Toward Undetectable Quantum Key Distribution over Bosonic Channels

TL;DR

This paper demonstrates the possibility of covert quantum key distribution over bosonic channels using a novel protocol that ensures undetectability from an adversary, with theoretical bounds and practical implications for secure communication.

Contribution

It introduces a protocol combining pulse-position modulation and multi-level coding for covert QKD, along with a new bound on Eve's information for bosonic channels.

Findings

Covert key expansion is feasible over quantum channels with limited adversary control.

The protocol achieves undetectability, making communication indistinguishable from random noise.

A new bound on Eve's information enables positive throughput in bosonic channels.

Abstract

We show that covert secret key expansion is possible using a public authenticated classical channel and a quantum channel largely under control of an adversary, which we precisely define. We also prove a converse result showing that, under the golden standard of quantum key distribution by which the adversary completely controls the quantum channel, no covert key generation is possible. We propose a protocol based on pulse-position modulation and multi-level coding that allows one to use traditional quantum key distribution (QKD) protocols while ensuring covertness, in the sense that no statistical test by the adversary can detect the presence of communication better than a random guess. When run over a bosonic channel, our protocol can leverage existing discrete-modulated continuous variable protocols. Since existing techniques to bound Eve's information do not directly apply, we develop a new bound that results in positive throughput for a range of channel parameters.

Equations

$${\chi }_2\left(\rho \Vert \sigma \right)\triangleq \{\begin{array}{ll}\text{tr}\left({\rho }^2{\sigma }^{-1}\right)-1& \text{if }\text{supp}(\rho )\subset \text{supp}(\sigma ),\\ \infty & \text{otherwise}.\end{array}$$

$${\mathcal{E}}_{X\to Y}^f:\mathcal{B}({\mathcal{H}}_X)$$

$${\rho }_X$$

$$\begin{gathered} {\sigma }_{A{Q}^n{E}^n}\triangleq \\ ({\text{id}}_{R{R}_A{R}_{B}A}\otimes {\mathcal{U}}_{Q^n\to Q^n{E}^n}\circ {\mathcal{E}}_{Q\to Q}^{\text{scalebox}0.7\otimes })({\tilde{\sigma }}_{R{R}_A{R}_{B}A{Q}^n}) \end{gathered}$$

$$\begin{gathered} {\sigma }_{C{S}_A{S}_B{E}^n}\triangleq \\ ({\text{id}}_{E^n}\otimes {\mathcal{D}}_{R_A{R}_{B}RA{Q}^n\to C{S}_A{S}_B})({\sigma }_{R{R}_A{R}_{B}A{Q}^n}). \end{gathered}$$

$$\begin{gathered} (1-5\sqrt{\mu }-ϵ-2\delta )K⩽2\delta \log \dim {\mathcal{H}}_C+{\mathbb{H}}_b\left(\sqrt{\mu }\right) \\ +{\mathbb{H}}_b\left(ϵ+\sqrt{\mu }\right)+2\left(1+\sqrt{\mu }\right){\mathbb{H}}_b\left(\frac{\sqrt{\mu }}{1+\sqrt{\mu }}\right). \end{gathered}$$

$$⟨\varphi |0⟩$$

$$\mathrm{supp}\left({\mathcal{E}}_{Q\to Q}(|1⟩⟨1|)\right)$$

$${|0⟩}^{\text{scalebox}0.7\otimes }\otimes |\varphi ⟩\otimes {|0⟩}^{\text{scalebox}0.7\otimes },$$

$$d(X_i,V_i)\triangleq (X_i-1)m_v+V_i,$$

$${\rho }_{Q^n}^{x^{\ell },v^{\ell }}\triangleq {\otimes }_{i=1}^{\ell }|\mathrm{PPM},d(x_i,v_i)⟩⟨\mathrm{PPM},d(x_i,v_i)|$$

$$g:[[1,h]]\to [[1,m_v{]]}^{\ell }:R\mapsto V^{\ell }=g(R).$$

$$v^{\ell }\mapsto \frac{1}{{m_x}^{\ell }}\sum _{x^{\ell }}{\mathcal{E}}_{Q\to Q}^{\text{scalebox}0.7\otimes }\left({\rho }_{Q^n}^{x^{\ell },v^{\ell }}\right).$$

$${\sigma }_{Q^n}\triangleq \frac{1}{{m_x}^{\ell }}\frac{1}{h}\sum _{x^{\ell },r}{\mathcal{E}}_{Q\to Q}^{\text{scalebox}0.7\otimes }\left({\rho }_{Q^n}^{x^{\ell },g(r)}\right).$$

$$\mathbb{P}\left(X^{{\ell }_2}\ne {\hat{X}}^{{\ell }_2}\right)⩽{ϵ}_{\mathrm{IR}},$$

$$\mathbb{P}\left(\mathrm{abort}|\text{leavevmode}\mathrm{honest}\text{leavevmode}\mathrm{channel}\right)⩽{ϵ}_{\mathrm{IR}},$$

$${\Vert {\sigma }_{C_{\mathrm{IR}}{E}^n{C}^{\prime }}-{\rho }_{C_{\mathrm{IR}}}^{\mathrm{unif}}\otimes {\sigma }_{E^n{C}^{\prime }}\Vert }_1⩽{ϵ}_{\mathrm{IR}}.$$

$$\log h=\frac{\ell }{m_x}{\chi }_2({\rho }_E^1\Vert {\rho }_E^0)+\sqrt{\ell }\left(2\log m_v+3\right)\sqrt{\log \frac{4}{{\lambda }_2}+1},$$

$${\Vert {\sigma }_{E^{n}C}-{\rho }_{E^n}^0\otimes {\rho }_C^{\mathrm{unif}}\Vert }_1⩽{\lambda }_1+{\lambda }_2+{ϵ}_{\mathrm{IR}}+{\delta }_{\mathrm{PA}},$$

$${\lambda }_1$$

$${\Vert {\sigma }_{E^{n}C}-{\rho }_{E^n}^0\otimes {\rho }_C^{\mathrm{unif}}\Vert }_1$$

$$⩽{\Vert {\sigma }_{E^{n}C}-{\sigma }_{E^n{C}^{\prime }}\otimes {\rho }_{C^{\prime \prime }}^{\mathrm{unif}}\Vert }_1$$

$$+{\Vert {\sigma }_{E^n{C}^{\prime }}\otimes {\rho }_{C^{\prime \prime }}^{\mathrm{unif}}-{\rho }_{E^n}^0\otimes {\rho }_C^{\mathrm{unif}}\Vert }_1$$

$$={\Vert {\sigma }_{E^{n}C}-{\sigma }_{E^n{C}^{\prime }}\otimes {\rho }_{C^{\prime \prime }}^{\mathrm{unif}}\Vert }_1+{\Vert {\sigma }_{E^n{C}^{\prime }}-{\rho }_{E^n}^0\otimes {\rho }_{C^{\prime }}^{\mathrm{unif}}\Vert }_1$$

$${\Vert {\sigma }_{E^n}-{\rho }_{E^n}^0\Vert }_1$$

$$={\Vert {\mathcal{U}}_{Q^n\to E^n}({\tilde{\sigma }}_{Q^n{C}^{\prime }})-{\mathcal{U}}_{Q^n\to E^n}({\left({\rho }_Q^0\right)}^{\text{scalebox}0.7\otimes }\otimes {\rho }_{C^{\prime }}^{\mathrm{unif}})\Vert }_1$$

$$⩽{\Vert {\tilde{\sigma }}_{Q^n{C}^{\prime }}-{\left({\rho }_Q^0\right)}^{\text{scalebox}0.7\otimes }\otimes {\rho }_{C^{\prime }}^{\mathrm{unif}}\Vert }_1.$$

$${\rho }_{Q^n}^{\mathrm{PPM}}\triangleq \frac{1}{{m_x}^{\ell }{m_v}^{\ell }}\sum _{x^{\ell },v^{\ell }}{\mathcal{E}}_{Q\to Q}^{\text{scalebox}0.7\otimes }({\rho }_{Q^n}^{x^{\ell },v^{\ell }}),$$

$$\Vert {\rho }_{Q^n}^{\mathrm{PPM}}\otimes {\rho }_{C^{\prime }}^{\mathrm{unif}}-{\left({\rho }_Q^0\right)}^{\text{scalebox}0.7\otimes }\otimes {\rho }_{C^{\prime }}^{\mathrm{unif}}\Vert$$

$$=\Vert {\rho }_{Q^n}^{\mathrm{PPM}}-{\left({\rho }_Q^0\right)}^{\text{scalebox}0.7\otimes }\Vert$$

$$\stackrel{(a)}{⩽}\sqrt{\frac{1}{2}\mathbb{D}\left({\rho }_{Q^n}^{\mathrm{PPM}}\Vert {\left({\rho }_Q^0\right)}^{\text{scalebox}0.7\otimes }\right)}$$

$$\stackrel{(b)}{⩽}\sqrt{\frac{\ell }{2m}{\chi }_2({\rho }_Q^1\Vert {\rho }_Q^0)}$$

$${\tilde{\rho }}_{Q^m}^v$$

$${\tilde{\rho }}_{Q^n}^{v^{\ell }}$$

$${\tilde{\rho }}_{V{Q}^m}$$

$${\rho }_{V{Q}^m}$$

$${\Vert {\sigma }_{Q^n{C}^{\prime }}-{\rho }_{Q^n}^{\mathrm{PPM}}\otimes {\rho }_{C^{\prime }}^{\mathrm{unif}}\Vert }_1$$

$$=\frac{1}{|\mathcal{F}|}\frac{1}{\left|\mathcal{Z}\right|}\sum _{f\in \mathcal{F},z\in \mathcal{Z}}{\Vert \frac{1}{h}\sum _{v^{\ell }\in f^{-1}(z)}{\mathcal{E}}_{Q\to Q}^{\text{scalebox}0.7\otimes }\left({\rho }_{Q^n}^{v^{\ell }}\right)-{\rho }_{Q^n}^{\mathrm{PPM}}\Vert }_1$$

Full text

I Introduction

The combination of quantum mechanics and information theory has led to several intriguing applications. In particular, there have been significant advances in QKD, which has now been successfully implemented and deployed in the field Diamanti et al. (2016). QKD finds its foundations in two pioneering papers Bennett Ch and Brassard (1984); Ekert (1991), which discovered that non-classical signaling allows two parties (Alice and Bob) to exploit the laws of quantum mechanics and bound the information leaked to any adversary (Eve); when combined with classical information-theoretic tools, such as information reconciliation and privacy amplification, this observation can lead to protocols for the distillation of secure key bits. The security proofs of QKD have evolved from considering simple attacks, in which Eve could only perform a measurement on each transmitted signal and send another state to Bob, to accounting for all attacks that could be described in the framework of quantum mechanics, known as coherent attacks Renner (2008); recent proofs even consider an adversary who tampers with the legitimate users’ measurement devices Acín et al. (2007).

Although QKD ensures the confidentiality of the generated keys in an extremely strong sense, Alice and Bob might desire other security features. One such feature that has recently attracted attention is covertness Bash et al. (2013); Wang et al. (2016); Bloch (2016), i.e., the ability to prevent an adversary from distinguishing whether a communication protocol is running or not from its observations. For memory-less classical and classical-quantum (cq) channels, over which Alice aims at sending a message, a square root law has been established Bash et al. (2013); Sheikholeslami et al. (2016) and states that the optimal number of bits that can be reliably and covertly transmitted scales as the square root of the number of channel uses. This contrasts with the limits of confidential communication, for which a linear scaling is feasible. The main intuition behind the square root law is that the central limit theorem ensures the presence of statistical uncertainty in Eve’s observations, on the order of the square root of the number of channel uses, in which the transmitter can hide its signals.

The first attempts at covert QKD Arrazola and Scarani (2016); Bash et al. (2015) have ensured covertness with fully coordinated protocols, in which information-bearing qubits are only transmitted over a secret random subset of channel uses upon which Alice and Bob secretly agree prior to communication; in the remaining channel uses Alice transmits an “idle” state corresponding to no communication. If $n$ denotes the total number of channel uses and $t$ denotes the number of channel uses over which transmission happens, fully coordinated protocols Arrazola and Scarani (2016); Bash et al. (2015) require $t=\Theta(\sqrt{n})$ to generate $\Omega(\sqrt{n})$ bits of secret key. Although the processing complexity is identical to that of standard QKD protocols, fully coordinated protocols require Alice and Bob to share $\log\binom{n}{t}=\Theta(\sqrt{n}\log n)$ secret bits prior to communication, so that the number of required key bit asymptotically dominates the number of generated bits.

To circumvent the impossibility of key expansion with fully coordinated protocol, we have recently proposed Tahmasbi and Bloch (2019) to achieve covertness with an uncoordinated protocol based on the use of “sparse signaling” for quantum state distribution. If $\alpha_{n}\triangleq O(n^{-\frac{1}{2}})$ and if $P_{X}$ denotes the Bernoulli($\alpha_{n}$) distribution, Alice generates an i.i.d. sequence $X^{n}=(X_{1},\cdots,X_{n})$ according to P_{X}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}, which is then modulated by mapping zero to the idle state and one to another state. A technical subtlety, however, prevents Alice and Bob from performing classical information reconciliation and privacy amplification to obtain a secret key from their shared quantum states. While the asymptotic key rate is $O(n^{-\frac{1}{2}})$ by the square root law, the finite length penalty of privacy amplification is of the order of $\omega(n^{-\frac{1}{2}})$ Watanabe and Hayashi (2013), which dominates the asymptotic rate. For a known adversary’s attack, our uncoordinated protocol circumvents this difficulty and ensures secret-key expansion using a likelihood encoder Tahmasbi and Bloch (2019) but the classical post-processing of the protocol is much more complex than for typical QKD protocols.

To reap the benefits of both fully coordinated and uncoordinated protocols and achieve secret key expansion without increasing processing complexity, we develop here a partially coordinated protocol inspired by our prior construction of low-complexity codes for covert communication over classical channels with PPM and MLC Kadampot et al. (2018). This approach is more aligned with traditional low-complexity information reconciliation and privacy amplification algorithms and we analyze the covertness and the security under an unknown attack by the adversary. We restrict, however, the adversary’s control of the channel by requiring that a portion of the channel be out of the adversary’s control (e.g., the part of channel in Alice’s laboratory). We prove that such a requirement is fundamentally necessary to establish any covertness result. We also point out that we were not able to use any standard technique to bound Eve’s information. Accordingly, we present a new bound, by which we could in our security analysis achieve positive throughputs for some range of bosonic channel parameters. While our results are slightly disappointing in that this range of useful parameters is limited, they open the way to experimental demonstrations of covert QKD.

II Notation

A system (e.g. $A$) is described by a finite-dimensional Hilbert space (e.g. ${\mathcal{H}}_{A}$). Let $\mathbf{1}_{A}$ be the identity map on ${\mathcal{H}}_{A}$ and $\rho_{A}^{\mathrm{unif}}\triangleq\frac{\mathbf{1}_{A}}{\dim{\mathcal{H}}_{A}}$, where $\dim{\mathcal{H}}_{A}$ is the dimension of ${\mathcal{H}}_{A}$. ${\mathcal{B}}({\mathcal{H}}_{A})$ denotes the set of all bounded linear operators from ${\mathcal{H}}_{A}$ to ${\mathcal{H}}_{A}$, ${\mathcal{P}}({\mathcal{H}}_{A})$ denotes the set of all positive operators in ${\mathcal{B}}({\mathcal{H}}_{A})$, and ${\mathcal{D}}({\mathcal{H}}_{A})$ denotes the set of all density operators on ${\mathcal{H}}_{A}$. For $X\in{\mathcal{B}}({\mathcal{H}}_{A})$, the trace norm of $X$ is ${{\left\|{X}\right\|}}_{1}\triangleq\text{{tr}}\left(\smash{\sqrt{X^{\dagger}X}}\right)$, and $\nu(X)$ denotes the number of distinct eigenvalues of $X$. We recall the definition of the von Neumann entropic quantities $H(\rho_{A})\triangleq{\mathbb{H}}\!\left(A\right)_{\rho}\triangleq-\text{{tr}}\left(\rho_{A}\log\rho_{A}\right)$, ${\mathbb{H}}\!\left(A|B\right)_{\rho}\triangleq{\mathbb{H}}\!\left(AB\right)_{\rho}-{\mathbb{H}}\!\left(B\right)_{\rho}$, and ${{\mathbb{I}}\!\left(A;B\right)}_{\rho}\triangleq{\mathbb{H}}\!\left(A\right)_{\rho}-{\mathbb{H}}\!\left(A|B\right)_{\rho}$. The fidelity between two density operators $\rho_{A}$ and $\sigma_{A}$ is defined as $F(\rho_{A},\sigma_{A})\triangleq{{\left\|{\smash{\sqrt{\rho_{A}}\sqrt{\sigma_{A}}}}\right\|}}_{1}^{2}$. We further define $C(\rho_{A},\sigma_{A})\triangleq\sqrt{1-F(\rho_{A},\sigma_{A})}$, which satisfies the triangle inequality. A quantum channel ${\mathcal{N}}_{A\to B}$ is a linear trace-preserving completely positive map from ${\mathcal{B}}({\mathcal{H}}_{A})$ to ${\mathcal{B}}({\mathcal{H}}_{B})$. Let $\textnormal{id}_{A}$ be the identity channel on ${\mathcal{B}}({\mathcal{H}}_{A})$. For two states $\rho$ and $\sigma$, we define

[TABLE]

For a non-empty finite set ${\mathcal{X}}$, let ${\mathcal{H}}_{X}$ be a Hilbert space defined by an orthonormal basis ${\left\{|x\rangle:x\in{\mathcal{X}}\right\}}$. For a function $f:{\mathcal{X}}\to{\mathcal{Y}}$, we define the channel

[TABLE]

III Covert QKD Setup

Alice and Bob aim at covertly expanding a secret key in the following manner. Let $R_{A}$ and $R_{B}$ be Alice’s and Bob’s local randomness, respectively, and let $R$ be a secret common randomness. As depicted in Figure 1, Alice has a transmitter in her lab to send quantum states to Bob. At any time instant, the state of the transmitter is described by a density operator on a Hilbert space ${\mathcal{H}}_{Q}$. A pure state ${|0\rangle\langle 0|}$ identifies the “idle” state of the transmitter when there is no communication 111One can associate a mixed state to no communication, but in bosonic systems, the natural choice for the idle state is a pure vacuum state.. Alice prepares a quantum state $\widetilde{\sigma}_{AQ^{n}}=\mathrm{tr}_{RR_{A}R_{B}}\left({\widetilde{\sigma}_{RR_{A}R_{B}AQ^{n}}}\right)$ and sends $\widetilde{\sigma}_{Q^{n}}$ to Bob by $n$ uses of her transmitter. The adversary Eve is assumed to receive the state through a known memoryless quantum channel, which we call probe, ${\mathcal{E}}_{Q\to Q}$ that is outside its control. Eve therefore obtains the output of {\mathcal{E}}_{Q\to Q}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n} for the input $\widetilde{\sigma}_{Q^{n}}$, which then interacts with an ancilla $E^{n}$ in Eve’s lab before being transmitted to Bob. The whole operation can be described by an isometry $U_{Q^{n}\to Q^{n}E^{n}}$, for which we denote the corresponding quantum channel by ${\mathcal{U}}_{Q^{n}\to Q^{n}E^{n}}$. We call this phase quantum state distribution, which results in the joint quantum state

[TABLE]

between Alice, Bob, and Eve, respectively. After establishing a shared quantum state, Alice and Bob interactively communicate over an authenticated classical public channel and perform measurements on their available state to generate keys $S_{A}$ and $S_{B}$, respectively. We call this phase quantum key distillation and formally describe it by a quantum channel ${\mathcal{D}}_{R_{A}R_{B}RAQ^{n}\to CS_{A}S_{B}}$, where $C$ denotes all public communication. The final state is then

[TABLE]

Furthermore, we assume that, in the absence of an adversary, Alice and Bob expect to be connected through the “honest” channel ${\mathcal{N}}_{Q\to Q}$ after the probe. Alice and Bob can also abort the protocol at any time and do not generate secret keys. For a particular protocol inducing the final joint state $\sigma_{CS_{A}S_{B}E^{n}}$, we assess the performance of the protocol with the following three quantities:

probability of error ${\mathbb{P}}{\left(S_{A}\neq S_{B}|\mathrm{not\leavevmode\nobreak\ abort}\right)}$; 2. 2.

information leakage ${{\left\|{\sigma_{S_{A}E^{n}C}-\rho_{S_{A}}^{\mathrm{unif}}\otimes\sigma_{E^{n}C}}\right\|}}_{1}$; 3. 3.

covertness ${{\left\|{\sigma_{CE^{n}}-\rho_{C}^{\mathrm{unif}}\otimes\rho_{E^{n}}^{0}}\right\|}}_{1}$, where \rho_{E^{n}}^{0}\triangleq{\mathcal{U}}_{Q^{n}\to E^{n}}({\mathcal{E}}_{Q\to Q}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}({|0\rangle\langle 0|}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n})); and 4. 4.

robustness ${\mathbb{P}}{\left(\mathrm{abort}\right)}$ in the presence of the honest channel ${\mathcal{N}}_{Q\to Q}$.

We highlight here three crucial distinctions between our model and traditional QKD.

As covertness is of no concern in QKD, the idle state of the transmitter is not specified in a QKD model. 2. 2.

Unlike QKD, in which the quantum channel is in complete control of the adversary, we restrict Eve’s observations to result from a known probe ${\mathcal{E}}_{Q\to Q}$. We discuss this limit on our result in Section IV. 3. 3.

Our covertness metric ${{\left\|{\sigma_{CE^{n}}-\rho_{C}^{\mathrm{unif}}\otimes\rho_{E^{n}}^{0}}\right\|}}_{1}$ not only imposes a negligible dependence between public communication and $\sigma_{E^{n}}$ but also requires that public communication be distributed according to a pre-specified distribution, which we choose as the uniform distribution $\rho_{C}^{\mathrm{unif}}$ for simplicity. These two requirements are critical to ensure that public communication does not help Eve detect the communication.

IV Role of the Probe

We establish here a no-go result in the absence of the warden’s probe and for a relaxed secrecy and covertness constraint.

Theorem 1**.**

Let ${\mathcal{E}}_{Q\to Q}=\textnormal{id}_{Q}$ and define $K\triangleq\log\dim{\mathcal{H}}_{S_{A}}$. Consider a protocol that operates as in Section III with ${\mathbb{P}}{\left(S_{A}\neq S_{B}\right)}\leqslant\epsilon$, ${{\left\|{\sigma_{S_{A}C}-\rho_{S_{A}}^{\mathrm{unif}}\otimes\sigma_{C}}\right\|}}_{1}\leqslant\delta$, and {{\left\|{\widetilde{\sigma}_{Q^{n}}-{|0\rangle\langle 0|}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}}\right\|}}_{1}\leqslant\mu. We then have

[TABLE]

Proof.

See Appendix A. ∎

Consequently, if $\epsilon,\delta,\mu\to 0$, $K$ vanishes, as well. Theorem 1 therefore shows that giving the complete control of the channel to the adversary is too stringent to establish covertness. A probe is therefore necessary and could by created with some part of the channel that is protected from the adversary, for example the portion of an optical fiber that lies inside Alice’s lab.

V Protocol Description

We first provide a high level description of the role of PPM and MLC in our protocol. The principle of PPM is to split the whole transmission block into smaller sub-blocks and to transmit exactly one non-idle state in a position chosen uniformly at random in each sub-block. The number of sub-blocks and the size of each sub-block should both be $O(\sqrt{n})$ to achieve covertness Bloch and Guha (2017). The principle of MLC is to further split the randomness used to specify the position of the non-idle state into two parts: one part with a fixed size independent of $n$, generated locally by Alice and used for key generation, and another part of size growing with $n$, generated secretly and jointly by Alice and Bob and used for mimicking the uniform distribution via quantum channel resolvability (Hayashi, 2006, Chapter 9.4). This splitting allows Alice and Bob to partially coordinate without paying the penalty incurred by full coordination. The use of MLC converts the problem of covert QKD into a traditional QKD problem over an effective block-length scaling as $O(\sqrt{n})$, for which low-complexity processing is possible.

We now elaborate on the details of the partially coordinated protocol. As depicted in Fig. 2, the $n$ channel uses are partitioned into $\ell$ consecutive sub-blocks of length $m$ so that $n\triangleq\ell m$. Fix a non-idle state $|\phi\rangle$ for the transmitter such that

[TABLE]

We define the $z^{\mathrm{th}}$ PPM state of length $m$, $|\mathrm{PPM},z\rangle_{Q^{m}}$ as

[TABLE]

a product of $|0\rangle$ and $|\phi\rangle$ with a single non-idle state in the $z^{\mathrm{th}}$ position. Writing $m\triangleq{m_{x}}{m_{v}}$, Alice generates $\ell$ PPM states of length $m$ by choosing the position of the non-idle state in the $i^{\mathrm{th}}$ state as

[TABLE]

where $X^{\ell}=(X_{1},\cdots,X_{\ell})\in\llbracket{1},{{m_{x}}}\rrbracket^{\ell}$ and $V^{\ell}=(V_{1},\cdots,V_{\ell})\in\llbracket{1},{{m_{v}}}\rrbracket^{\ell}$ are randomly generated sequences. Let $\rho_{Q^{n}}^{x^{\ell},v^{\ell}}$ be the corresponding density operator when $X^{\ell}=x^{\ell}$ and $V^{\ell}=v^{\ell}$, i.e.,

[TABLE]

The crux of the protocol is to generate the sequences $X^{\ell}$ and $V^{\ell}$ using different mechanisms: $X^{\ell}$ is generated locally by Alice i.i.d. according to the uniform distribution over $\llbracket{1},{m_{x}}\rrbracket$ while $V^{\ell}$ is generated jointly by Alice and Bob by sampling codewords uniformly at random from a codebook of size $h$ described as follows. Let ${\mathcal{F}}$ be a regular two-universal family of hash functions from $\llbracket{1},{{m_{v}}}\rrbracket^{\ell}\to{\mathcal{Z}}$ where ${\mathcal{Z}}=\llbracket{1},{\frac{{m_{v}}^{\ell}}{h}}\rrbracket$. Bob samples $f\in{\mathcal{F}}$ and $z\in{\mathcal{Z}}$ uniformly at random and transmits them over the public channel. The codebook consists of the codewords in $f^{-1}(z)$ and will be denoted through the function

[TABLE]

The choice of $X^{\ell}$ uniformly at random defines an effective cq channel from $v^{\ell}$ to the state at the output of the probe, formally described by

[TABLE]

By sampling $R$ uniformly at random in $\llbracket{1},{h}\rrbracket$ and using $g(R)$ at the input of the effective cq channel, Eve’s received state is

[TABLE]

If Alice and Bob secretly share $R$ prior to the transmission, Bob can discard $m-{m_{x}}$ of his sub-systems in each sub-block, for which he knows that the state $|0\rangle$ is sent. We shall later account for the partial coordination through $R$ by subtracting $\log h$ from the number of generated key bits. For each sub-block, Alice therefore obtains the classical state $X_{i}$ while Bob obtains ${m_{x}}$ received states. We denote the whole state shared between Alice and Bob in $\ell$ sub-blocks by $\sigma_{X^{\ell}(Q^{m_{x}})^{\ell}}$, which is \tau_{XQ^{{m_{x}}}}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}\ell} in the absence of the adversary for some $\tau_{XQ^{{m_{x}}}}$ independent of $n$.

The rest of the protocol is similar to a traditional QKD protocol applied to $\sigma_{X^{\ell}(Q^{m_{x}})^{\ell}}$ with the additional constraint ${{\left\|{\sigma_{CE^{n}}-\rho_{C}^{\mathrm{unif}}\otimes\rho_{E^{n}}^{0}}\right\|}}_{1}\leqslant\delta$, which requires the public communication to be uniformly distributed and independent of Eve’s observation during the quantum communication phase. The three main steps of this phase are parameter estimation, information reconciliation, and privacy amplification. Let $\ell\triangleq\ell_{1}+\ell_{2}$ and decompose $X^{\ell}(Q^{m_{x}})^{\ell}$ into two disjoint parts $X^{\ell_{1}}(Q^{m_{x}})^{\ell_{1}}$ and $X^{\ell_{2}}(Q^{m_{x}})^{\ell_{2}}$, used for parameter estimation and secret key distillation, respectively. For simplicity, we do not detail the classical algorithm for information reconciliation and take for granted the existence of a protocol ${\mathcal{I}}_{X^{\ell_{2}}(Q^{m_{x}})^{\ell_{2}}\to X^{\ell_{2}}\widehat{X}^{\ell_{2}}C_{\mathrm{IR}}}$ where $\widehat{X}^{\ell_{2}}$ denotes Bob’s estimate of $X^{\ell_{2}}$ and $C_{\mathrm{IR}}$ is the public communication that takes place during the information reconciliation protocol. Let $\sigma_{X^{\ell_{2}},\widehat{X}^{\ell_{2}}C_{IR}E^{n}C^{\prime}}\triangleq({\mathcal{I}}\otimes\textnormal{id}_{E^{n}C^{\prime}})(\sigma_{X^{\ell_{2}}(Q^{{m_{x}}})^{\ell_{2}}E^{n}C^{\prime}})$ where $\sigma_{E^{n}}$ is the adversary’s observation from the quantum communication and $C^{\prime}$ is the public communication in the quantum state distribution phase. We assume that

[TABLE]

More justification of the existence of good reconciliation protocols can be found in Martinez-Mateo et al. (2013) and references therein. Furthermore, using the ideas in Chou and Bloch (2016), one can ensure the additional constraint in (16). The final step is to perform privacy application to establish a secure key. To this end, Alice and Bob require a bound on $\mathbb{H}_{\min}^{\delta_{\mathrm{PA}}}(X^{\ell_{2}}|E^{n})$ for some information leakage threshold $\delta_{\mathrm{PA}}$, which we establish in Theorem 3.

VI Protocol Analysis

VI.1 Covertness

Theorem 2**.**

For any $\lambda_{2}>0$, with

[TABLE]

we have

[TABLE]

where

[TABLE]

Proof.

Let $C=(C^{\prime},C^{\prime\prime})$ where $C^{\prime}$ denotes the public communication required to choose the codebook, and $C^{\prime\prime}$ denotes the remaining public communication. By the triangle inequality, we have

[TABLE]

By our discussion at the end of Section V and leftover hash lemma Renner (2008), we have ${{\left\|{\sigma_{E^{n}C}-\sigma_{E^{n}C^{\prime}}\otimes\rho_{C^{\prime\prime}}^{\mathrm{unif}}}\right\|}}_{1}\leqslant\epsilon_{\mathrm{IR}}+\delta_{\mathrm{PA}}$. We now consider the second term ${{\left\|{\sigma_{E^{n}C^{\prime}}-\rho_{E^{n}}^{0}\otimes\rho_{C^{\prime}}^{\mathrm{unif}}}\right\|}}_{1}$. Note first that by the monotonicity of the trace norm,

[TABLE]

We upper-bound the above term in two steps. Introducing an intermediate state

[TABLE]

which is the average state at the output of the probe when $v^{\ell}$ is chosen uniformly at random from $\llbracket{1},{{m_{x}}}\rrbracket^{\ell}$, we have

[TABLE]

where $(a)$ follows from Pinsker’s inequality, and $(b)$ follows from (Tahmasbi and Bloch, 2018, Eq. (B144))222In the classical setting, the authors of Bloch and Guha (2017) showed the upper-bound with a factor of $1/2$ on the right hand side. While we conjecture that an extension of such upper-bound to the quantum setting is possible, we could only prove the upper-bound without the factor $1/2$. Therefore, establishing covertness amounts to proving that the state $\sigma_{Q^{n}C^{\prime}}$ generated by the protocol is nearly identical to $\rho_{Q^{n}}^{\mathrm{PPM}}\otimes\rho_{C^{\prime}}^{\mathrm{unif}}$. This problem is known as quantum channel resolvability, and the minimum number of bits $\log h$ required is approximately equal to the Holevo information (Hayashi, 2006, Lemma 9.2). Recall that ${\mathcal{F}}$ is a regular two-universal family of hash functions from $\llbracket{1},{{m_{v}}}\rrbracket^{\ell}$ to ${\mathcal{Z}}\triangleq\llbracket{1},{{m_{v}}^{\ell}/h}\rrbracket$.

Let us define

[TABLE]

By Lemma 2 in Appendix B,

[TABLE]

provided that

[TABLE]

and $\left|{{\mathcal{V}}}\right|^{\ell}$ is divisible by $h$ 333For any $h^{\prime}$, we can choose $h$ such that $\left|{{\mathcal{V}}}\right|h^{\prime}\geqslant h\geqslant h^{\prime}$ and $\left|{{\mathcal{V}}}\right|^{\ell}$ is divisible by $h$; hence, this condition adds at most $\log\left|{{\mathcal{V}}}\right|=O(\log n)$ of penalty on $\log h$.. Applying (Renner, 2008, Corollary 3.3.7), we simplify the condition on $\log h$ by noting that

[TABLE]

where $(a)$ follows since $\tau_{V}$ is the mixed state. We also further upper-bound ${{\mathbb{I}}\!\left(V;Q^{m}\right)}_{\rho}$ by

[TABLE]

where $(a)$ follows from the symmetry in the definition of $\rho^{v}_{Q^{m}}$. This concludes the proof.

∎

VI.2 Security

The objective of this section is to lower bound the smooth min-entropy of Alice’s data $X^{\ell}$ given Eve’s observations. We first remind that, by our discussion in Section V, we can assume that Alice prepares \widetilde{\sigma}_{XQ^{m_{x}}}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}\ell} where

[TABLE]

and sends \widetilde{\sigma}_{Q^{m_{x}}}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}\ell} over the quantum channel to Bob. We assume that Eve applies the same unitary $U_{Q^{{m_{x}}}\to Q^{{m_{x}}}E^{m}}$ on each PPM symbol. Generalizing the security proof to a general attack could follow from the same techniques as in Furrer et al. (2012); Leverrier et al. (2013); Renner and Cirac (2009). We now introduce some notation, which is summarized in Fig. 3.

Let us define

[TABLE]

We also define

[TABLE]

Theorem 3**.**

We have

[TABLE]

for all unitaries $U$ and for all $\eta^{x}$ such that

[TABLE]

where

[TABLE]

Remark 1**.**

The right hand side of (53) only depends on quantities that are either specified by the protocol and the probe, or could be calculated from Alice’s and Bob’s observations.

Remark 2**.**

We explain here the difficulty in obtaining such bounds. Note first that, as detailed in Tahmasbi and Bloch (2019), reverse reconciliation does not lead to a positive covert throughput unless Eve’s and Bob’s observations are independent when $|0\rangle$ is sent. This is unfortunately not the case when the channel is a beam-splitter. To the best of our knowledge, there exist two standard methods to bound Eve’s information for continuous variable QKD protocols. The first method leverages the optimality of Gaussian attack, which results in a sub-optimal bound on Eve’s information for discrete-variable protocols. Since Alice’s measurement is not Gaussian (in the entanglement-based version), it is not straightforward to calculate the bound for forward reconciliation protocols. The second method exploits entropic uncertainty relations, which requires finding an entanglement-based version with two different measurement at Alice. We could not find such version of our specific quantum state distribution.

Remark 3**.**

Note that in the absence of the adversary ${{\mathbb{I}}\!\left(X;Q^{{m_{x}}}\right)}_{\sigma}={{\mathbb{D}}\!\left({{\mathcal{N}}(\rho_{Q}^{1})\|{\mathcal{N}}(\rho_{Q}^{0})}\right)}+O(1/{m_{x}})$ Bloch and Guha (2017). Excluding finite-length effects, we achieve positive covert throughput when,

[TABLE]

This inequality holds when $\eta_{x}>0$ and ${\mathcal{N}}$ is close to the noiseless channel.

We now state a general upper bound for the relative entropy between the output of the complementary channel for two fixed states.

Theorem 4**.**

Let $A$ and $B$ be two possibly infinite dimensional quantum systems such that system $A$ is a composition of two sub-systems $A^{\prime}$ and $A^{\prime\prime}$. Let $\rho_{A}^{0}$ and $\rho_{A}^{1}$ be in ${\mathcal{D}}({\mathcal{H}}_{A})$ such that for two pure states $|\phi^{0}\rangle_{A^{\prime}}$ and $|\phi^{1}\rangle_{A^{\prime}}$ in ${\mathcal{H}}_{A^{\prime}}$ and a mixed state $\nu_{A^{\prime\prime}}$ in ${\mathcal{D}}({\mathcal{H}}_{A^{\prime\prime}})$, we have $C(\phi^{x}_{A^{\prime}}\otimes\nu_{A^{\prime\prime}},\rho^{x}_{A})\leqslant\delta_{x}$. Let ${\mathcal{N}}:{\mathcal{D}}({\mathcal{H}}_{A})\to{\mathcal{D}}({\mathcal{H}}_{B})$ be a quantum channel with a complementary channel ${\mathcal{E}}:{\mathcal{D}}({\mathcal{H}}_{A})\to{\mathcal{D}}({\mathcal{H}}_{E})$. Suppose that $\eta>0$ satisfies

[TABLE]

where $\lambda\triangleq 2\delta_{0}+\sqrt{\eta+4\sqrt{\eta}\delta_{1}+4\delta_{1}^{2}}$, $\delta\triangleq\delta_{0}+\delta_{1}$.

We then have

[TABLE]

Proof.

See Appendix D. ∎

Proof of Theorem 3.

By (Renner, 2008, Corollary 3.3.7), we have

[TABLE]

Furthermore,

[TABLE]

Note now that

[TABLE]

Since $\eta_{x}$ satisfies the condition in (61) by (54), We can apply Theorem 4 to obtain

[TABLE]

Combining the above inequalities, we obtain the result. ∎

VI.3 Example

We present here an experimental setup over which our proposed scheme could be executed. As illustrated in Fig. 4, Alice’s transmitter is a laser whose output is a single-mode bosonic system. The idle state is $|0\rangle$ and we choose a coherent state $|\alpha\rangle$ as the non-idle state. The probe and the honest channel are both beam-splitters with transmissivity $\tau_{E}$ and $\tau_{N}$, respectively, and excess noise $\overline{n}_{E}$ and $\overline{n}_{N}$, respectively. In Fig. 5, we plot the number of bits per PPM symbol versus $\tau_{N}$ for $\tau_{E}=0.9994$, $\alpha=0.6$, $\overline{n}_{E}=11$, and $\overline{n}_{N}=0.01$. For these parameters, we also have $\chi_{2}({\mathcal{E}}({|0\rangle\langle 0|})\|{\mathcal{E}}({|\alpha\rangle\langle\alpha|}))=59881934$, which controls the covertness through Eq. (18).

Although the range of channel parameters highlighted is narrow and the efficiency is very low, this example shows the possibility of covert QKD in settings not envisioned earlier . One can certainly improve the performance of the protocol by developing tighter bound for Eve’s information, which we leave out for future investigations.

acknowledgement

This work is supported by NSF under Award 1910859.

Appendix A Proof of Theorem 1

We first prove a quantum counterpart of (Ahlswede and Csiszar, 1993, Lemma 2.2).

Lemma 1**.**

Let $\rho_{AB}$ be a bipartite state and ${\mathcal{E}}_{A\to AF}$ be a quantum channel. We then have

[TABLE]

where $\rho^{\prime}_{ABF}\triangleq({\mathcal{E}}_{A\to AF}\otimes\textnormal{id}_{B})(\rho_{AB})$.

Proof.

We have

[TABLE]

where $(a)$ follows from the sub-additivity of the von Neumann entropy, and $(b)$ follows from the data processing inequality. ∎

Proof of Theorem 1.

Let $\widetilde{\sigma}_{AQ^{n}}$ be the state initially prepared by Alice such that {{\left\|{\widetilde{\sigma}_{Q^{n}}-{|0\rangle\langle 0|}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}}\right\|}}_{1}\leqslant\mu. We then have

[TABLE]

Let $\widetilde{\sigma}_{RAQ^{n}}$ be a purification of $\widetilde{\sigma}_{AQ^{n}}$. By Uhlmann’s theorem, there exists a unit vector $|\phi\rangle_{RA}$ such that

[TABLE]

Let \widetilde{\tau}_{AQ^{n}}\triangleq\mathrm{tr}_{R}\left({{|\phi\rangle\langle\phi|}_{RA}}\right)\otimes{|0\rangle\langle 0|}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n} and $\tau_{CS_{A}S_{B}E^{n}}$ be the output of the same protocol if Alice initially prepares $\widetilde{\tau}_{AQ^{n}}$ instead of $\widetilde{\sigma}_{AQ^{n}}$. By monotonicity of the fidelity, we have $F(\widetilde{\tau}_{AQ^{n}},\widehat{\sigma}_{AQ^{n}})\geqslant 1-\mu$, and therefore, ${{\left\|{\widetilde{\tau}_{AQ^{n}}-\widetilde{\sigma}_{AQ^{n}}}\right\|}}_{1}\leqslant\sqrt{\mu}$. By the data processing inequality, we also have ${{\left\|{\tau_{CS_{A}S_{B}E^{n}}-\sigma_{CS_{A}S_{B}E^{n}}}\right\|}}_{1}\leqslant\sqrt{\mu}$. This implies that ${\mathbb{P}}{\left(S_{A}\neq S_{B}\right)}_{\tau}\leqslant\epsilon+\sqrt{\mu}$. By (Wilde, 2013, Exercise 11.10.2), we also have

[TABLE]

where $(a)$ follows from

[TABLE]

By Fannnes’s inequality,

[TABLE]

Note that

[TABLE]

We furthermore have

[TABLE]

Using Fano’s inequality, we obtain

[TABLE]

where $(a)$ follows from using Lemma 1 for each use of the public channel, $(b)$ follows from data processing inequality, and $(c)$ follows since $\widetilde{\tau}_{AQ^{n}}=\widetilde{\tau}_{A}\otimes\widetilde{\tau}_{Q^{n}}$. Combining (85), (87), and (92), we obtain the desired bound. ∎

Appendix B A Quantum Resolvability Result

We prove a quantum channel resolvability result based on the privacy amplification result of Renner (2008). Note that we cannot use the standard quantum resolvability result of Hayashi (2006) since it depends on the dimension of the output space, which itself grows exponentially for $v^{\ell}\mapsto\rho_{Q^{n}}^{v^{\ell}}$. We first recall the definition of two-universal family of hash functions.

Definition 1**.**

Let ${\mathcal{X}}$ and ${\mathcal{Z}}$ be two finite non-empty sets. A non-empty family of functions ${\mathcal{F}}$ from ${\mathcal{X}}$ to ${\mathcal{Z}}$ is called two-universal if for all distinct $x,x^{\prime}\in{\mathcal{X}}$, we have

[TABLE]

Moreover, ${\mathcal{F}}$ is called regular if for all $f\in{\mathcal{F}}$ and all $z\in{\mathcal{Z}}$, we have $\left|{f^{-1}(z)}\right|=\frac{\left|{{\mathcal{X}}}\right|}{\left|{{\mathcal{Z}}}\right|}$, where $f^{-1}(z)\triangleq{\left\{x\in{\mathcal{X}}:f(x)=z\right\}}$.

The next two results are well-known properties of two-universal hash functions.

Proposition 1**.**

Let ${\mathcal{X}}$ and ${\mathcal{Z}}$ be two non-empty finite sets such that $\left|{{\mathcal{X}}}\right|$ is divisible by $\left|{{\mathcal{Z}}}\right|$. There exists a two-universal regular family of functions from ${\mathcal{X}}$ to ${\mathcal{Z}}$.

Proof.

All functions $f$ with $f^{-1}(z)=\frac{\left|{{\mathcal{Z}}}\right|}{\left|{{\mathcal{X}}}\right|}$ form a two-universal family of hash functions. ∎

Proposition 2** ( Renner (2008)).**

Let $\rho_{XA}$ be a cq state on ${\mathcal{H}}_{X}\otimes{\mathcal{H}}_{A}$ with respect to an orthonormal basis ${\left\{|x\rangle:x\in{\mathcal{X}}\right\}}$ for ${\mathcal{H}}_{X}$, and ${\mathcal{F}}$ be a two-universal family of functions from ${\mathcal{X}}$ to ${\mathcal{Z}}$. We then have

[TABLE]

We are now ready to establish the main result of this section, which shows the existence of a resolvability code. The classical counter-part of this result was proved in Kadampot et al. (2018).

Lemma 2**.**

Let $\rho_{XA}=\sum_{x\in{\mathcal{X}}}\frac{1}{|{\mathcal{X}}|}|x\rangle\langle x|\otimes\rho_{A}^{x}$ be a cq state on ${\mathcal{H}}_{X}\otimes{\mathcal{H}}_{A}$. Let $\delta>0$, $h$ be a positive integer such that $\left|{{\mathcal{X}}}\right|$ is divisible by $h$ and

[TABLE]

For a regular two-universal family of hash functions ${\mathcal{F}}$ from ${\mathcal{X}}$ to ${\mathcal{Z}}$, we have

[TABLE]

In particular, there exists a function $g:\llbracket{1},{h}\rrbracket\to{\mathcal{X}}$ such that

[TABLE]

Proof.

Let us define ${\mathcal{Z}}\triangleq\llbracket{1},{\frac{\left|{{\mathcal{X}}}\right|}{h}}\rrbracket$. By Proposition 1 and Proposition 2,

[TABLE]

By definition of ${\mathcal{E}}^{f}_{X\to Z}$ and $\rho_{XA}$, we have

[TABLE]

Therefore, we have

[TABLE]

Combining (99) and (102), we have for at least one $z\in{\mathcal{Z}}$ and at least one $f\in{\mathcal{F}}$,

[TABLE]

where $(a)$ follows from (95). Taking a bijection $g:\llbracket{1},{h}\rrbracket\to f^{-1}(z)$ completes the proof. ∎

Appendix C Reducing public communication when ${m_{v}}$ is a power of prime

In the next lemma, we show that under our symmetry conditions on ${\mathcal{F}}$ and $\rho_{XA}$, the choice of $z$ does not matter.

Lemma 3**.**

Suppose that for all $f\in{\mathcal{F}}$, $z,z^{\prime}\in{\mathcal{Z}}$, there exist a bijection $\phi:{\mathcal{X}}\to{\mathcal{X}}$ and unitary $U$ acting on ${\mathcal{H}}_{A}$ (depending on $z$, $z^{\prime}$, and $f$) such that

[TABLE]

We then have

[TABLE]

Proof.

Note that

[TABLE]

Moreover, we have

[TABLE]

Therefore, we obtain (106). ∎

When ${m_{v}}$ is a power of a prime, we provide an example of two-universal hash functions satisfying the conditions of Lemma 3. We assume in this paragraph only that ${\mathcal{V}}=\llbracket{0},{{m_{v}}-1}\rrbracket$ to be consistent with the standard notation for finite fields. Note first that ${\mathcal{V}}^{\ell}$ is a field with component-wise addition modulo ${m_{v}}$ and a multiplication operation denoted by $\odot$. We use the short-hand $0^{m}$ for the all-zero sequence of length $m$ and $\cdot|\cdot$ for the concatenation of two sequences. For $k\in\llbracket{1},{\ell}\rrbracket$ and $u^{\ell}\in{\mathcal{V}}^{\ell}$, let $f_{u^{\ell}}(v^{\ell})$ be the first $k$ elements of $u^{\ell}\odot v^{\ell}$. By Bellare and Tessaro (2012), ${\mathcal{F}}={\left\{f_{u^{\ell}}:u^{\ell}\in{\mathcal{V}}^{\ell}\setminus{\left\{0^{\ell}\right\}}\right\}}$ is a regular two-universal class of hash functions. Moreover, for any $u^{\ell}\in{\mathcal{V}}^{\ell}\setminus{\left\{0\right\}}$, $z^{k},{z^{\prime}}^{k}\in{\mathcal{V}}^{k}$, we define $\phi(v^{\ell})=(({z^{\prime}}^{k}-{z}^{k})|0^{\ell-k})\odot(u^{\ell})^{-1}+v^{\ell}$. We show that $\phi$ satisfies (104) and (105). Note that

[TABLE]

Furthermore, let $U_{\mathrm{CS}}$ be the unitary operation on {\mathcal{H}}_{Q}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}m} corresponding to cyclic shift of length 1, i.e., $|\phi_{1}\rangle\otimes\cdots\otimes|\phi_{m}\rangle\mapsto|\phi_{m}\rangle\otimes|\phi_{1}\rangle\otimes\cdots|\phi_{m-1}\rangle$. By definition of $d(x,v)$ and $\rho_{Q^{n}}^{v^{\ell}}$, we have

[TABLE]

where $v^{\ell}+{v^{\prime}}^{\ell}$ is modulo ${m_{v}}$. We therefore conclude that (105) holds.

Appendix D Proof of Theorem 4

To prove Theorem 4, we need the following tools.

Theorem 5**.**

((Wilde, 2013, Theorem 12.1.1))*

Let $A$ and $B$ be two quantum systems. Let $\rho_{A}^{0}$ and $\rho_{A}^{1}$ be in ${\mathcal{D}}({\mathcal{H}}_{A})$ and ${\mathcal{N}}:{\mathcal{D}}({\mathcal{H}}_{A})\to{\mathcal{D}}({\mathcal{H}}_{B})$ be a quantum channel. There exists a quantum channel ${\mathcal{R}}:{\mathcal{D}}({\mathcal{H}}_{B})\to{\mathcal{D}}({\mathcal{H}}_{A})$ (depending only on ${\mathcal{N}}$ and $\rho_{A}^{0}$) such that*

[TABLE]

and

[TABLE]

Lemma 4**.**

Let $A$ and $B$ be two quantum systems such that $A$ is a composition of two sub-systems $A^{\prime}$ and $A^{\prime\prime}$. Let $\rho_{A}^{0}$ and $\rho_{A}^{1}$ be in ${\mathcal{D}}({\mathcal{H}}_{A})$ such that for two pure states $|\phi^{0}\rangle_{A^{\prime}}$ and $|\phi^{1}\rangle_{A^{\prime}}$ in ${\mathcal{H}}_{A^{\prime}}$ and a mixed state $\nu_{A^{\prime\prime}}$ in ${\mathcal{D}}({\mathcal{H}}_{A^{\prime\prime}})$, we have $C(\phi^{x}_{A^{\prime}}\otimes\nu_{A^{\prime\prime}},\rho^{x}_{A})\leqslant\delta_{x}$. Let ${\mathcal{N}}:{\mathcal{D}}({\mathcal{H}}_{A})\to{\mathcal{D}}({\mathcal{H}}_{A})$ be a quantum channels such that $F(\rho_{A}^{x},{\mathcal{N}}(\rho_{A}^{x}))\geqslant 1-\epsilon_{x}$. We then have

[TABLE]

where $\delta\triangleq\sum_{x}\delta_{x}$, $\lambda=\sum_{x}\sqrt{\epsilon_{x}+4\sqrt{\epsilon_{x}}\delta_{x}+4\delta_{x}^{2}}$, ${\mathcal{E}}$ is a complementary channel to ${\mathcal{N}}$.

Proof.

See Appendix D.1. ∎

We are now ready to provide the proof of Theorem 4.

Proof.

By Theorem 5, there exists a channel ${\mathcal{R}}:{\mathcal{D}}(E)\to{\mathcal{D}}(A)$ such that

[TABLE]

Let ${\mathcal{U}}_{A\to BE}$ be an isometric extension of ${\mathcal{N}}$ compatible with ${\mathcal{E}}$. Let ${\mathcal{W}}_{E\to AF}$ be an isometric extension of ${\mathcal{R}}$. The isometry $(\mathbf{1}_{B}\otimes{\mathcal{W}}_{E\to AF}){\mathcal{U}}_{A\to BE}$ is an isometric extension of ${\mathcal{R}}\circ{\mathcal{E}}$. Hence, the mapping

[TABLE]

is a complementary channel of ${\mathcal{R}}\circ{\mathcal{E}}$ and

[TABLE]

Therefore, ${\mathcal{N}}$ is a degraded version of the complementary channel of ${\mathcal{R}}\circ{\mathcal{E}}$. Hence, by Lemma 4, we have

[TABLE]

where

[TABLE]

By our assumption in (61), we have $\aleph(\lambda,F(\phi_{A}^{1},\phi_{A}^{0}))\geqslant\aleph(\lambda^{\prime},F(\phi_{A}^{1},\phi_{A}^{0}))$. Since $\aleph(x,y)$ is decreasing in $x$ for positive $x$, we have

[TABLE]

which yields that $1-\eta\geqslant 1-F(\rho_{A}^{1},{\mathcal{R}}({\mathcal{E}}(\rho_{A}^{1}))$. Substituting this inequality in (123) completes the proof of our claim.

∎

D.1 Proof of Lemma 4

We first prove a “triangle” inequality for fidelity measure, which follows from the triangle inequality for $C(\cdot,\cdot)$.

Lemma 5**.**

Let $\rho,\sigma,\rho^{\prime},\sigma^{\prime}\in{\mathcal{D}}(A)$ and let $\epsilon\triangleq C(\rho,\rho^{\prime})+C(\sigma,\sigma^{\prime})$. We then have

[TABLE]

Proof.

By the triangle inequality for $C(\cdot,\cdot)$, we have

[TABLE]

This could be written as

[TABLE]

Therefore,

[TABLE]

which yields the desired bound. ∎

We now prove a result similar to Lemma 4 when $\rho^{0}_{A}$ and $\rho^{1}_{A}$ are pure.

Lemma 6**.**

Let $A$ and $B$ be finite dimensional quantum systems such that $A$ is a composition of two sub-systems $A^{\prime}$ and $A^{\prime\prime}$. Let $|\phi^{0}\rangle_{A^{\prime}}$ and $|\phi^{1}\rangle_{A^{\prime}}$ be pure states in ${\mathcal{H}}_{A^{\prime}}$ and $\nu_{A^{\prime\prime}}$ be a mixed state in ${\mathcal{D}}({\mathcal{H}}_{A^{\prime\prime}})$. Let us define $\rho_{A}^{x}\triangleq\phi^{x}_{A^{\prime}}\otimes\nu_{A^{\prime\prime}}$. Let $V:{\mathcal{H}}_{A}\to{\mathcal{H}}_{A}\otimes{\mathcal{H}}_{B}$ be an isometry and define $\psi^{x}_{AB}\triangleq V\rho_{A}^{x}V^{\dagger}$. Let

[TABLE]

We then have

[TABLE]

Proof.

Let $|\nu\rangle_{RA^{\prime\prime}}$ be a purification of $\nu_{A^{\prime\prime}}$ and define $|\psi^{x}\rangle_{RAB}\triangleq\mathbf{1}_{R}\otimes V(|\phi^{x}\rangle_{A^{\prime}}\otimes|\nu\rangle_{A^{\prime\prime}R})$ (which is consistent with the definition of $\psi^{x}_{AB}$). By Uhlmann’s theorem, there exist isometries $U^{0}$ and $U^{1}$ from ${\mathcal{H}}_{R}$ to ${\mathcal{H}}_{R}\otimes{\mathcal{H}}_{B}$ such that

[TABLE]

Furthermore, note that

[TABLE]

where $(a)$ follows since $V_{A\to AB}$ is an isometry, and $(b)$ follows from Lemma 5 Therefore, we have

[TABLE]

Using Lemma 5 again, we obtain

[TABLE]

∎

We now prove Lemma 4. Note that for

[TABLE]

we have

[TABLE]

where $(a)$ follows from Lemma 5, and $(b)$ follows from Lemma 6 Additionally, we have

[TABLE]

for $x=0,1$. This implies that $\lambda\leqslant\sum_{x}\sqrt{\epsilon_{x}+4\sqrt{\epsilon_{x}}\delta_{x}+4\delta_{x}^{2}}$.