The history of quantum key distribution (QKD) began in 1984 with a beautifully simple proof-of-concept result [1], where a sender, commonly called Alice, randomly prepares one of four single-qubit states from two complementary bases which she sends to a receiver, commonly known as Bob, via an insecure quantum channel. Bob then measures in one of the two bases, randomly chosen, which is followed by a number of classical post-processing steps including sifting, parameter estimation, error correction and privacy amplification. If all those steps succeed, Alice and Bob obtain a common key they can use to encrypt their communication using the one-time pad protocol, the security of which has been proven mathematically [2] and does not rely on any computational assumptions on an eavesdropper, commonly named Eve.

The reason that today, 40 years later, QKD is still an active field of basic research rather than a standard tool in communication, is that effectively implementing a QKD protocol in practice, without violating any of the assumptions made when proving its security, is a highly non-trivial task, both for the experimentalists reducing imperfections in their apparatuses that might be exploited by Eve, and for the theorists that include such imperfections into their security proofs. While a lot of progress has been made in recent decades, see [3,4] for recent reviews, I do not believe those two sides have completely converged yet.

A major challenge for implementing protocols such as BB84 in its original and very simple form is the need for single-photon states. Since exact single-photon sources are difficult to implement, one typically uses weak laser pulses described by coherent states with low average photon number [5]. Such pulses, however, can contain additional photons with small probability. Eve can make use of such pulses to obtain information, while remaining undetected, e.g., by an attack known as photon-number splitting (PNS). To counteract such a security loophole, techniques such as decoy states have been developed [6], however at the cost of complicating the protocol and its security proof.

An alternative way to overcome such PNS attacks has been introduced by [7] in 2002. Unlike most QKD protocols the so-called differential-phase-shift (DPS) protocol involves Bob measuring the relative phase between two pulses, which counteracts attacks on individual pulses, including the PNS attack. In the DPS protocol, raw key bits are obtained from the relative phase between two coherent states, rather than from a single coherent state. In an implementation Alice uses a source of weak coherent pulses and a phase modulator to encode random phases, whereupon Bob uses a Mach-Zehnder interferometer to measure the phase between subsequent pulses. Assuming Eve performs a PNS attack, this would require a photon-number measurement, which can be detected in such a setup.

Of course, security against a particular kind of attack is by far not sufficient for a protocol to be deemed secure against a general quantum adversary. Given the huge range of possible attacks, one typically considers the following three classes of attacks: Assuming a prepare-and-measure QKD protocol, in an individual attack, Eve can control the Stinespring isometry of the channel between Alice and Bob in every round, but is assumed not to possess a quantum memory, and hence has to measure her quantum output after each round individually. A generalisation is a collective attack, where Eve controls the individual Stinespring isometries of each round, but can store her quantum outputs until the end of the protocol and measure them collectively then.

A further generalisation is a coherent, also called general, attack, where Eve is not restricted to controlling the Stinespring isometries in each round individually, but is allowed to control the entire transmission part of the protocol in a coherent way. Whereas proving security against individual and collective attacks is often straightforward, the possibility of coherent attacks typically poses significant challenges. Tools for security proofs against coherent attacks include de Finetti theorems [8], post-selection techniques [9] and entropy-accumulation theorems (EATs) [10,11,12]. Using such techniques it is often possible to reduce coherent-state security to collective-attack security.

The non-standard structure of the DPS protocol, which even without attack involves operations performed jointly on subsequent rounds, has for a long time hindered its security analysis including coherent attacks. In particular the fact that there is no permutation symmetry between rounds has prevented a treatment using de Finetti. Intuitively one would also expect that collective attacks are not the best choice for Eve. More than 20 years after the initial proposal of the DPS protocol, Sandfuchs et al. [13] have now proven security against coherent attacks using the generalised entropy-accumulation theorem (GEAT) [11], which is a major achievement. In addition, Sandfuchs et al. have shown that coherent attacks of the DPS protocol can indeed be stronger than collective ones, confirming the intuition.

The EAT, and its generalisation the GEAT, are powerful tools that have previously been used to prove coherent security of device-indecent QKD [14], conference key agreement [15], and discrete-modulated continuous-variable QKD [16]. However they are far from being easily applicable plug-and-play results. For one, it is necessary to formulate the protocol as a sequence of channels that fulfil certain conditions. In the original EAT, a Markov condition has to be fulfilled ensuring that side-information produced in a certain round has to be taken into account in that round rather than passed along to future rounds and adding to their side information. In the GEAT this condition is relaxed to a condition of no-signalling. Such conditions typically require the invention of a virtual or hypothetical protocol to which the EAT is applied, but which is different from the actual protocol performed by Alice and Bob. It then has to be shown that security of the virtual protocol also implies security of the actual protocol.

In their security proof of the DPS, Sandfuchs et al. use a so-called relativistic protocol as virtual protocol to which they apply the GEAT, and then show that security of the relativistic protocol also implies security against coherent attacks for the DPS protocol. In the relativistic protocol, the Mach-Zehnder interferometer is distributed between the labs of Alice and Bob. Namely, Alice sends a coherent state onto a beam splitter, resulting in a reference and signal system. The reference system is sent to Bob immediately, whereas the signal system gets modulated and delayed in Alice’s lab before being sent to Bob. Meanwhile, Bob delays the reference system in his lab until the signal systems arrives, recombines the two on the beam splitter, measuring the relative phase between the two. Combined with exact time-keeping, such a setup allows Alice and Bob to enforce the necessary non-signalling and sequentiality conditions from relativistic principles.

While the security proof presented by Sandfuchs et al. works against coherent attacks, it still relies on a non-signalling assumption. Since Alice and Bob can enforce such an assumption, i.e., they can check wether the assumption was fulfilled in an experiment and otherwise abort, this is not a limitation of security. The importance of enforcing the assumption becomes obvious when considering a known upper bound on the key rate given by [17], which does not satisfy the non-signalling condition, and which is violated by Sandfuchs et al. Since all collective attacks fulfil the non-signalling assumption, the attack corresponding to [17] shows that techniques such as entropy accumulation, which reduce coherent-attack security to collective attack cannot be applied with additional assumptions, such as non-signalling, showing the limitations of such techniques. So, while there is still work to be done in the future, the present security proof represents a large step forward and seems to be as general as possible given the current state of the art.

► BibTeX data

► References

Cited by

This View is published in Quantum Views under the Creative Commons Attribution 4.0 International (CC BY 4.0) license. Copyright remains with the original copyright holders such as the authors or their institutions.