Editing Device-Independent Quantum Key Distribution


A device-independent quantum key distribution protocol implements the task of [[Quantum Key Distribution]] (QKD) without relying on any particular description of the underlying system. The protocol enables two parties, Alice and Bob, to establish a classical secret key by distributing an entangled quantum state and checking for the violation of a \underline{Bell inequality} in order to certify the security. The output of the protocol is a classical secret key which is completely unknown to any third party, namely an eavesdropper. 

'''Tags:''' [[:Category:Two Party Protocols|Two Party]], [[:Category:Quantum Enhanced Classical Functionality|Quantum Enhanced Classical Functionality]], [[:Category:Specific Task|Specific Task]],[[Quantum Key Distribution]], [[BB84 Quantum Key Distribution|BB84 QKD]], [[Category:Multi Party Protocols]] [[Category:Quantum Enhanced Classical Functionality]][[Category:Specific Task]][[Category:Entanglement Distribution Network Stage]]
==Assumptions==
* We assume the existence of an authenticated public classical channel between the two parties
* We assume synchronous network between parties
* We assume security from [[coherent attacks]]

==Outline==
A DIQKD protocol is composed by the following steps:
*'''Distribution:''' For each round of the distribution phase:
** Alice uses the source to prepare a maximally entangled state and send half of the state to Bob.
** Upon receiving the state, Bob announces that he received it, and they both use their respective devices to measure the quantum systems. They record their output in a string of bits.
*  A second phase where Alice and Bob publicly exchange classical information in order to perform [[error correction]], where they correct their strings generating the raw keys, and [[parameter estimation]], where they estimate the parameters of interest. At the end of this phase Alice and Bob are supposed to share the same $n$-bit string and have an estimate of how much knowledge an eavesdropper might have about their raw key.
* In the final phase, Alice and Bob perform [[privacy amplification]], where the not fully secure <math>n</math>-bit strings are mapped into smaller strings <math>K_A</math> and <math>K_B</math>, which represents the final keys of Alice and Bob respectively.

==Hardware Requirements ==
*'''Network Stage:''' [[:Category: Entanglement Distribution Network Stage|Entanglement Distribution]]
*'''Relevant Network Parameters:''' <math>\epsilon_T, \epsilon_M</math> (see [[:Category: Entanglement Distribution Network Stage|Entanglement Distribution]])
* Distribution of Bell pairs, and measurement in three different bases (two basis on Alice's side and three basis on Bob's side).
* Minimum number of rounds ranging from <math>\mathcal{O}(10^6)</math> to <math>\mathcal{O}(10^{12})</math> depending on the network parameters, for commonly used secure parameters.
* <math>QBER \leq 0.071</math>, taking a depolarizing model as benchmark. Parameters satisfying <math>\epsilon_T+\epsilon_M\leq 0.071</math> are sufficient.
* [[Authenticated classical channel]].
* [[Random number generator]].

==Notations Used==
* <math>n</math> expected number of rounds
* <math>l</math> final key length 
* <math>\gamma</math> fraction of test rounds 
* <math>Q</math> quantum bit error rate
* <math>\beta</math> CHSH violation 
* <math>\omega_{exp}</math>  expected winning probability on the CHSH game in an honest implementation 
* <math>\delta_{est}</math> width of the statistical interval for the Bell test
* <math>\delta_{con}</math> confidence interval for the Bell test 
* <math>\epsilon_s</math> smoothing parameter 
* <math>\epsilon_{EC},\epsilon'_{EC}</math> error probabilities of the error correction protocol 
* <math>\epsilon_{EA}</math> error probability of Bell violation estimation.
* <math>\epsilon_{con}</math> error probability of Bell violation estimation.
* <math>\epsilon_{PA}</math> error probability of the privacy amplification protocol 
* <math>\mbox{leak}_{EC}</math> leakage in the error correction protocol
==Properties==
Either Protocol (see [[Device Independent Quantum Key Distribution#Pseudo-code|Pseudo-code]]) abort with probability higher than <math>1-(\epsilon_{EA}+\epsilon_{EC})</math>, or it generates a
	<math>(2\epsilon_{EC}+\epsilon_{PA}+\epsilon_s)</math>-correct-and-secret key  of length</br>
	<math>	l\geq& \frac{{n}}{\bar{s}}\eta_{opt} -\frac{{n}}{\bar{s}}h(\omega_{exp}-\delta_{est}) -\sqrt{\frac{{n}}{\bar{s}}}\nu_1  -\mbox{leak}_{EC} </math></br>
	<math> \quad -3\log\de{1-\sqrt{1-\de{\frac{\epsilon_s}{4(\epsilon_{EA} + \epsilon_{EC})}}^2}}+2\log\de{\frac{1}{2\epsilon_{PA}}}</math></br>
	where <math>\mbox{leak}_{EC}</math> is the leakage due to error correction step and the functions <math>\bar{s}</math>, <math>\eta_{opt}</math>, <math>\nu_1</math> and <math>\nu_2</math> are specified in Table below.
The security parameters of the error correction protocol, <math>\epsilon_{EC}</math> and <math>\epsilon'_{EC}</math>, mean that if the error correction step in Protocol 1 does not abort, then <math>K_A=K_B</math> with probability at least <math>1-\epsilon_{EC}</math>, and for an honest implementation, the error correction protocol aborts with probability at most <math>\epsilon'_{EC}+\epsilon_{EC}</math>.

==Pseudo Code==
*'''Input:'''<math>n, \gamma, \epsilon_{\rm PA},\epsilon_{\rm PE},\epsilon_{\rm EC},\epsilon'_{\rm EC},Q_Z</math>
*'''Output:'''<math>K_A, K_B</math>
<u>'''Stage 1'''</u> Distribution and measurement
#For i=1,2,...,n
##  Sender chooses random bits <math>X_i\epsilon\{0,1\}</math> and <math>A_i\epsilon_R\{0,1\}</math> such that <math>P(X_i=1)=\gamma</math>
##  Sender prepares <math>H^{X_i}|A_i\rangle</math> and sends it to Bob
##  Receiver announces receiving a state
##  Receiver chooses bit <math>Y_i\in_R\{0,1\}</math> such that <math>P(Y_i=1)=\gamma</math>
##  Receiver measures <math>H^{X_i}|A_i\rangle</math> in basis <math>\{H^{Y_i}|0\rangle, H^{Y_i}|1\rangle\}</math> with outcome <math>B_i</math>
  
*At this stage Sender holds strings <math>X_1^n, A_1^n</math> and Receiver <math>Y_1^n, B_1^n</math>, all of length <math>n</math>
<u>'''Stage 2'''</u> Sifting  
#Alice and Bob publicly announce <math>X_1^n, Y_1^n</math>
#For i=1,2,....,n
##	If <math>X_i=Y_i</math>
###	<math>A_1^{n'} = A_1^{n'}.</math>append</math>(A_i)</math>
###	<math>B_1^{n'} = B_1^{n'}.</math>append<math>(B_i)</math>
###	<math>X_1^{n'} = X_1^{n'}.</math>append<math>(X_i)</math>
###	<math>Y_1^{n'} = Y_1^{n'}.</math>append<math>(Y_i)</math>
*Now Sender holds strings <math>X_1^{n'}, A_1^{n'}</math> and Receiver <math>Y_1^{n'}, B_1^{n'}</math>, all of length <math>n'\leq n</math>
<u>'''Stage 3'''</u> Parameter estimation
#For <math>i=1,...,n</math>
##	size<math>Q</math> = 0
##	If{<math>X_i = Y_i = 1</math>
###	Sender and Receiver publicly announce <math>A_i, B_i</math>
###	Sender and Receiver compute <math>Q_i = 1 - \delta_{A_iB_i}</math>, where <math>\delta_{A_iB_i}</math> is the Kronecker delta
##	size<math>Q</math> += 1\;

*Both Sender and Receiver, each, compute <math>Q_X = \frac{1}{\text{size}Q} \sum_{i=1}^{n'}Q_i</math></br>
<u>'''Stage 4'''</u> Error correction
*''<math>C(\cdot,\cdot)</math> is an error correction subroutine determined by the previously estimated value of <math>Q_Z</math> and with error parameters  <math>\epsilon'_{\rm EC}</math> and <math>\epsilon_{\rm EC}</math>
#Both Sender and Receiver run <math>C(A_1^{n'},B_1^{n'})</math>''. 
#Receiver obtains <math>\tilde{B}_1^{n'}</math>
<u>'''Stage 5'''</u> Privacy amplification
*''<math>PA(\cdot,\cdot)</math> is a privacy amplification subroutine determined by the size <math>\ell</math>, computed from equation for key length <math>\ell</math> (see [[Quantum Key Distribution#Properties|Properties]]), and  with secrecy parameter <math>\epsilon_{\rm PA}</math>''
#Sender and Receiver run $PA(A_1^{n'},\tilde{B}_1^{n'})$ and obtain secret keys $K_A, K_B$\;

==Further Information==
# [https://core.ac.uk/download/pdf/82447194.pdf BB(1984)] introduces the BB84 protocol, as the name says, by Charles Bennett and Gilles Brassard.
# [https://quantum-journal.org/papers/q-2017-07-14-14/ TL(2017)] The derivation of the key length in [[BB84 Quantum Key Distribution#Properties|Properties]], combines the techniques developed in this article and minimum leakage error correcting codes.
# [https://tspace.library.utoronto.ca/bitstream/1807/10010/1/Lo_6438_2610.pdf GL03] gives an extended analysis of the BB84 in the finite regime.
# Sifting: the BB84 protocol can also be described in a symmetric way. This means that the inputs <math>0</math> and <math>1</math> are chosen with the same probability. In that case only <math>1/2</math> of the generated bits are discarded during the sifting process. Indeed, in the symmetric protocol, Alice and Bob measure in the same basis in about half of the rounds. 
# [https://dl.acm.org/citation.cfm?id=1058094 LCA05] the asymmetric protocol was introduced to make this more efficient protocol presented in this article.
# A post-processing of the key using 2-way classical communication, denoted [[Advantage distillation]], can increase the QBER tolarance  up to <math>18.9\%</math> (3).
# We remark that in [[BB84 Quantum Key Distribution#Pseudo Code|Pseudo Code]], the QBER in the <math>Z</math> basis is not estimated during the protocol. Instead Alice and Bob make use of a previous estimate for the value of <math>Q_Z</math> and the error correction step, Step 4 in the pseudo-code, will make sure that this estimation is correct. Indeed, if the real QBER is higher than the estimated value <math>Q_Z</math>, [[BB84 Quantum Key Distribution#Pseudo Code|Pseudo Code]] will abort in the Step 4 with very high probability.
# The BB84 can be equivalently implemented by distributing [[EPR pairs]] and Alice and Bob making measurements in the <math>Z</math> and <math>X</math> basis, however this required a [[entanglement distribution]] network stage.