[Paper Review] Privacy Amplification in Quantum Key Distribution: Pointwise Bound versus Average Bound

Gerald Gilbert, Michael Hamrick+1 more|ArXiv.org|Aug 2, 2001

Quantum Computing Algorithms and Architecture4 references3 citations

TL;DR

This paper rigorously derives a cryptographically meaningful upper bound on the pointwise mutual information between an eavesdropper and a quantum-secured key, showing that privacy amplification must account for both the failure probability of selecting a weak hash function and the required key shortening to ensure practical throughput. Unlike the standard average-bound approach, the pointwise analysis reveals that achieving a secrecy threshold of $10^{-9}$ requires shortening the key by 60 bits (with $g_{PPA} = 60$) to maintain a failure probability of $10^{-9}$, still yielding viable throughput rates of ~5.5 kbps at 1 MHz pulse rate.

ABSTRACT

In order to be practically useful, quantum cryptography must not only provide a guarantee of secrecy, but it must provide this guarantee with a useful, sufficiently large throughput value. The standard result of generalized privacy amplification yields an upper bound only on the average value of the mutual information available to an eavesdropper. Unfortunately this result by itself is inadequate for cryptographic applications. A naive application of the standard result leads one to incorrectly conclude that an acceptable upper bound on the mutual information has been achieved. It is the pointwise value of the bound on the mutual information, associated with the use of some specific hash function, that corresponds to actual implementations. We provide a fully rigorous mathematical derivation that shows how to obtain a cryptographically acceptable upper bound on the actual, pointwise value of the mutual information. Unlike the bound on the average mutual information, the value of the upper bound on the pointwise mutual information and the number of bits by which the secret key is compressed are specified by two different parameters, and the actual realization of the bound in the pointwise case is necessarily associated with a specific failure probability. The constraints amongst these parameters, and the effect of their values on the system throughput, have not been previously analyzed. We show that the necessary shortening of the key dictated by the cryptographically correct, pointwise bound, can still produce viable throughput rates that will be useful in practice.

Motivation & Objective

• To clarify the distinction between average and pointwise bounds on mutual information in quantum key distribution (QKD), showing that average bounds are insufficient for cryptographic security.
• To identify the cryptographic failure probability associated with selecting a specific hash function in privacy amplification, which is critical for practical implementation.
• To derive a mathematically rigorous upper bound on the pointwise mutual information that accounts for both the secrecy threshold and the failure probability.
• To analyze the trade-off between key compression, failure probability, and system throughput in practical QKD systems.
• To demonstrate that the required key shortening for pointwise security still permits usable throughput rates in real-world quantum cryptography.

Proposed method

• Derives a rigorous mathematical bound on the pointwise mutual information between the eavesdropper and the final key, using the universal$_2$ class of hash functions.
• Introduces two distinct parameters: $g_{PPA}$ (total key shortening) and $g'$ (pointwise bound parameter), with $g''$ representing the failure probability parameter.
• Applies the inequality $I riangleq rac{1}{2} ext{tr}( ho_{ ext{Eve}} ho_{ ext{Eve}}^{ ext{uniform}}) imes ext{trace} ext{ term} imes 2^{-g'}$ to bound the pointwise mutual information.
• Uses the relation $g_{PPA} = g' + g''$ to express the total key reduction and failure probability, ensuring the bound holds with high probability.
• Performs throughput analysis using a realistic QKD scenario with a 1 MHz pulse repetition frequency and satellite-to-ground link parameters.
• Compares throughput for $g_{PPA} = 30$ and $g_{PPA} = 60$, showing that the latter maintains ~5.5 kbps throughput despite increased key shortening.

Experimental results

Research questions

• RQ1 Why is the standard average-bound result of privacy amplification insufficient for ensuring cryptographic security in practical QKD systems?
• RQ2 What is the correct relationship between key shortening, failure probability, and the pointwise upper bound on mutual information?
• RQ3 How much key compression is required to achieve a specific pointwise mutual information bound (e.g., $10^{-9}$) while maintaining a tolerable failure probability?
• RQ4 Can the required key shortening for pointwise security still yield viable throughput rates in practical quantum key distribution?
• RQ5 What is the impact of increasing the pointwise bound parameter $g'$ on the total key reduction $g_{PPA}$ and system performance?

Key findings

• The average mutual information bound from BBCM is insufficient for cryptographic applications because it does not guarantee security for any specific hash function choice.
• Achieving a pointwise mutual information bound of $10^{-9}$ requires setting $g' = 30$, but this necessitates $g_{PPA} = 60$ to keep the failure probability $P_f riangleq 2^{-g''}$ at $10^{-9}$, which corresponds to $g'' = 30$.
• The failure probability $P_f$ is directly tied to the choice of $g''$, and setting $g'' = 0$ (i.e., $g_{PPA} = g'$) leads to a 100% failure probability, rendering the bound cryptographically meaningless.
• Throughput remains viable: at a 1 MHz pulse rate, the secret key rate drops from 5614 bps ($g_{PPA} = 30$) to 5563 bps ($g_{PPA} = 60$), a reduction of only ~0.9%, which is acceptable for most practical applications.
• The pointwise bound requires a separate parameterization of key shortening and failure probability, unlike the average case, and this distinction is critical for secure implementation.
• The analysis confirms that the pointwise bound is both necessary and sufficient for cryptographic security, and that the required key shortening does not preclude practical deployment.