Solution TD 3

Security of Quantum Key Distribution

QCRYPT

This TD corresponds to the content of Lecture 3: Security of Quantum Key Distribution. It will
cover optimal attacks for Eve, and in general bounds on achievable measurement.

The solution is either a direction on how to reach the conclusion, direct solution as an equation
or for open questions, the most important points

EXERCISE 1
Correctness and secrecy implies security

Solution of question 1.1.

X
ρreal
ABE = pKA KB (kA , kB ) |kA , kB ⟩ ⟨kA , kB | ⊗ ρE
kA ,kB (1)
kA ,kB ∈{0,1}n

Solution of question 1.2.

1
ρideal
ABE = IAB ⊗ ρE (2)
P 2n
where IAB = k∈{0,1}n |k, k⟩ ⟨k, k|
Solution of question 1.3.
X
σABE = pKA KB (kA , kB ) |kA , kA ⟩ ⟨kA , kA | ⊗ ρE
kA ,kB (3)
kA ,kB ∈{0,1}n

Solution of question 1.4. Strong convexity of the trace distance gives

X
T (ρreal
ABE , σABE ) ≤ pKA KB (kA , kB )T (|kA , kB ⟩ ⟨kA , kB |⊗ρE E
kA ,kB , |kA , kA ⟩ ⟨kA , kA |⊗ρkA ,kB )
kA ,kB ∈{0,1}n
(4)
which in terms gives
T (ρreal
ABE , σABE ) ≤ Pr[KA ̸= KB ] ≤ εc (5)
Solution of question 1.5. Subsystem B is the only thing that differs from σABE and ρreal
ABE
and hence

TrB (σABE ) = TrB (ρreal

ABE ) (6)
Solution of question 1.6. Note that for both states σABE and ρidealABE the state in register B is
a copy of the state in register A and hence the trace distance ”doesn’t care” about subsystem B:
 
ideal 1
T (σABE , ρABE ) = T σAE , n IA ⊗ ρE (7)
2
Then using σAE = ρreal
AE and εs -secrecy.
Solution of question 1.7. By the triangle inequality

T (ρreal ideal real ideal

ABE , ρABE ) ≤ T (ρABE , σABE ) + T (σABE , ρABE ) ≤ εc + εs (8)

QCRYPT TD 3 - Security of Quantum Key Distribution 1/4

 EXERCISE 2
Correctness, secrecy and robustness

Solution of question 2.1. Alice randomly generates KA and announces it on the public chan-
nel. Bob and Eve holds a perfect copy of KA such that Pr(KA ̸= KB ) = 0 ensuring correctness
but obviously not secret since Eve also holds a copy of KA .

Solution of question 2.2. Alice randomly generates KA and Bob randomly generates KB . No
one announces anything on the public channels. Then, in the absence of any bias, Eve has no
information on Alice (or Bob) key but P (KA ̸= KB ) = 1 − 21n .

Solution of question 2.3. Alice and Bob always abort, with p⊥ = 1. By definition the protocol
is 0-secret and 0-correct.

EXERCISE 3
Security of the entanglement based version

Solution of question 3.1. Remember that we want to prove the following:

1
||ρABE − ρU ⊗ ρE ||1 ≤ ϵ
2
Since Eve is not bounded on her operations, we will assume the worst case, i.e. that her purifi-
cation ρABE is in the form of a pure state |ψABE ⟩ since any other purification can be obtained
from this state by doing operations on Eve system.
Using Ulhmann’s theorem and given a purification ρABE of ρAB there exists a purification of
|Φ+ ⟩ such that

F (ρAB , |Φ+ ⟩) = F (ρABE , |Φ⟩+ ⊗ σE )

Use the relation on the fidelity presented in the previous exercise to show that

1
||ρABE − |Φ+ ⟩ ⊗ ρE ||1 ≤ ϵ
2
Use the fact that when Alice measures her own part part of |Φ+ ⟩, whatever
P the basis, the resulting
state after the partial trace is the maximally mixed state ρU = s |s⟩ ⟨s| showing the required
result.

EXERCISE 4
Holevo’s bound
Pn
Solution of question 4.1. S(ρX ) = − x=1 px log(px ) = H(X).

Solution of question 4.2.

n
X
ρXQ = px |x⟩ ⟨x| ⊗ ρx
x=1

Solution of question 4.3.

n
X
ρ = TrX (ρXQ ) = px ρx (9)
x=1

QCRYPT TD 3 - Security of Quantum Key Distribution 2/4

Solution of question 4.4.
qy|x = Tr(Ey ρx ) (10)
p p
Ey ρx Ey
ρy|x =
qy|x
Solution of question 4.5.
n X
m
′
X
ρXQ Y = px qy|x |x⟩ ⟨x| ⊗ ρy|x ⊗ |y⟩ ⟨y|
x=1 y=1

Solution of question 4.6. E Q is a quantum channel so it can only decrease the quantum
mutual information

S(X : Q′ Y ) ≤ S(X : Q)
The trace can be seen as quantum channel so tracing out a subsystem can only decrease the
quantum mutual information

S(X : Y ) ≤ S(X : Q′ Y )
and hence

S(X : Y ) ≤ S(X : Q)
Solution of question 4.7.
  Xn X
m n X
m
′
X
ρXY = TrQ′ ρXQ Y = px qy|x |x⟩ ⟨x| ⊗ |y⟩ ⟨y| = ρXY = px,y |x, y⟩ ⟨x, y|
x=1 y=1 X=1 y=1

S(X : Y ) = S ρX + S ρY − S ρXY = H(X) + H(Y ) − H(XY ) = I(X : Y )

Solution of question 4.8. First note that ρQ = TrX (ρXQ ) = ρ. Also

n n

X X
log ρXQ = log(px ) |x⟩ ⟨x| ⊗ I + |x⟩ ⟨x| ⊗ log(ρx )
x=1 x=1
Now, here is the sketch of the computation

S(X : Q) =S(ρX ) + S(ρQ ) − S(ρXQ )

n n
! !
X X
=H(X) + S(ρ) + Tr px log(px ) |x⟩ ⟨x| ⊗ ρx + Tr px |x⟩ ⟨x| ⊗ ρx log(ρx )
x=1 x=1

Also
n n n
! !
X X X
Tr px log(px ) |x⟩ ⟨x| ⊗ ρx = Tr px log(px ) |x⟩ ⟨x| = px log(px ) = −H(X)
x=1 x=1 x=1

and

n n n
! !
X X X X
Tr px |x⟩ ⟨x| ⊗ ρx log(ρx ) = Tr px ρx log(ρx ) = px Tr(ρx log(ρx )) = − px S(ρx )
x=1 x=1 x=1 x

This gives the final result by replacing in S(X : Q).

QCRYPT TD 3 - Security of Quantum Key Distribution 3/4

Solution of question 4.9. Iacc = I(X : Y ) which we now is also Iacc = S(X : Y ) with question
7. Using question 6, we then have

Iacc ≤ S(X : Q)
and using the previous question,
n
X
Iacc ≤ S(ρ) − px log(ρx )
x=1

EXERCISE 5
Extra - Trusted node

No correction (extra).

QCRYPT TD 3 - Security of Quantum Key Distribution 4/4