One Key Good, L Keys Better: List Decoding Meets Quantum Privacy Amplification

TL;DR

This paper introduces list privacy amplification (LPA) for quantum key distribution, allowing extraction of multiple candidate keys with at least one being perfectly secret, thus increasing the achievable key length and error tolerance.

Contribution

The paper formalizes LPA within the abstract cryptography framework, proves the Quantum List Leftover Hash Lemma (QLLHL), and demonstrates its application to enhance quantum key distribution protocols.

Findings

Quantum list privacy amplification yields a    gain over standard QLHL.

Applying LPA increases the phase-error threshold in BB84-type QKD protocols.

Two efficient constructions for LPA are proposed, with proven security and practical runtimes.

Abstract

We introduce list privacy amplification (LPA), a relaxation of the final step of quantum key distribution (QKD) in which Alice and Bob extract a list of $L$ candidate keys from a raw string correlated with an eavesdropper Eve, with the guarantee that at least one key is perfectly secret while Eve cannot identify which. This parallels list decoding in error-correcting codes: relaxing unique decoding to list decoding increases the decoding radius; analogously, list extraction increases achievable key length beyond the standard quantum leftover hash lemma (QLHL). Within the abstract cryptography framework, we formalise LPA and prove the \emph{Quantum List Leftover Hash Lemma} (QLLHL): an $L$-list of $\ell$-bit keys can be extracted from an $n$-bit source with smooth min-entropy $k$ iff \[ \ell \le k + \log L - 2\log(1/\epsilon) - 3, \] yielding a tight additive $\log L$ gain over QLHL. This gain arises because the index of the secure key is chosen after hashing and hidden from Eve, effectively contributing $\log L$ bits of entropy. Applying QLLHL to BB84-type QKD, a list size $L = 2^{\alpha n'}$ increases the tolerable phase-error threshold from $h^{-1}(1 - h(e_b))$ to $h^{-1}(1 - h(e_b) + \alpha)$, exceeding the standard $\approx 11\%$ bound for any $\alpha > 0$. We prove tightness via a matching intercept-resend attack, establish composability with Wegman--Carter authentication, and present two constructions: a polynomial inner-product hash over $\mathbb{F}_{2^m}$ and a Toeplitz-based variant, running in $O(nL)$ and $O(nL \log n)$ time.