11

PostPost--processing for processing for quantum key distributionquantum key distribution

Xiongfeng MaXiongfeng MaCQIQC, University of TorontoCQIQC, University of Toronto

Institute for Quantum ComputingInstitute for Quantum ComputingChiChi--Hang Fred Fung, JeanHang Fred Fung, Jean--Christian Boileau, Hoi Fung ChauChristian Boileau, Hoi Fung Chau

Computers & Security 30, 172 Computers & Security 30, 172 –– 177 (2011)177 (2011)Phys. Rev. A 81, 012318 (2010)Phys. Rev. A 81, 012318 (2010)

22

OutlineOutline

IntroductionIntroductionSecurity proofSecurity proofFinite key analysisFinite key analysisPostPost--processingprocessingConclusionConclusion

33

IntroductionIntroduction

44

Private key cryptosystemPrivate key cryptosystem

Alice and Bob share two identical keys Alice and Bob share two identical keys secretly: onesecretly: one--time padtime pad

Key Distribution

Encode

10010110101

00111010100

10101100001

XORMessage

Code

Alice

Key

Decode

00111010100XOR

10101100001

10010110101 Message

Code

Bob

Key

55

Quantum key distributionQuantum key distribution

BB84 (Bennett & Brassard 1984)BB84 (Bennett & Brassard 1984)

Alice

0101100

0:1:

01X11X001X11X0

Bob

0101110

Eve

1110100

11010011X10X0

66

Biased basis choiceBiased basis choiceStandard BB84Standard BB84

Alice and Bob choose XAlice and Bob choose X-- and Zand Z--basis with equal basis with equal probabilities (50/50)probabilities (50/50)Basis sift factor: 1/2Basis sift factor: 1/2

Efficient BB84Efficient BB84Alice and Bob choose XAlice and Bob choose X-- and Zand Z--basis with different basis with different probabilities, i.e., with a biasprobabilities, i.e., with a biasBasis sift factor: approaches to 1 asymptoticallyBasis sift factor: approaches to 1 asymptotically

TradeTrade--offoffIn practice, a larger bias leads to less accurate phase In practice, a larger bias leads to less accurate phase error rate estimation. Think about the extreme case.error rate estimation. Think about the extreme case.

H.H.--K. Lo, H. F. Chau, and M. Ardehali, J. Crypto. 18, 133 (2005).K. Lo, H. F. Chau, and M. Ardehali, J. Crypto. 18, 133 (2005).

77

In practiceIn practice

Biased basis ratio, e.g., 90% for ZBiased basis ratio, e.g., 90% for Z--basis basis and 10% for Xand 10% for X--basisbasisBit reconciliationBit reconciliation

Error correction: straightforward*Error correction: straightforward*Authentication and error verificationAuthentication and error verificationPrivacy amplificationPrivacy amplification

Amount: phase error rate estimationAmount: phase error rate estimationEfficiency: hash matrix constructionEfficiency: hash matrix construction

Confidence level on the final keyConfidence level on the final keySecurity parametersSecurity parameters

88

ObjectivesObjectivesLink between security analyses and Link between security analyses and experimentsexperiments

InfiniteInfinite--key analysis to finitekey analysis to finite--key analysiskey analysisPostPost--processingprocessing

From raw key to final key, step by stepFrom raw key to final key, step by stepParameter optimizationParameter optimization

Biased basis choiceBiased basis choiceSecurity parameter vs. secureSecurity parameter vs. secure--key costkey cost

Towards a security analysis standardTowards a security analysis standardSecurity claimSecurity claimFinal key size evaluationFinal key size evaluationUnderlying assumptionsUnderlying assumptions

99

TakeTake--home messageshome messagesA practical postA practical post--processing scheme: step by stepprocessing scheme: step by step

Basis independent sourceBasis independent sourceSquashing model compatible detection systemSquashing model compatible detection system

Biased basis ratioBiased basis ratioTypically, 90:10Typically, 90:10

Authentication: can be done efficiently in practiceAuthentication: can be done efficiently in practiceError verification: essentially an authentication schemeError verification: essentially an authentication scheme

Phase error estimation: a strict bound Phase error estimation: a strict bound Main contribution to the finiteMain contribution to the finite--key effectkey effect

Efficiency of privacy amplification: highEfficiency of privacy amplification: highOther sources and protocols: yet to be doneOther sources and protocols: yet to be done

Decoy state, COW, DPS, Decoy state, COW, DPS, ……

X. Ma, C.X. Ma, C.--H. F. Fung, J.H. F. Fung, J.--C. Boileau, H. F. Chau, C. Boileau, H. F. Chau, Computers & Computers & Security 30, 172 Security 30, 172 –– 177 (2011)177 (2011)

1010

Why is it secure?Why is it secure?

1111

A quick reviewA quick reviewPreparePrepare--andand--measure protocolsmeasure protocols

BB84, sixBB84, six--statestate……Entanglement based protocolsEntanglement based protocols

Ekert91, BBM92Ekert91, BBM92Unconditional security proof Unconditional security proof

Mayers (1996) Mayers (1996) Lo and Chau (1999)Lo and Chau (1999)Shor and Preskill (2000)Shor and Preskill (2000)Devetak and Winter (2003), Renner (2005)Devetak and Winter (2003), Renner (2005)

Security analysis for QKD with imperfect devicesSecurity analysis for QKD with imperfect devicesE.g. Mayers, LE.g. Mayers, Lüütkenhaus, ILMtkenhaus, ILMKoashiKoashi--PreskillPreskillGottesmanGottesman--LoLo--LLüütkenhaustkenhaus--Preskill (GLLP)Preskill (GLLP)

1212

Entanglement based protocolsEntanglement based protocols

Alice (or Eve) prepares an EPR pairAlice (or Eve) prepares an EPR pair

Alice and Bob each measures one half of the Alice and Bob each measures one half of the pairpair

Estimate bit and phase error ratesEstimate bit and phase error ratesZ basis measurement (bit)Z basis measurement (bit)

|0> or |1>|0> or |1>X basis measurement (phase)X basis measurement (phase)

|0>+|1> or |0>|0>+|1> or |0>--|1>|1>

)1100(2

1 +=ΨAB

C. H. Bennett, D. P. DiVincenzo, J. A. Smolin, and W. K. WootterC. H. Bennett, D. P. DiVincenzo, J. A. Smolin, and W. K. Wootterss,,PRA 54, 3824 (1996).PRA 54, 3824 (1996).

1313

Entanglement distillation protocolEntanglement distillation protocol

Entanglement distillation (Lo & Chau 99)Entanglement distillation (Lo & Chau 99)1.1. Bit error correctionBit error correction2.2. Phase error correctionPhase error correction3.3. Share (Share (almostalmost) pure EPR pairs) pure EPR pairs4.4. Measure in Z basis to get final keyMeasure in Z basis to get final keyReduce to prepareReduce to prepare--andand--measure schemes measure schemes (Shor & Preskill 00)(Shor & Preskill 00)

Put the final key measurement ahead by moving 4 Put the final key measurement ahead by moving 4 ahead of 1ahead of 1Error correctionError correctionPrivacy amplificationPrivacy amplification

1414

Underlying assumptionsUnderlying assumptionsCharacterized source or basisCharacterized source or basis--independent sourceindependent source

Single photon (qubit) sourceSingle photon (qubit) sourceCoherent state source: decoy stateCoherent state source: decoy stateEntangled sourceEntangled source

Detection system: compatible with the squashing modelDetection system: compatible with the squashing modelThreshold detectorThreshold detectorNo efficiency mismatchNo efficiency mismatch

Classical accessoriesClassical accessoriesauthentication; error correction; classical communication; authentication; error correction; classical communication; random number generators; key management; random number generators; key management; Secure key cost: asymptotically negligibleSecure key cost: asymptotically negligible

Infinite key limitInfinite key limitRates Rates →→ probabilitiesprobabilitiesFailure probability Failure probability →→ 00

N. J. Beaudry, T. Moroder, and N. LN. J. Beaudry, T. Moroder, and N. Lüütkenhaus,tkenhaus, Phys. Rev. Lett. , 101, Phys. Rev. Lett. , 101, 093601, (2008).093601, (2008).

1515

Basis independent setupBasis independent setup

BBM92 (Bennett, Brassard & Mermin 1992)BBM92 (Bennett, Brassard & Mermin 1992)

M. Koashi and J. Preskill, Phys. Rev. Lett. , 90, 057902, (2003)M. Koashi and J. Preskill, Phys. Rev. Lett. , 90, 057902, (2003)..X. Ma, C.X. Ma, C.--H. F. Fung, and H.H. F. Fung, and H.--K. Lo, PRA 76, 012307 (2007).K. Lo, PRA 76, 012307 (2007).

One can assume One can assume Eve has a full Eve has a full control of the control of the source. source. The basis choice is The basis choice is independent of the independent of the state in the channel.state in the channel.The source can be The source can be treated as a perfect treated as a perfect single photon (qubit) single photon (qubit) or EPR source. or EPR source. EveEve

1616

Finite key analysisFinite key analysis

1717

FiniteFinite--key issueskey issuesInitial keyInitial key

Authentication: manAuthentication: man--inin--thethe--middle attackmiddle attackOther uses: encryption of classical communication in the postOther uses: encryption of classical communication in the post--processingprocessing

ComposabilityComposabilityGenerated key may be used for the next round of QKDGenerated key may be used for the next round of QKDKey growth rather than key distributionKey growth rather than key distribution

No perfect key in realNo perfect key in real--lifelifeIdentical: Alice and Bob share the same keyIdentical: Alice and Bob share the same keyRealReal--life: no perfect error correction code, i.e., any error life: no perfect error correction code, i.e., any error correction code can only guarantee with a certain confidence correction code can only guarantee with a certain confidence intervalintervalPrivate: Eve knows nothing about the final keyPrivate: Eve knows nothing about the final keyRealReal--life: Eve can just guess the bit values of the initial key with life: Eve can just guess the bit values of the initial key with a successful probability, a successful probability, εε=2=2--kk

1818

NaNaïïve security definitionsve security definitionsSecure key cost in postSecure key cost in post--processingprocessing

Key cost (k) < key generation (n)Key cost (k) < key generation (n)A fixed failure probability for an arbitrary number of A fixed failure probability for an arbitrary number of rounds, rounds, εε, [too strong], [too strong]

With EveWith Eve’’s simple guess + mans simple guess + man--inin--thethe--middle attack: middle attack: εε=2=2--kk, for , for each roundeach roundThe failure probability for n rounds (potentially n attacks) is The failure probability for n rounds (potentially n attacks) is at at least n2least n2--kk, linear dependence, linear dependence

Small portion of the initial key known by Eve, [too weak]Small portion of the initial key known by Eve, [too weak]Even exponentially small is not strong enough due to continuous Even exponentially small is not strong enough due to continuous use of the QKD systemuse of the QKD systemRequirement of composabilityRequirement of composability

1919

Composable securityComposable securityConfidence interval / Failure probabilityConfidence interval / Failure probability

Confidence interval: the probability that the final key is identConfidence interval: the probability that the final key is identical ical and private, and private, 11--εεThe failure probability for n rounds: nThe failure probability for n rounds: nεε, linear dependence, linear dependenceExponentially decreasing with key cost kExponentially decreasing with key cost kA rough guess: A rough guess: εε=2=2--O(k)O(k) per roundper roundSmaller than a certain threshold determined by some practical Smaller than a certain threshold determined by some practical use of the key, say 10use of the key, say 10--1010

Remark: Remark: it does not mean Eve knows nit does not mean Eve knows nεε--bit information about bit information about the final keythe final key

Composable security definitionComposable security definitionFailure probability is smaller than the preFailure probability is smaller than the pre--determined threshold determined threshold for for allall rounds of QKD system usagesrounds of QKD system usages

M. BenM. Ben--Or et al, in TCC (2005), 386.Or et al, in TCC (2005), 386.R. Renner and R. KR. Renner and R. Köönig, in TCC (2005), 407.nig, in TCC (2005), 407.

Security measuresSecurity measuresFidelity: failure probabilityFidelity: failure probability

Lo, Chau and other prior worksLo, Chau and other prior worksM. HayashiM. HayashiM. KoashiM. Koashi

Trace distanceTrace distanceR. Canetti (2001)R. Canetti (2001)M. BenM. Ben--Or, M. Horodecki, D. W. Leung, D. Mayers, and Or, M. Horodecki, D. W. Leung, D. Mayers, and J. J. Oppenheim (2005)Oppenheim (2005)R. Renner and R. KR. Renner and R. Köönig (2005)nig (2005)

Workshop, FiniteWorkshop, Finite--Size Effects in QKD (Singapore, Size Effects in QKD (Singapore, 2008)2008)

Two approaches are equivalentTwo approaches are equivalentRenner: we should use trace distanceRenner: we should use trace distance

2020

2121

ToTo--do listdo listReRe--exam security proofsexam security proofs

Underlying assumptionsUnderlying assumptionsFormulas from asymptotic security analyses should be reFormulas from asymptotic security analyses should be re--derivedderivedNote: all the security analyses are about Note: all the security analyses are about privacy amplificationprivacy amplification

Calculate failure probability and secureCalculate failure probability and secure--key costkey costFor each step: basis sift, error correction, authentication, errFor each step: basis sift, error correction, authentication, error or verification, and phase error rate estimationverification, and phase error rate estimationEfficiency of privacy amplificationEfficiency of privacy amplification

Parameter optimizationParameter optimizationBiased basis choice Biased basis choice securesecure--key cost for each stepkey cost for each step

We have all the recipes ready: put them togetherWe have all the recipes ready: put them together

2222

PostPost--processingprocessing

2323

Underlying assumptionsUnderlying assumptions

A single photon (qubit) source or a basisA single photon (qubit) source or a basis--independent sourceindependent source

Coherent state (e.g., with decoy state) QKD: Coherent state (e.g., with decoy state) QKD: in progressin progress

A detection system: compatible with the A detection system: compatible with the squashing modelsquashing modelClassical communicationClassical communicationRandom number generator and key Random number generator and key management management

Flow chartFlow chartM. Hayashi, M. Hayashi, D. W. Leung, D. W. Leung, H.H.--K. Lo, N. LK. Lo, N. Lüütkenhaus, tkenhaus, M. Koashi, X. Mo, M. Koashi, X. Mo, B. Qi, B. Qi, R. Renner, V. Scarani, D. R. Renner, V. Scarani, D. Stebila, K. Tamaki, W. Stebila, K. Tamaki, W. TittelTittelWorkshop, Quantum Workshop, Quantum Works QKD Meeting Works QKD Meeting (Waterloo, Canada)(Waterloo, Canada)Workshop, FiniteWorkshop, Finite--Size Size Effects in QKD Effects in QKD (Singapore)(Singapore)N. LN. Lüütkenhaus, Phys. tkenhaus, Phys. Rev. A 59, 3301 (1999): Rev. A 59, 3301 (1999): using error verification to using error verification to replace error testing.replace error testing.

2424

2525

Procedures IProcedures IKey sift [neither authenticated nor encrypted]Key sift [neither authenticated nor encrypted]

Discard all noDiscard all no--clicks and randomly assign doubleclicks and randomly assign double--clicksclicksOther sift scheme might be applied, e.g., Ma, Moroder Other sift scheme might be applied, e.g., Ma, Moroder and Land Lüütkenhaustkenhaus, arXiv:0812.4301 (2008)arXiv:0812.4301 (2008)

Basis sift [authenticated but not encrypted]Basis sift [authenticated but not encrypted]Use a 2kUse a 2k--bit secure key to generate a Toeplitz matrixbit secure key to generate a Toeplitz matrixCalculate the tag by multiply the matrix with her/his Calculate the tag by multiply the matrix with her/his basis stringbasis stringSend each other the basis string with the tagSend each other the basis string with the tagDiscard those bits that used different basesDiscard those bits that used different basesOther sift scheme might be applied, e.g., SARGOther sift scheme might be applied, e.g., SARG’’0404

2626

Procedures IIProcedures II

Error correction [not authenticated but encrypted]Error correction [not authenticated but encrypted]Any error correction scheme can be applied hereAny error correction scheme can be applied hereCount the number of bits in the classical Count the number of bits in the classical communicationcommunication

Error verification [essentially an authentication Error verification [essentially an authentication problem]problem]

Alice sends an encrypted tag to BobAlice sends an encrypted tag to BobBob verify the tagBob verify the tagIf failed, they can go back to error correction againIf failed, they can go back to error correction again

2727

Procedures IIIProcedures III

Phase error rate estimationPhase error rate estimationProb.{phase error} = Prob.{bit error}Prob.{phase error} = Prob.{bit error}Asymptotically, rates Asymptotically, rates →→ probabilitiesprobabilitiesA simple random sampling problemA simple random sampling problem

2828

Procedure IVProcedure IV

Privacy amplification [authenticated but Privacy amplification [authenticated but not encrypted]not encrypted]

Alice generates an Alice generates an nnxx+n+nzz+l+l--11bit random bit bit random bit string and sends it to Bob through an string and sends it to Bob through an authenticated channelauthenticated channelThey use this random bit string to generate a They use this random bit string to generate a Teoplitz matrix to do privacy amplificationTeoplitz matrix to do privacy amplification

2929

Final key rateFinal key rateKey rate formulaKey rate formula

FiniteFinite--key effectkey effectPhase error rate estimation, which determines the Phase error rate estimation, which determines the biased basis choicebiased basis choicekk33: cost of authentication, error verification, efficiency : cost of authentication, error verification, efficiency of privacy amplificationof privacy amplification

3030

OptimizationOptimization

Parameters to be optimizedParameters to be optimizedFailure probabilities:Failure probabilities:

Key costs: Key costs: FiniteFinite--key effectkey effect

Net key growth: NRNet key growth: NR≥≥ll--kkecec--kk33Failure probability: Failure probability: εε==εεphph + + εε33The contribution of The contribution of εε33 is negligible, when the is negligible, when the final key length >> 37 bitsfinal key length >> 37 bits

3131

FiniteFinite--key effectskey effects

Error correction [fixed]Error correction [fixed]

Phase error Phase error rate estimation:rate estimation:

The amount of The amount of privacy privacy amplificationamplificationOptimal basis Optimal basis biasbias

Other partsOther partsAuthenticationAuthenticationError Error verificationverificationEfficiency of Efficiency of privacy privacy amplificationamplification

3232

Quick resultsQuick resultsAn extreme exampleAn extreme example

Raw key size n=10Raw key size n=103030 and and εε=10=10--3030; ; kk33=947 bits and =947 bits and εε33<10<10--3232

A typical exampleA typical examplen=10n=1077, , εε=10=10--77; ; kk33=202 bits and =202 bits and εε33<10<10--99

ObservationObservationMain effect comes from phase error estimationMain effect comes from phase error estimationThe efficiency of privacy amplification is close to 1The efficiency of privacy amplification is close to 1The costs of authentication and error verification are The costs of authentication and error verification are negligible in a normal (say, data size >10k) negligible in a normal (say, data size >10k) experimentexperiment

333310

210

410

610

810

1010

120.5

0.55

0.6

0.65

0.7

0.75

0.8

0.85

0.9

0.95

1

Raw key data size

Bia

s

px set by Alice

qx obtained by Bob

eexx=e=ezz=4%=4%εε==1010--77

100% error correction efficiency100% error correction efficiency

343410

210

410

610

810

1010

120

0.1

0.2

0.3

0.4

0.5

0.6

0.7

Raw key data size

Key

rate

per

raw

key

Finite keyAsymptotic key

eexx=e=ezz=4%=4%εε=10=10--77

100% error correction efficiency100% error correction efficiency

353510

-10010

-8010

-6010

-4010

-2010

010

2

103

104

105

failure probability ε

min

dat

a si

ze to

yie

ld a

pos

itive

key

minimun data size

eexx=e=ezz=4%=4%100% error correction efficiency100% error correction efficiency

3636

ConclusionConclusion

A practical postA practical post--processing scheme with processing scheme with failure probability as the security definition failure probability as the security definition Error verification: essentially an Error verification: essentially an authentication schemeauthentication schemePhase error estimation: a strict bound Phase error estimation: a strict bound Efficiency of privacy amplification: highEfficiency of privacy amplification: highParameter optimization: main finiteParameter optimization: main finite--key key effect comes from phase error rate effect comes from phase error rate estimationestimation

3737

Further discussionFurther discussionFurther improvement in the privacy amplification Further improvement in the privacy amplification step: no classical communication needed?step: no classical communication needed?

Efficiency: failure probability, secureEfficiency: failure probability, secure--key costkey costExtractors for privacy amplificationExtractors for privacy amplification

Detector efficiency mismatchDetector efficiency mismatchSquashing modelSquashing model

FiniteFinite--key analysis for the decoykey analysis for the decoy--state QKDstate QKDStatistics (software)Statistics (software)HardwareHardware

Computational complexityComputational complexityOnOn--line postline post--processingprocessing

Random number consumptionRandom number consumptionExtractorsExtractors

3838

ReferencesReferencesX. Ma, C.X. Ma, C.--H. F. Fung,H. F. Fung, J.J.--C. Boileau, H. F. Chau, C. Boileau, H. F. Chau, Computers & Computers & Security 30, 172 Security 30, 172 –– 177 (2011)177 (2011)C.C.--H. F. Fung, X. Ma, and H. F. Chau, Phys. Rev. A 81, 012318 H. F. Fung, X. Ma, and H. F. Chau, Phys. Rev. A 81, 012318 (2010)(2010)H. Krawczyk, in Advances in Cryptology H. Krawczyk, in Advances in Cryptology -- CRYPTO'94 (SpringerCRYPTO'94 (Springer--Verlag, 1994), 893, 129Verlag, 1994), 893, 129--139.139.N. LN. Lüütkenhaus, Phys. Rev. A 59, 3301 (1999).tkenhaus, Phys. Rev. A 59, 3301 (1999).M. Koashi and J. Preskill, Phys. Rev. Lett. , 90, 057902, (2003)M. Koashi and J. Preskill, Phys. Rev. Lett. , 90, 057902, (2003)..M. BenM. Ben--Or et al, in TCC (2005), 386.Or et al, in TCC (2005), 386.R. Renner and R. KR. Renner and R. Köönig, in TCC (2005), 407.nig, in TCC (2005), 407.M. Hayashi, Phys. Rev. A 74, 022307 (2006).M. Hayashi, Phys. Rev. A 74, 022307 (2006).X. Ma, C.X. Ma, C.--H. F. Fung, and H.H. F. Fung, and H.--K. Lo, PRA 76, 012307 (2007).K. Lo, PRA 76, 012307 (2007).V. Scarani and R. Renner, Phys. Rev. Lett. 100, 200501 (2008).V. Scarani and R. Renner, Phys. Rev. Lett. 100, 200501 (2008).T. Tsurumaru and K. Tamaki, Phys. Rev. A 78, 032302 (2008).T. Tsurumaru and K. Tamaki, Phys. Rev. A 78, 032302 (2008).N. J. Beaudry, T. Moroder, and N. LN. J. Beaudry, T. Moroder, and N. Lüütkenhaus, Phys. Rev. Lett. 101, tkenhaus, Phys. Rev. Lett. 101, 093601 (2008).093601 (2008).

3939

Another interesting topicAnother interesting topic

Efficiency loopholeEfficiency loopholeLong existing problem in BellLong existing problem in Bell’’s inequality testss inequality tests

QKD systemQKD systemDetector efficiency mismatchDetector efficiency mismatchDead time / after pulseDead time / after pulse

Attacks Attacks TimeTime--shift attackshift attackOther freedoms: space, frequency, Other freedoms: space, frequency, ……Even practical oneEven practical one--time encryptiontime encryption

EfficiencyEfficiency--loophole free QKDloophole free QKDX. Ma, T. Moroder, and N. LX. Ma, T. Moroder, and N. Lüütkenhaus, arXiv:0812.4301, (2008).tkenhaus, arXiv:0812.4301, (2008).

4040

Thank you!Thank you!

XiongfengXiongfeng Ma, July 06Ma, July 06thth, 2011, 2011