-Q_{R})$ and $p^{A\rightarrow B}_{a,1,0}=p\cdot Q_{R}$. This symmetry assumption (which also may be enforced by the users) is not necessary but only done to simplify our notation. Also, as before, if, for instance, $p^{A\rightarrow B}_{a,1}=0$, then $\ket{g_{0}}$ and $\ket{g_{1}}$ technically never appear in $\rho$ and so they may be arbitrary; in this case we may simply define $p^{A\rightarrow A}_{a,1,0}=p\cdot Q_{R}$. Similarly for the case if $p^{A\rightarrow B}_{a,0}=0$.

Finally, to compute our bound on $S(A|E)$, we will also need to compute the inner product appearing in the $\lambda$ function, namely $Re^{2}\braket{e_{0}}{g_{0}}$. As we are interested in the worst-case, we actually want to find a lower-bound on this inner-product (which, as can be seen from Equation 2, minimizes $S(A|E)$). It is not difficult to see that:

[TABLE]

where, above, we used the fact that $|\braket{e_{0}}{f_{1}}|\leq\sqrt{\braket{e_{0}}{e_{0}}\braket{f_{1}}{f_{1}}}$.

We thus reduced the problem to bounding $\braket{e_{0}}{e_{3}}$. To attain this, we must look at several more statistics. First, consider $\braket{g_{1}}{g_{1}}=p^{A\rightarrow B}_{a,1}p^{A\rightarrow A}_{a,1,0}/p$. Expanding $\braket{g_{1}}{g_{1}}$ yields:

[TABLE]

Above, we used the fact that $Re\braket{f_{0}}{e_{2}}=\sqrt{\braket{e_{2}}{e_{2}}}\sqrt{\braket{f_{0}}{f_{0}}}\cos\theta=\sqrt{\braket{e_{2}}{e_{2}}}\sqrt{Q_{R}}\cos\theta$, for some $\theta$ (this follows from the Cauchy-Schwarz inequality). Solving the above quadratic, and taking the maximal root over all $\theta$ (note that $\braket{e_{2}}{e_{2}}$ represents the probability of a $\ket{1}$ flipping to a $\ket{0}$, however this noise value is not observable and so we can only bound it based on values we can observe), we find:

[TABLE]

Similarly, we can bound $\braket{f_{3}}{f_{3}}$ by considering $\braket{g_{2}}{g_{2}}=p^{A\rightarrow B}_{a,0}Q_{R}$. Solving the resulting quadratic, we find:

[TABLE]

We now have upper-bounds on the “hidden” noise of the channel.

Next, let us consider the statistic $p^{A\rightarrow A}_{a,R,a}$ which we use to denote the probability that, conditioning on the event $A$ sends $\ket{a}$, $B$ chooses to Reflect, and $A$ chooses to measure using POVM $\Lambda$ (see Protocol 1), that the outcome of this measurement is “$a$”.

It is straight-forward (though slightly tedious) algebra, to find that:

[TABLE]

where:

[TABLE]

and where $\ket{E_{\bar{a}}}$ is a sub-normalized vector in $\mathcal{H}_{E}$, the exact state of which may be found by tracing the action of linear operator $U_{R}\mathcal{F}$, though its state is irrelevant to our discussion. From this, we find:

[TABLE]

At this point, we must consider additional mismatched measurements. Consider $p^{A\rightarrow A}_{a,0,a}$ which we use to denote the probability that, conditioning on $A$ sending $\ket{a}$, $B$ choosing Measure and Resend and actually observing $\ket{0}$, and $A$ choosing to measure, that she receives outcome “$a$”. To compute this probability, we trace the evolution of the qubit as it travels:

[TABLE]

where $\ket{E^{\prime}}_{E}$ is some irrelevant, sub-normalized, state in $E$’s ancilla. Note that, from the above expression, the choice of notation for $\ket{V_{a,0,a}}$ is clear and we find:

[TABLE]

Repeating the above but considering the event when $B$ observes $\ket{1}$, we find:

[TABLE]

Substituting this into Equation 18 and also expanding $Re\braket{V_{a,0,a}}{V_{a,1,a}}$, we find:

[TABLE]

(Note that, above, we used the fact that $Re\braket{x}{y}=Re\braket{y}{x}$.) We may simplify the above equation slightly by taking advantage of the unitarity of $U_{R}$. Namely, we have the following restrictions (see Equation 5):

[TABLE]

Using this, Equation 21 becomes:

[TABLE]

Consider the following inner-product:

[TABLE]

Then the above equation for $p^{A\rightarrow A}_{a,R,a}$ simplifies to:

[TABLE]

Solving for the term involving $Re\braket{e_{0}}{e_{3}}$ (which is the quantity we are currently interested in bounding) yields:

[TABLE]

where:

[TABLE]

$A$ and $B$ do not have sufficient quantum capabilities to fully bound $\chi$; however we can bound it based on what we already know and using the Cauchy-Schwarz inequality, namely:

[TABLE]

(Note that, above, we used the fact that $\braket{e_{3}}{e_{3}}=1-\braket{e_{2}}{e_{2}}$ and $\braket{f_{2}}{f_{2}}=1-\braket{f_{3}}{f_{3}}$.) Upper-bounds on $\braket{e_{2}}{e_{2}}$ and $\braket{f_{3}}{f_{3}}$ were already derived in Equations 13 and 14.

Finally, we claim $A$ and $B$ can observe $Re\braket{g_{1}}{g_{3}}$ by considering the statistic $p^{A\rightarrow A}_{a,R,0}$; that is, the probability that $A$’s measurement produces outcome “[math]” conditioned on the event she initially sent $\ket{a}$ and $B$ chose Reflect. Indeed, tracing the qubit in this case, it is not difficult to see that:

[TABLE]

from which we attain:

[TABLE]

Since $\braket{g_{i}}{g_{i}}$ are all observable (see Equation 11), this completes our bound.

This completes our lower-bound on $S(A|E)$. To summarize, given as input $\alpha$ along with those observable statistics as utilized above, one must simply minimize Equation 8 over all $q_{3}$, $\braket{e_{2}}{e_{2}}$, and $\braket{f_{3}}{f_{3}}$, as enforced by Equations 10, 13, and 14. For any particular choice of these values, one may compute a bound on $\chi$ from Equation 25; one may also compute a bound on $Re\braket{e_{0}}{e_{3}}$ using Equation 24. This then allows one to bound $Re^{2}\braket{e_{0}}{g_{0}}$, using Equation 12 which gives a possible value of $S(A|E)$. Minimizing over $\braket{e_{2}}{e_{2}}$, $\braket{f_{3}}{f_{3}}$, and $q_{3}$ gives a worst-case lower-bound on $S(A|E)$ over all attacks which induce the observed statistics. This is a simple minimization problem allowing one to evaluate the key-rate numerically.

Note that if $\alpha=0$ (i.e., the protocol is classical), then it is easy to check that Equation 24 becomes simply $0=0$, regardless of the choice of $\braket{e_{0}}{e_{3}}$ (i.e., Eve may set this inner-product arbitrarily and Equation 24 will be satisfied). It is also clear that $\braket{e_{0}}{g_{0}}=q_{3}\braket{e_{0}}{e_{3}}$. Thus, Eve may set $\braket{e_{0}}{e_{3}}=0$ in this case resulting in the entropy $S(A|E)=0$ as expected. That is, in the classical case, Eve has no uncertainty on $A$ and $B$’s raw key and so the protocol is insecure. The interesting question is what happens when $\alpha>0$?

To finish the key-rate computation (and answer this question), we also need $H(A|B)$, however this value is easily found:

[TABLE]

thus completing the key-rate computation.

IV Evaluation

To evaluate our protocol, and more importantly to see the effect of $\alpha$ on the secure key-rate, we must put values to those observable statistics $p^{A\rightarrow B}_{\cdot,\cdot}$ and $p^{A\rightarrow A}_{\cdot,\cdot,\cdot}$. We will assume a symmetric attack parameterized by noise values $Q_{F}$ (in the forward channel), $Q_{R}$ (in the reverse), and $Q_{X}$ (for the “loop” channel when $B$ reflects), where:

[TABLE]

and where $p=\frac{1}{1+\alpha}$, the maximal allowed value as discussed earlier.

To put values to the mismatched events, we model the channel as a depolarization channel, a common approach when evaluating (S)QKD protocols. This is not a requirement of our security proof of course, simply a way to put realistic (i.e., physically realizable) numbers to the observable parameters in order to evaluate the key-rate. A depolarization channel with parameter $Q$ is simply the map:

[TABLE]

From this, we find:

[TABLE]

As expected, the noise tolerance of this protocol is low, however we are able to attain positive key-rates as shown in Figures 1, 2, and 3. It is clear from these figures that the forward channel noise is the most important statistic - indeed, as shown in Figure 1, the protocol can tolerate a high level of reverse and “loop” noise (approaching $10\%$). However, as shown in Figure 3, if the forward channel increases too much (even by a small amount), there are only a few choices for $\alpha$ where a positive key-rate can be attained (and that key-rate is still low). Unless the reverse channel noise is very large, the optimal choice for $\alpha$ ranged between $0.175$ and $0.2$ for those evaluations we performed. For small $Q_{F}$ and high $Q_{R}$ and $Q_{X}$, as in Figure 1, the optimal value of $\alpha$ is slightly lower, ranging between $0.13$ and $0.16$.

Despite the low noise tolerance, we still consider this a positive, and interesting, result as this protocol was designed specifically to smoothly transform from classical to quantum communication and to allow research in investigating how this affects secure communication. Of course, our key-rate is a lower bound, so the actual security rate can only be higher. Further studying this would make interesting future work.

V Comments on Further Restrictions

One natural question for future work is: can the requirements of this protocol be reduced even further? That is, can $A$ have even more restrictions placed on her quantum abilities? One clear direction is to attempt to remove $A$’s POVM and replace it with a single basis measurement, measuring in the $\mathcal{A}=\{\ket{a},\ket{\bar{a}}\}$ basis (where $\braket{\bar{a}}{a}=0$). However, this removes certain key statistics that we relied on in our security proof. While we attempted to analyze this protocol, a full security proof remains elusive.

We do, however, conjecture that this even more restricted protocol is secure. To provide at least some evidence in support of this, we were able to analyze a particular intercept-resend attack and show that the protocol is secure against this. The attack we consider is one which induces no additional noise in the channel (that is, it is undetectable). To remain hidden from $A$ and $B$, Eve simply measures the reverse channel in the $\mathcal{A}$ basis (the same basis $A$ uses, thus $E$ will have the same information as $A$ does from the reverse channel - but, importantly, not the forward channel). If this measurement results in outcome $\ket{a}$, $E$ guesses the raw key bit is $1$; otherwise she guesses it is [math] (note that if $\alpha=0$ this guess is always correct and so, in that case, the protocol is insecure as expected). We compute the values $p^{AE}_{i,j}$ for $i,j\in\{0,1\}$ which we use to denote the probability that $A$’s raw key bit is $i$ and $E$’s guess is $j$ assuming she uses this attack. From this we can compute the key-rate equation for any $\alpha$.

The attack schematic is shown in Figure 4; the key-rate for various $\alpha$ is shown in Figure 5. We notice that the key-rate is positive for all $\alpha\in(0,1)$ (of course it is insecure if $\alpha=0$ or $1$). The optimal choice for $\alpha$ in this event is $\alpha=0.5$ (contrast this with the “full” protocol we analyzed in this paper where the optimal was usually around $0.2$). Also note the asymmetry in the key-rate graph.

Of course this is only showing some evidence that this further restriction (i.e., removing $A$’s ability to use POVM $\Lambda$ as we considered in our protocol in this work) may result in a secure protocol. A complete analysis we leave as interesting future work.

VI Closing Remarks

In this paper, we developed a new SQKD protocol with a tuneable parameter $\alpha$ allowing one to gauge the effect of the secure communication rate, based on “how quantum” the protocol is. When $\alpha$ is set to zero, the communication is purely classical and thus the protocol is insecure. As $\alpha$ increases, security can be attained for certain optimal choices and for certain channels. Studying the protocol further may help to shed light on the “gap” between quantum and classical secure communication. Furthermore, our proof approach may be applicable to other (S)QKD protocols where users are highly restricted in their quantum capabilities (either intentionally or due, perhaps, to hardware faults).

Many interesting future problems remain open. Obviously the noise tolerance of our protocol is very low - though, we stress that we are only interested in this protocol from a theoretical perspective and in discovering when, or even if, this protocol can be secure (and our answer is in the affirmative). However, it would be interesting to try to improve on this. Our bound may be improved by attempting to bound all terms appearing in Equation 7 (we only used the lower bound from Equation 8). Other mismatched statistics may help here. Also, studying the effect of $\alpha$ against different forms of attacks (e.g., practical intercept-resend attacks) may also be highly beneficial and interesting.

Another interesting question is whether we can reduce the resource requirements of the users even further. As commented on in the previous section, we attempted to analyze the case where $A$’s measurement capabilities are further reduced than what we used in this paper; so far, however, a full proof of security in that case remains an open problem.

Acknowledgments: AG would like to acknowledge the support of National Science Foundation grant number 1659764, which supported her during a summer REU at the University of Connecticut. WK and HI are partially supported by the NSF under grant number 1812070.