[Paper Review] Coupling Lemma and Its Application to The Security Analysis of Quantum Key Distribution

Kentaro Kato|arXiv (Cornell University)|May 23, 2015

Chaos-based Image/Signal Encryption3 citations

TL;DR

This paper challenges the widely accepted failure probability interpretation of the security parameter ε in quantum key distribution (QKD) by applying the coupling lemma from probability theory. It demonstrates that ε, defined via trace distance, does not represent the probability of protocol failure, especially when real and ideal keys are statistically independent, as the variational distance is strictly less than the mismatch probability in such cases.

ABSTRACT

It is known that the coupling lemma provides a useful tool in the study of probability theory and its related areas. It describes the relation between the variational distance of two probability distributions and the probability that outcomes from the two random experiments associated with each distribution are not identical. In this paper, the failure probability interpretation problem that has been presented by Yuen and Hirota is discussed from the viewpoint of the application of the coupling lemma. First, we introduce the coupling lemma, and investigate properties of it. Next, it is shown that the claims for this problem in the literatures are justified by using the coupling lemma. Consequently, we see that the failure probability interpretation is not adequate in the security analysis of quantum key distribution.

Motivation & Objective

• To resolve the long-standing debate over whether the security parameter ε in QKD can be interpreted as the failure probability.
• To examine the validity of the failure probability interpretation proposed in earlier literature using the coupling lemma.
• To clarify why the standard justification for interpreting ε as failure probability is flawed, particularly under physically reasonable assumptions of statistical independence.
• To provide a rigorous probabilistic analysis using the coupling lemma to show that ε is not equivalent to the probability of key mismatch.

Proposed method

• Applies the coupling lemma to relate the variational distance between two probability distributions to the probability that their outcomes differ.
• Uses the existence of a maximal coupling where variational distance equals the mismatch probability to analyze the upper bound on failure likelihood.
• Analyzes the case where real and ideal keys are statistically independent, showing that the variational distance is strictly less than the mismatch probability.
• Demonstrates that the equality v(P_K, P_U) = Pr{k ≠ u} only holds for specific, non-physical couplings that impose artificial correlations.
• Employs the trace distance criterion in QKD, defined as ||ρ_KE - ρ_U ⊗ ρ_E|| ≤ ε, and investigates the interpretation of ε via coupling-based reasoning.
• Uses counterexamples and theoretical analysis to show that the failure probability interpretation fails under natural physical assumptions of independence.

Experimental results

Research questions

• RQ1 Can the security parameter ε in QKD be meaningfully interpreted as the failure probability of the protocol?
• RQ2 Is the justification for the failure probability interpretation, based on the existence of a coupling with Pr{k ≠ u} = v(P_K, P_U), physically valid?
• RQ3 What happens to the relationship between ε and the actual mismatch probability when real and ideal keys are statistically independent?
• RQ4 Why does the coupling lemma reveal a fundamental flaw in the standard failure probability interpretation of ε?
• RQ5 Under what conditions does the variational distance equal the probability of key mismatch, and are these conditions physically justifiable?

Key findings

• The failure probability interpretation of ε is not valid because the variational distance v(P_K, P_U) is strictly less than Pr{k ≠ u} when real and ideal keys are statistically independent.
• The equality v(P_K, P_U) = Pr{k ≠ u} only holds for a specific maximal coupling that introduces artificial correlations between real and ideal keys, which lack physical justification.
• The coupling lemma shows that v(P_K, P_U) is a lower bound on all possible Pr{k ≠ u}, meaning ε cannot be interpreted as a failure probability in general.
• The claim that ε represents the maximal failure probability is unjustified because it relies on a 'there exists' coupling rather than a 'for all' condition.
• The analysis confirms Yuen's criticism: the failure probability interpretation is not supported by the coupling lemma under physically reasonable assumptions.
• The paper concludes that ε does not represent any probability, particularly not the failure probability, in the security analysis of QKD.