Quantum Key Distribution and Composable Secrecy

Fix finite nonempty sets $\mathsf{K}$ and $\mathsf{T}$ of key values and public transcripts, respectively, and fix an ordering of each finite set. Choose a symbol $\mathrm{\perp }\mathrm{\notin }\mathsf{K}$ and order $\mathsf{K}\cup \{\mathrm{\perp }\}$ by placing $\mathrm{\perp }$ after the ordered keys. The full key registers $A$ and $B$ are copies of $Q_{\mathrm{\mid }\mathsf{K}\mathrm{\mid }+1}$, with computational basis labelled by $\mathsf{K}\cup \{\mathrm{\perp }\}$; the transcript register $T$ is $Q_{\mathrm{\mid }\mathsf{T}\mathrm{\mid }}$, with basis labelled by $\mathsf{T}$, using Finite registers and their ordered computational bases. For accepted-state calculations, identify the subspaces spanned by the key vectors $\mathrm{\mid }a⟩$, $a\in \mathsf{K}$, with $Q_{\mathrm{\mid }\mathsf{K}\mathrm{\mid }}$; operators on these subspaces are embedded in the full key registers by zero extension. A finite two-party key-distribution protocol is a finite-round interaction of Alice and Bob in which each quantum register is nonzero and finite-dimensional, every local quantum operation is a quantum channel or finite instrument (Finite-dimensional quantum channel, Finite instruments and conditional states), and every classical message alphabet is finite. Eve's operation on each insecure quantum transmission is a channel from the sent register and her current memory to the received register and her updated memory. The parties communicate through an ideal authenticated public channel: each message is delivered unchanged to its intended honest recipient, and Eve receives a copy. The transcript $t\in \mathsf{T}$ records all such messages, including messages that lead the protocol to abort. This is an assumption about the communication resource; it does not prove security of an authentication implementation. Any implementation error must be included in the abort convention or in an additional security parameter.

For each allowed adversarial strategy, the final output is a normalized state, classical in the key registers $A,B$ and transcript register $T$, on $A\otimes B\otimes T\otimes E$, where $E$ is Eve's retained finite-dimensional quantum system. Both honest parties output the common abort symbol $\mathrm{\perp }$ on an abort. In the ordered product basis this state has the form

${\rho }_{ABTE}={\sum }_{t\in \mathsf{T}}\mathrm{\mid }\mathrm{\perp },\mathrm{\perp },t⟩⟨\mathrm{\perp },\mathrm{\perp },t\mathrm{\mid }\otimes {\omega }_E^{\mathrm{\perp },t}+{\sum }_{a,b\in \mathsf{K},t\in \mathsf{T}}\mathrm{\mid }a,b,t⟩⟨a,b,t\mathrm{\mid }\otimes {\omega }_E^{a,b,t},$

where every block ${\omega }_E^{\mathrm{\perp },t}$ and ${\omega }_E^{a,b,t}$ is nonnegative and the sum of their traces is $1$. The trace of each block is the joint probability of its displayed classical labels. All registers and tensor factors retain the displayed order. The transcript is included separately from $E$ so that secrecy below explicitly conditions on the public messages as well as Eve's quantum information.

Let $\mathsf{K}$ be a finite nonempty key alphabet with a fixed ordering, and let $H_T,H_E$ be finite-dimensional complex inner-product spaces with $H_T\mathrm{\ne }\{0\}$ and $H_E\mathrm{\ne }\{0\}$. Give the key register $H_A={\mathbb{C}}^{\mathsf{K}}$ its corresponding computational basis $(\mathrm{\mid }k⟩{)}_{k\in \mathsf{K}}$. For each $k\in \mathsf{K}$, define $L_k:H_A\otimes H_T\otimes H_E\to H_A\otimes H_B\otimes H_T\otimes H_E$ by

$L_k(\mathrm{\mid }j⟩\otimes x)=\{\begin{array}{ll}\mathrm{\mid }k,k⟩\otimes x,& j=k,\\ 0,& j\mathrm{\ne }k,\end{array}$

and extend linearly, where $H_B$ is another copy of $H_A$. Then

$\mathcal{C}(X):={\sum }_{k\in \mathsf{K}}{L}_{k}X{L}_k^{†}$

is a finite-dimensional quantum channel. On every input classical in $A$, ${\xi }_{ATE}={\sum }_k\mathrm{\mid }k⟩⟨k\mathrm{\mid }\otimes {\xi }_{TE}^k$, it acts by

$\mathcal{C}({\xi }_{ATE})={\sum }_{k\in \mathsf{K}}\mathrm{\mid }k,k⟩⟨k,k\mathrm{\mid }\otimes {\xi }_{TE}^k\mathrm{.}$

This map copies a measured classical key register; it does not copy arbitrary quantum states.

Let $I$ be a finite nonempty set with a fixed ordering, let $H_E$ be a nonzero finite-dimensional complex inner-product space, and let $X_i:H_E\to H_E$ be self-adjoint for each $i\in I$. On the ordered register ${\mathbb{C}}^I\otimes H_E$ with the corresponding computational basis, set $X={\sum }_{i\in I}\mathrm{\mid }i⟩⟨i\mathrm{\mid }\otimes X_i$. Then

$\mathrm{\parallel }X{\mathrm{\parallel }}_1={\sum }_{i\in I}\mathrm{\parallel }{X}_i{\mathrm{\parallel }}_1\mathrm{.}$

Fix one adversarial strategy in a protocol from Finite authenticated key-distribution protocol. Write its final output blocks as ${\omega }_E^{\mathrm{\perp },t}$ on abort and ${\omega }_E^{a,b,t}$ on acceptance. Define the abort and accepted transcript-adversary substates by

${\rho }_{TE}^{\mathrm{a}\mathrm{b}\mathrm{o}\mathrm{r}\mathrm{t}}:={\sum }_{t\in \mathsf{T}}\mathrm{\mid }t⟩⟨t\mathrm{\mid }\otimes {\omega }_E^{\mathrm{\perp },t},{\rho }_{TE}^{\mathrm{a}\mathrm{c}\mathrm{c}}:={\sum }_{t\in \mathsf{T}}\mathrm{\mid }t⟩⟨t\mathrm{\mid }\otimes {\sum }_{a,b\in \mathsf{K}}{\omega }_E^{a,b,t}\mathrm{.}$

The accepted part of the full real state is ${\rho }_{ABTE}^{\mathrm{a}\mathrm{c}\mathrm{c}}:={\sum }_{a,b\in \mathsf{K},t\in \mathsf{T}}\mathrm{\mid }a,b,t⟩⟨a,b,t\mathrm{\mid }\otimes {\omega }_E^{a,b,t}$.

Their traces are $p_{\mathrm{a}\mathrm{b}\mathrm{o}\mathrm{r}\mathrm{t}}$ and $p_{\mathrm{a}\mathrm{c}\mathrm{c}}$, with $p_{\mathrm{a}\mathrm{b}\mathrm{o}\mathrm{r}\mathrm{t}}+p_{\mathrm{a}\mathrm{c}\mathrm{c}}=1$. If $p_{\mathrm{a}\mathrm{c}\mathrm{c}}>0$, put ${\rho }_{ABTE}^{\mathrm{\top }}:={\rho }_{ABTE}^{\mathrm{a}\mathrm{c}\mathrm{c}}\mathrm{/}{p}_{\mathrm{a}\mathrm{c}\mathrm{c}}$ and define the normalized accepted marginals directly from their classical blocks:

${\rho }_{ATE}^{\mathrm{\top }}:={\sum }_{a,t}\mathrm{\mid }a,t⟩⟨a,t\mathrm{\mid }\otimes \frac{1}{p_{\mathrm{a}\mathrm{c}\mathrm{c}}}{\sum }_b{\omega }_E^{a,b,t},{\rho }_{TE}^{\mathrm{\top }}:={\sum }_t\mathrm{\mid }t⟩⟨t\mathrm{\mid }\otimes \frac{1}{p_{\mathrm{a}\mathrm{c}\mathrm{c}}}{\sum }_{a,b}{\omega }_E^{a,b,t}\mathrm{.}$

For $m:=\mathrm{\mid }\mathsf{K}\mathrm{\mid }$, define the uniform key state ${\tau }_A:=m^{-1}{\sum }_{a\in \mathsf{K}}\mathrm{\mid }a⟩⟨a\mathrm{\mid }$ and the ideal uniform shared-key state ${\tau }_{AB}:=m^{-1}{\sum }_{a\in \mathsf{K}}\mathrm{\mid }a,a⟩⟨a,a\mathrm{\mid }$. The abort-aware ideal full output keeps the real abort branch and the accepted transcript-adversary marginal, but replaces the accepted keys with a uniform shared key independent of both:

${\rho }_{ABTE}^{\mathrm{i}\mathrm{d}\mathrm{e}\mathrm{a}\mathrm{l}}:={\sum }_t\mathrm{\mid }\mathrm{\perp },\mathrm{\perp },t⟩⟨\mathrm{\perp },\mathrm{\perp },t\mathrm{\mid }\otimes {\omega }_E^{\mathrm{\perp },t}+{\tau }_{AB}\otimes {\rho }_{TE}^{\mathrm{a}\mathrm{c}\mathrm{c}}\mathrm{.}$

Let ${\rho }_{ABTE}^{\mathrm{r}\mathrm{e}\mathrm{a}\mathrm{l}}$ be the normalized output from the protocol definition. The real-ideal trace-distance error is ${\delta }_{\mathrm{i}\mathrm{d}}:=D({\rho }_{ABTE}^{\mathrm{r}\mathrm{e}\mathrm{a}\mathrm{l}},{\rho }_{ABTE}^{\mathrm{i}\mathrm{d}\mathrm{e}\mathrm{a}\mathrm{l}})$, using Trace Distance. The correctness error is ${\epsilon }_{\mathrm{c}\mathrm{o}\mathrm{r}}:=\mathrm{Pr}[K_A\mathrm{\ne }{K}_B]={\sum }_{a\mathrm{\ne }b,t}\mathrm{tr}({\omega }_E^{a,b,t})$; the common abort output contributes no mismatch. The secrecy error is

${\epsilon }_{\mathrm{s}\mathrm{e}\mathrm{c}}:=\{\begin{array}{ll}{p}_{\mathrm{a}\mathrm{c}\mathrm{c}}D({\rho }_{ATE}^{\mathrm{\top }},{\tau }_A\otimes {\rho }_{TE}^{\mathrm{\top }}),& p_{\mathrm{a}\mathrm{c}\mathrm{c}}>0,\\ 0,& p_{\mathrm{a}\mathrm{c}\mathrm{c}}=0.\end{array}$

This is an unconditional convention: the normalized secrecy distance on acceptance is weighted by the acceptance probability. Errors in a protocol are uniform bounds on these strategy-specific quantities over all allowed adversarial strategies.

Let $\mathsf{K},\mathsf{T}$ be finite nonempty alphabets and let $H_E$ be a nonzero finite-dimensional adversary space. Consider a normalized state classical in $A,B,T$,

${\rho }_{ABTE}={\sum }_{a,b\in \mathsf{K},t\in \mathsf{T}}\mathrm{\mid }a,b,t⟩⟨a,b,t\mathrm{\mid }\otimes R_E^{a,b,t},$

where each $R_E^{a,b,t}$ is nonnegative. Define Alice's $ATE$ marginal by

${\rho }_{ATE}:={\sum }_{a,t}\mathrm{\mid }a,t⟩⟨a,t\mathrm{\mid }\otimes {\sum }_b{R}_E^{a,b,t},$

and let ${\gamma }_{ABTE}:=\mathcal{C}({\rho }_{ATE})$ for the classical key-copy channel $\mathcal{C}$ of The finite classical key-copy map is a quantum channel. Then

$D({\rho }_{ABTE},{\gamma }_{ABTE})=\mathrm{Pr}[K_A\mathrm{\ne }{K}_B]={\sum }_{a\mathrm{\ne }b,t}\mathrm{tr}(R_E^{a,b,t})\mathrm{.}$

For a protocol output and fixed adversarial strategy as in Abort-aware real and ideal QKD outputs and security errors, the real full output is a density operator. If $p_{\mathrm{a}\mathrm{c}\mathrm{c}}>0$, the normalized accepted state ${\rho }_{ABTE}^{\mathrm{\top }}$ and the block-defined marginals ${\rho }_{ATE}^{\mathrm{\top }},{\rho }_{TE}^{\mathrm{\top }}$ are density operators; so are ${\tau }_A$, ${\tau }_{AB}$, ${\tau }_A\otimes {\rho }_{TE}^{\mathrm{\top }}$ and the ideal full output ${\rho }_{ABTE}^{\mathrm{i}\mathrm{d}\mathrm{e}\mathrm{a}\mathrm{l}}$. If $p_{\mathrm{a}\mathrm{c}\mathrm{c}}=0$, the ideal full output equals the real abort-only state.

For every finite authenticated key-distribution protocol and each fixed allowed adversarial strategy, let ${\delta }_{\mathrm{i}\mathrm{d}}$, ${\epsilon }_{\mathrm{c}\mathrm{o}\mathrm{r}}$, and ${\epsilon }_{\mathrm{s}\mathrm{e}\mathrm{c}}$ be as in Abort-aware real and ideal QKD outputs and security errors. Then

${\delta }_{\mathrm{i}\mathrm{d}}\le {\epsilon }_{\mathrm{c}\mathrm{o}\mathrm{r}}+{\epsilon }_{\mathrm{s}\mathrm{e}\mathrm{c}}\mathrm{.}$

Consequently, if correctness and secrecy errors are bounded uniformly over all allowed adversarial strategies by ${\epsilon }_{\mathrm{c}\mathrm{o}\mathrm{r}}$ and ${\epsilon }_{\mathrm{s}\mathrm{e}\mathrm{c}}$, respectively, then the real-ideal trace distance is uniformly at most their sum.