[Paper Review] The Universal Composable Security of Quantum Key Distribution

Michael Ben-Or, Michał Horodecki+3 more|ArXiv.org|Sep 14, 2004

Physical Unclonable Functions (PUFs) and Hardware Security4 citations

TL;DR

This paper establishes a universal composable security framework for quantum key distribution (QKD) by introducing a composable security definition that ensures keys generated by QKD remain secure even when used in subsequent protocols. It proves that standard QKD security implies composable security, resolving long-standing concerns about joint attacks across QKD and key usage, and shows that repeated QKD runs degrade security slowly under this model.

ABSTRACT

The existing unconditional security definitions of quantum key distribution (QKD) do not apply to joint attacks over QKD and the subsequent use of the resulting key. In this paper, we close this potential security gap by using a universal composability theorem for the quantum setting. We first derive a composable security definition for QKD. We then prove that the usual security definition of QKD still implies the composable security definition. Thus, a key produced in any QKD protocol that is unconditionally secure in the usual definition can indeed be safely used, a property of QKD that is hitherto unproven. We propose two other useful sufficient conditions for composability. As a simple application of our result, we show that keys generated by repeated runs of QKD degrade slowly.

Motivation & Objective

• To close the security gap in QKD where standard definitions do not account for joint attacks across QKD and subsequent key usage.
• To formalize a composable security definition for QKD that ensures keys can be safely used in arbitrary downstream protocols.
• To prove that existing unconditional security definitions of QKD imply the new composable security definition.
• To identify sufficient conditions for composability beyond the standard definition, including key degradation under repeated runs.
• To demonstrate that delayed measurements by an eavesdropper (Eve) do not compromise security when composable definitions are used.

Proposed method

• Introduces a universal composable (UC) security framework adapted to the quantum setting, modeling QKD as a protocol interacting with an environment and simulator.
• Defines a composable security condition based on the trace distance between the real and ideal protocols, ensuring indistinguishability up to a negligible epsilon.
• Uses the hybrid method to bound the trace distance between the real QKD protocol and the ideal functionality by constructing intermediate states (ρ_qi1, ρ_qi2) and analyzing their fidelity.
• Applies the fidelity-based security criterion via the singlet fidelity of the final state shared by Alice and Bob, showing that high fidelity implies security.
• Leverages the fact that if the Holevo information and accessible information of Eve’s state are negligible, then the key is secure under composable definitions.
• Demonstrates that the security of QKD under the standard definition implies composable security by showing that the trace distance between real and ideal protocols is negligible.

Experimental results

Research questions

• RQ1 Can standard QKD security definitions guarantee that keys can be safely used in subsequent protocols, even when Eve delays her measurement?
• RQ2 What is a composable security definition for QKD that accounts for joint attacks across QKD and key application?
• RQ3 Does a QKD protocol that is unconditionally secure in the standard sense remain secure under the new composable definition?
• RQ4 How does repeated use of QKD affect key security, and can this degradation be quantified under composability?
• RQ5 Can the security of QKD be preserved when keys are used for quantum encryption, especially under collective attacks?

Key findings

• The standard unconditional security definition of QKD implies the new composable security definition, ensuring that keys can be safely used in any subsequent protocol.
• Keys generated by QKD degrade slowly under repeated runs, with security loss bounded by the trace distance between real and ideal protocols.
• The composable security definition ensures that even if Eve delays her measurement until after key usage, her information gain remains negligible.
• The fidelity of the final state shared by Alice and Bob to a perfect EPR pair is a sufficient condition for composable security, with high fidelity implying negligible information gain by Eve.
• The accessible information of Eve’s state, when averaged over all keys, is negligible under the composable definition, ensuring that the key is nearly uniform and shared correctly.
• The paper establishes that the security of QKD under the standard definition is sufficient for composability, resolving a long-standing open problem in quantum cryptography.