Secret keys from quantum correlations

Abstract

Quantum mechanics allows to create informationtheoretical secure key based only on observed data. We review the current status of the resulting field quantum key distribution. What does QKD achieve?It is the goal of quantum key distribution (QKD) to generate secret keys simultaneously for two distant parties, traditionally called Alice and Bob. The power of this procedure lies in the fact that the security of the resulting key can be proven explicitly. This proof can be made without assumptions about the power of an eavesdropper, called Eve, who is acting on the signals that are exchanged between the two parties. This is usually referred to as unconditional security, though some natural and unavoidable assumptions are being made: the eavesdropper cannot attack the sending and receiving devices themselves. For example, we assume that the eavesdropper cannot intrude into the devices to read off the physical setting of elements. In any physical realization it needs to be shown that these natural assumptions hold.The process of quantum key distribution utilizes a quantum and a classical channel connecting two parties. It is necessary to authenticate the communication on the public channel to avoid so-called man-in-the-middle attacks in which an eavesdropper impersonates the legitimate partner both in the quantum as in the classical channel. The authentication can be done unconditionally secure, for example by N. Lütkenhaus (u) the method of Wegman and Carter [64] which uses a short secret key to authenticate large messages. The overhead of the required secret key shows double logarithmic dependence on the length of messages. Nevertheless, the fact that both parties need to share initially some secret key turns the process of key distribution into a process that is more correctly termed "quantum key growing" or "quantum key expansion", though we will stick to the more familiar name quantum key distribution. It should be pointed out that key expansion with provable security of the resulting key is impossible within the framework of classical communication.Once the process of QKD is started, the key expansion can operate continuously. In each round it provides fresh key to the participants while authenticating the classical communication with part of the secret key from the previous round of key expansion. Note that for this purpose it is necessary that authentication and quantum key distribution are composable, which has been investigated and proven recently [3]. One can think about other methods to start the key distribution process rather than the Wegman and Carter methods with initially shared secret keys. The security of the alternative method can be based on assumptions about current technology. Indeed, once the initial message exchange is authenticated and the generated key has been accepted, then it is too late for an eavesdropper to break the initial authentication method. Therefore, one could imagine using complexity based authentication methods that are secure against technology available at the time when t...