Guessing probability in quantum key distribution

TL;DR

This paper introduces a new method to significantly tighten the upper bound on guessing probability in quantum key distribution, demonstrating that existing security measures are far more effective than previously believed.

Contribution

A simple and efficient approach to tighten the upper bound of guessing probability in quantum key distribution, improving previous bounds by thousands of orders of magnitude.

Findings

Upper bound of guessing probability can be tightened by thousands of orders of magnitude.

The new bound shows existing trace distance security is much stronger than previously assumed.

For a 10^{-9}-secure key, the bound is as low as 2*10^(-3277).

Abstract

On the basis of the existing trace distance result, we present a simple and efficient method to tighten the upper bound of the guessing probability. The guessing probability of the final key k can be upper bounded by the guessing probability of another key k', if k' can be mapped from the final key k. Compared with the known methods, our result is more tightened by thousands of orders of magnitude. For example, given a 10^{-9}-secure key from the sifted key, the upper bound of the guessing probability obtained using our method is 2*10^(-3277). This value is smaller than the existing result 10^(-9) by more than 3000 orders of magnitude. Our result shows that from the perspective of guessing probability, the performance of the existing trace distance security is actually much better than what was assumed in the past.

Tables

Table 1. Table 1: Comparison of the guessing probability, where Q tol = 2.14 % subscript 𝑄 tol percent 2.14 Q_{\mathrm{tol}}=2.14\% is the channel error tolerance, N z = 0.22 ​ N tol subscript 𝑁 𝑧 0.22 subscript 𝑁 tol N_{z}=0.22N_{\mathrm{tol}} is the length of the string used to do parameter estimation, N tol subscript 𝑁 tol N_{\mathrm{tol}} is the total length of the sifted key, N = 0.78 ​ N tol 𝑁 0.78 subscript 𝑁 tol N=0.78N_{\mathrm{tol}} is the length of the string for key generation, ε = 10 − 9 𝜀 superscript 10 9 \varepsilon=10^{-9} is the security level, n 𝑛 n is the length of the 10 − 9 superscript 10 9 10^{-9} -secure key, and p g subscript 𝑝 g p_{\mathrm{g}} is the probability of correctly guessing the final key. Specifically, p g Thm ​ .2 superscript subscript 𝑝 g Thm .2 p_{\mathrm{g}}^{\mathrm{Thm.2}} is the result of Theorem 2 of this work.

$N_{\mathrm{tol}}$	${10}^4$	${10}^5$	${10}^6$
$n$	$2.01\times {10}^3$	$4.06\times {10}^4$	$4.90\times {10}^5$
$p_g$Yuen (2016)	${10}^{-6}$	${10}^{-6}$	${10}^{-6}$
$p_g$Portmann and Renner (2014)	${10}^{-9}$	${10}^{-9}$	${10}^{-9}$
$p_g^{\mathrm{Thm}.2}$	$2\times {10}^{-32}$	$2\times {10}^{-327}$	$2\times {10}^{-3277}$

Table 2. Table 2: Comparison of the rate r = n / N tol 𝑟 𝑛 subscript 𝑁 tol r=n/N_{\mathrm{tol}} and r ′ = n ′ / N tol superscript 𝑟 ′ superscript 𝑛 ′ subscript 𝑁 tol r^{\prime}=n^{\prime}/N_{\mathrm{tol}} under the same parameters shows in Table.  1 . ε 𝜀 \varepsilon and ε ′ superscript 𝜀 ′ \varepsilon^{\prime} are the security levels, n 𝑛 n and n ′ superscript 𝑛 ′ n^{\prime} are the length of ε 𝜀 \varepsilon -secure key and the length of ε ′ superscript 𝜀 ′ \varepsilon^{\prime} -secure key, respectively.

$N_{\mathrm{tol}}$	${10}^4$	${10}^5$	${10}^6$
$\epsilon$	${10}^{-9}$	${10}^{-9}$	${10}^{-9}$
$n$	$2.01\times {10}^3$	$4.06\times {10}^4$	$4.90\times {10}^5$
$r$	$0.20$	$0.41$	$0.49$
${\epsilon }^{\prime }$	${10}^{-32}$	${10}^{-327}$	${10}^{-3277}$
$n^{\prime }$	$136$	$1.12\times {10}^3$	$1.10\times {10}^4$
$r^{\prime }$	$0.01$	$0.01$	$0.01$

Equations

$$\frac{1}{2}\parallel {\rho }_{\mathrm{AE}}-{\rho }_{\mathrm{U}}\otimes {\rho }_{\mathrm{E}}{\parallel }_1\le \epsilon ,$$

$$p(\mathbf{k})\le p({\mathbf{k}}^{\prime }).$$

$$p(\mathbf{k})\le \bar{p}({\mathbf{k}}^{\prime })=\frac{1}{2^{n_2}}+{\epsilon }_{{\mathbf{k}}^{\prime }}.$$

$$p(\mathbf{k})\le p({\mathbf{k}}^{\prime }).$$

$$p({\mathbf{k}}^{\prime })\le \bar{p}({\mathbf{k}}^{\prime })=\frac{1}{2^{n_2}}+{\epsilon }_{{\mathbf{k}}^{\prime }},$$

$$p(\mathbf{k})\le \bar{p}({\mathbf{k}}^{\prime })=\frac{1}{2^{n_2}}+{\epsilon }_{{\mathbf{k}}^{\prime }}.$$

$${\mathbf{k}}^{\prime }=M(\mathbf{k})=R_{n_{2}N}\mathbf{s}.$$

$$2^{-n_2}={\epsilon }_{{\mathbf{k}}^{\prime }}(n_2),$$

$$n_1>n_2.$$

$$p(\mathbf{k})\le \bar{p}({\mathbf{k}}^{\prime })=2^{-(n_2-1)},$$

$${\rho }_{\mathrm{XE}}=\sum _{\mathbf{x}\in \mathcal{X}}|\mathbf{x}⟩⟨\mathbf{x}|\otimes {\rho }_E^{\mathbf{x}},$$

$$\frac{1}{2}\parallel {\rho }_{\mathrm{XE}}-{\rho }_{{\mathrm{U}}_{\mathbf{x}}}\otimes {\rho }_{\mathrm{E}}{\parallel }_1\le {\epsilon }_{\mathbf{x}},$$

$$\frac{1}{2}\Vert {\rho }_{\mathrm{XE}}-{\rho }_{{\mathrm{U}}_{\mathbf{x}}}\otimes {\rho }_{\mathrm{E}}{\Vert }_1$$

$$\ge$$

$$=$$

$$\frac{1}{2}\sum _{\mathbf{x}\in \mathcal{X}}|q(\mathbf{x})-\frac{1}{2^n}|$$

$$=$$

$$\ge$$

$$=$$

$$p(\mathbf{k})\le \bar{p}(\mathbf{k})=\frac{1}{2^{n_1}}+{\epsilon }_{\mathbf{k}},$$

$$\frac{1}{2}\parallel {\rho }_{\mathrm{AE}}-{\rho }_{\mathrm{U}}\otimes {\rho }_{\mathrm{E}}{\parallel }_1\le {\epsilon }_{\mathbf{k}},$$

$$n_2\le N[1-h(Q_{\mathrm{tol}}+\mu )]-fNh(Q_{\mathrm{tol}})-\log \frac{2}{{\epsilon }_{{\mathbf{k}}^{\prime }}^3}$$

$$2^{-n_2}={\epsilon }_{{\mathbf{k}}^{\prime }}(n_2).$$

$$-\log {\epsilon }_{{\mathbf{k}}^{\prime }}=N[1-h(Q_{\mathrm{tol}}+\mu )]-fNh(Q_{\mathrm{tol}})-\log \frac{2}{{\epsilon }_{{\mathbf{k}}^{\prime }}^3},$$

Full text

I Introduction

The first quantum key distribution (QKD) protocol has been proposed by Bennett and Brassard in 1984; the protocol was based on the fundamentals of quantum mechanics Bennett (1984). Since then, the security of QKD has always been the central issue in the quantum cryptographic field Renner (2008). Trace distance is a very important security criterion  Curty et al. (2014); Tomamichel et al. (2012). It provides the universal composable security Ben-Or et al. (2005); Renner and König (2005), which can guarantee the security of key regardless of its application such as one-time pad (OTP). This is why many studies choose trace distance for the security criterion König et al. (2007); Tomamichel et al. (2012); Curty et al. (2014); Hayashi and Tsurumaru (2012).

In a classical practical cryptosystem, the impact of guessing probability on security is very important Alimomeni and Safavi-Naini (2012); Issa and Wagner (2017). Specifically, the key generated by the QKD protocol is not based on the presumed hardness of mathematical problems; thus, the eavesdropper Eve can only guess the final key via the measurement result of her probe. The guessing probability intuitively describes the probability that Eve can correctly guesses the final key, which can reflect the number of guesses that Eve requires to obtain the final key.

There are few studies on the guessing probability of QKD. Because there are more rigorous security criterions, such as the trace distance Ben-Or et al. (2005); Renner and König (2005), which gives the composable security. This makes the theoretical foundation for security of QKD crucially important. However, in the real application of QKD projects, customers often ask the question of guessing probability. The existing prior art results cannot give them a satisfactory upper bound Portmann and Renner (2014). Consequently, some people questioned the security of QKD by relying on the prior art results of guessing probability Yuen (2016). For example, according to the existing result Portmann and Renner (2014), the guessing probability of the $\varepsilon$-secure key is approximately $10^{-9}$ if $\varepsilon$ is approximately $10^{-9}$. From the perspective of guessing probability, the security of the value $10^{-9}$ is equivalent to that of a $30$ perfect bits. The existing classical computer systems can easily crack such key. In practice, it is not unusual to request a much smaller guessing probability such as $10^{-100}$ or $10^{-1000}$. Therefore, it is beneficial to find a more tightened upper bound of guessing probability.

As an important criterion in cryptography, guessing probability alone cannot guarantee the security of the final key. However, the large value of the loose upper bound of the guessing probability does not indicate the insecurity of the final key Yuen (2016) because the value is not achievable by Eve, and one can find a more tightened value for the upper bound of the guessing probability. Here, by applying the trace distance criterion Renner (2008), we find such tightened bound. We show that the guessing probability is actually smaller than the existing bound values by many orders of magnitude if one takes the privacy amplification by Toeplitz matrix. This shows that the trace distance criterion Renner (2008) can actually produce a much better result than what was assumed previously in the viewpoint of guessing probability.

II Results

We consider the security definitions of a practical QKD protocol with finite size under the framework of composable security Canetti (2001); Müller-Quade and Renner (2009); Tomamichel et al. (2012); Curty et al. (2014). Suppose that Alice and Bob get two $N$-bit sifted key strings, $\mathbf{s}$ and $\mathbf{s}^{\prime}$. By performing an error correction and private amplification scheme, Alice gets a $n_{1}$-bit key $\mathbf{k}$, and Bob gets an estimate key $\mathbf{\hat{k}}$ of $\mathbf{k}$ from $\mathbf{s}$ and $\mathbf{s}^{\prime}$. The protocol is $\varepsilon_{\mathrm{cor}}$-correct if $P[\mathbf{k}\neq\mathbf{\hat{k}}]\leq\varepsilon_{\mathrm{cor}}$. In general, the key $\mathbf{k}$ of Alice can be correlated with an eavesdropper system, and the density matrix of Alice and Eve is $\rho_{\mathrm{AE}}$. The protocol outputs an $\varepsilon$-secure key König et al. (2007), if

[TABLE]

where $\parallel\centerdot\parallel_{1}$ denotes the trace norm, $\rho_{\mathrm{U}}$ is the fully mixed state of Alice’s system. The protocol is $\varepsilon_{\mathrm{tol}}$-secure if $\varepsilon_{\mathrm{cor}}$ and $\varepsilon$ satisfy $\varepsilon_{\mathrm{cor}}+\varepsilon\leq\varepsilon_{\mathrm{tol}}$, which means that it is $\varepsilon_{\mathrm{tol}}$-indistinguishable from a perfect protocol (which is correct and secret). Without any loss of generality, we consider the case of $\varepsilon_{\mathrm{cor}}=\varepsilon$ in this article.

We define the security level:

Definition 1

If key $\mathbf{k}$ is $\varepsilon$-secure, the security level of key $\mathbf{k}$ is $\varepsilon$.

For symbol clarity, we will use notation $\varepsilon_{\mathbf{k}}$ for the security level of key $\mathbf{k}$. With this definition, we can say that the key $\mathbf{k}$ is $\varepsilon_{\mathbf{k}}$-secure or that its security level is $\varepsilon_{\mathbf{k}}$.

We define the guessing probability:

Definition 2

Let the final key generated by the QKD protocol be $\mathbf{k}$; the guessing probability of $\mathbf{k}$ is defined as the success probability of the attacker Eve guessing the final key via her measurement result and is denoted as $p(\mathbf{k})$.

Lemma 1

The guessing probability of $\varepsilon_{\mathbf{k}}$-secure key $\mathbf{k}$ with length $n_{1}$ is not larger than $\frac{1}{2^{n_{1}}}+\varepsilon_{\mathbf{k}}$.

This is a conclusion from Ref. Portmann and Renner (2014). The proof has been already given in Ref. Portmann and Renner (2014); for the convenience of readers, we write the proof again in the Method section.

According to Lemma 1, the guessing probability of key $\mathbf{k}$ can be divided into two parts; one part $2^{-n_{1}}$ is related to the length of the key, the other part $\varepsilon_{\mathbf{k}}(n_{1})$ is related to the security level. Under the framework of universally composable security, when calculating the final key length, we often make the security level to be between $10^{-9}\sim 10^{-24}$, which is much bigger than $2^{-n_{1}}$ because $n_{1}$ is often $10^{3},10^{4}$, or larger. Therefore, $2^{-n_{1}}$ can be ignored and $p(\mathbf{k})\leq\bar{p}(\mathbf{k})\sim\mathcal{O}(\varepsilon(\mathbf{k}))$. However, the guessing probability of a secure key with a length of tens of bits can also reach this magnitude. Therefore, when the secure requirements are very high, it is clearly not enough for a key with a length of thousands of bits or even longer if the upper bound of guessing probability only stops at this magnitude. Therefore, we cannot simply use this formula alone to obtain the upper bound of the guessing probability. Fortunately, we have a much better way for tightening the bound. The approach will be presented below.

Lemma 2

If key $\mathbf{k}$ can be mapped to string $\mathbf{k}^{\prime}$ by a map $M$ that is known to Eve, then the guessing probability of $\mathbf{k}$ cannot be larger than the guessing probability of string $\mathbf{k}^{\prime}$, i.e.,

[TABLE]

Here $p(\mathbf{k}),p(\mathbf{k}^{\prime})$ are the guessing probabilities of $\mathbf{k}$ and $\mathbf{k}^{\prime}$, respectively.

Proof. This lemma is clear because when Eve can correctly guess $\mathbf{k}$, Eve can obtain $\mathbf{k}^{\prime}$ by knowing the map $M$. Otherwise, Eve can still correctly guess the $\mathbf{k}^{\prime}$ with a probability not less than [math], i.e., $p(\mathbf{k}^{\prime})=p(\mathbf{k})+\delta,\delta\geq 0$.

Theorem 1

If the $\varepsilon_{\mathbf{k}}$-secure key $\mathbf{k}$ with a length $n_{1}$ can be mapped to the $\varepsilon_{\mathbf{k}^{\prime}}$-secure key $\mathbf{k}^{\prime}$ with length $n_{2}$, the guessing probability of $\mathbf{k}$ cannot be larger than $\mathbf{k}^{\prime}$, i.e.,

[TABLE]

Proof. This theorem actually requires two conditions:

i) the final key $\mathbf{k}$ can be mapped to the string $\mathbf{k}^{\prime}$,

ii) the string $\mathbf{k}^{\prime}$ can be regarded as a $\varepsilon_{\mathbf{k}^{\prime}}$-secure key.

Using the above-mentioned conditions, the proof is very simple. Given the condition i), we can apply Lemma 2 to obtain

[TABLE]

Given the condition ii), we can apply Lemma 1 to obtain

[TABLE]

where $\bar{p}(\mathbf{k}^{\prime})$ is the upper bound of $p(\mathbf{k}^{\prime})$. According to Eqs. (4) and (5), we can obtain

[TABLE]

This ends our proof of Theorem 1.

As discussed above, if the length of the final key $\mathbf{k}$ and the string $\mathbf{k}^{\prime}$ are very large, then $2^{-n_{1}}$ and $2^{-n_{2}}$ can be ignored. Meanwhile, if $n_{2}<n_{1}$ and $\varepsilon_{\mathbf{k}^{\prime}}<\varepsilon_{\mathbf{k}}$, then $2^{-n_{2}}+\varepsilon_{\mathbf{k}^{\prime}}\sim\varepsilon_{\mathbf{k}^{\prime}}\leq\varepsilon_{\mathbf{k}}\sim 2^{-n_{1}}+\varepsilon_{\mathbf{k}}$. Thus, Theorem 1 can provide a tighter upper bound of guessing probability.

Using Theorem 1, it is now possible for us to obtain the upper bound of the guessing probability of the $\varepsilon_{\mathbf{k}}$-secure key $\mathbf{k}$ more tightly. Instead of directly applying Lemma 1, we choose to first map $k$ to a $n_{2}$-bit string $\mathbf{k}^{\prime}=M(\mathbf{k})$. If the string $\mathbf{k}^{\prime}$ itself can be regarded as an $\varepsilon_{\mathbf{k}^{\prime}}$-secure final key, we can apply Theorem 1 by calculating $\bar{p}(\mathbf{k}^{\prime})$. In addition, we can obtain a much smaller upper bound of the guessing probability of $\mathbf{k}$ if $\varepsilon_{\mathbf{k}^{\prime}}$ is very small and $n_{2}$ is not too small. Now, the remaining problems are to determine the map $M$, to make sure that $\mathbf{k}^{\prime}=M(\mathbf{k})$ is another key that is $\varepsilon_{\mathbf{k}^{\prime}}$-secure, and to calculate $\varepsilon_{\mathbf{k}^{\prime}}$. We start our method with the hashing function in the key distillation.

Our hashing function. We use the key distillation with the random matrix. Denote $R_{nN}$ as the $n\times N$ random matrix with each element being randomly chosen to be either [math] or $1$. In addition, we represent the $N$-bit sifted string $\mathbf{s}$ by a column vector, which contains $N$ elements. To obtain the $n$-bit final key, we use the calculation $R_{nN}\mathbf{s}$. It can be easily confirmed that our random matrix belongs to the class of two-universal hashing function familyRenner (2008).

Suppose we have distilled out the $n_{1}$-bit key $\mathbf{k}$ from the $N$-bit sifted key $\mathbf{s}$ through hashing by our random matrix $R_{n_{1}N}$. We can map the $n_{1}$-bit key $\mathbf{k}$ into the $n_{2}$-bit string $\mathbf{k}^{\prime}=M(\mathbf{k})$ by deleting the last $n_{1}-n_{2}$ bits from the key string $\mathbf{k}$. Clearly, this string $\mathbf{k}^{\prime}$ mapped from $\mathbf{k}$ can be also regarded as another final key distilled from the sift key $\mathbf{s}$ by the $n_{2}\times N$ random hashing matrix $R_{n_{2}N}$, which is a submatrix of $R_{n_{1}N}$. In summary, we have

[TABLE]

This means that $\mathbf{k}^{\prime}$ is a string mapped from key $\mathbf{k}$. Moreover, $\mathbf{k}^{\prime}$ can be regarded as another final key of length $n_{2}$ distilled from the sifted key $\mathbf{s}$. Because the two conditions in Theorem 1 are satisfied, according to Theorem 1, we can obtain a tightened upper bound of $p(\mathbf{k})$ with Eq. (3) if we know the security level of key $\mathbf{k}^{\prime}$, i.e., the value of $\varepsilon_{\mathbf{k}^{\prime}}$. Because our random matrix is a class of two-universal hashing function, the value $\varepsilon_{\mathbf{k}^{\prime}}$ depends on $n_{2}$ Tomamichel et al. (2012). The details are shown in the Method section and explain the calculation of $\varepsilon_{\mathbf{k}^{\prime}}$ for $n_{2}$. Hence, in the QKD protocol that uses a random hashing matrix presented here, to obtain the upper bound of the guessing probability of the $n_{1}$-bit final key $\mathbf{k}$, we can summarize the procedure above by the following scheme:

Scheme

1. Given the $n_{1}$-bit final key $\mathbf{k}$, we delete its last $n_{1}-n_{2}$ bits and obtain a string $\mathbf{k}^{\prime}$. 2) We regard $\mathbf{k}^{\prime}$ as another possible final key that is $\varepsilon_{\mathbf{k}^{\prime}}$-secure. Compute the $\varepsilon_{\mathbf{k}^{\prime}}$ value of $\mathbf{k}^{\prime}$ with the input parameters $N$ and $n_{2}$. 3) Calculate $\bar{p}(\mathbf{k})$ by Theorem 1 through Eq. (3).

Because in our scheme the value of $\varepsilon_{\mathbf{k}^{\prime}}$ is dependent on $n_{2}$, as shown in the Method section, we can now replace $\varepsilon_{\mathbf{k}^{\prime}}$ by a functional form, $\varepsilon_{\mathbf{k}^{\prime}}(n_{2})$. To obtain the tightened upper bound value of the guessing probability in scheme 1, we need to choose an appropriate $n_{2}$ value. In our calculation, we set the condition

[TABLE]

for the appropriate $n_{2}$.

For any $n>n_{2}$, we have $\varepsilon_{\mathbf{k}}(n)>\varepsilon_{\mathbf{k}^{\prime}}(n_{2})=2^{-n_{2}}$; however, for any $n<n_{2}$, we have $2^{-n}>2^{-n_{2}}$. In conclusion, if $n\neq n_{2}$, $2^{-n}+\varepsilon_{\mathbf{k}}(n)>2^{-n_{2}}$. Therefore, in this study, we set $2^{-n_{2}}=\varepsilon_{\mathbf{k}^{\prime}}(n_{2})$, and obtain a tightened guessing probability $2^{-n_{2}+1}$.

Once we determine the value $n_{2}$ and the corresponding $\varepsilon_{\mathbf{k}^{\prime}}(n_{2})$, we calculate $\bar{p}(\mathbf{k}^{\prime})$ by Eq. (3). Clearly, this is the upper bound of the guessing probability of the final key $\mathbf{k}$ of length $n_{1}$ provided that

[TABLE]

Thus, we can actually use a more efficient scheme to obtain the upper bound of the guessing probability of key $\mathbf{k}$, as the following Theorem 2:

Theorem 2

In the QKD protocol, if the $n_{1}$-bit final key $\mathbf{k}$ is distilled from the sifted key $\mathbf{s}$ using a random matrix $R_{n_{1}N}$, the guessing probability of $\mathbf{k}$ can be upper bounded by

[TABLE]

where $\mathbf{k}^{\prime}=M(\mathbf{k})=R_{n_{2}N}\mathbf{s}$ and $n_{2}$ satisfies $2^{-n_{2}}=\varepsilon_{\mathbf{k}^{\prime}}(n_{2}),n_{2}<n_{1}.$

As shown in Fig. 1, the arrow between $\mathbf{s}$ and $\mathbf{k}$ indicates that the $\varepsilon_{\mathbf{k}}$-secure $n_{1}$-bit final key $\mathbf{k}$ can be distilled from the $N$-bit sifted key $\mathbf{s}$ using a random matrix $R_{n_{1}N}$, i.e. $\mathbf{k}=R_{n_{1}N}{\mathbf{s}}$. The arrow between $\mathbf{k}$ and $\mathbf{k}^{\prime}$ indicates that there exists a map $M$ that can map the key $\mathbf{k}$ into $\mathbf{k}^{\prime}$, i.e., $\mathbf{k}^{\prime}=M(\mathbf{k})$. The arrow between the sifted key $\mathbf{s}$ and $\mathbf{k}^{\prime}$ indicates that if a random hashing matrix $R_{n_{2}N}$ is used to distill the final key, we have $\mathbf{k}^{\prime}=R_{n_{2}N}\mathbf{s}$. Then if $n_{2}$ satisfies the condition in Theorem 2, a tightened guessing probability of $\mathbf{k}$ can be obtained.

There are two important points need to be noticed. First, when applying our theorem to obtain the non-trivial upper bound of the guessing probability for the final key $\mathbf{k}$, we do not really need to transform $\mathbf{k}$ to another string $\mathbf{k}^{\prime}$, and we only need the existence of a map that can map $\mathbf{k}$ to $\mathbf{k}^{\prime}$ mathematically. That is to say, we use the final key $\mathbf{k}$, but its guessing probability is calculated from the shorter key $\mathbf{k}^{\prime}$. As shown above, the existence has been proven. Second, in this study, we use the random matrix $R_{nN}$ as a family of two-universal hash functions to distill the key to illustrate our conclusion more intuitively. Of course, we can also use the modified Toeplitz matrix Hayashi and Tsurumaru (2012) instead of the random matrix $R_{nN}$. Thus, the final key $\mathbf{k}$ can be also mapped to the string $\mathbf{k}^{\prime}$, and the string $\mathbf{k}^{\prime}$ can also be regarded as the $\varepsilon_{\mathbf{k}^{\prime}}$-secure key. This means that the proposed theorem in this study still holds.

III Discussion

Table. 1 describes the upper bounds of the guessing probability calculated by different $N_{\mathrm{tol}}$, where $N_{\mathrm{tol}}$ is the length of the total string that includes the sifted keys for key generation and the string used to do parameter estimation. In Table. 1, $N_{\mathrm{tol}}=10^{4},10^{5}$, and $10^{6}$. Table. 1 shows that when $N_{\mathrm{tol}}=10^{6}$, $n=4.90\times 10^{5}$ and the guessing probabilities obtained using the methods of  Yuen (2016) and  Portmann and Renner (2014) are approximately $10^{-6}$ and $10^{-9}$. However, using our method, the guessing probability can be reduced to $2\times 10^{-3277}$, which is more tightened by thousands of orders of magnitude than prior art methods. With an increase in the length of $N_{\mathrm{tol}}$, the length of the final key also increases; however, the guessing probabilities in Yuen (2016) and  Portmann and Renner (2014) almost remain unchanged. Compared with Yuen (2016) and Portmann and Renner (2014), the guessing probability obtained by our method is considerably reduced, which is more realistic and tighter. It should be noted that we calculate the case without the known-plaintext attack (KPA) in Table. 1. Now, we consider the case of KPA in QKD using our method. Suppose that Eve knows the $t$ bits of the final $n_{2}$-bit key $\mathbf{k}^{\prime}$; then, the guessing probability of the $\varepsilon_{\mathbf{k}^{\prime}}$-secure key $\mathbf{k}^{\prime}$ is $p_{\mathrm{KPA}}(\mathbf{k}^{\prime})\leq 2^{-(n_{2}-t-1)}$. Now, the upper bound of the guessing probability of key $\mathbf{k}^{\prime}$ is equal to that of an ideal $(n_{2}-t-1)$-bit key.

Table. 2 compares the length of the $\varepsilon$-secure key $n$ and the length of $\varepsilon^{\prime}$-secure key $n^{\prime}$ when the total length of the sifted key is $10^{4},10^{5}$, and $10^{6}$. This table shows that if only using Lemma 1 to obtain a smaller guessing probability, $\varepsilon$ needs to be reduced. Accordingly, the length of the final key and the key rate will be considerably reduced. For example, from Table II, when $N_{\mathrm{tol}}=10^{6}$, if the customer wants to reduce the guessing probability from $10^{-9}$ to $2\times 10^{-3277}$, the length of the key will become $n^{\prime}=1.1\times 10^{4}$, and the key rate will become $r^{\prime}=0.01$. This result is much lower than the original key length $n=4.9\times 10^{5}$ and the key rate $r=0.49$. Using our result, there is actually no bit cost for a much smaller bound value of guessing probability. For example, when $N_{\mathrm{tol}}=10^{6}$, we can upper bound the guessing probability by $2\times 10^{-3277}$ by setting $\varepsilon=10^{-9}$. Thus, without reducing the value of $\varepsilon$, we can obtain a tightened upper bound of guessing probability $p_{\mathrm{g}}^{\mathrm{Thm.2}}$ of $\mathbf{k}$, as can be seen from Table. 1.

Our result shows that in terms of guessing probability, the performance of the existing trace distance security is much better than what has been assumed in the past. Incidentally, after the upper bound value $10^{-9}$ was presented in Ref. Portmann and Renner (2014), a looser upper bound, $10^{-6}$ for guessing probability was presented Yuen (2016). We emphasize that this looser upper bound does not in any sense challenge the validity of the existing security proof of QKD Portmann and Renner (2014). Although the large value of lower bound of Eve’s guessing probability can show insecurity, the large value of upper bound cannot show insecurity. If one does not make any effort, one can also obtain a large-value upper bound of $100\%$ for Eve’s guessing probability. Such value is correct for the upper bound but not meaningful. If any new upper bound is larger than that in the prior art result, it means that the ”new upper bound” is trivial and meaningless rather than the prior art result is invalid. Thus, the looser upper bound presented by Ref. Yuen (2016) only shows that Eve’s guessing probability of the key is smaller than $10^{-6}$. It does not conflict with more tightened results presented elsewhere.

In this study, our goal is to obtain a tightened guessing probability. On the basis of the existing secure criterion (Trace distance) and the general property of guessing probability, we propose a simple and efficient method to tighten the upper bound of the guessing probability. We find that the guessing probability $p(\mathbf{k})$ of $\mathbf{k}$ can be upper bounded by $2^{-(n_{2}-1)}$, where $n_{2}$ satisfies $2^{-n_{2}}=\varepsilon_{\mathbf{k}^{\prime}}(n_{2})$ and $n_{2}<n_{1}$. Specifically, a simple random matrix $R_{nN}$ can be used to distill the final key. Compared with the prior art results, of which the upper bound of the guessing probability of the $\varepsilon$-secure key is approximately $\varepsilon$, our method provides a more tightened upper bound. Therefore, the loose upper bound for the guessing probability obtained in Ref. Yuen (2016) cannot be regarded as evidence to question the validity of existing the security proof of QKD.

IV Method

Proof of Lemma 1

Lemma 1

The guessing probability of the $\varepsilon_{\mathbf{k}}$-secure key $\mathbf{k}$ with length $n_{1}$ is not larger than $\frac{1}{2^{n_{1}}}+\varepsilon_{\mathbf{k}}$.

This is a conclusion obtained from Ref. Portmann and Renner (2014). The proof has been already presented in Ref. Portmann and Renner (2014). Here, for the convenience of the reader, we write the proof again.

Proof. Let the $n$-bit string $\mathbf{x}$ be the $\varepsilon_{\mathbf{x}}$-secure key in $\mathcal{X}$. The density matrix of Alice and Eve is $\rho_{\mathrm{XE}}$ and satisfies

[TABLE]

where $\rho_{\mathrm{U}_{\mathbf{x}}}$ is the fully mixed state in $\mathcal{X}$. Then we have

[TABLE]

Eve’s guessing probability of string $\mathbf{x}$ is $q(\mathbf{x})$, and the maximum guessing probability is $p_{\mathrm{g}}=\max_{\mathbf{x}\in\mathcal{X}}\{q(\mathbf{x})\}$. Without any loss of generality, it is possible to assume that the maximum guessing probability is $q(\mathbf{x}^{\prime})$. Note that $\sum_{\mathbf{x}\in\mathcal{X}}q(\mathbf{x})=1$, then the following holds

[TABLE]

From Eqs.(11)-(13), we have $p_{\mathrm{g}}\leq{2^{-n_{1}}}+\varepsilon_{\mathbf{x}}$; thus, for the $n_{1}$-bit $\varepsilon_{\mathbf{k}}$-secure key $\mathbf{k}$, the guessing probability satisfies

[TABLE]

where $\bar{p}(\mathbf{k})$ is the upper bound of $p(\mathbf{k})$. This ends our proof of Lemma 1.

Calculation of $\varepsilon_{\mathbf{k}^{\prime}}$

We consider the security definitions of a practical QKD protocol with a finite-size under the framework of composable security Canetti (2001); Müller-Quade and Renner (2009); Tomamichel et al. (2012). Suppose that Alice and Bob get two $N$-bit sifted key strings. By performing an error correction and private amplification scheme, Alice get a $n$-bit final key $\mathbf{k}$ and Bob get an estimate $\mathbf{\hat{k}}$ of $\mathbf{k}$. The protocol is $\varepsilon_{\mathrm{cor}}$-correct if $P[\mathbf{k}\neq\mathbf{\hat{k}}]\leq\varepsilon_{\mathrm{cor}}$. In general, the key $\mathbf{k}$ of Alice can be correlated with an eavesdropper system, and the density matrix of Alice and Eve is $\rho_{\mathrm{AE}}$.

The protocol outputs an $\varepsilon_{\mathbf{k}}$-secure key Canetti (2001), if

[TABLE]

where $\parallel\centerdot\parallel_{1}$ denotes the trace norm, $\rho_{\mathrm{U}}$ is the fully mixed state of Alice’s system. The protocol is $\varepsilon_{\mathrm{tol}}$-secure if $\varepsilon_{\mathrm{cor}}$ and $\varepsilon_{\mathbf{k}}$ satisfies $\varepsilon_{\mathrm{cor}}+\varepsilon_{\mathbf{k}}\leq\varepsilon_{\mathrm{tol}}$, which means that it is $\varepsilon_{\mathrm{tol}}$-indistinguishable from an ideal protocol. Without any loss of generality, we consider the case of $\varepsilon_{\mathrm{cor}}=\varepsilon_{\mathbf{k}}$.

From Lemma 1, we can calculate $\bar{p}(\mathbf{k})$ given the $n$-bit $\varepsilon_{\mathbf{k}}$-secure key $\mathbf{k}$. In this situation, $\bar{p}(\mathbf{k})=2^{-n}+\varepsilon_{\mathbf{k}}$. However, in our method, we only know $N$ and $n_{2}$, which are the length of the sifted key and $\mathbf{k}^{\prime}$. (The string $\mathbf{k}^{\prime}$ itself can be also regarded as another final key distilled from the sifted key.) To get a tightened upper bound of the guessing probability of $\mathbf{k}$, we need to obtain the value of $\varepsilon_{\mathbf{k}^{\prime}}$ . According to Ref. Tomamichel et al. (2012), with $N$ and $n_{2}$, the final key is $\varepsilon_{\mathbf{k}^{\prime}}$-secure if $\varepsilon_{\mathbf{k}^{\prime}}$ satisfies the following equation:

[TABLE]

where $\mu=\sqrt{\frac{N+N_{z}}{NN_{z}}\frac{N_{z}+1}{N_{z}}\ln\frac{2}{\varepsilon_{\mathbf{k}^{\prime}}}}$, $N_{z}$ is the length of string used for parameter estimation, $f=1.1$, $h$ denotes the binary Shannon entropy function, $h(x)=-x\log x-(1-x)\log(1-x)$ and $Q_{\mathrm{tol}}$ represents the channel error tolerance. To obtain non-trivial results, we use equality in Eq. (16) to calculate the value of $\varepsilon_{\mathbf{k}^{\prime}}$, given the input $n_{2}$. Since $\varepsilon_{\mathbf{k}^{\prime}}$ is dependent on $n_{2}$, we use notation $\varepsilon_{\mathbf{k}^{\prime}}(n_{2})$ for $\varepsilon_{\mathbf{k}^{\prime}}$. Here, $\varepsilon_{\mathbf{k}^{\prime}}(n_{2})$, if $n_{2}$ is given and we numerically find the value of $\varepsilon_{\mathbf{k}^{\prime}}$ by Eq. (16).

In our calculation, we choose specific a $n_{2}$-value that satisfies

[TABLE]

In combination with Eq. (16),we obtain the following equation for the tightened $\varepsilon_{\mathbf{k}^{\prime}}$ value:

[TABLE]

and we can calculate the value of $\varepsilon_{\mathbf{k}^{\prime}}$ and then calculate the guessing probability by Eq. (8) in our main body text.

data availability

The data that support the findings of this study are available from the corresponding author upon reasonable request.

acknowledgement

We acknowledge the financial support in part by Ministration of Science and Technology of China through The National Key Research and Development Program of China grant No. 2017YFA0303901; National Natural Science Foundation of China grant No. 11474182, 11774198, 11974204 and U1738142.

author contributions

Xiang-Bin Wang developed the theory, Jing-Tao Wang and Ji-Qian Qin contributed equally to the calculation work, Cong Jiang and Zong-Wen Yu contributed to simulation work. All authors contributed to the manuscript.

Competing interests

The authors declare no competing interests.

Additional information

Correspondence and requests for materials should be addressed to X.-B.W., J.-T.W. or Z.-W.Y.