3.2 The BB84 Protocol
43
Note that the eigenvalues {λ i j } are not completely fixed by the observed error rates
E Z and E X through (3.16) and (3.17). Thus we must consider the worst-case scenario
and minimize (3.23) over {λ i j }, with the constraints given by (3.16) and (3.17). The
minimization leads to the following result [6]:
H (R A |E) = 1 + h(E Z ) − (h(E X ) + h(E Z )) = 1 − h(E X ).
(3.24)
We remark that we could minimize H (R A |E) independently of H (R A |R B ) since the
latter is fixed by the QBER E Z . Indeed, the conditional Shannon entropy H (R A |R B )
is computed on the probability distribution Pr(a, b) of Alice and Bob’s Z outcomes.
Due to the symmetrization of the marginals, it is easy to express the entropy exclusively in terms of E Z as follows:
H (R A |R B ) = h(E Z ).
(3.25)
By employing (3.24) and (3.25) in (3.9), we obtain the asymptotic key rate of the
BB84 protocol in terms of the observed error rates:
r BB84 = 1 − h(E X ) − h(E Z ).
(3.26)
3.3 Finite-Key Security
The asymptotic secret key rate given in (3.9) is only valid in the limit of infinitely many
protocol rounds. Here, we generalize that result by presenting the secret key length
achieved by a general QKD protocol with finite resources and prove its security. In
doing so, we mainly follow the reference [12].
3.3.1 General QKD Protocol
Consider two parties, Alice and Bob, who have access to fresh randomness and are
linked by an insecure quantum channel and an authenticated classical public channel
(see Fig. 3.1). A potential eavesdropper, Eve, is assumed to have full control over
the quantum channel and access to the messages sent via the public channel.
The parties run a QKD protocol, whose goal is to output a pair of identical keys
(s A , s B ) for Alice and Bob, respectively, completely unknown to Eve. The protocol
could also abort and output the symbol: s A = s B =⊥. We describe the general QKD
protocol in the entanglement-based view.
1. The protocol starts with the distribution of M quantum signals through the quantum channel. The joint state of the signals is represented by ρ
M
AB and Eve holds
its purifying system (we allow for coherent attacks). Alice and Bob perform
43
Note that the eigenvalues {λ i j } are not completely fixed by the observed error rates
E Z and E X through (3.16) and (3.17). Thus we must consider the worst-case scenario
and minimize (3.23) over {λ i j }, with the constraints given by (3.16) and (3.17). The
minimization leads to the following result [6]:
H (R A |E) = 1 + h(E Z ) − (h(E X ) + h(E Z )) = 1 − h(E X ).
(3.24)
We remark that we could minimize H (R A |E) independently of H (R A |R B ) since the
latter is fixed by the QBER E Z . Indeed, the conditional Shannon entropy H (R A |R B )
is computed on the probability distribution Pr(a, b) of Alice and Bob’s Z outcomes.
Due to the symmetrization of the marginals, it is easy to express the entropy exclusively in terms of E Z as follows:
H (R A |R B ) = h(E Z ).
(3.25)
By employing (3.24) and (3.25) in (3.9), we obtain the asymptotic key rate of the
BB84 protocol in terms of the observed error rates:
r BB84 = 1 − h(E X ) − h(E Z ).
(3.26)
3.3 Finite-Key Security
The asymptotic secret key rate given in (3.9) is only valid in the limit of infinitely many
protocol rounds. Here, we generalize that result by presenting the secret key length
achieved by a general QKD protocol with finite resources and prove its security. In
doing so, we mainly follow the reference [12].
3.3.1 General QKD Protocol
Consider two parties, Alice and Bob, who have access to fresh randomness and are
linked by an insecure quantum channel and an authenticated classical public channel
(see Fig. 3.1). A potential eavesdropper, Eve, is assumed to have full control over
the quantum channel and access to the messages sent via the public channel.
The parties run a QKD protocol, whose goal is to output a pair of identical keys
(s A , s B ) for Alice and Bob, respectively, completely unknown to Eve. The protocol
could also abort and output the symbol: s A = s B =⊥. We describe the general QKD
protocol in the entanglement-based view.
1. The protocol starts with the distribution of M quantum signals through the quantum channel. The joint state of the signals is represented by ρ
M
AB and Eve holds
its purifying system (we allow for coherent attacks). Alice and Bob perform