Security of Quantum Key Distribution with One-Time-Pad-Protected Error Correction and Its Performance Benefits

TL;DR

This paper shows that using a one-time pad in quantum key distribution maintains security and improves performance by reducing computational demands.

Contribution

The paper proves that OTP-protected QKD achieves the same key rate as unprotected methods while reducing computational overhead.

Findings

OTP-protected QKD achieves the same quantum key rate as the reference protocol at the same security level.

Computational requirements for encoding and privacy amplification are significantly reduced with OTP protection.

The technique avoids using QKD keys between sessions and preserves security.

Abstract

In quantum key distribution (QKD), public discussion over the authenticated classical channel inevitably leaks information about the raw key to a potential adversary, which must later be mitigated by privacy amplification. To limit this leakage, a one-time pad (OTP) has been proposed to protect message exchanges in various settings. Building on the security proof of Tomamichel and Leverrier, which is based on a non-asymptotic framework and considers the effects of finite resources, we extend the analysis to the OTP-protected scheme. We show that when the OTP key is drawn from the entropy pool of the same QKD session, the achievable quantum key rate is identical to that of the reference protocol with unprotected error-correction exchange. This equivalence holds for a fixed security level, defined via the diamond distance between the real and ideal protocols modeled as completely positive trace-preserving maps. At the same time, the proposed approach reduces the computational requirements: for non-interactive low-density parity-check codes, the encoding problem size is reduced by the square of the syndrome length, while privacy amplification requires less compression. The technique preserves security, avoids the use of QKD keys between sessions, and has the potential to improve performance.

Figures

Full text

1. Introduction

A comprehensive, self-contained proof of security for quantum key distribution (QKD) was presented in [1] that considers the effects of finite resources. The analysis includes both entanglement-based and prepare-and-measure protocols within a unified framework, using a security reduction to relate the latter to the former. Specifically, the considered protocols correspond to variants of BBM92 [2] and BB84 [3], respectively.

When a QKD protocol is represented as a completely positive trace-preserving (CPTP) map, its security can be quantified by its operational distinguishability from an ideal protocol, which is defined as one in which the final keys are independent, uniformly distributed random strings. A QKD protocol that is $[eqn]$ -secure has a maximum distinguishing probability of $[eqn]$ in an optimal experiment. Formally, $[eqn]$ is the diamond distance between the actual and ideal CPTP maps and extends the notion of trace distance from quantum states to quantum channels.

A critical stage in QKD is key reconciliation, where error-correction information is exchanged over a public channel. This stage can significantly influence the security. To prevent the leakage of information to a potential adversary, encryption of reconciliation data has been proposed. Among the possible schemes, the one-time pad cipher (OTP) is of particular interest due to its unconditional security, which remains intact even against quantum adversaries, provided that the strict requirements are met. The main limitation of the OTP lies in its demand for a secret key whose length is at least equal to the length of the message and which must be securely exchanged in advance between the communicating parties. For instance, in [4], a standalone non-quantum key distribution method based on optical noise and supplemented by privacy amplification is proposed to address this requirement.

The explicit integration of the OTP scheme into QKD has been explored in several studies. In [5], the OTP is used to encrypt error-correction data in order to decouple error correction from privacy amplification. In this approach, Alice and Bob must initially share an OTP key whose length is equal to the requirements of a full QKD session, and the cost of this initial key is to be offset by generating a longer quantum key. A similar strategy is adopted in [6], where part of the QKD key generated in a previous session is reused as the OTP key for the following session. While both methods are effective in principle, they require an initial pre-shared key. Consequently, a complete proof of security should consider both the initialization phase and the security implications of the key-chaining process.

In this paper, we present an alternative use of the OTP cipher within QKD that avoids pre-shared keys and chaining. Specifically, a designated block of the raw key obtained within the same QKD session is used as the OTP key to encrypt the error-correction data for the remaining portion of the raw key. A key distinction from earlier proposals is that the OTP keys used by Alice and Bob are necessarily different. Since the OTP keys originate from the same QKD session in which they are applied, eliminating the need for key reuse across sessions, the protocol allows a formal assessment of security on a per-session basis alone.

We extend the non-asymptotic security proof of Tomamichel and Leverrier [1], which analyzes the security of QKD at finite key lengths while allowing for a small probability of failure. In this setting, we show that the OTP extension achieves the same quantum key rate as the conventional protocol—where the key rate is defined as the ratio of the final key length to the total number of quantum systems shared between Alice and Bob—at the desired security level. No additional assumptions are required for the OTP keys beyond those that already apply to the raw key, which are briefly summarized in the next section and described in detail in [1] (pp. 7–9).

While the proposed OTP extension of the QKD protocol does not change its security level, it provides a practical advantage by reducing the computational requirements of error correction. We illustrate these benefits using low-density parity-check (LDPC) codes, a subclass of forward error-correction (FEC) codes that allow the receiver to detect and correct errors without retransmission. We show that the size of the encoding problem decreases by the square of the syndrome length, while the size of the decoding problem remains the same. Moreover, the QKD session requires less compression during privacy amplification.

We begin with an overview of the QKD reference protocol and summarize the main conclusions of the original security proof. The formalism and notation introduced in [1] (pp. 3–7) are adopted, and readers are encouraged to consult that work for a full treatment of the proof. A complete restatement of all theorems and lemmas is not necessary here. However, we highlight those assumptions that are relevant to the modeling of the OTP extension and the security proof.

The structure of the paper is as follows. Section 2 recalls the entanglement-based QKD protocol and introduces the notation used in the analysis. Section 3 presents the modification of the error-correction step, including a visualization of the classical and quantum systems involved. Section 4 establishes theoretical bounds on the length of the error-correction data for both noisy and noise-free channels. In Section 5, we adjust the mathematical model of the QKD reference protocol, which serves as the basis for extending the original security proof to the OTP-enhanced protocol in Section 6. Section 7 evaluates the performance benefits of the modified error-correction scheme when implemented with LDPC codes. Finally, Section 8 concludes the paper.

2. Reference Protocol

The security proof in [1] applies to a variant of the entanglement-based QKD protocol introduced in [2] and is subsequently extended to prepare-and-measure schemes with essentially identical results. For completeness, we briefly recall the relevant elements of this otherwise well-known protocol.

The protocol takes as input a bipartite quantum state $[eqn]$ and outputs two, typically identical, binary strings $[eqn]$ and $[eqn]$ representing the final keys held by Alice and Bob, respectively. The protocol may also abort under one of two conditions: failure of parameter estimation, indicated by the flag $[eqn]$ , or failure of error correction, indicated by the flag $[eqn]$ .

Alice and Bob each start with m quantum systems, where the specific physical mechanism by which they are obtained is left unspecified. These systems are modeled as tensor products of local Hilbert spaces of the systems A and B. The proof in [1] relies on several assumptions—such as deterministic detection, commuting measurements, and measurement complementarity—which, while necessary for the original proof, are not repeated here. Likewise, the sifting procedure used to ensure basis matching has been completed in advance.

At the beginning of the protocol, Alice generates a set of random seeds and transmits them to Bob via the authenticated classical communication channel. These seeds determine the random selection of a subset of raw key bits for parameter estimation ( $[eqn]$ ), the choice of measurement bases for parameter estimation ( $[eqn]$ ), and the measurement bases of the remaining systems used in key extraction ( $[eqn]$ ). Two other seeds, $[eqn]$ and $[eqn]$ , are used to randomly select particular hash functions from a universal family of hash functions. For clarity, we explicitly introduce these seeds when they appear in the following analysis.

The measurement outcomes of the m quantum systems—on both Alice’s and Bob’s sides—are recorded in binary registers. Each register is partitioned into two disjoint segments according to a random selection procedure controlled by the shared seeds: a segment of length k reserved for parameter estimation, denoted by V on Alice’s side and W on Bob’s side, and a segment of length n reserved for key distillation, denoted by X on Alice’s side and Y on Bob’s side.

In the parameter estimation step, Alice transmits a transcript $[eqn]$ of her V over the public channel. After receiving $[eqn]$ , Bob compares V with his corresponding W and determines whether the observed error rate is below a predefined threshold $[eqn]$ . If the threshold is exceeded, Bob sets $[eqn]$ , and the protocol aborts.

The error-correction procedure is characterized by the quintuple $[eqn]$ , where the details of syndrome-based error correction are explained in Section 7. In short, to reconcile discrepancies between X and Y, Alice computes an error-correction syndrome $[eqn]$ and transmits its public transcript $[eqn]$ of length r over the authenticated classical channel. Bob applies an efficient correction algorithm $[eqn]$ , producing $[eqn]$ as his best estimate of Alice’s X.

Both parties then check the success of the error correction by computing the hash values of X and $[eqn]$ , respectively, using a randomly chosen function from a family of universal hash functions $[eqn]$ . The choice of hash function is determined by the seed $[eqn]$ generated by Alice and transmitted over the public channel. After receiving Alice’s hash transcript $[eqn]$ of length t, Bob compares the results and sets the error-correction flag $[eqn]$ accordingly; if $[eqn]$ , the protocol aborts.

In the final stage, privacy amplification is performed to meet the prescribed security parameters. A random hash function $[eqn]$ from a family of universal hash functions $[eqn]$ is selected using the seed $[eqn]$ , generated and publicly announced by Alice. The final keys, of length l, are computed as $[eqn]$ and $[eqn]$ .

We summarize the notation used in the modeling and proof in Table 1, similar to [1], with additional registers introduced. The notation used to describe error-correction algorithms is given separately in Section 7.

3. OTP-Protected Error Correction

We make no restrictions on the choice of error-correction method, except that it must operate in a non-interactive, or one-way, mode. In [1], the authors propose the use of a linear code defined by a parity-check matrix. While interactive error-correction methods could, in principle, also be protected by OTP encryption, such an approach falls outside the scope of our current analysis.

To describe the extension of the QKD protocol, we adopt the representation in Figure 1, which provides a modified view of the joint evolution of the classical and quantum systems during and after error correction, based on the original representation in [1]. In this diagram, the boxes represent subsystems accessible to Alice, Bob, and the public channel, while temporary classical systems are indicated by crossed-out boxes. The preceding and following steps of the protocol are identical to those in the reference formulation.

In the proposed extension, Alice and Bob agree on a subset of their raw quantum key, which serves as a one-time pad. The quantum representations of the corresponding classical OTP registers, denoted by O on Alice’s side and $[eqn]$ on Bob’s side, contain the respective measurement outcomes of their initial quantum systems A and B. The formal introduction of these newly defined registers, together with the measurement maps that determine their contents, can be found in Section 5.

The modified procedure is as follows. Alice first computes the error-correction data $[eqn]$ and then applies the OTP protection by forming $[eqn]$ , where xor denotes the bitwise addition modulo 2. The public transcript $[eqn]$ of register Z is then transmitted via the authenticated classical channel.

After obtaining $[eqn]$ , Bob reverses the transformation by calculating $[eqn]$ . He then applies the error-correction algorithm to obtain $[eqn]$ . The estimate $[eqn]$ is then processed analogously to the reference protocol: the two parties compute the hash values T and $[eqn]$ , respectively, with Bob performing the comparison of the values to verify successful reconciliation, setting the error-correction flag $[eqn]$ accordingly. Depending on the result, the protocol either aborts or proceeds with privacy amplification, as described in Section 2.

4. Syndrome and Parity Lengths

For an n-bit raw key transmitted over a binary symmetric channel (BSC) with a crossover probability p, the minimum syndrome length r required for error correction is determined by the entropy of the error pattern, namely, $[eqn]$ , where $[eqn]$ denotes the binary entropy, $[eqn]$ . This bound follows directly from Shannon’s source coding theorem [7] and the Slepian–Wolf theorem [8] for lossless source coding with side information, and was formalized by Brassard and Salvail in [9] for syndrome-based error correction over an error-free channel.

In practice, error-correction codes are not theoretically optimal. Their efficiency is commonly quantified by a parameter $[eqn]$ , with larger $[eqn]$ indicating reduced efficiency. The actual number of syndrome bits required is therefore

$$[eqn]$$

Since the OTP scheme introduces additional errors, the problem becomes equivalent to error correction over a noisy channel, which increases the required redundancy. In this case, transmitting $[eqn]$ correction bits would itself require correction, adding another $[eqn]$ bits, which in turn would require $[eqn]$ bits, and so forth. The minimum number of correction bits in this setting is therefore

$$[eqn]$$

where $[eqn]$ , as first derived in [7] from the channel capacity constraint. Accounting for inefficiency, this expression becomes

$$[eqn]$$

for $[eqn]$ . Since what is exchanged in this context is not a syndrome but more general redundancy information, it is more appropriate—by analogy with classical telecommunications—to use the term parity exchange instead of syndrome exchange. Accordingly, in the OTP-protected scheme, the error-correction quintuple is updated to $[eqn]$ .

5. Revised Mathematical Model

We now revise the mathematical model of the QKD protocol from [1], which will serve as the basis for extending the original security proof to the OTP-enhanced version in the following section. As mentioned above, we assume that Alice and Bob each have a collection of m individual quantum systems, with Alice’s systems described by the tensor product of Hilbert spaces $[eqn]$ , and Bob’s systems analogously by $[eqn]$ . The states of these systems are arbitrary, finite-dimensional, and otherwise unrestricted, so that the joint input state is fully described by a density operator $[eqn]$ .

Once the random seeds have been distributed over the authenticated public channel, the global state of the protocol is described by $[eqn]$ . Each of the classical registers is represented in the model as a quantum state. For example, the register encoding the seed $[eqn]$ is described as the maximally mixed state

$$[eqn]$$

where $[eqn]$ is the set of all subsets of size k chosen from m elements, and $[eqn]$ forms an orthonormal basis of the register space.

Since the OTP modification only affects the error-correction phase, the modeling of the parameter estimation remains identical to that in [1]. Measurements are represented as CPTP maps that transform quantum systems into the content of a classical register. A general measurement is defined as

$$[eqn]$$

where A denotes the measured subsystem, X the resulting register, and $[eqn]$ the measurement operator yielding outcome x. Without going into the explicit representation in orthonormal bases, we denote by $[eqn]$ the state obtained after applying the measurement map to the subsystems selected by $[eqn]$ and storing the outcomes in the registers V on Alice’s side and W on Bob’s side:

$$[eqn]$$

The measurement process is conceptually divided into two groups: (i) measurements used for parameter estimation and (ii) measurements used for extracting the secret key. This division is formal and has no impact on the practical realization of the protocol. Note that the measurement operators depend on bases determined by the random seed $[eqn]$ , represented as the maximally mixed classical state $[eqn]$ . In addition, the state $[eqn]$ in (6) is extended by a similarly constructed $[eqn]$ .

To incorporate the OTP scheme, we need to change the second group of measurements. Instead of the total measurement map defined in [1] as

$$[eqn]$$

we introduce the modified map

$$[eqn]$$

in which the raw keys are split into two components: X and O on Alice’s side, and Y and $[eqn]$ on Bob’s side. The OTP blocks satisfy $[eqn]$ , while the remaining raw key lengths are $[eqn]$ . The partitioning itself is arbitrary, provided that both parties select the same subset of the raw key. After the quantum systems A and B have been discarded, the resulting classical state is

$$[eqn]$$

Since the parameter estimation phase is modeled identically to [1], Equation (9) conditioned on the parameter estimation outcome is

$$[eqn]$$

where $[eqn]$ denotes the CPTP map corresponding to the parameter estimation function

$$[eqn]$$

which determines the quantum representation of the flag $[eqn]$ . Note that, for a general function $[eqn]$ , the corresponding CPTP map is defined as

$$[eqn]$$

which leaves the register X intact while appending a new register Y, i.e., $[eqn]$ .

By renaming V as transcript $[eqn]$ published on the public channel and discarding W, we obtain $[eqn]$ , which is the input state for the error correction and OTP encryption.

Let $[eqn]$ , $[eqn]$ , and $[eqn]$ denote the CPTP maps implementing the respective functions as given in Section 3, and let $[eqn]$ denote the map that computes the verification hash T and the success flag $[eqn]$ . The final state after error correction is then represented by the composition

$$[eqn]$$

where the new subsystems $[eqn]$ , $[eqn]$ , $[eqn]$ , and $[eqn]$ arise from the respective CPTP maps and the inclusion of the uncorrelated quantum representation of the random seed $[eqn]$ .

The modeling of the privacy amplification remains unchanged from [1]. Specifically, the distilled keys are compressed via a universal hash function $[eqn]$ , which is selected and publicly announced by Alice using a random seed $[eqn]$ . The final keys are $[eqn]$ and $[eqn]$ , where the process is represented by a CPTP map $[eqn]$ . The final state of the protocol is therefore

$$[eqn]$$

where $[eqn]$ denotes the collection of all transcripts, seeds, and flags exposed on the public channel. This state has the same structural form as in [1], although the sizes and interdependencies of the subspaces differ due to the OTP modifications.

6. Security Proof Extension

We quantify the distinguishability between the CPTP map representing the QKD protocol formalized above and that of an ideal protocol, in which the final keys $[eqn]$ and $[eqn]$ are replaced by independent, uniformly distributed random bit strings. For the entanglement-based formulation, this distinguishability is evaluated by the diamond distance

$$[eqn]$$

where the supremum is taken over all normalized states on the joint system $[eqn]$ . Here, E denotes the purifying environment controlled by the eavesdropper, Eve. It suffices to assume $[eqn]$ . Since purification represents the strongest possible adversary, any attack by Eve, whether collective, coherent, or memory-based, can be modeled as her holding the purification. However, it is important to emphasize that real-world security can be compromised if the underlying assumptions are violated. For example, vulnerabilities can arise if the source of the quantum state deviates from the modeled behavior or if the assumption of a sealed laboratory does not hold.

In [1], the authors establish an upper bound on $[eqn]$ by uniformly bounding the trace distance of the protocol’s final state from the corresponding ideal state. More precisely, they consider

$$[eqn]$$

where the notation $[eqn]$ denotes the sub-normalized state [1] (p. 5) conditioned on both successful parameter estimation and successful error correction. The ideal key of length l is modeled as the maximally mixed state

$$[eqn]$$

defined in the orthonormal basis $[eqn]$ .

The derivation of $[eqn]$ and its proof can be summarized as follows. Lemma 1 of [1] (p. 15) establishes that $[eqn]$ can be decomposed into two contributions: one quantifying the correctness of the protocol and the other quantifying its secrecy.

The correctness term is upper-bounded by Theorem 2 of [1] (p. 16) as

$$[eqn]$$

where t denotes the length of the verification hash used during error correction.

For secrecy, the problem is reduced to bounding the simplified trace-distance expression

$$[eqn]$$

The security analysis introduces a scalar parameter, $[eqn]$ , that accounts for the unlikely event that parameter estimation passes, based on the observed error rate between registers V and W, while the fraction of mismatches between X and Y still exceeds $[eqn]$ by at least $[eqn]$ . The parameter $[eqn]$ thus acts as a smoothing parameter, permitting optimization over nearby quantum states in non-asymptotic entropy calculations.

Before turning to the OTP-modified protocol, we recall the final result from Theorem 3 of [1] (p. 16), which provides the secrecy bound:

$$[eqn]$$

with

$$[eqn]$$

and

$$[eqn]$$

In addition to the quantities already introduced, the complementarity of Alice’s measurements in different bases is required in the last equation, with $[eqn]$ defined as in [1] (p. 9). Ideally, $[eqn]$ . Combining Lemma 1, Theorems 2 and 3, the security of the original QKD protocol, expressed by the diamond distance, is bounded as

$$[eqn]$$

The modifications to the proof for the OTP-extended protocol begin with a reformulated conclusion of Corollary 5 [1] (p. 18). In particular, the registers used for key distillation are split into a key component and an OTP component, $[eqn]$ and $[eqn]$ . This change yields the following uncertainty relation:

$$[eqn]$$

where $[eqn]$ . For consistency with [1], we continue to use the designations X and Y for the raw keys prior to distillation, although the introduction of O and $[eqn]$ shortens them relative to the original. This uncertainty relation bounds Eve’s maximum probability of correctly guessing Alice’s key, given her quantum side information.

To adequately account for finite-size effects and the possibility of early termination, smooth min- and max-entropies are employed. For a sub-normalized state $[eqn]$ , these are defined as

$$[eqn]$$

and

$$[eqn]$$

where $[eqn]$ denotes the set of sub-normalized states on $[eqn]$ , and $[eqn]$ denotes the purified distance [1] (p. 4). The smoothing parameter $[eqn]$ defines an $[eqn]$ -ball of nearby sub-normalized states around $[eqn]$ , which ensures the robustness of the entropy bounds against statistical fluctuations. The standard definition of the (non-smooth) conditional quantum min-entropy [1] (p. 6) is used in (25), while the conditional max-entropy in (26) follows from the duality relation $[eqn]$ for any tripartite pure state $[eqn]$ .

We now apply the same modification introduced in the uncertainty relation to the bound on the conditional smooth max-entropy of the protocol state after successful parameter estimation. The adapted Proposition 8 of [1] (p. 19) gives

$$[eqn]$$

valid for any $[eqn]$ such that $[eqn]$ and $[eqn]$ . No additional proofs are required here, since the adjustments are purely notational, arising from the introduction of the registers O and $[eqn]$ .

Following the logic of Proposition 11 in [1] (p. 21), we combine the above result with the uncertainty relation to obtain

$$[eqn]$$

where $[eqn]$ .

Discarding W and rewriting V as $[eqn]$ can be accounted for by the data-processing inequality [1] (p. 7), i.e., $[eqn]$ , valid for any CPTP map $[eqn]$ , yielding

$$[eqn]$$

The OTP-encrypted error-correction data $[eqn]$ transmitted from Alice to Bob can be integrated using the chain rule [1] (p. 7), i.e., $[eqn]$ , for a classical register X. Applying this to the OTP-protected exchange, similar to what is implemented for the syndrome exchange of the original protocol, we obtain

$$[eqn]$$

where $[eqn]$ corresponds to the OTP-specific redundancy length $[eqn]$ .

Next, we eliminate the explicit dependency on O in (30) by exploiting the properties of bitwise modulo-2 addition. Let us first assume a sub-normalized classical–quantum state $[eqn]$ , where X, Y, and Z are classical registers and A is a quantum system possibly correlated with them. Suppose the registers are related by

$$[eqn]$$

Given X and Z, the value of Y is uniquely determined if $[eqn]$ is known. Therefore, the non-smoothed conditional min-entropy $[eqn]$ is equal to $[eqn]$ . This can be shown first by noting that the min-entropy in the case of a classical X conditioned on a quantum system B can be expressed more conveniently using guessing probability as $[eqn]$ [1] (p. 6). Since the classical Y is uniquely determined by $[eqn]$ and Z, if one can guess X correctly, one automatically knows Y, i.e., $[eqn]$ , where B is treated as $[eqn]$ .

The following equalities then hold by construction:

$$[eqn]$$

where the first equality follows from the definition (25), the second from the fact that non-smoothed min-entropies are maximized over the same $[eqn]$ -ball, and the last again from the definition. In the above, the relation between X, Y, and Z is enforced by construction. We smooth first before tracing out Y, which ensures a tight, operationally meaningful bound. On the other hand, restricting the smoothing region too early can result in a smaller $[eqn]$ -ball, which would lead to a less strict relation $[eqn]$ , which holds in general [10] (p. 82). We substitute $[eqn]$ , $[eqn]$ , $[eqn]$ , and $[eqn]$ , apply the sub-normalization $[eqn]$ , and replace $[eqn]$ with $[eqn]$ to get

$$[eqn]$$

With the lower bound of min-entropy established in the same form as [1],

$$[eqn]$$

we can proceed analogously. In particular, by (i) adding the independent seed $[eqn]$ for the error-correction verification hash to the left-hand side, (ii) subtracting the verification hash length t on the right-hand side, (iii) imposing the condition $[eqn]$ via Lemma 10 [1] (p. 21), and (iv) finalizing with Corollary 12 [1] (p. 22), we recover the results of Theorem 3 [1] (20)–(22), with the only difference being that r is replaced by $[eqn]$ .

Comparing the OTP-protected scheme with the original formulation for a given m, we first notice that the raw key length available for distillation differs. In the original scheme, n is equal to $[eqn]$ , while in the OTP scheme, n is reduced to $[eqn]$ . Substituting the latter into the expression for redundancy (3), we obtain

$$[eqn]$$

Rearranging yields

$$[eqn]$$

In other words, although $[eqn]$ exceeds r for correcting the same message length, in the OTP-protected variant, the effective message length is shortened. This ensures that, for a given m and $[eqn]$ , the redundancy parameters $[eqn]$ and r match exactly.

Consequently, the achievable key rate $[eqn]$ is identical in both schemes for a fixed security parameter $[eqn]$ . In this respect, the OTP-extended and original protocols are therefore equivalent. Since (32) is exact, while the rest of the proof reuses the bounds of the original proof, the $[eqn]$ bound is as strict as in the reference scheme.

7. Error-Correction Performance

We demonstrate the benefits of the OTP scheme using LDPC codes, which achieve performance close to the Shannon limit for reliable communication over noisy channels. First introduced by Gallager in 1962 [11], LDPC codes became practical with the rise of efficient computational techniques and are now widely deployed. Their main feature is a sparse parity-check matrix—predominantly zeros with relatively few ones—enabling efficient iterative decoding, most commonly implemented via belief-propagation or message-passing algorithms.

In the following, we compare syndrome-based error correction with the parity-based OTP approach. The notation used to describe the error-correction algorithms is summarized in Table 2.

In the syndrome-based method, Alice holds a sparse parity-check matrix H of size $[eqn]$ . She calculates the syndrome of her raw key as

$$[eqn]$$

where $[eqn]$ denotes her raw key represented as a column vector of length $[eqn]$ , and all operations are performed modulo 2. The rows of H correspond to r parity-check equations.

After obtaining $[eqn]$ , Bob applies an LDPC decoding algorithm to recover the most probable candidate $[eqn]$ , i.e., the vector closest to his raw key $[eqn]$ , subject to the condition

$$[eqn]$$

where $[eqn]$ denotes the identity-extended parity-check matrix.

Equivalently, the process can be described in terms of error vectors. Bob first computes his own syndrome $[eqn]$ , then identifies the most likely error vector $[eqn]$ satisfying $[eqn]$ , and finally reconstructs Alice’s key $[eqn]$ . Both formulations are equivalent and lead to the same corrected key.

In contrast, parity-based error correction over the noisy channel requires Alice to employ a parity-generator matrix P of size $[eqn]$ . This matrix is derived from the decomposition $[eqn]$ , where A is a submatrix of size $[eqn]$ , corresponding to parity-check equations for the message bits, and B is a square submatrix of dimension $[eqn]$ corresponding to parity-check equations for the parity bits themselves. The generator matrix can be calculated as

$$[eqn]$$

Alice first computes her parity bits as

$$[eqn]$$

where $[eqn]$ is represented as a column vector of length $[eqn]$ . The OTP encryption $[eqn]$ followed by the decryption $[eqn]$ on Bob’s side effectively emulates the transmission of parity bits through a noisy channel, where $[eqn]$ and $[eqn]$ are one-time pad vectors on the respective sides.

After obtaining $[eqn]$ , Bob employs LDPC decoding algorithms to find the most probable key $[eqn]$ that is closest to $[eqn]$ by solving the equation

$$[eqn]$$

Although $[eqn]$ is larger than H, the decoding task (38) can be considered just as difficult as (41). This is because, in the syndrome-based approach, the received syndrome $[eqn]$ in (38) is already correct, while in the OTP scheme, the errors are present in $[eqn]$ and $[eqn]$ . The combined length of these erroneous components is equal to the length of $[eqn]$ alone in the syndrome case, under the condition $[eqn]$ . The advantage of the OTP scheme is on Alice’s side: because of the smaller matrix dimensions, computing (40) requires about $[eqn]$ fewer operations than computing (37). This estimate is approximate, since different algorithmic optimizations may be applied in practice.

The decoding tasks are comparable, and thus the robustness of the QKD protocol—measured by the success probability $[eqn]$ —remains essentially the same for both schemes, subject to some random variations. In contrast, the encoding tasks differ in difficulty: when expressed as the ratio of encoding problem sizes, determined by the number of elements in P and H and using (36), we obtain

$$[eqn]$$

Since the same parity-check matrix can be reused across multiple sessions, recalculating P for each session is unnecessary. To compute (39), the submatrix B must be nonsingular; however, the explicit inversion of B is not required to generate the parity bits. Instead, an $[eqn]$ decomposition of B can be performed, where $[eqn]$ , with L a lower triangular matrix and U an upper triangular matrix. By heuristically rearranging the rows and columns of H, both L and U can be made sparse. This enables efficient calculation of the parity bits using standard forward and backward substitution.

In practice, the raw key is segmented to allow the use of parity-check matrices of manageable size, suitable for software implementation or, preferably, for efficient hardware implementation. For example, 5G parity-check matrices [12] (pp. 19–26) can be employed. Using the 5G Base Graph 1 matrix with a lifting factor of 224, a matrix H of size 5072 × 10,000 can be extracted, which experimentally achieves an error-correction success rate of 0.99 at a bit error rate of 0.09. The resulting error-correction efficiency is $[eqn]$ , since the theoretical redundancy is $[eqn]$ . The corresponding parity-generator matrix P then has the dimensions $[eqn]$ , giving a ratio of (42) equal to 0.4928. In other words, under this setup, syndrome encoding is approximately twice as demanding as parity encoding when assessed purely in terms of problem size.

In the syndrome scheme, H is employed to generate error-correction data, whereas in the OTP scheme it is primarily used to verify parity-check equations on the receiver side, an approach more in line with classical wireless communication. One could alternatively define H as the parity generator in the OTP case, but this would break the equivalence $[eqn]$ , since the problem dimensions would no longer align.

The final key length l and the parameters k, t, and $[eqn]$ for a given $[eqn]$ , m, $[eqn]$ , and $[eqn]$ are identical across both schemes. However, since the length of the distilled keys n is different, the compression ratio used in privacy amplification must be adjusted accordingly. In particular, the OTP scheme requires a compression ratio that is only a fraction of the ratio of the reference scheme,

$$[eqn]$$

which is independent of m and coincides with the size ratio of the encoding problems (42).

Figure 2a presents the achievable key rates $[eqn]$ determined by numerical optimization for $[eqn]$ and error-correction efficiency $[eqn]$ within a range of $[eqn]$ . Figure 2b shows the corresponding compression ratios under $[eqn]$ .

8. Conclusions

The use of one-time pad protection in QKD has been proposed before, often accompanied by the claim that the encryption of the error-correction syndrome ensures that any remaining information leakage becomes useless to an eavesdropper. Such assertions, however, are generally only valid under restrictive assumptions and specific settings. In particular, prior work often leaves unaddressed the generation and potential leakage of pre-shared encryption keys, or relies on session chaining without adequately analyzing the security of the initial conditions. Moreover, the information available to an adversary is not limited to the public communication channel; consequently, the analysis is incomplete.

In this work, we show that the information disclosed over the public channel is determined by the choice of error-correction scheme, regardless of whether the data is encrypted, if the generation of encryption keys is also part of a security framework. Here, the overall security is evaluated in terms of the protocol’s distinguishability from the ideal QKD protocol. While the exact computation of the diamond distance between the corresponding CPTP maps is challenging, we can reuse much of the non-asymptotic treatment developed by Tomamichel and Leverrier. Apart from this theoretical equivalence, the OTP approach also offers practical implementation advantages. As shown for LDPC codes, it has the potential to reduce the computational resources required for error correction. As QKD is increasingly integrated into related technologies such as quantum secure direct communication [13], new opportunities for future research arise, in terms of both theoretical security and performance aspects of error correction.