Quantum key distribution with delayed privacy amplification and its application to the security proof of a two-way deterministic protocol

Privacy amplification (PA) is an essential postprocessing step in quantum key distribution (QKD) for removing any information an eavesdropper may have on the final secret key. In this paper, we consider delaying PA of the final key after its use in one-time pad encryption and prove its security. We prove that the security and the key generation rate are not affected by delaying PA. Delaying PA has two applications: it serves as a tool for significantly simplifying the security proof of QKD with a two-way quantum channel, and also it is useful in QKD networks with trusted relays. To illustrate the power of the delayed PA idea, we use it to prove the security of a qubit-based two-way deterministic QKD protocol which uses four states and four encoding operations.

Figure 1

Overview of delayed PA. The message ${\vec{m}}^{\prime }$ is secure in both situations, even though Eve sees different strings in the OTP channel. We show in Theorem 1 that security is not affected by whether Eve sees $f\left(\vec{a}\right)\oplus {\vec{m}}^{\prime }$ or $\vec{a}\oplus \vec{m}$. Here, $f$ is the PA function which shortens its input and the arrow of the BB84 channel indicates the direction of the qubits. (a)BB84 with normal PA and OTP. (b)BB84 with PA delayed after the OTP. $\vec{m}$ can be regarded as the expanded version of the secret message ${\vec{m}}^{\prime }$.

Figure 2

Protocol DQKD. Bob chooses one of the four qubit states to send to Alice on the forward channel. She applies one of the four operations to encode her key bit and returns the qubit to Bob on the backward channel. Bob measures the received qubit in the basis he originally used for the forward qubit. The value of Alice's key bit depends on Bob's basis (see Table ).

Figure 3

Protocols 2b, 2c, and 2d are equivalent. The equivalence between Protocols 2c and 2d can be understood intuitively by noting that both a measurement and a depolarizing operation disentangle line B-to-A and line A-to-B. This is rigorously shown by comparing their density matrices in Eq. (6) of Protocol 2c and Eqs. (8) and (9) of Protocol 2d. We identify the message bit $m_1$ ($m_2$) of Protocol 2d with $m$ of Protocol 2c when $w=z$ ($w=x$). Thus, Protocol 2d requires Bob to inform his basis $w$ to Alice so that she knows whether $m_1$ or $m_2$ is used for the final key generation. In all cases, privacy amplification $f$ is delayed after the OTP to generate the final secret key $f\left(\vec{m}\right)$, and the top part of each figure is Protocol 1. Here, we assume for simplicity that the backward line A-to-B is noiseless, but noise can be incorporated easily (see Sec. 5c). QC, quantum channel; CC, classical channel.