Security analysis of the decoy method with the Bennett–Brassard 1984 protocol for finite key lengths

Abstract

This paper provides a formula for the sacrifice bit-length for privacy amplification with the Bennett-Brassard 1984 protocol for finite key lengths, when we employ the decoy method. Using the formula, we can guarantee the security parameter for a realizable quantum key distribution system. The key generation rates with finite key lengths are numerically evaluated. The proposed method improves the existing key generation rate even in the asymptotic setting.In this paper, when Aliceʼs basis is the same as Bobʼs basis, the basis is called matched.Content from this work may be used under the terms of the Creative Commons Attribution 3.0 licence. Any further distribution of this work must maintain attribution to the author(s) and the title of the work, journal citation and DOI.setting, there are two obstacles for security. One is the noise of the communication quantum channel. Due to the presence of the noise, the eavesdropper can obtain part of the raw keys information behind the noise. The second one is the imperfection of the photon source. If the sender sends the two-photon state instead of the single photon state, the eavesdropper can obtain one photon so that she can obtain information perfectly. Many realized QKD systems have been realized with weak coherent pulses. In this case, the photon number of transmitted pulses obeys the Poisson distribution, whose average is given by the intensity μ of the pulse. The first problem can be resolved by the application of error correction and random privacy amplification to the raw keys [2][3][4][5]. In the privacy amplification stage, we amplify the security of the raw keys by sacrificing part of our raw keys. The security of the final keys depends on the decreasing number of keys in the privacy amplification stage, which is called the sacrifice bit-length. Shor-Preskill [2] and Mayers [3] showed that this method gives the secure keys asymptotically when the rate of the sacrifice bit-length is greater than a certain amount. In order to solve the second problem, Gottesman-Lo-Lütkenhaus-Preskill (GLLP) [6] extended their result to the case when the photon source has an imperfection. However, GLLPʼs result assumes the fractions of respective photon number pulses among received pulses. Indeed, there is a possibility that the eavesdropper can control the receiverʼs detection rate depending on the photon number because pulses with the different photon number can be distinguished by the eavesdropper. In order to solve this problem, we need to estimate the detection rate of the single photon pulses. Hwang proposed the decoy method to estimate the detection rate [7]. This method has been improved by many researchers [8][9][10][11][12][13][14][15][16]. In this method, in order to estimate the detection rates, the sender randomly chooses several kinds of pulses with different intensities. The first kind of pulses are the signal pulses, which generate raw keys. The other kind of pulses are the decoy pulses, which are used for estimating the operation by the eavesdropper and have a di...

Critical side channel effects in random bit generation with multiple semiconductor lasers in a polarization-based quantum key distribution system

“…Intensity fluctuation is also a potential threat as already discussed in [5,15,16] especially for decoy-BB84 QKD protocol. In [15], general theory of security performance of QKD under intensity fluctuation is described with assumption that Eve can knows the relatively strong and weak pulses.…”

“…It claims that secure key rate described in [9] can be decreased to 70.8 bits/s under intensity error upper bound of 5%, which was originally 136.3 bits/s. Security analysis with intensity fluctuation has been studied [16,17] in diverse situations because it can seriously decrease secure key rates.…”

Security Bounds for Efficient Decoy-State Quantum Key Distribution

“…This allowed to improve the decoy-state bounds and achieve experimental key rates beyond 1 Mbps over a 50 km optical fiber link, still under the condition of collective attacks [24]. In [50], the same numerical PE based on BI distribution as in [24] and [49] was used 3 to prove for the first time the security of the eds-BB84 protocol against general attacks, assuming a perfect vacuum state prepared by Alice and the quantities analogous to (see Table I) exactly known. The resulting HG distribution was upper bounded by the sum of two BI distributions [50].…”

“…In [50], the same numerical PE based on BI distribution as in [24] and [49] was used 3 to prove for the first time the security of the eds-BB84 protocol against general attacks, assuming a perfect vacuum state prepared by Alice and the quantities analogous to (see Table I) exactly known. The resulting HG distribution was upper bounded by the sum of two BI distributions [50]. Later on, a simpler proof of eds-BB84 security against general attacks, based on the entropic uncertainty relations [35], [36], was provided in [38].…”

“…Differently from [50], we use the Ahrens map to tightly bound (within a factor √2, see Fig. 1) the HG distribution using a permuted BI distribution.…”