The Quantum Chernoff Divergence in Advantage Distillation for QKD and DIQKD

Quantum key distribution (QKD) [1, 2] is founded on the goal of extracting secret keys from measurement correlations between quantum systems. Much of QKD research is focused on “device-dependent” protocols, where it is assumed that devices execute quantum operations within specified tolerances. However, implementations of device-dependent QKD may suffer from attacks that leverage discrepancies between the physical devices and the models in the security proofs, undermining the security of such implementations [3, 4, 5]. Device-independent (DI) QKD [6, 7] is an alternative that seeks to surmount this weakness by deriving security proofs with only minimal assumptions on the devices involved. This is made possible by taking advantage of quantum correlations that violate a Bell inequality [8, 9], which can allow for the production of secret keys even without characterizing the measurements performed by the devices [6, 7]. In effect, DIQKD lacks various vulnerabilities of device-dependent QKD that arose from requiring detailed characterization of the device measurements.

However, the improved security prospects come at the cost of DIQKD having worse noise and loss tolerances than device-dependent QKD. Furthermore, there is a foundational question of more precisely characterizing the circumstances under which DIQKD is possible, as it has been shown for instance that not all correlations that violate Bell inequalities can be used for DIQKD [10]. Hence a direction of interest in current DIQKD research is to find methods that improve the noise tolerance beyond the values in existing protocols. Thus far, some methods that have been proposed include noisy pre-processing [11, 12, 13, 14, 15] (where trusted noise is added to the trusted parties’ raw measurement outputs), random key measurements [16, 14] (where random measurement choices are selected for key generation), random postselection [17] (where some rounds are randomly discarded based on the measurement outcomes), and advantage distillation [18, 19] (where a two-way communication procedure is substituted into the error correction step of the protocol). Some of these methods were also previously studied in the context of device-dependent QKD [20, 21, 22, 23, 24]. Our work focuses on enhanced performance of DIQKD by means of the last technique, i.e. advantage distillation.

Under the assumption of independent and identically distributed (IID) collective attacks, previous works [18, 19] have studied the noise tolerance of DIQKD when implementing an advantage distillation protocol known as the repetition-code protocol. In particular, in [18] a sufficient condition was derived for this protocol to be secure, based on the fidelity between some states that arise in the protocol. A conjectured fidelity-based necessary condition for security also exists [19], but it does not match the aforementioned sufficient condition. This gap between the sufficient and necessary conditions presents difficulties in characterizing the noise tolerance of the protocol — for instance, in [19] a semidefinite programming (SDP) algorithm was developed to compute arbitrarily tight bounds on the fidelity, but the resulting noise tolerance improvements were limited by the fact that these fidelity-based conditions do not provide an exact characterization of when the protocol is secure.

Hence in this work, we aim to address this issue by investigating relevant quantities that could replace the role of fidelity in those security proofs, ideally yielding matching sufficient and necessary conditions. Specifically, an interesting candidate is the quantum Chernoff divergence [25, 26, 27], defined for arbitrary quantum states $\rho$ and $\sigma$ as

For easier comparison to the previous fidelity-based results, in this work we instead mainly present our results in terms of the argument of the logarithm in the above expression, which can be referred to as the non-logarithmic quantum Chernoff divergence (NQCD):

The characteristic property of the quantum Chernoff divergence is that it describes the asymptotic behaviour of the trace distance (and hence distinguishing probability [28]) between many IID copies of the states $\rho,\sigma$; more precisely, the following relation holds (see Theorem 2.2 of [25] and Eq. (1) of [26]):

Our main finding in this work is that by using this fundamental property of the NQCD, we can derive security conditions for the repetition-code protocol. Specifically, we obtain a sufficient condition (in terms of the NQCD) for device-independent security of the repetition-code protocol against IID collective attacks. Furthermore, we also derive a necessary condition for security of the protocol, which matches the sufficient condition up to a natural conjecture regarding the structure of Eve’s optimal attack. Hence our results indicate that the NQCD is the central quantity of interest for studying the security of this protocol. (We remark that while the focus of our work is on DIQKD, our results also serve to generalize the findings of [22] for device-dependent QKD to a broader class of device-dependent QKD protocols; we discuss this further in Sec. III.1.)

Using this condition, we obtain lower bounds on the noise tolerance of some DIQKD scenarios under the depolarizing-noise model, achieving improvements of up to $2.7\%$ compared to the fidelity-based condition [18, 19], and an improvement of $0.23\%$ compared to the best previous noise tolerances [29] (note that the protocol in that work only uses one-way error correction, but it implements both noisy pre-processing and random key measurements). While the latter improvement is fairly small, this arises mainly from the fact that the existing techniques to evaluate the NQCD in the device-independent setting do not yield very tight bounds. Since our work highlights the NQCD as the critical quantity that characterizes security of the repetition-code protocol (in the IID collective attacks setting, at least), future study of this protocol could be focused on developing better techniques to bound this quantity, which should improve the noise tolerances further.

We outline a general DIQKD protocol between two trusted parties. These two parties, Alice and Bob, possess $M_{A}$ and $M_{B}$ possible measurement choices, indexed by $x\in\{0,...,M_{A}-1\},\;y\in\{0,...,M_{B}-1\}$. We shall often refer to the labels $x,y$ as Alice and Bob’s inputs, in the sense that they can be viewed as classical inputs Alice and Bob supply to the devices in order to specify which measurement is performed. In each round, an untrusted source Eve sends Alice and Bob each a part of some entangled state, and retains some extension of the state for herself as side-information. Alice and Bob then choose some inputs $x,y$ to supply to their devices, which measure the state and provide some outputs, that are recorded in registers $\hat{A}_{x}$ and $\hat{B}_{y}$ for Alice and Bob respectively. Following the QKD protocol structure outlined in [21], after collecting outputs from sufficiently many rounds, Alice and Bob use some subset of their data to perform parameter estimation, in which they decide whether to accept or abort the protocol. If they accept, some or all of the remaining rounds are then used to generate the final key, using some classical post-processing steps we describe below. We shall focus only on protocols where all measurements are binary-outcome and there is only a single pair of measurements used for key generation, which we shall take to correspond to the labels $x=y=0$.

We perform the security analysis in the IID collective attacks setting, where it is assumed that all states and measurements are IID. In this case, it is enough to consider Alice, Bob and Eve’s single round composite state, written as $\sigma_{ABE}$, where $E$ denotes Eve’s purification of Alice and Bob’s states. Also, we shall denote the hermitian operators describing the measurements for inputs $x,y$ as $A_{x},B_{y}$ respectively (not to be confused with the registers $\hat{A}_{x},\hat{B}_{y}$ that store the outputs). When the key-generating measurements are performed, the resulting state produced between the three parties is a classical-classical-quantum state of the form

where $\sigma_{E|ab}$ is Eve’s single-round state conditioned on Alice and Bob performing the key-generating measurements and getting output values $\hat{A}_{0}=a,\hat{B}_{0}=b$.

To simplify the security proof, we also impose a symmetrization step¹¹1For the protocol we consider, this symmetrization step can be omitted in practice without significantly affecting the sufficient conditions for security, but it may affect the necessary conditions — we elaborate on this point in Sec. IV., which involves Alice publicly communicating to Bob a uniformly random bit $T$, followed by having each of them XOR their output value with $T$. Let $\widetilde{A}_{x}$ and $\widetilde{B}_{y}$. denote Alice and Bob’s registers respectively that store the symmetrized values (for inputs $x$ and $y$), i.e. so we have $\widetilde{A}_{x}=\hat{A}_{x}\oplus T$ and $\widetilde{B}_{y}=\hat{B}_{y}\oplus T$. We shall use $\operatorname{Pr}(ab|xy)$ to denote the probability distribution on registers $\widetilde{A}_{x}\widetilde{B}_{y}$, i.e. the distribution of output values after symmetrization, conditioned on the input pair $x,y$ being used.

With this notation, when the key-generating measurements are performed, the composite state between the three parties after symmetrization is

where $\rho_{ET|ab}$ denotes Eve’s single-round state conditioned on $\widetilde{A}_{0}=a,\widetilde{B}_{0}=b$, and is given by

where $\overline{a}$ denotes $a\oplus 1$ and similarly for $\overline{b}$. The symmetrization step enables the outcome probabilities $\operatorname{Pr}(ab|00)$ for the key-generating measurements to be written in terms of a single parameter: the quantum bit error rate (QBER) $\epsilon$, which we define in this context to be the probability that $\widetilde{A}_{0}\neq\widetilde{B}_{0}$. Explicitly, we have $\text{Pr}(01|00)=\text{Pr}(10|00)=\frac{\epsilon}{2}$ and $\text{Pr}(00|00)=\text{Pr}(11|00)=\frac{1-\epsilon}{2}$.

We focus on deriving the conditions for security in the asymptotic limit of infinitely many rounds. In this setting, we can make the simplifying assumption (see e.g. [21, 30] for further discussion) that the condition for the parameter-estimation step to accept is that the statistical estimates for the probability distribution $\operatorname{Pr}(ab|xy)$ exactly match the values for an honest implementation of the protocol. Under the IID assumption, these estimates are arbitrarily accurate given enough rounds, which implies (by the arguments in [21, 30]) that for the asymptotic analysis we can focus only on states producing the same distribution $\operatorname{Pr}(ab|xy)$ as in an honest implementation.

We now present the repetition-code protocol for advantage distillation, following the description in e.g. [21]. First, Alice and Bob gather the outputs from their devices over some number of key-generating rounds, which we shall denote as $N$. They split the $N$ rounds into blocks of $k$ rounds and execute the following procedure on each individual block. Focusing on one block, let $\widetilde{\mathbf{A}}_{0}$ and $\widetilde{\mathbf{B}}_{0}$ denote Alice and Bob’s (symmetrized) values respectively for this block. For this block, Alice independently generates a uniform random bit $C\in\{0,1\}$ and sends $\mathbf{M}=\widetilde{\mathbf{A}}_{0}\oplus(C,...,C)$ to Bob, who computes $\widetilde{\mathbf{B}}_{0}\oplus\mathbf{M}$. If $\widetilde{\mathbf{B}}_{0}\oplus\mathbf{M}=(C^{\prime},...,C^{\prime})$ for some bit $C^{\prime}\in\{0,1\}$, then Bob accepts the block and sends a bit $D=1$ to Alice. Otherwise, he rejects the block and sends $D=0$. (Note that this accept/reject value is for individual blocks, not the overall protocol.) After performing this procedure across all the blocks, Alice and Bob respectively keep the strings of $C$ and $C^{\prime}$ values from the accepted blocks. Alice and Bob then perform a one-way error-correction procedure on these strings, and implement privacy amplification to produce their final key (see [21] for details).

Let $\mathbf{ET}$ denote Eve’s side information (including the symmetrization bits) across all rounds of one block, and let $H(\cdot)$ denote the von Neumann entropy. It was shown in [21, 31] that if the values $C,C^{\prime}$ produced in each block satisfy the Devetak–Winter condition

then the above procedure achieves a positive secret key rate in the asymptotic limit of infinitely many rounds $N$. Conversely, the results in [20] for binary symmetric channels imply (see also the discussion in [22]) that if in each block, Eve can use her registers $\mathbf{ETM}$ to construct a guess $C^{\prime\prime}$ for the bit $C$ that satisfies

then the repetition-code protocol as described above²²2Note that in particular, this means Alice and Bob perform the one-way error-correction procedure on the strings of $C,C^{\prime}$ bits “directly”, without further processing them first. We leave for future work the question of whether such processing (for instance, possibly applying the block-processing procedure iteratively) could further improve the noise tolerance. cannot achieve a positive asymptotic secret key rate. Hence in our work, we shall focus on studying conditions under which (7) holds (implying positive asymptotic keyrate is achievable) or (8) holds (implying positive asymptotic keyrate is not achievable).

In this section, we first present the sufficient and necessary conditions for security as Theorems 1 and 2 respectively. After that, we compute the improvement in noise tolerance with these new findings, and compare our results to noise tolerances computed for one-way protocols as well as the previous fidelity-based security condition.

In this work, we have shown that the NQCD can be used to obtain a sufficient condition for security of the repetition-code advantage distillation protocol in DIQKD, for the scenario of IID collective attacks. Furthermore, it also gives a precisely complementary necessary condition for security, up to a conjecture regarding the structure of Eve’s attack. This strongly indicates that the NQCD should be the central quantity to consider in analyzing the security of this protocol, allowing us to focus our attention on this quantity in subsequent study of this topic. In particular, resolving that conjecture would imply that when considering the question of whether this protocol allows secret key generation (against IID collective attacks), it suffices to study the value of $Q(\rho_{ET|00},\rho_{ET|11})$.

Regarding the explicit noise tolerance thresholds given by this security condition, in this work we did not find an approach to bound $Q(\rho_{ET|00},\rho_{ET|11})$ directly in the DI setting, and instead bounded it indirectly using the trace distance, which is not necessarily optimal. However, our results in Sec. III.2 show that even with this limitation, our approach already suffices to certify that advantage distillation can outperform one-way protocols (under the assumption of IID collective attacks), even when using the noisy pre-processing and random key measurement techniques.

Still, there is a significant gap between the results we obtained and the upper bounds on noise tolerance derived in [10], and hence there still remains potential for further improvement. In particular, if tighter lower bounds on $Q(\rho_{ET|00},\rho_{ET|11})$ were established, we would be able to further increase our noise tolerance thresholds. To this end, one could aim to develop a numerical algorithm that can compute arbitrarily tight lower bounds on $Q(\rho_{ET|00},\rho_{ET|11})$ in the DI setting, similar to the approach developed in [19] for bounding the fidelity. However, such an algorithm would face the difficulty that it is not currently known whether there exists a measurement on Eve’s registers that leaves $Q(\rho_{ET|00},\rho_{ET|11})$ invariant — this property, which does hold for the fidelity, was essential to the approach in [19]. Nevertheless, the development of a numerical algorithm that calculates the equivalent for $Q(\rho_{ET|00},\rho_{ET|11})$ remains an avenue for further study, which could potentially improve the noise tolerance thresholds.

A relevant consideration for further research is the minimum block size $k$ required to yield a positive key rate with our new security condition. One drawback of the proof approach in this work, as noted in Sec. III.1, is that it does not provide explicit bounds on this minimum block size. Resolving this issue would require finding a lower bound on the conditional entropy $H(C|\mathbf{ET})_{\overline{\rho}}$ in terms of $Q(\rho_{ET|00},\rho_{ET|11})$ only, without any dependence on the system dimensions. The lower bound we use in our security proof is reliant on a function $g(k)$ (see Appendix A) whose only known lower bound is dimension-dependent [32]. To explicitly compute the minimum required block sizes in the DI setting, one would need to find a dimension-independent lower bound on $g(k)$ (possibly at the cost of changing its asymptotic scaling behaviour with respect to $k$, though such a change is not an issue for our proof), or possibly use an entirely different proof approach.

For the security conditions we derived in this work, the symmetrization bits $\mathbf{T}$ played an important role in reducing our analysis to states of the special form (12). However, we note that it has been shown that if the repetition-code protocol is secure with the symmetrization procedure, then it is still secure without the symmetrization procedure [18, 39]. In particular, this implies that our sufficient security condition is still valid even in the latter setting (more precisely: if the condition (9) holds for the protocol with symmetrization, then the protocol without symmetrization is secure). On the other hand, this does potentially affect the necessary security condition — in principle, it might be possible that there exists an attack for Eve when symmetrization is performed, but not when it is omitted. This would imply that our sufficient and necessary conditions no longer match exactly for the protocol without symmetrization. We leave for future work the question of whether this is indeed the case, as well as whether the conjecture regarding Eve’s states in the necessary condition can be resolved. (On the other hand, for the modified version of the repetition-code protocol that we describe in Appendix C, the symmetrization step indeed does not affect either the necessary or sufficient conditions, as we discuss in that appendix.)

In this work, we have focused on the repetition-code protocol because in the device-dependent case, it is the protocol that has achieved the highest noise tolerances thus far [40]. However, a possible direction to investigate in future work would be other advantage distillation protocols, for instance as described in [23, 24]. In such protocols, the NQCD might no longer be the main quantity of interest: for the repetition-code protocol, it has a structure that yields tensor-power states similar to those considered when studying the NQCD, but this may not be the case for other advantage distillation protocols.

Finally, it would be ideal if our results could be extended to the coherent attack setting. One difficulty faced in this setting is that by eliminating the IID assumption, the single-round probability distributions $\operatorname{Pr}(ab|xy)$ and conditional states $\sigma_{E|ab}$ (and consequently $\rho_{ET|ab}$) would no longer be well-defined without conditioning on all previous input and output values. Also, the tensor product structure of $\rho_{\mathbf{ET}|\mathbf{mm}}$ would no longer hold, in which case it unclear whether it would be possible to extend our analysis based on the NQCD (whose nature is ingrained in distinguishing tensor-power states) to this regime.