[Paper Review] What The Trace Distance Security Criterion in Quantum Key Distribution Does And Does Not Guarantee

Horace P. Yuen|arXiv (Cornell University)|Oct 25, 2014

Chaos-based Image/Signal Encryption5 references7 citations

TL;DR

This paper critically challenges the widespread misinterpretation of the trace distance criterion in quantum key distribution (QKD) as a failure probability or failure probability per bit. It demonstrates that the distinguishability advantage interpretation and the $d/l$ per-bit metric are conceptually flawed, as they incorrectly assume statistical independence of key bits and misrepresent operational security guarantees, revealing that current security claims are misleadingly optimistic.

ABSTRACT

Cryptographic security of quantum key distribution is currently based on a trace distance criterion. The widespread misinterpretation of the criterion as failure probability and also its actual scope have been discussed previously. Recently its distinguishability advantage interpretation is re-emphasized as an operational guarantee, and the failure probability misinterpretation is maintained with a further failure probability per bit interpretation. In this paper we explain the basic perpetuating error as a confusion on the correspondence between mathematics and reality. We note that the assignment of equal a priori probability of 1/2 to the real and ideal situations for distinguishability advantage would not lead to operational guarantee. We explain why operational guarantee in terms of Eve's probabilities of getting various key bits is necessary for security, and why the failure probability interpretation misrepresents the security situation. The scope and limits of the trace distance guarantee are summarized. It is shown that there would have been no security problem to begin with if the failure probability per bit interpretation validity.

Motivation & Objective

• To clarify the conceptual confusion between mathematical trace distance and real-world cryptographic security in QKD.
• To expose the fundamental flaw in interpreting trace distance $d$ as a failure probability or failure probability per bit.
• To demonstrate that distinguishability advantage does not provide a valid operational security guarantee.
• To show that the $d/l$ per-bit metric is mathematically and conceptually invalid due to incorrect assumptions about bit independence.
• To argue that current security interpretations in QKD literature mislead by overstating the actual protection offered by trace distance.

Proposed method

• Analyzes the trace distance $d = \frac{1}{2}\|\rho_{\text{real}} - \rho_{\text{ideal}}\|_1$ as a measure of statistical distance between real and ideal key distributions.
• Examines the distinguishability advantage interpretation, showing it fails to provide operational security guarantees due to incorrect assumptions about a priori probabilities.
• Critically evaluates the $d/l$ metric labeled as 'failure probability per bit', demonstrating its invalidity under realistic assumptions of bit correlation.
• Uses the bound $p_1^E = 2^{-n} + d$ to show that $d \sim 10^{-9}$ is inadequate for $n \sim 10^5$ bits, even if $d$ is small.
• Highlights that $d$ applies to a single key round, not to the aggregate of multiple rounds, and that $d/l$ misrepresents the actual risk of key compromise.
• Argues that operational security requires guarantees on Eve’s probability of obtaining individual key bits, not on distinguishability or averaged metrics.

Experimental results

Research questions

• RQ1 Does the trace distance criterion $d$ truly represent the failure probability of a QKD system in practice?
• RQ2 Can the distinguishability advantage between real and ideal key states be interpreted as a meaningful operational security guarantee?
• RQ3 Is the 'failure probability per bit' metric $d/l$ a valid or meaningful measure of QKD security?
• RQ4 Why does the assumption of equal a priori probability for real and ideal scenarios fail to yield operational security guarantees?
• RQ5 What are the actual limits of the trace distance criterion in guaranteeing information-theoretic security for QKD?

Key findings

• The trace distance $d$ does not represent the failure probability of a QKD system, and interpreting it as such leads to misleading security assessments.
• The distinguishability advantage interpretation fails to provide operational security guarantees because it does not account for the true nature of binary hypothesis testing and the dependence of key bits.
• The 'failure probability per bit' metric $d/l$ is conceptually invalid, as it assumes statistical independence of key bits, which does not hold in practice and leads to false optimism.
• Even with $d \sim 10^{-9}$, which is considered good in some protocols, the probability of Eve obtaining all $10^5$ bits in a single round is non-negligible, indicating poor security for long keys.
• For $10^6$ QKD rounds per day with $d \sim 0.1$, up to $10^5$ rounds could be fully compromised, contradicting claims that accumulated failure is 'strictly less than 1'.
• The claim that a protocol with $d/l \sim 10^{-24}$ can run for the age of the universe with less than one failure is invalid, as it misapplies $d$ to the total number of bits $l$ rather than to individual key lengths.