Secret-key distillation (SKD) is the technique used to convert some given random variables, shared among the legitimate parties and a potential eavesdropper Eve, into a secret key. Secret-key distillation is generally described as a protocol between the legitimate parties, who exchange messages over the public classical authenticated channel as a function of their key elements X and Y, aiming to agree on a common secret key K.

We assume here that the eavesdropper's knowledge can be modeled as a classical random variable. For more general assumptions on the eavesdropping techniques, please refer to Chapter 12.

The quantum transmission is assumed to be from Alice to Bob. In order to be able to specify another direction for secret-key distillation, we use the Claude-and-Dominique naming convention. Here, the random variables X and Y model the variables obtained by Claude and Dominique, respectively, using the quantum channel, and the random variable Z contains anything that Eve was able to infer from eavesdropping on the quantum channel. As detailed in Section 11.3.2, both assignments (Alice = Claude ∧ Bob = Dominique) and (Alice = Dominique ∧ Bob = Claude) are useful.

In this chapter, I first propose a general description of the reconciliation and privacy amplification approach. I then list the different characteristics that a SKD protocol can have. And finally, I overview several important classes of known results and treat the specific case of SKD with continuous variables.

Wonderful news from Copenhagen

Heisenberg and Schrödinger invented mathematical formalisms that provided correct answers to all the various problems of (non-relativistic) quantum theory. It was Bohr who uncovered the underlying significance of the theory; in particular he showed how the profound conceptual difficulties encountered as the theory developed – the so-called wave–particle duality, the totally unclassical nature of the uncertainty principle – could be neutralised by a revision, or more accurately a generalisation, of our use of physical concepts.

Such was the generally accepted view of things from soon after 1927, when Bohr first put forward his ideas on complementarity at an international meeting of physicists at Como, through the 1930s, when it was felt that Bohr destroyed Einstein's contrary opinions, and certainly up to the time of Bohr's death in 1962. Bohr's analysis is usually spoken of as the Copenhagen interpretation of quantum theory, though it is instructive to realise that such a term was frowned upon by those closest to Bohr, since it appears to suggest that the interpretation is just one among (conceivably) many.

Let us examine, for example, the words of Léon Rosenfeld, Bohr's disciple and long-term collaborator, as expounded at a conference in 1957 [52]. Rosenfeld maintained that any idea of ‘interpreting a formalism’ was a ‘false problem’, that in a good theory, the ‘ordinary language (spiced with technical jargon for the sake of conciseness)’ in which it is described, is ‘inseparably united … with whatever mathematical apparatus is necessary’, that ‘we are here not faced with a matter of choice between two possible languages or two possible interpretations, but with a rational language intimately connected with the formalism and adapted to it, on the one hand, and with rather wild, metaphysical speculations … on the other’.

So far, the knowledge of Eve has been modeled by a classical random variable. The aim of this chapter is first to discuss how the previous results apply to QKD, where Eve's action may not necessarily be classically described by the random variable Z. Then, we explain the equivalence between BB84 and so-called entanglement purification protocols as a tool to encompass general eavesdropping strategies. Finally, we apply this equivalence to the case of the coherent-state protocol GG02.

Eavesdropping strategies and secret-key distillation

In Chapters 10 and 11, I analyzed the security of the protocols with regard to individual eavesdropping strategies only. In this particular case, the result of Alice's, Bob's and Eve's measurements can be described classically and the results of Section 6.4 apply. Let us review other kinds of eavesdropping strategies and discuss how the concepts of Chapter 6 can be applied.

Note that the individual eavesdropping strategy, the simplest class of strategies, is still technologically very challenging to achieve today in an optimal way. Nevertheless, we do not want the security of quantum cryptography to rely only on technological barriers. By considering more general eavesdropping strategies, we make sure quantum cryptography lies on strong grounds.

Following Gisin et al. [64], we divide the possible eavesdropping strategies into three categories: individual attacks, collective attacks and joint attacks.

In the history of cryptography, quantum cryptography is a new and important chapter. It is a recent technique that can be used to ensure the confidentiality of information transmitted between two parties, usually called Alice and Bob, by exploiting the counterintuitive behavior of elementary particles such as photons.

The physics of elementary particles is governed by the laws of quantum mechanics, which were discovered in the early twentieth century by talented physicists. Quantum mechanics fundamentally change the way we must see our world. At atomic scales, elementary particles do not have a precise location or speed, as we would intuitively expect. An observer who would want to get information on the particle's location would destroy information on its speed – and vice versa – as captured by the famous Heisenberg uncertainty principle. This is not a limitation due to the observer's technology but rather a fundamental limitation that no one can ever overcome.

The uncertainty principle has long been considered as an inconvenient limitation, until recently, when positive applications were found.

In the meantime, the mid-twentieth century was marked by the creation of a new discipline called information theory. Information theory is aimed at defining the concept of information and mathematically describing tasks such as communication, coding and encryption. Pioneered by famous scientists like Turing and von Neumann and formally laid down by Shannon, it answers two fundamental questions: what is the fundamental limit of data compression, and what is the highest possible transmission rate over a communication channel?

Albert Einstein and relativity

If I were to ask a number of people in the street what they think was the most important new theory in physics in the twentieth century, and who has been the greatest physicist, I am fairly sure that – of those able to express an opinion at all – a substantial majority would say that relativity has been the greatest theory, and Einstein the greatest physicist.

Indeed Albert Einstein has probably achieved the remarkable feat of not just becoming the best-known practitioner of any branch of science among the general public, but retaining that position for 85 years, 50 of those years since his death in 1955.

It was in 1905, when he was 26, that Einstein astonished the scientific community by producing four pieces of work of the very highest quality. These included his first paper on relativity, in which he introduced what is now called the special theory of relativity (a term I shall explain in Chapter 3). The three other papers will be referred to in due course. What was astonishing was not just the quality of the work, but that the author was not an academic of note, or even of promise, but was working as a patent inspector after rather a mediocre student career. (A recent pleasantly written biography of Einstein is that of Abraham Pais [1], himself a well-known physicist; Pais gives references to many other accounts of Einstein's life. Another, more recent, biography is that by Fölsing [2].

In this chapter, I will discuss some important aspects of universal families of hash functions. I will not remain completely general, however, as we are only interested in universal families of hash functions for the purpose of privacy amplification of QKD-produced bits. In the first section, I explain my motivations, detailing the requirements for families of hash functions in the scope of privacy amplification. I then give some definitions of families and show how they fit our needs. Finally, I discuss their implementation.

Defined in Section 6.3.1, the essential property of an ∈/|B|-almost universal family of hash function is recalled in Fig. 7.1.

Requirements

For the purpose of privacy amplification, families of hash functions should meet some important requirements. They are listed below:

• The family should be universal (∈ = 1) or very close to it (∈ ≈ 1).

• The number of bits necessary to represent a particular hash function within its family should be reasonably low.

• The family should have large input and large output sizes.

• The evaluation of a hash function within the family should be efficient.

The first requirement directly affects the quality of the produced secret key. The closer to universality, the better the secrecy of the resulting key – see Section 6.3.1.

The second requirement results from the fact that the hash function will be chosen randomly within its family and such a choice has to be transmitted between Claude and Dominique. It is not critical, however, because the choice of the hash function need not be secret. A number of bits proportional to the input size is acceptable.

This book aims at giving an introduction to the principles and techniques of quantum cryptography, including secret-key distillation, as well as some more advanced topics. As quantum cryptography is now becoming a practical reality with products available commercially, it is important to focus not only on the theory of quantum cryptography but also on practical issues. For instance, what kind of security does quantum cryptography offer? How can the raw key produced by quantum cryptography be efficiently processed to obtain a usable secret key? What can safely be done with this key? Many challenges remain before these questions can be answered in their full generality. Yet quantum cryptography is mature enough to make these questions relevant and worth discussing.

The content of this book is based on my Ph.D. thesis [174], which initially focused on continuous-variable quantum cryptography protocols. When I decided to write this book, it was essential to include discrete-variable protocols so as to make its coverage more balanced. In all cases, the continuous and discrete-variable protocols share many aspects in common, which makes it interesting to discuss about them both in the same manuscript.

Quantum cryptography is a multi-disciplinary subject and, in this respect, it may interest readers with different backgrounds. Cryptography, quantum physics and information theory are all necessary ingredients to make quantum cryptography work. The introductory material in each of these fields should make the book self-contained. If necessary, references are given for further readings.

Structure of this book

The structure of this book is depicted in Fig. 0.1. Chapter 1 offers an overview of quantum cryptography and secret-key distillation.

The publication of the BB84 protocol by Bennett and Brassard in 1984 [10] marks the beginning of quantum key distribution. Since then, many other protocols have been invented. Yet, BB84 keeps a privileged place in the list of existing protocols: it is the one most analyzed and most often implemented, including those used in commercial products, e.g., [91, 113].

In this chapter, I define the BB84 protocol, although I already described it informally in Section 1.1. The physical implementation is then investigated. Finally, I analyze the eavesdropping strategies against BB84 and deduce the secret key rate.

Description

Alice chooses binary key elements randomly and independently, denoted by the random variable X ∈ χ = {0, 1}. In this protocol, there are two encoding rules, numbered by i ∈ {1, 2}. Alice randomly and independently chooses which encoding rule she uses for each key element.

• In case 1, Alice prepares a qubit from the basis {|0〉, |1〉} as

• In case 2, Alice prepares a qubit from the basis {|+〉, |−〉} as

On his side, Bob measures either Z or X, yielding the result YZ or YX, choosing at random which observable he measures. After sending a predefined number of qubits, Alice reveals to Bob the encoding rule for each of them. They proceed with sifting, that is, they discard the key elements for which Alice used case 1 (or case 2) and Bob measured Z (or X). For the remaining (sifted) key elements, we denote Bob's sifted measurements by Y.

David Bohm: life and times

In what is perhaps Virginia Woolf's most famous novel, much of the narrative describes intentions, hopes, plans for the visit To the Lighthouse, a visit forestalled by bad weather. There follows a section ‘Time passes’ in which all is war, death, decay, desperation; only the poets thrive. Then life returns slowly and timorously; the visit is at last made, in sombre reflective mood.

Between perhaps 1930 and 1952, the study of the meaning of quantum theory went through its own period of emptiness. Von Neumann had done most to cause it. Einstein could not disturb it … When interest did creep back, it was a result of the work of David Bohm.

Bohm had already experienced a chequered career. He was born in the USA in 1917, and rapidly built up an exceedingly high reputation as a theoretical physicist. After initial collaboration with Robert Oppenheimer, he specialised in the physics of plasmas – gases in which, because of high temperature or low pressure, atoms are ionised, or broken up into negatively charged electrons and positively charged ions. Plasmas [118] are important in astrophysics and also in the effort to achieve controlled nuclear fusion. In nuclear fusion, small nuclei fuse together to form one large one, with the emission of energy; high temperatures are required, and so one is forced to deal with plasmas. This is also exactly the process that causes stars to radiate energy.

In this section, I wish to put quantum key distribution (QKD) in the wider context of a cryptosystem. I shall discuss informally some aspects that are considered important. The questions I wish to answer here are: “What are the ingredients needed to make a QKD-based cryptosystem work? What services does it bring? What are its limitations?”

As I shall detail below, QKD may be used to provide the users with confidential communications. This can be achieved when we combine QKD and the one-time pad. For the quantum modulation, QKD needs a source of truly random numbers. Also, QKD requires a classical authenticated channel to work, so authentication plays an essential role. As a consequence, QKD must start with a secret key, making it a secret-key encryption scheme. I will also discuss what happens if classical cryptography is introduced in the system. Finally, I will describe the implementation of a simple cryptosystem on top of QKD.

A key distribution scheme

The first function of QKD is to distribute a secret key between two parties. The use of this key is outside the scope of this first section – the need for a secret key is omnipresent in cryptography.

As depicted in Fig. 5.1, QKD relies on a classical authenticated channel for sifting and secret-key distillation and on random bits for the modulation of quantum states. The key produced by QKD can be intended for encryption purposes – this will be discussed in Section 5.2 – but is also required by authentication. A part of the distributed key is used for authentication. When QKD is run for the first time, however, an initial secret key must be used instead.

Following its etymology, the term cryptography denotes the techniques used to ensure the confidentiality of information in its storage or transmission. Besides confidentiality, cryptography also encompasses other important functions such as authentication, signature, non-repudiation or secret sharing, to name just a few.

The purpose of this section is to give a short introduction to classical cryptography, but only for areas that are relevant to quantum cryptography. For our purposes, we will only deal with confidentiality and authentication. The former is the most important function that quantum key distribution helps to achieve, while the latter is a requirement for quantum key distribution to work. Also, we will cover some topics on the security of classical cryptographic schemes so as to give some insight when comparing classical and quantum cryptography.

The study of cryptography ranges from the analysis of cryptographic algorithms (or primitives) to the design of a solution to a security problem. A cryptographic algorithm is a mathematical tool that provides a solution to a very specific problem and may be based on premises or on other primitives. A solution can be designed by combining primitives, and the requirements and functions of the primitives have to be combined properly.

We will first review the confidentiality provided by ciphers that use the same key for both encryption and decryption, hence called secret-key ciphers. Then, we will discuss authentication techniques. Finally, we will show some aspects of public-key cryptography.

The 1927 Solvay Congress

In Chapter 4, we left Einstein in early 1926, cautiously optimistic that Schrödinger's scheme might provide what Heisenberg's could not, and did not attempt to – a mathematical description of atomic processes that could also give a physical picture of what was actually occurring. But the demonstration that the two formalisms were equivalent severely dented such optimism.

It was still possible for Einstein to prefer Schrödinger's version as offering more hope for future physical interpretation. Thus it is interesting to review the recommendations Einstein made for Nobel Prizes [1]. In 1928, Einstein suggested that Heisenberg and Schrödinger might share a prize, adding ‘With respect to achievement, each one … deserves a full Nobel prize although their theories in the main coincide in regard to reality content.’ However, Einstein was cautious enough to add that ‘it still seems problematic how much will ultimately survive of [their] grandiosely conceived theories’, and gave precedence to de Broglie, also mentioning Davisson, Germer, Born and Jordan.

By 1931, more convinced that quantum theory would last (and with de Broglie the 1929 prizewinner), Einstein plumped for Heisenberg and Schrödinger, commenting that ‘In my opinion, this theory contains without doubt a piece of the ultimate truth. The achievements of both men are independent of each other, and so significant that it would not be appropriate to divide a Nobel prize between them.’

The discrete modulation of quantum states as in BB84 stems fairly naturally from the need to produce zeroes and ones for the final secret key. But since secret-key distillation can also process continuous key elements, there is no reason not to investigate the continuous modulation of quantum states. In fact, continuous-variable protocols are fairly elegant alternatives to their discrete counterparts and allow for high secret key rates.

In this chapter, I describe two important QKD protocols involving continuous variables: first a protocol involving the Gaussian modulation of squeezed states and then a protocol with coherent states. These QKD protocols must be seen as a source of Gaussian key elements, from which we can extract a secret key. Finally, I detail the implementation of the protocol with coherent states.

From discrete to continuous variables

In the scope of continuous-variable QKD, we focus on quantum states that are represented in a continuous Hilbert space, of which their most notable examples are the coherent and squeezed states.

The BB84 protocol was designed with single photon states in mind. The coherent states, much easier to produce, are used only as an approximation of single photon states.