Limits of adaptive two-way linear postprocessing in six-state quantum key distribution

The gist The limits of adaptive linear postprocessing in six-state quantum key distribution are identified by constructing a single compatible collective attack that defeats a broad class of linear postprocessing, showing that reliable agreement on a linear final key is incompatible with secrecy

Protocol Class and Setup

The paper specifies the context for the analysis, defining the six-state QKD protocols and the class of classical postprocessing considered The raw keys are represented as column vectors A, B ∈ Fn squared Public communication involves announcing messages of the form MhA + dh or MhB + dh, where the matrix Mh and offset dh depend on the public history h At an accepted leaf with complete transcript T = t, Alice outputs K = FtA + ct ∈ Fl(t) squared This definition permits parity tests on arbitrary coordinate sets, adaptive block splitting and regrouping, coordinate permutations, and acceptance of any publicly specified syndrome classes

Recovery Comparison Theorem

Theorem 1 establishes the core result: For each p ∈ [p∗, 1/2], there is a collective attack Ap compatible with QBER p in all three bases such that for every accepted transcript t of positive probability, pguess(K E, T = t) ≥ pguess(K B, T = t) This comparison holds for every finite n and every protocol defined above The conclusion rules out direct agreement on a linear final key, without assuming recovery of a longer intermediate string

Proof of the Recovery Comparison

The proof relies on analyzing the affine structure of a fixed communication transcript, where Alice’s and Bob’s compatible inputs form a product of two affine subspaces Eve's recovery is bounded by comparing her information on the resulting subspace with Bob’s posterior coset probabilities The bound derived is pguess(K E, T = t) ≥ ZJ (α)ZD(α), where J = D ∩ ker Ft and D = CA ∩ CB This inequality demonstrates that the recovery comparison holds for the stated class

Key Information Theoretic Bounds

The analysis utilizes several lemmas to establish information-theoretic bounds, including Lemma 8, which provides a one-bit endpoint bound C(p) ≤ (1 − θ)C(0) + θC(1/2), where θ = 4p(1 − p) This bound is iterated over all bits to yield the middle inequality in Eq. (52), C ≤ Eµ 2−κ(S) Furthermore, the comparison of averages shows that J = Eµ[ab] ≥ Eµa Eb This final inequality completes the proof of Theorem 6, leading to the conclusion that 2−H(TV) ≤ C ≤ Eµ 2−κ(S) ≤ J = 2−[H 2(T)-H 2(V)]

Scope and Limitations

The scope of the result is limited to the stated class, specifically excluding arbitrary nonlinear functions of undisclosed data or secret noisy preprocessing The result does not establish zero unrestricted secret-key capacity It also rules out linear information reconciliation and publicly seeded linear privacy amplification yielding a secure protocol within the same class

Conclusion

The finite-length comparison identifies a limitation of adaptive linear processing at the known threshold Its main ingredients are a deliberately weakened quantum attack and the geometry of the full public transcript The information-theoretic comparison, rather than any restriction on decoding efficiency, prevents reliable linear key agreement from being secret

How it works

The attack produces a state ωp = 1/2 X sum a,e∈F2 p e a⟩⟨aA ⊗ a + e⟩⟨a + eB ⊗ e⟩⟨eE1 ⊗ ϕa⟩⟨ϕaE2, p0 = 1 − p, p1 = p Eve holds N exactly in E1 and the product state ϕa⟩ = On j=1 phiaj⟩ (9) The overlap of Eve’s two states in the no-bit-error branch is β = 1 − 2p / 1 − p She can map these states to the alphabet in Eq. (7) precisely in the required range β ≤ γ ⇐⇒ (1 − 2p) squared ≤ p(1 − p)

Coset and Subspace Comparisons

The proof of Lemma 5 uses the coset inequality of Cammarota and Russo to show that Zw+C0(q)Zv+C(q) ≤ ZC0(q)ZC(q) This is used to prove Eq. (21), which relates the comparison of code weight sums The counting proof in Section 3.3 shows that Zu+G(q)Zv+G(q) ≤ ZG(q)Zu+v+G(q) = ZG(q)Zu+v

Entropy Comparisons

The final comparison in Appendix A.6 combines the inequalities to prove Eq. (45), which reverses the order of the bounds by taking negative logarithms The argument includes bit probabilities zero, 1/2, and one A two-bit example shows that Eµ 2−κ(S) = 7/32 differs from J = 25/34, illustrating why the comparison of averages in Appendix A.5.2 is needed

Application to Main Text

To apply the result in the main-text notation, set L1 = G, L2 = G0, Z = W, pj = 1 − γ squared Here γ is the scalar overlap in Eq. (7) The random set S in this appendix specifies the coordinates made uniform The uses of independence and linearity can be summarized as follows: Adding one bit mixes the original probabilities Pp, Qp in pairs Independence of the bits lets us iterate the bound The difference of two independent copies has an exact representation as a mixture of uniform distributions using the same θj Finally, both the rank of V and the dimension of changes in T that preserve V increase with S

References

[1] D. Gottesman and H.-K. Lo, Proof of security of quantum key distribution with two-way classical communications, IEEE Trans. Inf. Theory 49, 457–475 (2003)

[2] H. F. Chau, Practical scheme to share a secret key through a quantum channel with a 27.6% bit error rate, Phys. Rev. A 66, 060302(R) (2002)

[3] J. Bae and A. Acín, Key distillation from quantum channels using two-way communication protocols, Phys. Rev. A 75, 012334 (2007)

[4] S. Khatri and N. Lütkenhaus, Numerical evidence for bound secrecy from two-way postprocessing in quantum key distribution, Phys. Rev. A 95, 042320 (2610)

1. Adaptive linear postprocessing limitation in QKD systems: The improved system can detect when reliable agreement on a linear final key is incompatible with secrecy, as Theorem 1 shows that reliable agreement on a linear final key is incompatible with secrecy for every accepted transcript of positive probability.

2. Robust quantum key distribution (QKD) security analysis: The system can establish a lower bound on the conditional secrecy distance, specifically showing that the conditional secrecy distance obeys ∆acc:= 1/2 ρKETacc − τl ⊗ ρETacc ≥ 1 − εB - 2−l for every finite length and every protocol defined in the paper.

3. Adaptive classical postprocessing verification: The system can verify the limitations of adaptive linear reconciliation by showing that a positive value would enable linear information reconciliation and publicly seeded linear privacy amplification [7, 8], yielding a secure protocol within the same class and contradicting Theorem 1.