A Novel Approach to Reducing Information Leakage for Quantum Key Distribution

Quantum key distribution (QKD) constitutes a promising solution for distributing unconditionally secure keys between two remote parties, such as Alice and Bob, in the presence of an eavesdropper, usually called Eve. Since the first QKD protocol, commonly known as the BB84 protocol, was proposed in 1984[1], security analysis has been the focus of QKD studies. Though the ideal BB84 protocol has been proven to be unconditionally secure[2], imperfect practical devices might still introduce security vulnerabilities, threatening the security of a practical QKD system. For instance, through the photon-number-splitting (PNS) attack [3, 4, 5] against the imperfect photon sources, Eve was capable of obtaining the complete information of each multi-photon pulse without causing any change in the quantum bit error rate (QBER). To address this challenge, Gottesman-Lo-Lutkenhaus-Preskill (GLLP) [6] proved the unconditional security of a practical QKD system with imperfect devices. In the GLLP theory, each pulse can be represented as a mixed state of Fock states after phase randomization and the pulses can be classified based on the photon number. The information of all multi-photon pulses is assumed to be completely obtained by Eve, and the secure keys are solely generated from vacuum and single-photon pulses. Based on the GLLP theory, the secure key rate (SKR) of some discrete-variable (DV) QKD protocol, such as decoy-BB84 [7, 8, 9] and sending-or-not-sending twin-field (SNS-TF)[10, 11, 12], can be calculated. In this paper, we point out that there is still possible to improve the SKR via estimating the information leakage during the information reconciliation (IR) more accurately.

Assume that the random variables $A$ and $B$ represent the sequences of Alice and Bob to be reconciled of length $N$, respectively. According to the noiseless coding theorem [20], the lower bound of the exchanged information $L_{all}$ for reliable IR can be calculated by the conditional entropy $H(A|B)$. In a DV-QKD system, $H(A|B)$ can be written as $Nh(e)$ [21], where $h(e)=-e{\log_{2}}(e)-(1-e){\log_{2}}(1-e)$ and $e$ is referred to as QBER. For a practical implementation of IR, $L_{all}$ is usually higher than $Nh(e)$. To this end, the IR efficiency $f={L_{all}}/Nh(e)$ is introduced, while a smaller $f$ implies a better IR, and $f=1$ represents the perfect IR [21, 22]. The commonly used IR protocols in DV-QKD systems can be generally divided into two categories [23]: interactive and non-interactive. As the most widely used interactive IR protocol, Cascade [21] detects and corrects errors by comparing the parity bits and performing binary search operations, respectively. The IR efficiency of Cascade is capable of approaching 1.02 [24], but its high communication overhead potentially limits its practical application in QKD systems. Accordingly, the non-interactive IR protocols, based on low-density-parity-check (LDPC) [23, 25] or polar codes [26, 27], were proposed. For practical implementations of non-interactive protocols, the efficiencies typically range from 1.1 to 1.2 [23]. In previous literatures about IR, all the exchanged information $L_{all}$ was considered as leaked information and subtracted directly from candidate secure keys during the SKR calculation.

However, we find out that only one part of $L_{all}$ needs to be subtracted during the SKR calculation. We notice that all the information of multi-photon pulses is assumed to be completely known by Eve through the PNS attack before IR. Thus, the exchanged information of IR caused solely by multi-photon pulses $L_{M}$ has also been known by Eve before IR and unable to provide any extra information for Eve after IR. Since the information of multi-photon pulses has been subtracted when analyzing the quantum part during the SKR calculation, $L_{M}$ is unnecessary to be subtracted again when analyzing the information leakage of IR of post-processing part. Following this idea, the SKR can be improved theoretically via avoiding the repetitive subtraction of $L_{M}$ during the SKR calculation.

The rest of this paper is organized as follows. Sec. 2 presents the main idea of our approach. In Sec. 3, the information leakage of two typical QKD protocols are analyzed. The performances of our approach are reported and analyzed through numerical simulations in Sec. 4. Some conclusions are drawn in the last Section.

In this section, we take the Cascade IR protocol as an example to further elaborate on the main idea of our approach. As illustrated in Fig. 1, the key sequences of Alice and Bob are first randomly shuffled and divided into two blocks of length $8$. Then, the parities of “Block 1” and “Block 2” of both parties are exchanged and compared simultaneously.

For "Block 1" with $p_{A}^{1}\neq p_{B}^{1}$, a binary searching (i.e., recursively splitting a bit sequence into two halves and check the parities of the first halves of both parties) is performed to correct one error. Note that there is no need to exchange the parity of the second half since it can be easily deduced. For example, $p_{A}^{3}$ can be calculated by $p_{A}^{1}\oplus p_{A}^{2}$. After four rounds of communications, the error is eventually found in sub-block 7. Through the exchanged parities, Eve can gain some information about the key sequences. For instance, the number of possible combinations of Alice’s sub-sequence in sub-block 2 decreases from 16 to 8 with the help of $p_{A}^{2}=1$. Overall, Eve obtains 1-bit information from each sub-block boxed in red and the total exchanged information of "Block 1" is 4-bit. However, when considering the overlap between the information leakage of quantum part and post-processing part, the effective amount of information $L_{v}$ obtained by Eve from IR is not equal to 4-bit. Let us suppose that there is a special sub-block 5 consisting two bits generated from multi-photon pulses. Before IR, Eve can obtain all the information of these two bits through the PNS attack. Though the parity of this sub-block is leaked to Eve during IR, Eve cannot acquire any extra useful information from the parity. In other words, the parity information has been known by Eve even if the parity is not exchanged. As a result, only the parity information obtained from the sub-block 2, 6, 7 are useful for Eve. Thus, $L_{v}$ equals to 3-bit, even though 4-bit information has been exchanged during IR.

Since $p_{A}^{8}=p_{B}^{8}$, we do not deal with “Block 2” at this moment, even if this block still contains an even number of errors which cannot be detected or corrected until the subsequent processing. After several iterative passes of error correction (i.e. restarting shuffling and binary searching in each pass), the probability of correcting all errors is rather high, signifying a successful error correction. In addition, Cascade involves backtracking operations to benefit the binary searching, thereby reducing the information leakage.

The above analysis suggests that the information leakage of a sub-block which solely contains bits generated from multi-photon pulses is not effective for Eve. Furthermore, the amount of effective information leakage $L_{v}$ to Eve can be obtained by estimating the number of such blocks, i.e., $L_{v}=L_{all}-L_{M}$.

Owing to the symmetry of DV-QKD protocols, without loss of generality, we only focus on the Alice’s sequence $A$. Let $A_{0}$, $A_{1}$, $A_{M}$ represent the set of bits generated from the vacuum, single-photon and multi-photon pulses, respectively, s.t. $A={A_{0}}\cup{A_{1}}\cup{A_{M}}$. No matter which IR protocol is applied, a collection of blocks $C=\{c|c\subset A\}$ will be generated after IR, and each block c($c\in C$) is also a set containing several bits from $A$. Considering that each block $c$ is regarded to leak 1-bit information and some blocks from $C$ may be linearly correlated [24], the original information leakage $L_{all}\leq\left|C\right|$. Let ${C_{M}}=\{c|(\forall c\in{C})\wedge(c\subset{A_{M}})\}$, we have ${L_{v}}={L_{all}}-{L_{M}}\leq\left|{C}\right|-\left|{{C_{M}}}\right|$.

Let $D$ represent the set of block lengths after IR (e.g. $D=\left\{{8,4,2,1}\right\}$ in the case shown in Fig. 1) and the sets $C^{l},C_{M}^{l}(l\in D)$ satisfy ${C^{l}}=\{c|(\forall c\in C)\wedge(\left|c\right|=l)\}$, $C_{M}^{l}=\{c|(\forall c\in{C_{M}})\wedge(\left|c\right|=l)\}$. Known that the sequences are shuffled before each pass and the bits are then uniformly distributed in the sequences, we have

where $\Delta_{M}$ represents the proportion of the count rate of the multi-photon pulses to that of the signal pulses.

Let $R$ represents the SKR per pulse in a practical DV-QKD system and $q$ is the sifting efficiency, we eventually get the formula for calculating the improved $R$ as

We can see from Eq. (1) that the critical parameter is $\Delta_{M}^{\inf}$. For this reason, we deduce the methods of calculating $\Delta_{M}^{\inf}$ for two typical DV-QKD protocols based on the GLLP theory, that is, decoy-BB84 and SNS-TF protocols. Note that for some modified TF-type protocols, such as no-phase-postselection protocol [28], phase-matching protocol [29], etc., our new approach cannot be directly applied, as the signals can not be directly classified based on the number of photons in these protocols. For these protocols, additional analysis and proofs based on our main idea may be required.

We evaluate the performance improvement of our new approach over the original GLLP formula through simulations under practical experimental parameters. The key simulation parameters of the decoy-BB84 [30] and SNS-TF protocols [31] are detailed in Table 1 and 2, respectively.

In addition, we can clearly see from Eq. (1) that the smaller $l$ is, the better our approach performs. However, in a commonly used non-interactive IR protocol, a larger $l$ is usually applied to achieve a higher $f$. Therefore, we consider that the non-interactive IR protocols cannot gain obvious SKR improvement from our approach. In contrast, a collection of blocks with different block lengths whose value can be as low as 1, will be obtained after Cascade. We thus conclude that a greater SKR improvement can be obtained when using Cascade. Therefore, we apply Cascade as the IR protocol in our simulations and its IR efficiency $f$ is set to the optimal value 1.

We show the numerical results for decoy-BB84 protocol and SNS-TF protocol in Fig. 2 and Fig. 3. Simulation results show that our approach can not only improve the SKR at any distance, but also increase the maximal transmission distances of two protocols by 5km and 20km, respectively. We note that the SKR improvement of our approach does not depend on the performance boost of optical devices, but rather comes from the more accurate estimation of the information leakage of IR.

Though our approach can significantly improve the SKR at any distance, Eq. (2) needs further modification when our formula is expanded to the finite-size regime. Since the information leakage of our new approach is affected by finite-size effects, additional analysis may be needed. In addition, based on different protocols, related parameters can be optimized to obtain a better $\Delta_{M}^{\inf}$, thus improving SKR.

In this study, we propose a novel approach to reduce the information leakage of IR by specially considering the overlap between the information leakage of quantum part and the post-processing part. Benefiting from avoiding the repetitive subtraction of information leakage caused by multi-photon pulses during IR, our approach theoretically improves the SKR of a QKD protocol. Simulation results for decoy-BB84 and SNS-TF protocols show that our approach is capable of improving both the SKRs at any distance and the maximal transmission distance. Note that our approach can be applied to all DV-QKD protocols based on the GLLP theory.

Besides, we consider that the main idea of our approach may have implications for continuous-variable (CV) QKD protocols as well. Our main idea implies that the quantum and classical signal processing are not completely independent. Thus, when estimating the leaked information through the classical channel, whether it overlaps with the information leaked in the quantum part also needs to be considered. The above analyses bring us an implication for CV-QKD system, that is, a better SKR can be calculated for a CV-QKD system if there exist similar situations in this system.

Funding

Acknowledgments This work is supported by the National Natural Science Foundation of China (Grant Number: 62071151, 61301099). Special thanks goes to Dr. Xuan Wen for the helpful discussions.

Disclosures The authors declare no conflicts of interest.

Data Availability Statement Data underlying the results presented in this paper are not publicly available at this time but may be obtained from the authors upon reasonable request.