- Physical Review Journals
All JournalsPhysics Magazine

Physical Review Research

Reuse & Permissions

It is not necessary to obtain permission to reuse this article or its components as it is available under the terms of the Creative Commons Attribution 4.0 International license. This license permits unrestricted use, distribution, and reproduction in any medium, provided attribution to the author(s) and the published article's title, journal citation, and DOI are maintained. Please note that some figures may have been included with permission from other third parties. It is your responsibility to obtain the proper permission from the rights holder directly for these figures.

Export citation

Export citation

Choose format for download:

Download Citation
  • Open Access

Security-rate trade-off in quantum key distribution: From individual links to large-scale networks

Stefano Pirandola1,*, Cillian Harney2, and Gaetana Spedalieri2

  • 1Department of Computer Science, University of York, York YO10 5GH, United Kingdom
  • 2nodeQ, 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom

  • *Contact author: stefano.pirandola@york.ac.uk
PDF

Phys. Rev. Research 8, 033221 – Published 24 August, 2026

DOI: https://doi.org/10.1103/7839-3xhy

Abstract

We explore the interplay between security and key rate of a quantum key distribution (QKD) protocol. This fundamental trade-off is investigated both at the link layer, i.e., for a QKD protocol implemented on a channel, and at the network layer, i.e., within the context of a multiuser multihop communication network. In the former scenario, we consider both discrete- and continuous-variable protocols in the composable finite-size framework, showing how their epsilon security restricts the key rate achievable on a single fiber link under various assumptions for the process of parameter estimation. In the latter scenario, we analyze the impact of composable security in the network setting, studying the interplay between end-to-end (ETE) epsilon security and ETE key rate for arbitrarily chosen remote end points. Starting from basic topologies to more complex ones, such as perturbed lattices, we analyze this trade-off under different types of routing strategies. In multipath routing, a greater number of paths can improve key rates, but this enhancement is accompanied by a reduction in the ETE security level. In the setting of single-path routing, we introduce a modified Dijkstra algorithm, which we call “lambda protocol,” able to optimize route construction depending on the joint ETE demand for security and rate. Our results are first derived for specific network instances (i.e., fixed topologies within a given network class) and subsequently extended to ensemble averages over entire network classes, where phase transitions are revealed with respect to node connectivity.

View figure in article

Physics Subject Headings (PhySH)

Article Text

References (57)

  1. S. Pirandola, U. L. Andersen, L. Banchi, M. Berta, D. Bunandar, R. Colbeck, D. Englund, T. Gehring, C. Lupo, C. Ottaviani, et al., Advances in quantum cryptography, Adv. Opt. Photonics 12, 1012 (2020).
  2. N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Quantum cryptography, Rev. Mod. Phys. 74, 145 (2002).
  3. C. H. Bennett and G. Brassard, Quantum cryptography: Public key distribution and coin tossing, in Proceedings of the IEEE International Conference on Computers, Systems and Signal Processing (IEEE, Bangalore, India, 1984), pp. 175–179.
  4. A. K. Ekert, Quantum cryptography based on Bell's theorem, Phys. Rev. Lett. 67, 661 (1991).
  5. S. Pirandola, R. Laurenza, C. Ottaviani, and L. Banchi, Fundamental limits of repeaterless quantum communications, Nat. Commun. 8, 15043 (2017).
  6. S. Pirandola, Limits and security of free-space quantum communications, Phys. Rev. Res. 3, 013279 (2021).
  7. S. Pirandola, Satellite quantum communications: Fundamental bounds and practical security, Phys. Rev. Res. 3, 023130 (2021).
  8. M. Lucamarini, Z. L. Yuan, J. F. Dynes, and A. J. Shields, Overcoming the rate-distance limit of quantum key distribution without quantum repeaters, Nature (London) 557, 400 (2018).
  9. Z.-W. Yu, X.-L. Hu, C. Jiang, H. Xu, and X.-B. Wang, Sending-or-not-sending twin-field quantum key distribution in practice, Sci. Rep. 9, 3080 (2019).
  10. C. Jiang, Z.-W. Yu, X.-L. Hu, and X.-B. Wang, Unconditional security of sending or not sending twin-field quantum key distribution with finite pulses, Phys. Rev. Appl. 12, 024061 (2019).
  11. H. Xu, Z.-W. Yu, C. Jiang, X.-L. Hu, and X.-B. Wang, Improved results for sending-or-not-sending twin-field quantun key distribution: Breaking the absolute limit of repeaterless key rate, Phys. Rev. A 101, 042330 (2020).
  12. C. Cui, Z.-Q. Yin, R. Wang, W. Chen, S. Wang, G.-C. Guo, and Z.-F. Han, Twin-field quantum key distribution without phase postselection, Phys. Rev. Appl. 11, 034053 (2019).
  13. S. Pirandola, End-to-end capacities of a quantum communication network, Commun. Phys. 2, 51 (2019).
  14. O. Simeone, Classical and Quantum Information Theory: Uncertainty, Information, and Correlation (Cambridge University Press, Cambridge, 2026).
  15. The block rate Rblock represents the conditional rate of the protocol, i.e., the rate achievable when a block is successfully corrected (which happens with probability pEC). Then, we can define the average key rate pECRblock, which represents the unconditional rate of the protocol, i.e., the average rate that is achievable considering that some of the blocks are successful and others are not. This also corresponds to the average rate of a session Rses, where an average of pECnbks blocks are successfully corrected. Note that we are implicitly assuming a stationary QKD condition, i.e., stable channel and setup parameters. Under this condition, we assume that PE is successful (no abort due to denial-of-service attacks) and that the value of pEC remains constant during the session.
  16. V. Burenkov, B. Qi, B. Fortescue, and H.-K. Lo, Security of high speed quantum key distribution with finite detector dead time, Quantum Inf. Comput. 14, 217 (2014).
  17. As we will see in Appendixes pp1 and pp2, the PE error would appear as pECɛPE because PE is assumed to be done before EC. However, it is preferable to use the upper bound pECɛPE≤ɛPE in the formulas, since the epsilon errors are usually set as input target parameters, while the exact value of pEC is typically known only after the actual implementation of EC.
  18. Note that the expression for the session security parameter should be understood as the standard composable-security upper bound ɛses≤nbksɛblock. This additive form follows from the union bound and is tight to first order when the total failure probability is small. For typical values of ɛblock between 10−15 and 10−5, and nbks on the order of a few hundred, one has nbksɛblock≪1, so the additive union-bound estimate is well justified.
  19. F. Grosshans and P. Grangier, Continuous variable quantum cryptography using coherent states, Phys. Rev. Lett. 88, 057902 (2002).
  20. C. Weedbrook, A. M. Lance, W. P. Bowen, T. Symul, T. C. Ralph, and P. K. Lam, Quantum cryptography without switching, Phys. Rev. Lett. 93, 170504 (2004).
  21. Given some time interval over which we can assume stability, the effective number of session points nbksN depends on the repetition rate. This means that the stability is relative to the system's clock.
  22. A. S. Tanenbaum and D. J. Wetherall, Computer Networks, 5th ed. (Pearson, Upper Saddle River, NJ, 2010).
  23. L. R. Ford, Jr. and D. R. Fulkerson, Flows in Networks (Princeton University Press, Princeton, NJ, 1962).
  24. L. R. Ford, Jr. and D. R. Fulkerson, Maximal flow through a network, Can. J. Math. 8, 399 (1956).
  25. One way to mitigate this trade-off and meet a target value for the ETE epsilon security is to decrease the link epsilons, but this in turn means to decrease the link rates. At the end of the day, the best strategy may just consist in reducing the number of parallel paths.
  26. The additive multipath rate considered here should be interpreted as an idealized upper-level model. In practice, classical-control overheads may lead to mildly subadditive aggregation. However, because these effects are typically separated from the physical process of quantum key generation, which remains the dominant bottleneck, they are neglected here without affecting the security-rate trade-off.
  27. In the presence of horizontal depth, we can potentially meet a target value of the ETE epsilon security by reducing the link values. This is, of course, achieved at the cost of lowering the link rate and therefore the ETE rate.
  28. E. W. Dijkstra, A note on two problems in connexion with graphs, Numer. Math. 1, 269 (1959).
  29. T. H. Cormen, C. E. Leiserson, R. L. Rivest, and C. Stein, Introduction to Algorithms, 3rd ed. (MIT Press, Cambridge, MA, 2009).
  30. D. Lopez-Pajares, E. Rojas, J. A. Carral, I. Martinez-Yelmo, and J. Alvarez-Horcajo, The disjoint multipath challenge: Multiple disjoint paths guaranteeing scalability, IEEE Access 9, 74422 (2021).
  31. C. Harney and S. Pirandola, Practical routing and criticality in large-scale quantum communication networks, Phys. Rev. Res. 7, 043168 (2025).
  32. C. Harney and S. Pirandola, Analytical methods for high-rate global quantum networks, PRX Quantum 3, 010349 (2022).
  33. P. Erdős and A. Rényi, On the evolution of random graphs, Publ. Math. Inst. Hungarian Acad. Sci. 5, 17 (1960).
  34. M. E. J. Newman, Networks: An Introduction (Oxford University Press, Oxford, 2010).
  35. C. Portmann, Key recycling in authentication, IEEE Trans. Inf. Theory 60, 4383 (2014).
  36. M. N. Wegman and L. Carter, New hash functions and their use in authentication and set equality, J. Comput. Syst. Sci. 22, 265 (1981).
  37. info@nodeq.io.
  38. D. Rusca, A. Boaron, F. Grünenfelder, A. Martin, and H. Zbinden, Finite-key analysis for the 1-decoy state QKD protocol, Appl. Phys. Lett. 112, 171104 (2018).
  39. J. Wiesemann, J. Krause, D. Tupkary, N. Lütkenhaus, D. Rusca, and N. Walenta, A consolidated and accessible security proof for finite-size decoy-state quantum key distribution, Quantum 10, 2037 (2026).
  40. V. Scarani and R. Renner, Security bounds for quantum cryptography with finite resources, in Proceedings of the Theory of Quantum Computation, Lecture Notes in Computer Science (Springer, Berlin, 2008), Vol. 5106, pp. 83–95.
  41. V. Scarani and R. Renner, Quantum cryptography with finite resources: Unconditional security bound for discrete-variable protocols with one-way post-processing, Phys. Rev. Lett. 100, 200501 (2008).
  42. M. Tomamichel, A framework for non-asymptotic quantum information theory, Ph.D. thesis, ETH Zurich, Zurich, Switzerland, 2012.
  43. R. Renner, Security of quantum key distribution, Ph.D. thesis, ETH Zurich, Zurich, Switzerland, 2005.
  44. Here, we set ρ̃=ρ̃XE′ where we exclude Eve's classical register C from E=E′C. The contribution of system C has been considered in the leakEC term.
  45. D. Gottesman and H.-K. Lo, Proof of security of quantum key distribution with two-way classical communications, IEEE Trans. Inf. Theory 49, 457 (2003).
  46. B. Kraus, N. Gisin, and R. Renner, Lower and upper bounds on the secret-key rate for quantum key distribution protocols using one-way classical communication, Phys. Rev. Lett. 95, 080501 (2005).
  47. R. Renner, N. Gisin, and B. Kraus, Information-theoretic security proof for quantum-key-distribution protocols, Phys. Rev. A 72, 012332 (2005).
  48. C. C. W. Lim, M. Curty, N. Walenta, F. Xu, and H. Zbinden, Concise security bounds for practical decoy-state quantum key distribution, Phys. Rev. A 89, 022307 (2014).
  49. W. Hoeffding, Probability inequalities for sums of bounded random variables, J. Am. Stat. Assoc. 58, 13 (1963).
  50. H. L. Yin, M. G. Zhou, J. Gu, Y. M. Xie, Y. S. Lu, and Z. B. Chen, Tight security bounds for decoy-state quantum key distribution, Sci. Rep. 10, 14312 (2020).
  51. R. J. Serfling, Probability inequalities for the sum in sampling without replacement, Ann. Stat. 2, 39 (1974).
  52. C.-H. F. Fung, X. Ma, and H. F. Chau, Practical issues in quantum-key-distribution postprocessing, Phys. Rev. A 81, 012318 (2010).
  53. S. Pirandola and P. Papanastasiou, Improved composable key rates for CV-QKD, Phys. Rev. Res. 6, 023321 (2024).
  54. Note that there is no reduction of the block size N induced by sifting or channel loss as in DV-QKD.
  55. A. G. Mountogiannakis, P. Papanastasiou, B. Braverman, and S. Pirandola, Composably secure data processing for Gaussian-modulated continuous-variable quantum key distribution, Phys. Rev. Res. 4, 013099 (2022).
  56. A. G. Mountogiannakis, P. Papanastasiou, and S. Pirandola, Data postprocessing for the one-way heterodyne protocol under composable finite-size security, Phys. Rev. A 106, 042606 (2022).
  57. Note that this random choice must be done for each block in case of a session, so each block is compressed using a potentially different function.

Outline

Information

Phys. Rev. Research 8, 033221– Published 24 August, 2026
  • Received 31 December 2025
  • Accepted 23 June 2026
Crossmark - Check for updates button
Creative Commons Logo

Published by the American Physical Society under the terms of the Creative Commons Attribution 4.0 International license. Further distribution of this work must maintain attribution to the author(s) and the published article's title, journal citation, and DOI.

Published by the American Physical Society

Sign In to Your Journals Account

Filter

Filter

Article Lookup

Enter a citation