- Physical Review Journals
All JournalsPhysics Magazine

Physical Review Research

Reuse & Permissions

It is not necessary to obtain permission to reuse this article or its components as it is available under the terms of the Creative Commons Attribution 4.0 International license. This license permits unrestricted use, distribution, and reproduction in any medium, provided attribution to the author(s) and the published article's title, journal citation, and DOI are maintained. Please note that some figures may have been included with permission from other third parties. It is your responsibility to obtain the proper permission from the rights holder directly for these figures.

Export citation

Export citation

Choose format for download:

Download Citation
  • Open Access

Security loophole in error verification in quantum key distribution

Toyohiro Tsurumaru1,*, Akihiro Mizutani2,†, and Toshihiko Sasaki3,‡

  • 1Mitsubishi Electric Corporation, Information Technology R&D Center, 5-1-1 Ofuna, Kamakura-shi, Kanagawa 247-8501, Japan
  • 2Faculty of Engineering, University of Toyama, Gofuku 3190, Toyama 930-8555, Japan
  • 3Quantinuum K.K. Otemachi Financial City Grand Cube 3F, Global Business Hub Tokyo 1-9-2 Otemachi, Chiyoda-ku, Tokyo 100-0004, Japan

  • *Contact author: Tsurumaru.toyohiro@da.mitsubishielectric.co.jp
  • †Contact author: mizutani@eng.u-toyama.ac.jp
  • ‡Contact author: Toshihiko.Sasaki@quantinuum.com
PDF

Phys. Rev. Research 7, 043245 – Published 2 December, 2025

DOI: https://doi.org/10.1103/3vms-bx5d

Abstract

The security of quantum key distribution (QKD) is evaluated based on the secrecy of Alice's key and the correctness of the keys held by Alice and Bob. A practical method for ensuring correctness is known as error verification, in which Alice and Bob reveal a portion of their reconciled keys and check whether the revealed information matches. In this paper, we point out that when error verification is performed in a QKD protocol, the definition of secrecy must be revised accordingly. We illustrate the necessity of this revision with a counterexample, showing that neglecting it can lead to an incorrect security claim. In particular, we observe that in the case of the security proof method based on phase error correction, which is one of the mainstream approaches and also known as Koashi's approach, no explicit method has been established to properly incorporate the revised secrecy definition. To resolve this issue, we present a way to translate the phase error correction-based approach into another mainstream approach, called the leftover hash lemma-based approach, also known as Renner's approach, where a solution has already been formulated. As a consequence, security proofs under the phase error correction-based approach automatically remain valid without any change in the secret key length, even if they implicitly consider error verification without revising the secrecy definition.

View figure in article

Physics Subject Headings (PhySH)

Article Text

References (59)

  1. H.-K. Lo, M. Curty, and K. Tamaki, Secure quantum key distribution, Nat. Photon. 8, 595 (2014).
  2. F. Xu, X. Ma, Q. Zhang, H.-K. Lo, and J.-W. Pan, Secure quantum key distribution with realistic devices, Rev. Mod. Phys. 92, 025002 (2020).
  3. S. Pirandola, U. L. Andersen, L. Banchi, M. Berta, D. Bunandar, R. Colbeck, D. Englund, T. Gehring, C. Lupo, C. Ottaviani et al., Advances in quantum cryptography, Adv. Opt. Photon. 12, 1012 (2020).
  4. C. Portmann and R. Renner, Security in quantum cryptography, Rev. Mod. Phys. 94, 025008 (2022).
  5. M. Ben-Or, M. Horodecki, D. W. Leung, D. Mayers, and J. Oppenheim, The universal composable security of quantum key distribution, in Theory of Cryptography, edited by J. Kilian (Springer, Berlin, 2005), pp. 386–406.
  6. J. Müller-Quade and R. Renner, Composability in quantum cryptography, New J. Phys. 11, 085006 (2009).
  7. M. Koashi, Simple security proof of quantum key distribution based on complementarity, New J. Phys. 11, 045018 (2009).
  8. M. Hayashi and T. Tsurumaru, Concise and tight security analysis of the Bennett-Brassard 1984 protocol with finite key lengths, New J. Phys. 14, 093014 (2012).
  9. M. Tomamichel, C. C. W. Lim, N. Gisin, and R. Renner, Tight finite-key analysis for quantum cryptography, Nat. Commun. 3, 634 (2012).
  10. M. Tomamichel and A. Leverrier, A largely self-contained and complete security proof for quantum key distribution, Quantum 1, 14 (2017).
  11. D. Tupkary, E. Y. Z. Tan, S. Nahar, L. Kamin, and N. Lütkenhaus, QKD security proofs for decoy-state BB84: Protocol variations, proof techniques, gaps and limitations, arXiv:2502.10340.
  12. T. M. Cover and J. A. Thomas, Elements of Information Theory, Wiley Series in Telecommunications and Signal Processing (Wiley-Interscience, USA, 2006).
  13. T. Richardson and R. Urbanke, Modern Coding Theory (Cambridge University Press, Cambridge, 2008).
  14. Some theoretical methods are known to bound the decoding failure probability, which equals the correctness parameter; see, e.g., Refs. [12, 13]. However, such methods are not feasible in practical QKD systems, because computationally efficient methods cannot achieve both a high coding rate and a rigorous bound on the decoding failure probability simultaneously, and also because in practical QKD systems, it is almost impossible to precisely characterize the probability distribution of bit errors under arbitrary Eve's attacks.
  15. R. Renner, Security of quantum key distribution, arXiv:quant-ph/0512258.
  16. M. Curty, F. Xu, W. Cui, C. C. W. Lim, K. Tamaki, and H.-K. Lo, Finite-key analysis for measurement-device-independent quantum key distribution, Nat. Commun. 5, 3732 (2014).
  17. C. C. W. Lim, M. Curty, N. Walenta, F. Xu, and H. Zbinden, Concise security bounds for practical decoy-state quantum key distribution, Phys. Rev. A 89, 022307 (2014).
  18. K. Maeda, T. Sasaki, and M. Koashi, Repeaterless quantum key distribution with efficient finite-key analysis overcoming the rate-distance limit, Nat. Commun. 10, 3140 (2019).
  19. M. Sandfuchs, M. Haberland, V. Vilasini, and R. Wolf, Security of differential phase shift QKD from relativistic principles, Quantum 9, 1611 (2025).
  20. A. Mizutani, T. Sasaki, and G. Kato, Protocol-level description and self-contained security proof of decoy-state BB84 QKD protocol, arXiv:2504.20417.
  21. L. Kamin, J. Burniston, and E. Y. Z. Tan, Rényi security framework against coherent attacks applied to decoy-state QKD, arXiv:2504.12248.
  22. M. Koashi, Simple security proof of quantum key distribution via uncertainty principle, arXiv:quant-ph/0505108.
  23. A. Mizutani, Y. Takeuchi, and K. Tamaki, Finite-key security analysis of differential-phase-shift quantum key distribution, Phys. Rev. Res. 5, 023132 (2023).
  24. M. Pereira, G. Currás-Lorenzo, A. Navarrete, A. Mizutani, G. Kato, M. Curty, and K. Tamaki, Modified BB84 quantum key distribution protocol robust to source imperfections, Phys. Rev. Res. 5, 023065 (2023).
  25. A. Mizutani, M. Curty, C. C. W. Lim, N. Imoto, and K. Tamaki, Finite-key security analysis of quantum key distribution with imperfect light sources, New J. Phys. 17, 093011 (2015).
  26. K. Tamaki, H.-K. Lo, A. Mizutani, G. Kato, C. C. W. Lim, K. Azuma, and M. Curty, Security of quantum key distribution with iterative sifting, Quantum Sci. Technol. 3, 014002 (2018).
  27. H. Takesue, T. Sasaki, K. Tamaki, and M. Koashi, Experimental quantum key distribution without monitoring signal disturbance, Nat. Photon. 9, 827 (2015).
  28. G. Currás-Lorenzo, A. Navarrete, M. Pereira, and K. Tamaki, Finite-key analysis of loss-tolerant QKD based on random sampling theory, Phys. Rev. A 104, 012406 (2021).
  29. T. Sasaki, Y. Yamamoto, and M. Koashi, Practical quantum key distribution protocol without monitoring signal disturbance, Nature (London) 509, 475 (2014).
  30. D. Tupkary, E. Y. -Z. Tan, S. Nahar, L. Kamin, and N. Lütkenhaus, QKD security proofs for decoy-state BB84: Protocol variations, proof techniques, gaps and limitations, arXiv:2502.10340.
  31. J.-Y. Guan et al., Experimental passive round-robin differential phase-shift quantum key distribution, Phys. Rev. Lett. 114, 180502 (2015).
  32. S. Wang et al., Experimental demonstration of a quantum key distribution without signal disturbance monitoring, Nat. Photon. 9, 832 (2015).
  33. M. Koashi, Efficient quantum key distribution with practical sources and detectors, arXiv:quant-ph/0609180.
  34. M. Hayashi and R. Nakayama, Security analysis of the decoy method with the Bennett-Brassard 1984 protocol for finite key lengths, New J. Phys. 16, 063009 (2014).
  35. M. Koashi and J. Preskill, Secure quantum key distribution with an uncharacterized source, Phys. Rev. Lett. 90, 057902 (2003).
  36. G. Kato and K. Tamaki, Security of six-state quantum key distribution protocol with threshold detectors, Sci. Rep. 6, 30044 (2016).
  37. K. Tamaki, M. Curty, G. Kato, H.-K. Lo, and K. Azuma, Loss-tolerant quantum cryptography with imperfect sources, Phys. Rev. A 90, 052314 (2014).
  38. A. Mizutani, T. Sasaki, Y. Takeuchi, K. Tamaki, and M. Koashi, Quantum key distribution with simply characterized light sources, npj Quantum Inf. 5, 87 (2019).
  39. T. Matsuura, K. Maeda, T. Sasaki, and M. Koashi, Finite-size security of continuous-variable quantum key distribution with digital signal processing, Nat. Commun. 12, 252 (2021).
  40. T. Matsuura, S. Yamano, Y. Kuramochi, T. Sasaki, and M. Koashi, Refined finite-size analysis of binary-modulation continuous-variable quantum key distribution, Quantum 7, 1095 (2023).
  41. T. Tsurumaru, Leftover hashing from quantum error correction: Unifying the two approaches to the security proof of quantum key distribution, IEEE Trans. Inf. Theory 66, 3465 (2020).
  42. T. Tsurumaru, Equivalence of three classical algorithms with quantum side information: Privacy amplification, error correction, and data compression, IEEE Trans. Inf. Theory 68, 1016 (2022).
  43. M. A. Nielsen and I. L. Chuang, Quantum Computation and Quantum Information: 10th Anniversary Edition (Cambridge University Press, Cambridge, 2010).
  44. Note that, as mentioned in Sec. 2, when the abort decision is determined solely from the public information (for example, when the QBER is disclosed and the protocol is aborted whenever it exceeds a predetermined threshold), then even if the abort/nonabort outcome is publicly announced, no additional sacrifice in privacy amplification is required. In contrast, in the error-verification procedure considered from Sec. 3, Alice announces a hash value whereas Bob does not; instead, Bob checks consistency and announces the verification outcome. In this case, the abort decision is not determined solely from the public information, and in principle one must consider the possibility of further shortening the key during privacy amplification. Nevertheless, as explained in Sec. 4, within the security proof based on the leftover hash lemma, no additional sacrifice is required.
  45. We note, however, that all of them can be corrected without increasing the amount of privacy amplification, as justified in Sec. 4b of this paper.
  46. T. Tsurumaru and M. Hayashi, Dual universality of hash functions and its applications to quantum cryptography, IEEE Trans. Inf. Theory 59, 4700 (2013).
  47. M. Hayashi and T. Tsurumaru, More efficient privacy amplification with less random seeds via dual universal hash function, IEEE Trans. Inf. Theory 62, 2213 (2016).
  48. Note that subsystem B does not only consist of Bob's system, but also includes any system accessible to Alice. For example, it includes subsystems other than the qubits possessed by Alice, such as the shield system (i.e., the system that purifies Alice's emitted states).
  49. R. Koenig, R. Renner, and C. Schaffner, The operational meaning of min- and max-entropy, IEEE Trans. Inf. Theory 55, 4337 (2009).
  50. For example, Refs. [42, 49] state that QEC≤2Hmax(XA|B)ρ−(n−ℓ) is possible on average.
  51. M. Tomamichel and R. Renner, Uncertainty relation for smooth entropies, Phys. Rev. Lett. 106, 110506 (2011).
  52. P. W. Shor and J. Preskill, Simple proof of security of the BB84 quantum key distribution protocol, Phys. Rev. Lett. 85, 441 (2000).
  53. T. Tsurumaru and K. Tamaki, Security proof for QKD systems with threshold detectors, Phys. Rev. A 78, 032302 (2008).
  54. N. J. Beaudry, T. Moroder, and N. Lütkenhaus, Squashing models for optical measurements in quantum communication, Phys. Rev. Lett. 101, 093601 (2008).
  55. T. Tsurumaru, Squash operator and symmetry, Phys. Rev. A 81, 012328 (2010).
  56. C.-H. F. Fung, H. F. Chau, and H.-K. Lo, Universal squash model for optical communications using linear optics and threshold detectors, Phys. Rev. A 84, 020303(R) (2011).
  57. O. Gittsovich, N. J. Beaudry, V. Narasimhachar, R. R. Alvarez, T. Moroder, and N. Lütkenhaus, Squashing model for detectors and applications to quantum-key-distribution protocols, Phys. Rev. A 89, 012325 (2014).
  58. For example, Bob's measurement can be effectively modeled as acting on qubits due to the existence of a squash operator [53, 54, 55, 56, 57]. In this case, the effect of the verification can be explicitly incorporated into the security proof. Indeed, a recent security proof of the decoy-state BB84 protocol [20] rigorously addresses this issue using the PEC approach.
  59. Reference [8] fits this situation if one restricts that the universal hash function used for error verification, mentioned at the end of Sec. 2.2, to be linear (though we failed to say that it should be linear).

Outline

Information

Phys. Rev. Research 7, 043245– Published 2 December, 2025
  • Received 4 August 2025
  • Accepted 10 November 2025
Crossmark - Check for updates button
Creative Commons Logo

Published by the American Physical Society under the terms of the Creative Commons Attribution 4.0 International license. Further distribution of this work must maintain attribution to the author(s) and the published article's title, journal citation, and DOI.

Published by the American Physical Society

Sign In to Your Journals Account

Filter

Filter

Article Lookup

Enter a citation