Quantum key distribution: how to distill unconditionally secure keys
Transcript of Quantum key distribution: how to distill unconditionally secure keys
![Page 1: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/1.jpg)
Quantum key distribution: how to distill
unconditionally secure keys
Matteo Canale
Ph.D. student @ UniPDIntern @ ID Quantique SA
BunnyTN3 - March 12th, 2012
![Page 2: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/2.jpg)
Motivations QKD system model Key distillation QKD in practice
Outline
1 Motivations
2 QKD system model
3 Key distillation
4 QKD in practice
![Page 3: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/3.jpg)
Motivations QKD system model Key distillation QKD in practice
Outline
1 Motivations
2 QKD system model
3 Key distillation
4 QKD in practice
![Page 4: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/4.jpg)
Motivations QKD system model Key distillation QKD in practice
Quantum tools for Information-Theoretic security
Information-Theoretic security
![Page 5: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/5.jpg)
Motivations QKD system model Key distillation QKD in practice
Quantum tools for Information-Theoretic security
Information-Theoretic security
strongest notion of security, as it makes no assumptions on theattacker’s computing power
![Page 6: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/6.jpg)
Motivations QKD system model Key distillation QKD in practice
Quantum tools for Information-Theoretic security
Information-Theoretic security
strongest notion of security, as it makes no assumptions on theattacker’s computing poweronly relies on information theory
![Page 7: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/7.jpg)
Motivations QKD system model Key distillation QKD in practice
Quantum tools for Information-Theoretic security
Information-Theoretic security
strongest notion of security, as it makes no assumptions on theattacker’s computing poweronly relies on information theory
Physical laws of Quantum Mechanics can be exploited whilelooking for I-T security
![Page 8: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/8.jpg)
Motivations QKD system model Key distillation QKD in practice
Quantum tools for Information-Theoretic security
Information-Theoretic security
strongest notion of security, as it makes no assumptions on theattacker’s computing poweronly relies on information theory
Physical laws of Quantum Mechanics can be exploited whilelooking for I-T security
1 Eavesdropping detection
“In quantum systems, one cannot take a measurement withoutperturbing the system itself.”
![Page 9: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/9.jpg)
Motivations QKD system model Key distillation QKD in practice
Quantum tools for Information-Theoretic security
Information-Theoretic security
strongest notion of security, as it makes no assumptions on theattacker’s computing poweronly relies on information theory
Physical laws of Quantum Mechanics can be exploited whilelooking for I-T security
1 Eavesdropping detection
“In quantum systems, one cannot take a measurement withoutperturbing the system itself.”
passive attacks can be detected
![Page 10: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/10.jpg)
Motivations QKD system model Key distillation QKD in practice
Quantum tools for Information-Theoretic security
Information-Theoretic security
strongest notion of security, as it makes no assumptions on theattacker’s computing poweronly relies on information theory
Physical laws of Quantum Mechanics can be exploited whilelooking for I-T security
1 Eavesdropping detection
“In quantum systems, one cannot take a measurement withoutperturbing the system itself.”
passive attacks can be detectedno perturbation ⇒ no measurement ⇒ no eavesdropping
![Page 11: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/11.jpg)
Motivations QKD system model Key distillation QKD in practice
Quantum tools for Information-Theoretic security
Information-Theoretic security
strongest notion of security, as it makes no assumptions on theattacker’s computing poweronly relies on information theory
Physical laws of Quantum Mechanics can be exploited whilelooking for I-T security
1 Eavesdropping detection
“In quantum systems, one cannot take a measurement withoutperturbing the system itself.”
passive attacks can be detectedno perturbation ⇒ no measurement ⇒ no eavesdropping
2 No-cloning theorem
“Perfect copying is impossible in the quantum domain.”
![Page 12: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/12.jpg)
Motivations QKD system model Key distillation QKD in practice
Quantum tools for Information-Theoretic security
Information-Theoretic security
strongest notion of security, as it makes no assumptions on theattacker’s computing poweronly relies on information theory
Physical laws of Quantum Mechanics can be exploited whilelooking for I-T security
1 Eavesdropping detection
“In quantum systems, one cannot take a measurement withoutperturbing the system itself.”
passive attacks can be detectedno perturbation ⇒ no measurement ⇒ no eavesdropping
2 No-cloning theorem
“Perfect copying is impossible in the quantum domain.”
replay and man-in-the-middle attacks are more difficult todeploy
![Page 13: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/13.jpg)
Motivations QKD system model Key distillation QKD in practice
Quantum Key Distribution
Eavesdropping detection + no-cloning theorem
do not provide a complete solution for all cryptographicpurposes, but offer an advantage over classical systemsthey allow to know a posteriori if the information sent over aquantum channel and shared by two parties is actually secret
![Page 14: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/14.jpg)
Motivations QKD system model Key distillation QKD in practice
Quantum Key Distribution
Eavesdropping detection + no-cloning theorem
do not provide a complete solution for all cryptographicpurposes, but offer an advantage over classical systemsthey allow to know a posteriori if the information sent over aquantum channel and shared by two parties is actually secret
What if we use these tools in order to deploy a secret keyagreement protocol?
⇓
Quantum Key Distribution(QKD)
![Page 15: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/15.jpg)
Motivations QKD system model Key distillation QKD in practice
Outline
1 Motivations
2 QKD system model
3 Key distillation
4 QKD in practice
![Page 16: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/16.jpg)
Motivations QKD system model Key distillation QKD in practice
QKD system model
A fA(·, ·) fB(·, ·) BE
quantumchannel
quantumsource
quantumdetector
x y
zkA kB
classicalchannel
classicalmodem
classicalmodem
cc
cA
c
cB
Channel characteristics
Quantum Ch. Classical Ch.private public, auth.low rate high rateunreliable reliable
Objectives
maxfa,fB ,x
H(kA) subject to:
(Correctness) P[kA 6= kB] < ε
(Secrecy) I (kA, kB ; z , c) < ε′
(Uniformity) L(KA)− H(KA) < ε′′
![Page 17: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/17.jpg)
Motivations QKD system model Key distillation QKD in practice
QKD system model
A fA(·, ·) fB(·, ·) BE
quantumchannel
quantumsource
quantumdetector
x y
zkA kB
classicalchannel
classicalmodem
classicalmodem
cc
cA
c
cB
Legend
x/y prepared/measured random bit sequencez information on x leaked to E
c = [cA, cB ] public communicationsfA, fB key distillation functionskA, kB final keys
![Page 18: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/18.jpg)
Motivations QKD system model Key distillation QKD in practice
Key distillation: a practical scheme
3-phase protocol [Maurer,1993]:
![Page 19: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/19.jpg)
Motivations QKD system model Key distillation QKD in practice
Key distillation: a practical scheme
3-phase protocol [Maurer,1993]:
1 Sifting → advantage over E
so that I (x ′; y ′) > I (x ′; z , c ′)
f ′A(·, ·)
x
x ′
c ′B
c ′A
![Page 20: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/20.jpg)
Motivations QKD system model Key distillation QKD in practice
Key distillation: a practical scheme
3-phase protocol [Maurer,1993]:
1 Sifting → advantage over E
so that I (x ′; y ′) > I (x ′; z , c ′)
2 Information reconciliation → correctness
so that P [x ′′ 6= y ′′] < ε′
f ′A(·, ·)
f ′′A (·, ·)
x
x ′
c ′B
c ′A
x ′′
c ′′B
c ′′A
![Page 21: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/21.jpg)
Motivations QKD system model Key distillation QKD in practice
Key distillation: a practical scheme
3-phase protocol [Maurer,1993]:
1 Sifting → advantage over E
so that I (x ′; y ′) > I (x ′; z , c ′)
2 Information reconciliation → correctness
so that P [x ′′ 6= y ′′] < ε′
3 Privacy amplification → secrecy
so that I (kA, kB; z , c) < ε′′
f ′A(·, ·)
f ′′A (·, ·)
f ′′′A (·, ·)
x
x ′
c ′B
c ′A
x ′′
c ′′B
c ′′A
kA
c ′′′B
c ′′′A
![Page 22: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/22.jpg)
Motivations QKD system model Key distillation QKD in practice
A practical scheme
H(x)
I (x ; y)I (x ; z)
![Page 23: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/23.jpg)
Motivations QKD system model Key distillation QKD in practice
A practical scheme
H(x)
I (x ; y)I (x ; z)
H(x ′)
I (x ′; y ′)
I (x ′; z , c ′)
sifting
![Page 24: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/24.jpg)
Motivations QKD system model Key distillation QKD in practice
A practical scheme
H(x)
I (x ; y)I (x ; z)
H(x ′)
I (x ′; y ′)
I (x ′; z , c ′)
sifting
H(x ′′) = I (x ′′; y ′′)
I (x ′′; z , c ′, c ′′)
key reconciliation
![Page 25: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/25.jpg)
Motivations QKD system model Key distillation QKD in practice
A practical scheme
H(x)
I (x ; y)I (x ; z)
H(x ′)
I (x ′; y ′)
I (x ′; z , c ′)
sifting
H(x ′′) = I (x ′′; y ′′)
I (x ′′; z , c ′, c ′′)
key reconciliation
H(kA)
I (kA; z , c)
privacyamplification
![Page 26: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/26.jpg)
Motivations QKD system model Key distillation QKD in practice
Outline
1 Motivations
2 QKD system model
3 Key distillation
4 QKD in practice
![Page 27: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/27.jpg)
Motivations QKD system model Key distillation QKD in practice
Sifting (BB84 protocol [Bennett-Brassard,1984])
Map Bit → QubitBit Qubit Qubit
( ) ( )0
1
![Page 28: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/28.jpg)
Motivations QKD system model Key distillation QKD in practice
Sifting (BB84 protocol [Bennett-Brassard,1984])
Map Bit → QubitBit Qubit Qubit
( ) ( )0
1
1 Alice randomly generates
![Page 29: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/29.jpg)
Motivations QKD system model Key distillation QKD in practice
Sifting (BB84 protocol [Bennett-Brassard,1984])
Map Bit → QubitBit Qubit Qubit
( ) ( )0
1
1 Alice randomly generates
bits {xn} i.i.d. in {0, 1}
xn 0 1 1 0 0 1 1 1
![Page 30: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/30.jpg)
Motivations QKD system model Key distillation QKD in practice
Sifting (BB84 protocol [Bennett-Brassard,1984])
Map Bit → QubitBit Qubit Qubit
( ) ( )0
1
1 Alice randomly generates
bits {xn} i.i.d. in {0, 1}
bases {ψn} i.i.d. in { , }
xn 0 1 1 0 0 1 1 1
ψn
![Page 31: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/31.jpg)
Motivations QKD system model Key distillation QKD in practice
Sifting (BB84 protocol [Bennett-Brassard,1984])
Map Bit → QubitBit Qubit Qubit
( ) ( )0
1
1 Alice randomly generates
bits {xn} i.i.d. in {0, 1}
bases {ψn} i.i.d. in { , }
2 {an} = modulate{ψn}({xn})
xn 0 1 1 0 0 1 1 1
ψn
an
![Page 32: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/32.jpg)
Motivations QKD system model Key distillation QKD in practice
Sifting (BB84 protocol [Bennett-Brassard,1984])
Map Bit → QubitBit Qubit Qubit
( ) ( )0
1
1 Alice randomly generates
bits {xn} i.i.d. in {0, 1}
bases {ψn} i.i.d. in { , }
2 {an} = modulate{ψn}({xn})
3 Bob randomly generates {ξn} i.i.d. in { , }
xn 0 1 1 0 0 1 1 1
ψn
anξn
![Page 33: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/33.jpg)
Motivations QKD system model Key distillation QKD in practice
Sifting (BB84 protocol [Bennett-Brassard,1984])
Map Bit → QubitBit Qubit Qubit
( ) ( )0
1
1 Alice randomly generates
bits {xn} i.i.d. in {0, 1}
bases {ψn} i.i.d. in { , }
2 {an} = modulate{ψn}({xn})
3 Bob randomly generates {ξn} i.i.d. in { , }
4 {bn} = measure{ξn}({an})
xn 0 1 1 0 0 1 1 1
ψn
anξnbn
![Page 34: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/34.jpg)
Motivations QKD system model Key distillation QKD in practice
Sifting (BB84 protocol [Bennett-Brassard,1984])
Map Bit → QubitBit Qubit Qubit
( ) ( )0
1
1 Alice randomly generates
bits {xn} i.i.d. in {0, 1}
bases {ψn} i.i.d. in { , }
2 {an} = modulate{ψn}({xn})
3 Bob randomly generates {ξn} i.i.d. in { , }
4 {bn} = measure{ξn}({an})
5 {yn} = demod({bn})
xn 0 1 1 0 0 1 1 1
ψn
anξnbnyn 1 1 0 0 1 1 1 1
![Page 35: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/35.jpg)
Motivations QKD system model Key distillation QKD in practice
Sifting (BB84 protocol [Bennett-Brassard,1984])
Map Bit → QubitBit Qubit Qubit
( ) ( )0
1
1 Alice randomly generates
bits {xn} i.i.d. in {0, 1}
bases {ψn} i.i.d. in { , }
2 {an} = modulate{ψn}({xn})
3 Bob randomly generates {ξn} i.i.d. in { , }
4 {bn} = measure{ξn}({an})
5 {yn} = demod({bn})
xn 0 1 1 0 0 1 1 1
ψn
anξnbnyn 1 1 0 0 1 1 1 1
SIFTING - keep (xi , yi ) ⇐⇒ ψi = ξi
![Page 36: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/36.jpg)
Motivations QKD system model Key distillation QKD in practice
Key reconciliation
A encoder decoder BE
quantum channel(sifted)
x ′ y ′
x̂ ′
classic channel
cc cA
ccB
Channel characteristics
Quantum Ch. Classical Ch.private public, auth.low rate high rateunreliable reliable
Objectives
1 Correctness: P [x ′ = x̂ ′] ≈ 1
2 Secrecy: I (x ′; c) < δ
![Page 37: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/37.jpg)
Motivations QKD system model Key distillation QKD in practice
Key reconciliation
1 InteractiveKeys are interactively reconciled by means of a binary errorsearch based on multiple, subsequent public communications[Brassard-Salvail,93].
![Page 38: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/38.jpg)
Motivations QKD system model Key distillation QKD in practice
Key reconciliation
1 InteractiveKeys are interactively reconciled by means of a binary errorsearch based on multiple, subsequent public communications[Brassard-Salvail,93].
2 Systematic
Given a (n + r , n) generating matrix G =
[
InA
]
:
1 Alice transmits the redundancy c = Ax′
2 Bob chooses x̂′ = argmina∈C d(a, [y, c])
Examples: LDPC [Mondin et al.,2010]BCH [Traisilanun et al.,2007]
![Page 39: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/39.jpg)
Motivations QKD system model Key distillation QKD in practice
Key reconciliation
1 InteractiveKeys are interactively reconciled by means of a binary errorsearch based on multiple, subsequent public communications[Brassard-Salvail,93].
2 Systematic
Given a (n + r , n) generating matrix G =
[
InA
]
:
1 Alice transmits the redundancy c = Ax′
2 Bob chooses x̂′ = argmina∈C d(a, [y, c])
Examples: LDPC [Mondin et al.,2010]BCH [Traisilanun et al.,2007]
3 HashingGiven a (n, n − r) parity check matrix H:
1 Alice transmits the syndrome c = Hx′
2 Bob chooses x̂′ = argmina:Ha=c d(a, y)
Examples: Winnow [Buttler et al.,2003]LDPC [Elkouss et al.,2009]
![Page 40: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/40.jpg)
Motivations QKD system model Key distillation QKD in practice
Key reconciliation
The choice of the coding technique for reconciliation depends onthe model for the classical channel
Layer Ch. type Condition Delays Codes used
Physical AWGN high SNR none systematic (soft)
Data link binary low BER low systematic (hard)
Net & up packet error free long interactive, hashing
![Page 41: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/41.jpg)
Motivations QKD system model Key distillation QKD in practice
Privacy amplification
A compress compress BE
quantum channel(reconciled)
x ′ x̂ ′
k k̂
classic channel
cc cA
ccB
Channel characteristics
Quantum Ch. Classical Ch.private public, auth.low rate high rate
Goals
1 Maximum privacy: I (k; z, c) < ε′′
2 Minimum compression: maxH(k)
![Page 42: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/42.jpg)
Motivations QKD system model Key distillation QKD in practice
Choosing a compression function
Definition (2-universal hash functions [Wegman-Carter,1979])
A class H of hash functions from {0, 1}n to {0, 1}m is 2-universal if
∀ x , y ∈ {0, 1}n , x 6= y , h ∈ H : P [h(x) = h(y)] ≤1
2m
H
|{h ∈ H : h(x) = h(y )}| ≤ 12m|H|
![Page 43: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/43.jpg)
Motivations QKD system model Key distillation QKD in practice
Choosing a compression function
h ∼ U|H|
Priv.Ampl.x′ kn r
|H|
n = H(x′)
t = I (x′; z, c)
s = security margin
⇒ r = H(k) = n − t − s
Theorem ([Bennett et al.,1995])
If the compressing function h is chosen uniformly from a class of2-UHFs, then on average (over z and h)
I (k; z, h) ≤2−s
ln 2
![Page 44: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/44.jpg)
Motivations QKD system model Key distillation QKD in practice
Choosing a compression function
Families of 2-universal hash functions
...Random matrices
...Toeplitz random matricesRandomly choose an (n +m − 1)-bit seed which defines arandom m × n Toeplitz matrix
z1...zm
=
s4 s5 . . . . . . . . . . . . sn+m−1
s3 s4. . .
. . .. . .
. . . sn+m−2
s2 s3. . .
. . .. . .
. . ....
s1 s2 s3 s4 s5 . . . sn−1
x1x2...xn
...
...
![Page 45: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/45.jpg)
Motivations QKD system model Key distillation QKD in practice
Outline
1 Motivations
2 QKD system model
3 Key distillation
4 QKD in practice
![Page 46: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/46.jpg)
Motivations QKD system model Key distillation QKD in practice
Quantum and classical channels
Quantum channel
Fiber optics (commercial solutions: id Quantique, MagiQ, ...)Free-space (prototypes: UniPD, LMU, ...)
Classical channel
Ethernet802.11. . .
Classical Ch.
Quantum Ch.
![Page 47: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/47.jpg)
Motivations QKD system model Key distillation QKD in practice
QKD Networks
A
B
SECOQC (2004-2008)http://www.secoqc.net
SwissQuantum (2009-2011)http://swissquantum.idquantique.com
Tokyo QKD Network (2010)http://www.uqcc2010.org
...
![Page 48: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/48.jpg)
Motivations QKD system model Key distillation QKD in practice
QKD at UniPD: the QuantumFuture project
QuantumFuture
4-year research project at UniPD
1.4 MAC, funded by the University of Padova
4 RUs: Telecom, Controls, Optics, Astronomy
Main focus on free-space QKD
More information available at:http://quantumfuture.dei.unipd.it
![Page 49: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/49.jpg)
Motivations QKD system model Key distillation QKD in practice
QKD at id Quantique
Network encryption
plug-&-play commercial QKD devicesQKD devices for research and development applications
Quantum Random Number Generators
Single Photon Detectors for Quantum Applications
More information available at:http://www.idquantique.com
![Page 50: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/50.jpg)
Motivations QKD system model Key distillation QKD in practice
Essential references
[Maurer,1993] U. Maurer, “Secret key agreement by public discussionfrom common information”, IEEE Transactions on Information Theory,vol. 39, no. 3, pp. 733-742, 1993.
[Bennett-Brassard,1984] C. H. Bennett and G. Brassard, “Quantumcryptography: Public-key distribution and coin tossing”, in IEEEInternational Conference on Computers, Systems and Signal Processing,1984, pp. 175-179.
[Brassard-Salvail,1993] G. Brassard and L. Salvail, “Secret-KeyReconciliation by Public Discussion”, International Conference on theTheory and Applications of Cryptographic Techniques, Advances inCryptology, EUROCRYPT, pp. 410-423, 1993.
[Mondin et al.,2010] M. Mondin, M. Delgado, F. Mesiti, and F.Daneshgaran, “Soft-processing for Information Reconciliation in QKDApplications”, International Journal of Quantum Information, 2010.
![Page 51: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/51.jpg)
Motivations QKD system model Key distillation QKD in practice
Essential references
[Traisilanun et al.,2007] W. Traisilanun, K. Sripimanwat, and O.Sangaroon, “Secret key reconciliation using BCH code in quantum keydistribution”, in International Symposium on Communications andInformation Technologies, ISCIT, 2007, pp. 1482-1485.
[Buttler et al.,2003] W. T. Buttler, S. K. Lamoreaux, J. R. Torgerson, G.H. Nickel, C. H. Donahue, and C. G. Peterson, “Fast, efficient errorreconciliation for quantum cryptography”, Physical Review A, vol. 67, no.5, p. 052303, May 2003.
[Elkouss et al.,2009] D. Elkouss, A. Leverrier, R. Allaume, and J. J.Boutros, “Efficient reconciliation protocol for discrete-variable quantumkey distribution”, in IEEE International Symposium on InformationTheory, ISIT, 2009, pp. 1879-1883.
![Page 52: Quantum key distribution: how to distill unconditionally secure keys](https://reader037.fdocuments.net/reader037/viewer/2022090906/613ca23ef046235e845ce247/html5/thumbnails/52.jpg)
Motivations QKD system model Key distillation QKD in practice
Essential references
[Bennett et al.,1995] C. H. Bennett, G. Brassard, C. Crepeau, and U.Maurer, “Generalized privacy amplification”, IEEE Transactions onInformation Theory, vol. 41, no. 6, pp. 1915-1923, 1995.
[Canale,2011] Canale, M. On Information-Theoretic Secret KeyAgreement for Quantum Key Distribution. Tech. report, 2011.
[Canale et al.,2011] M. Canale, D. Bacco, S. Calimani, F. Renna, N.Laurenti, G. Vallone, P. Villoresi , “A prototype of a free-space QKDscheme based on the B92 protocol”, in International Symposium onApplied Sciences in Biomedical and Communication Technologies,ISABEL, 2011.