Finite-key security analysis for quantum key distribution with leaky sources

Abstract

Security proofs of quantum key distribution (QKD) typically assume that the devices of the legitimate users are perfectly shielded from the eavesdropper. This assumption is, however, very hard to meet in practice, and thus the security of current QKD implementations is not guaranteed. Here, we fill this gap by providing a finite-key security analysis for QKD which is valid against arbitrary information leakage from the state preparation process of the legitimate users. For this, we extend the techniques introduced by Tamaki et al (2016 New J. Phys. 18 065008) to the finite-key regime, and we evaluate the security of a leaky decoy-state BB84 protocol with biased basis choice, which is one of the most implemented QKD schemes today. Our simulation results demonstrate the practicability of QKD over long distances and within a reasonable time frame given that the legitimate users' devices are sufficiently isolated.While the results in [1,7] constitute an important step toward guaranteeing the security of quantum communication systems in the presence of information leakage, both analyses consider the asymptotic scenario where Alice sends Bob an infinite number of light pulses. This means that these results cannot be directly applied to real-life QKD implementations, where Alice sends Bob only a finite number of signals and they distill finitelength keys [12][13][14][15][16]. In this work, we fill this gap and extend the general framework introduced in [1] to the finite-key scenario. For this, we present a finite-key parameter estimation method which can be applied in the presence of information leakage. In particular, and for concreteness, we consider a biased basis choice decoystate QKD protocol [17,18] with three-intensity settings. This is one of the most implemented QKD schemes today [19][20][21][22][23][24][25]. Note, however, that our results could be straightforwardly adapted as well to analyze the security of other decoy-state based QKD systems.In addition, we shall consider information leakage from both the IM and the PM of Alice's transmitter. The former implies that a key assumption of the decoy-state method is violated, as now the yield of an n-photon signal could depend on the intensity setting used by Alice to generate it. As a result, the security analysis cannot be based on the typical counterfactual scenario where the intensity setting for each transmitted signal is selected by Alice a posteriori, that is, after Bob has already detected all the incoming signals. To solve this problem, we use the trace distance argument introduced in [1], which relates the n-photon yields (as well as the error rates) associated to pulses generated with different intensity settings, in combination with Azuma's inequality [26]. This inequality allows us to tackle statistical fluctuations in a finite-key regime while guaranteeing security against general attacks. To include the effect of information leakage from the PM in the security analysis, we apply the quantum coin idea introduced in [27, 28] to the finite-key regime....

Experimental measurement-device-independent quantum key distribution with imperfect sources

“…Specially, we have simulated the secret key rate under three particular examples of THA, where Eve sends coherent pulses of light to probe the intensity modulators and phase modulators of the legitimate parties. Similar to the analysis presented in [25], we have introduced an additional post-processing step in the actual protocol where Alice and Bob sacrifice part of their data. This step is necessary for the security proof to go through.…”

“…Eve's systems [25]. As a result, the parameter D j A j B ,ss Z,nm does not depend on the basis Z nor on the photon number n, m. Therefore, we shall denote it by D j A j B ,ss .…”

“…The steps to estimate the phase error rate e U ph are as follows. First, one can redo the analysis above for those "click" events in the relay which are associated with an error (see [24,25]). That is, now we focus on the quantities E error,nm,j A j B |χ which denote the expected number of events when Alice and Bob select the intensity settings γ j A and γ j B to send an n-photon pulse and an m-photon pulse, respectively, and the relay's detectors provide a click corresponding to an error given that both Alice and Bob select the χ basis.…”

“…We further assume that the back-reflected light from the IM has the form β r e iθr , where the values of the parameters β r and θ r depend on Alice's and Bob's intensity settings each given time with r ∈ {s, v, w}, and the back-reflected light from the PM is given by √ I max e iθχ , where I max is the maximum intensity of the back-reflected light and χ ∈ {Z, X} refers to the basis choice. Note that, here for simplicity and in order to compare our simulation results with those in [25], we assume that Eve's back-reflected light from the PM only contains the basis information. That is, we assume that |Ψ i 0,Z A ,E = |Ψ i 0,Z A ⊗ |φ Z E and |Ψ i 1,Z A ,E = |Ψ i 1,Z A ⊗ |φ Z E , where the state |φ Z E =| √ I max e iθ Z of Eve's back-reflected light is the same for both bit values (and similarly for the X basis).…”

“…To be precise, in Refs. [24,25] the authors consider that the phase randomization step is only applied to the back-reflected light from the IM. However, here we consider that this step is applied to the back-reflected light from both the IM and the PM.…”