Security Against Collective Attacks of a Modiﬁed BB84 QKD Protocol

with Information only in One Basis

Michel Boyer

, Rotem Liss

and Tal Mor

epartement IRO, Universit

e de Montr

eal, Montr

eal (Qu

ebec) H3C 3J7, Canada

Computer Science Department, Technion, Haifa 3200003, Israel

Keywords:

QKD, Security, Collective Attacks, Error Rate Threshold, Information Bits.

Abstract:

The Quantum Key Distribution (QKD) protocol BB84 has been proven secure against several important types

of attacks: the collective attacks and the joint attacks. Here we analyze the security of a modiﬁed BB84

protocol, for which information is sent only in the z basis while testing is done in both the z and the x bases,

against collective attacks. The proof follows the framework of a previous paper (Boyer et al., 2009), but it

avoids the classical information-theoretical analysis that caused problems with composability. We show that

this modiﬁed BB84 protocol is as secure against collective attacks as the original BB84 protocol, and that it

requires more bits for testing.

1 INTRODUCTION

Quantum Key Distribution (QKD) protocols take ad-

vantage of the laws of quantum mechanics, and most

of them can be proven secure even against powerful

adversaries limited only by the laws of physics. The

two parties (Alice and Bob) want to create a shared

random key, using an insecure quantum channel and

an unjammable classical channel (to which the ad-

versary may listen, but not interfere). The adversary

(eavesdropper), Eve, tries to get as much information

as she can on the ﬁnal shared key. The ﬁrst and most

important QKD protocol is BB84 (Bennett and Bras-

sard, 1984).

Boyer, Gelles, and Mor (BGM09) (Boyer et al.,

2009) discussed the security of the BB84 protocol

against collective attacks. Collective attacks (Biham

and Mor, 1997b; Biham and Mor, 1997a; Biham et al.,

2002) are a subclass of the joint attacks; joint attacks

are the most powerful theoretical attacks. BGM09

improved the security proof of Biham, Boyer, Bras-

sard, van de Graaf, and Mor (BBBGM02) (Biham

et al., 2002) against collective attacks, by using some

techniques of Biham, Boyer, Boykin, Mor, and Roy-

chowdhury (BBBMR06) (Biham et al., 2006) (that

proved security against joint attacks). In this paper,

too, we restrict the analysis to collective attacks, be-

cause security against collective attacks is conjectured

(and, in some security notions, proved (Renner, 2008;

Christandl et al., 2009)) to imply security against joint

attacks. In addition, proving security against col-

lective attacks is much simpler than proving security

against joint attacks.

In many QKD protocols, including BB84, Alice

and Bob exchange several types of bits (encoded as

quantum systems, usually qubits): INFO bits, that are

secret bits shared by Alice and Bob and are used for

generating the ﬁnal key (via classical processes of er-

ror correction and privacy ampliﬁcation); and TEST

bits, that are publicly exposed by Alice and Bob (by

using the classical channel) and are used for estimat-

ing the error rate. In BB84, each bit is sent from Alice

to Bob in a random basis (the z basis or the x basis).

In this paper, we extend the analysis of BB84 done

in BGM09 and prove the security of a QKD protocol

we shall name BB84-INFO-z. This protocol is almost

identical to BB84, except that all its INFO bits are in

the z basis. In other words, the x basis is used only for

testing. The bits are thus partitioned into three disjoint

sets: INFO, TEST-Z, and TEST-X. The sizes of these

sets are arbitrary (n INFO bits, n

TEST-Z bits, and n

TEST-X bits).

We note that, while this paper follows a line of

research that mainly discusses a speciﬁc approach of

security proof for BB84 and similar protocols (this

approach, notably, considers ﬁnite-key effects and

not only the asymptotic error rate), many other ap-

proaches have also been suggested: see for exam-

ple (Mayers, 2001; Shor and Preskill, 2000; Renner,

2008; Renner et al., 2005).

Boyer, M., Liss, R. and Mor, T.

Security Against Collective Attacks of a Modiﬁed BB84 QKD Protocol with Information only in One Basis.

DOI: 10.5220/0006241000230029

In Proceedings of the 2nd International Conference on Complexity, Future Information Systems and Risk (COMPLEXIS 2017), pages 23-29

ISBN: 978-989-758-244-8

In contrast to the line of research adopted here

(of (Biham and Mor, 1997b; Biham and Mor, 1997a;

Biham et al., 2002; Biham et al., 2006; Boyer et al.,

2009)), in which a classical information-theoretical

analysis caused problems with composability (see

deﬁnition in (Renner, 2008)), in this paper we suggest

a method to avoid those problems: we calculate the

trace distance between any two density matrices Eve

may hold, instead of calculating the classical mutual

information between Eve and the ﬁnal key (as done in

those previous papers). This method is implemented

in this paper for the proof of BB84-INFO-z; it also di-

rectly applies to the BB84 security proof in BGM09,

and it may be extended in the future to show that the

BB84 security proofs of BGM09, BBBGM02, and

BBBMR06 prove the composable security of BB84.

The “qubit space”, H

, is a 2-dimensional Hilbert

space. The states |0

i, |1

i form an orthonormal ba-

sis of H

, called “the computational basis” or “the z

basis”. The states |0

i ,

√

[|0

i+ |1

i] and |1

i ,

√

[|0

i − |1

i] form another orthonormal basis of

, called “the x basis”. Those two bases are said

to be conjugate bases.

In this paper, bit strings of some length t are de-

noted by a bold letter (e.g., i = i

. . . i

with i

, . . . , i

∈

{0, 1}) and are identiﬁed to elements of the t-

dimensional F

-vector space F

, where F

= {0, 1}

and the addition of two vectors corresponds to a XOR

operation. The number of 1-bits in a bit string s is de-

noted by |s|, and the Hamming distance between two

strings s and s

is d

(s, s

) = |s +s

2 FORMAL DESCRIPTION OF

THE BB84-INFO-Z PROTOCOL

Below we describe the BB84-INFO-z protocol used

in this paper.

1. Alice and Bob pre-agree on numbers n, n

, and n

(we denote N , n + n

+ n

), on error thresholds

a,z

and p

a,x

, on a linear error-correcting code C

with an r ×n parity check matrix P

, and on a

linear key-generation function (privacy ampliﬁca-

tion) represented by an m ×n matrix P

. It is re-

quired that all the r + m rows of the matrices P

and P

put together are linearly independent.

2. Alice randomly chooses a partition P = (s, z, b)

of the N bits by randomly choosing three N-

bit strings s, z, b ∈ F

that satisfy |s| = n, |z| =

, |b|= n

, and |s+z +b|= N. P thus partitions

the set of indexes {1, 2, ..., N} into three disjoint

sets:

• I (INFO bits, where s

= 1) of size n;

• T

(TEST-Z bits, where z

= 1) of size n

; and

• T

(TEST-X bits, where b

= 1) of size n

3. Alice randomly chooses an N-bit string i ∈ F

and sends the N qubit states |i

i, |i

i, . . . , |i

one after the other, to Bob using the quantum

channel. Notice that the INFO and TEST-Z bits

are encoded in the z basis, while the TEST-X bits

are encoded in the x basis. Bob keeps each re-

ceived qubit in quantum memory, not measuring

it yet

4. Alice publicly sends to Bob the string b =

···b

. Bob measures each saved qubit in the

correct basis (namely, if b

= 0 then he measures

the i-th qubit in the z basis, and if b

= 1 then he

measures it in the x basis).

The bit string measured by Bob is denoted by i

If there is no noise and no eavesdropping, then

= i.

5. Alice publicly sends to Bob the string s. The

INFO bits, used for generating the ﬁnal key, are

the n bits with s

= 1, while the TEST-Z and

TEST-X bits are the n

+ n

bits with s

= 0. The

substrings of i, b that correspond to the INFO bits

are denoted by i

and b

6. Alice and Bob both publish their values of all the

TEST-Z and TEST-X bits, and compare the bit

values. If more than n

· p

a,z

of the TEST-Z bits

are different between Alice and Bob or more than

· p

a,x

of the TEST-X bits are different between

them, they abort the protocol. We note that p

a,z

and p

a,x

(the pre-agreed error thresholds) are the

maximal allowed error rates on the TEST-Z and

TEST-X bits, respectively – namely, in each basis

(z and x) separately.

7. Alice and Bob keep the values of the remaining n

bits (the INFO bits, with s

= 1) secret. The bit

string of Alice is denoted x = i

, and the bit string

of Bob is denoted x

8. Alice sends to Bob the r-bit string ξ = xP

, that is

called the syndrome of x (with respect to the error-

correcting code C and to its corresponding parity

check matrix P

). By using ξ , Bob corrects the

errors in his x

string (so that it is the same as x).

Here we assume that Bob has a quantum memory and

can delay his measurement. In practical implementations,

Bob usually cannot do that, but is assumed to measure in a

randomly-chosen basis (z or x), so that Alice and Bob later

discard the qubits measured in the wrong basis. We assume

that Alice sends more than N qubits, so that N qubits are

ﬁnally detected by Bob and measured in the correct basis.

COMPLEXIS 2017 - 2nd International Conference on Complexity, Future Information Systems and Risk

9. Alice and Bob compute the m-bit ﬁnal key k =

The protocol is deﬁned similarly to BB84 (and to

its description in BGM09), except that it uses the gen-

eralized bit numbers n, n

, and n

(numbers of INFO,

TEST-Z, and TEST-X bits, respectively); that it uses

the partition P = (s, z, b) for dividing the N-bit string

i into three disjoint sets of indexes (I, T

, and T

); and

that it uses two separate thresholds (p

a,z

and p

a,x

) in-

stead of one (p

3 SECURITY PROOF OF

BB84-INFO-Z AGAINST

COLLECTIVE ATTACKS

3.1 Results from BGM09

The security proof of BB84-INFO-z against collective

attacks is very similar to the security proof of BB84

itself against collective attacks, that was detailed in

BGM09. Most parts of the proof are not affected at all

by the changes made to BB84 to get the BB84-INFO-

z protocol (changes detailed in Section 2 of the current

paper), because those parts assume ﬁxed strings s and

b, and because the attack is collective (so the analysis

is restricted to the INFO bits).

Therefore, the reader is referred to the proof in

Section 2 and Subsections 3.1 to 3.5 of BGM09, that

applies to BB84-INFO-z without any changes (except

changing the total number of bits, 2n, to N, which

does not affect the proof at all), and that will not be

repeated here.

We denote the rows of the error-correction parity

check matrix P

as the vectors v

, . . . , v

in F

, and

the rows of the privacy ampliﬁcation matrix P

as the

vectors v

r+1

, . . . , v

r+m

. We also deﬁne, for every r

, Span{v

, ..., v

}; and we deﬁne

r,m

, min

r≤r

<r+m

) = min

r≤r

<r+m

. (1)

For a 1-bit ﬁnal key k ∈ {0, 1}, we deﬁne

to be

the state of Eve corresponding to the ﬁnal key k, given

that she knows ξ. Thus,

n−r−1

∑



= ξ

x ·v

r+1

= k

, (2)

where ρ

is Eve’s state after the attack, given that

Alice sent the INFO bits x encoded in the bases b

. We also deﬁned in BGM09 the state

, that is a

lift-up of

(which means that

is a partial trace of

In the end of Subsection 3.5 of BGM09, it was

found that (in the case of a 1-bit ﬁnal key, i.e., m = 1)

tr|

−

|≤2



| ≥

r,1

| B

= b

, s



, (3)

where C

is the random variable corresponding to the

n-bit string of errors on the n INFO bits; B

is the

random variable corresponding to the n-bit string of

bases of the n INFO bits; b

is the bit-ﬂipped string

of b

= b

; and d

r,1

(and, in general, d

r,m

) was deﬁned

above.

Now, according to (Nielsen and Chuang, 2010,

Theorem 9.2 and page 407), and using the fact that

is a partial trace of

, we ﬁnd that

tr|

−

| ≤

tr|

−

|. From this result and from inequality (3)

we deduce that

tr|

−

|≤2



| ≥

r,1

| B

= b

, s



. (4)

3.2 Bounding the Differences Between

Eve’s States

We deﬁne c , i + i

: namely, c is the XOR of the

N-bit string i sent by Alice and of the N-bit string i

measured by Bob. For each index 1 ≤ l ≤ N, c

= 1

if and only if Bob’s l-th bit value is different from the

l-th bit sent by Alice. The partition P divides the N

bits into n INFO bits, n

TEST-Z bits, and n

TEST-X

bits. The corresponding substrings of the error string

c are c

(the string of errors on the INFO bits), c

(the

string of errors on the TEST-Z bits), and c

(the string

of errors on the TEST-X bits). The random variables

that correspond to c

, c

, and c

are denoted by C

, and C

, respectively.

We deﬁne

to be the random variable corre-

sponding to the string of errors on the INFO bits if

Alice had encoded and sent the INFO bits in the x ba-

sis (instead of the z basis dictated by the protocol). In

those notations, inequality (4) reads as

tr|

−

| ≤ 2



| ≥

r,1

| P



= 2



| ≥

r,1

| c

, c

, P



, (5)

using the fact that Eve’s attack is collective, so the

qubits are attacked independently, and, therefore, the

errors on the INFO bits are independent of the errors

on the TEST-Z and TEST-X bits (namely, of c

and

As described in BGM09, inequality (5) was not

derived for the actual attack U = U

⊗. . . ⊗U

ap-

plied by Eve, but for a virtual ﬂat attack (that depends

Security Against Collective Attacks of a Modiﬁed BB84 QKD Protocol with Information only in One Basis

on b and therefore could not have been applied by

Eve). That ﬂat attack gives the same states

and

as the original attack U, and gives a lower (or the

same) error rate in the conjugate basis. Therefore, in-

equality (5) also holds for the original attack U. This

means that, from now on, all our results apply to the

original attack U and not the ﬂat attack.

So far, we have discussed a 1-bit key. We will now

discuss a general m-bit key k. We deﬁne

to be the

state of Eve corresponding to the ﬁnal key k, given

that she knows ξ:

n−r−m

∑



= ξ

= k

(6)

Proposition 1. For any two m-bit keys k, k

tr|

−

≤ 2m



| ≥

r,m

| c

, c

, P



. (7)

Proof. We deﬁne the key k

, for 0 ≤ j ≤m, to consist

of the ﬁrst j bits of k

and the last m− j bits of k. This

means that k

= k, k

= k

, and k

j−1

differs from k

at most on a single bit (the j-th bit).

First, we ﬁnd a bound on

tr|

j−1

−

|: since

j−1

differs from k

at most on a single bit (the j-th

bit, given by the formula x·v

r+ j

), we can use the same

proof that gave us inequality (5), attaching the other

(identical) key bits to ξ of the original proof; and we

ﬁnd that:

tr|

j−1

−

≤ 2



| ≥

| c

, c

, P



(8)

where we deﬁne d

as d

r+ j

), and V

Span{v

, v

, . . . , v

r+ j−1

, v

r+ j+1

, . . . , v

r+m

Now we notice that d

is the Hamming distance

between v

r+ j

and some vector in V

, which means that

= |

∑

r+m

i=1

| with a

∈F

and a

r+ j

6= 0. The prop-

erties of Hamming distance assure us that d

is at least

) for some r ≤ r

< r + m. Therefore, we

ﬁnd that d

r,m

= min

r≤r

<r+m

) ≤ d

The result d

r,m

≤ d

implies that if |

| ≥

then

| ≥

r,m

. Therefore, inequality (8) implies

tr|

j−1

−

≤ 2



| ≥

r,m

| c

, c

, P



. (9)

Now we use the triangle inequality for norms to ﬁnd

tr|

−

tr|

−

| ≤

∑

j=1

tr|

j−1

−

≤ 2m



| ≥

r,m

| c

, c

, P



. (10)

The value we want to bound is the expected value

of difference between two states of Eve correspond-

ing to two ﬁnal keys. However, we should take into

account that if the test fails, no ﬁnal key is generated,

and the difference between all of Eve’s states becomes

0 for any purpose. We thus deﬁne the random variable

∆

a,z

a,x

)

Eve

(k, k

) for any two ﬁnal keys k, k

∆

a,z

a,x

)

Eve

(k, k

|P, ξ, c

, c

)







tr|

−

| if

≤ p

a,z

and

≤ p

a,x

0 otherwise

(11)

We need to bound the expected value

h∆

a,z

a,x

)

Eve

(k, k

)i, that is given by:

h∆

a,z

a,x

)

Eve

(k, k

)i =

∑

P,ξ ,c

∆

a,z

a,x

)

Eve

(k, k

|P, ξ, c

, c

)

·p(P , ξ , c

, c

) (12)

Theorem 2.

h∆

a,z

a,x

)

Eve

(k, k

)i ≤ 2m

h

≥

r,m



∧



≤ p

a,z



∧



≤ p

a,x

i

(13)

where

is the random variable corresponding to

the error rate on the INFO bits if they had been en-

coded in the x basis,

is the random variable cor-

responding to the error rate on the TEST-Z bits, and

is the random variable corresponding to the er-

ror rate on the TEST-X bits.

Proof. We use the convexity of x

, namely, the fact

that for all {p

}

satisfying p

≥ 0 and

∑

= 1, it

holds that (

∑

)

≤

∑

. We ﬁnd that:

h∆

a,z

a,x

)

Eve

(k, k

COMPLEXIS 2017 - 2nd International Conference on Complexity, Future Information Systems and Risk

∑

P,ξ ,c

∆

a,z

a,x

)

Eve

(k, k

|P, ξ, c

, c

)

·p(P , ξ , c

, c

)

(by (12))

≤

∑

P,ξ ,c



∆

a,z

a,x

)

Eve

(k, k

|P, ξ, c

, c

)



·p(P , ξ , c

, c

) (by convexity of x

)

∑

P,ξ ,

≤p

a,z

≤p

a,x



tr|

−



·p(P , ξ , c

, c

) (by (11))

≤4m

∑

P,ξ ,

≤p

a,z

≤p

a,x

| ≥

r,m

| c

, c

, P

·p(P , ξ , c

, c

) (by (7))

=4m

∑

≤p

a,z

≤p

a,x

| ≥

r,m

| c

, c

, P

·p(P , c

, c

)

=4m

∑

h

| ≥

r,m



∧



≤ p

a,z



∧



≤ p

a,x



| P

·p(P )

=4m

·P

h

| ≥

r,m



∧



≤ p

a,z



∧



≤ p

a,x

i

3.3 Proof of Security

Following BGM09 and BBBMR06, we choose matri-

ces P

and P

such that the inequality

r,m

> p

a,x

+ε is

satisﬁed for some ε (we will explain in Subsection 3.5

why this is possible). This means that

h

≥

r,m



∧



≤ p

a,z



∧



≤ p

a,x

i

≤ P

h

> p

a,x

+ ε



∧



≤ p

a,x

i

. (14)

We will now prove the right-hand-side of (14) to be

exponentially small in n.

As said earlier, the random variable

corre-

sponds to the bit string of errors on the INFO bits if

they had been encoded in the x basis. The TEST-X

bits are also encoded in the x basis, and the random

variable C

corresponds to the bit string of errors on

those bits. Therefore, we can treat the selection of

the n INFO bits and of the n

TEST-X bits as a ran-

dom sampling (after the numbers n, n

, and n

and the

TEST-Z bits have all already been chosen), and use

Hoeffding’s theorem (that is described in Appendix A

of BGM09).

Therefore, for each bit string c

. . . c

n+n

that con-

sists of the errors in the n + n

INFO and TEST-X

bits if the INFO bits had been encoded in the x ba-

sis, we apply Hoeffding’s theorem: namely, we take

a sample of size n without replacement from the pop-

ulation c

, . . . , c

n+n

(this corresponds to the random

selection of the INFO bits and the TEST-X bits, as de-

ﬁned above, given that the TEST-Z bits have already

been chosen). Let X =

be the average of the sam-

ple (this is exactly the error rate on the INFO bits, as-

suming, again, the INFO bits had been encoded in the

x basis); and let µ =

|+|C

n+n

be the expectancy of

X (this is exactly the error rate on the INFO bits and

TEST-X bits together). Then

≤ p

a,x

is equiva-

lent to (n + n

)µ −nX ≤ n

· p

a,x

, and, therefore, to

n ·(X −µ) ≥ n

·(µ − p

a,x

). This means that the con-

ditions



> p

a,x

+ ε



and



≤ p

a,x



rewrite



X −µ > ε + p

a,x

−µ



∧



·(X −µ) ≥ µ − p

a,x



, (15)

which implies



1 +



(X −µ) > ε, which is equiv-

alent to X −µ >

n+n

ε. Using Hoeffding’s theorem

(from Appendix A of BGM09), we get:

> p

a,x

+ ε

∧



≤ p

a,x



≤ P



X −µ >

n + n



≤ e

−2



n+n



nε

(16)

In the above discussion, we have actually proved

the following Theorem:

Theorem 3. Let us be given δ > 0, R > 0, and, for in-

ﬁnitely many values of n, a family {v

, . . . , v

} of

linearly independent vectors in F

such that δ <

and

≤ R. Then for any p

a,z

, p

a,x

> 0 and ε

sec

> 0

such that p

a,x

+ε

sec

≤

, and for any n, n

, n

> 0 and

two m

-bit ﬁnal keys k, k

, Eve’s difference between

her states corresponding to k and k

satisﬁes the fol-

lowing bound:

h∆

a,z

a,x

)

Eve

(k, k

)i ≤ 2R ne

−



n+n



nε

sec

(17)

In Subsection 3.5 we explain why this Theorem

guarantees security.

We note that the quantity h∆

a,z

a,x

)

Eve

(k, k

bounds the expected values of the Shannon Dis-

tinguishability and of the mutual information be-

tween Eve and the ﬁnal key, as done in BGM09

Security Against Collective Attacks of a Modiﬁed BB84 QKD Protocol with Information only in One Basis

and BBBMR06, which is sufﬁcient for proving non-

composable security; but it also avoids composabil-

ity problems: Eve is not required to measure immedi-

ately after the protocol ends, but she is allowed to wait

until she gets more information; and equation (17)

bounds the trace distance between any two of Eve’s

possible states.

3.4 Reliability

Security itself is not sufﬁcient; we also need the key

to be reliable (namely, to be the same for Alice and

Bob). This means that we should make sure that

the number of errors on the INFO bits is less than

the maximal number of errors that can be corrected

by the error-correcting code. We demand that our

error-correcting code can correct n(p

a,z

+ ε

rel

) errors.

Therefore, reliability of the ﬁnal key with exponen-

tially small probability of failure is guaranteed by the

following inequality: (as said, C

corresponds to the

actual bit string of errors on the INFO bits in the pro-

tocol, when they are encoded in the z basis)



> p

a,z

+ ε

rel



∧



≤ p

a,z



≤ e

−2



n+n



nε

rel

This inequality is proved by an argument similar to

the one used in Subsection 3.3: the selection of the

INFO bits and TEST-Z bits is a random partition of

n + n

bits into two subsets of sizes n and n

, respec-

tively (assuming that the TEST-X bits have already

been chosen), and thus it corresponds to Hoeffding’s

sampling.

3.5 Security, Reliability, and Error

Rate Threshold

According to Theorem 3 and to the discussion in Sub-

section 3.4, to get both security and reliability we

only need vectors {v

, . . . , v

} satisfying both the

conditions of the Theorem (distance

≥

a,x

+ ε

sec

) and the reliability condition (the ability

to correct n(p

a,z

+ ε

rel

) errors). Such families were

proven to exist in Appendix E of BBBMR06, giving

the bit-rate:

secret

= 1 −H

(2p

a,x

+ 2ε

sec

)

− H



a,z

+ ε

rel



(18)

where H

(x) , −x log

(x) −(1 −x)log

(1 −x).

Figure 1: The secure asymptotic error rates zone (below

the curve).

Note that we use here the error thresholds p

a,x

for

security and p

a,z

for reliability. This is possible, be-

cause in BBBMR06 those conditions (security and re-

liability) on the codes are discussed separately.

To get the asymptotic error rate thresholds, we re-

quire R

secret

> 0, and we get the condition:

(2p

a,x

+ 2ε

sec

) + H



a,z

+ ε

rel



< 1 (19)

The secure asymptotic error rate thresholds zone

is shown in Figure 1 (it is below the curve), assum-

ing that

is negligible. Note the trade-off between

the error rates p

a,z

and p

a,x

. Also note that in the

case p

a,z

= p

a,x

, we get the same threshold as BB84

(BBBMR06 and BGM09), which is 7.56%.

4 CONCLUSION

In this paper, we have analyzed the security of the

BB84-INFO-z protocol against any collective attack.

We have discovered that the results of BB84 hold

very similarly for BB84-INFO-z, with only two ex-

ceptions:

1. The error rates must be separately checked to be

below the thresholds p

a,z

and p

a,x

for the TEST-Z

and TEST-X bits, respectively, while in BB84 the

error rate threshold p

applies to all the TEST bits

together.

2. The exponents of Eve’s information (security) and

of the failure probability of the error-correcting

code (reliability) are different than in BGM09, be-

cause different numbers of test bits are now al-

lowed (n

and n

are arbitrary). This implies that

the exponents may decrease more slowly (or more

quickly) as a function of n. However, if we choose

= n

= n (thus sending N = 3n qubits from Al-

ice to Bob), then we get exactly the same expo-

nents as in BGM09.

COMPLEXIS 2017 - 2nd International Conference on Complexity, Future Information Systems and Risk

The asymptotic error rate thresholds found in this

paper are more ﬂexible than in BB84, because they

allow us to tolerate a higher threshold for a speciﬁc

basis (say, the x basis) if we demand a lower thresh-

old for the other basis (z). If we choose the same er-

ror rate threshold for both bases, then the asymptotic

bound is 7.56%, exactly the bound found for BB84 in

BBBMR06 and BGM09.

We conclude that even if we change the BB84 pro-

tocol to have INFO bits only in the z basis, this does

not harm its security and reliability (at least against

collective attacks). This does not even change the

asymptotic error rate threshold, and allows more ﬂex-

ibility when choosing the thresholds for both bases.

The only drawbacks of this change are the need to

check the error rate for the two bases separately, and

the need to either send more qubits (3n qubits in total,

rather than 2n) or get a slower exponential decrease

of the exponents required for security and reliability.

We thus ﬁnd that the feature of BB84, that both

bases are used for information, is not very impor-

tant for security and reliability, and that BB84-INFO-

z (that lacks this feature) is almost as useful as BB84.

This may have important implications on the security

and reliability of other protocols that also only use one

basis for information qubits, as done in some two-way

protocols.

We also present a better approach for the proof,

that uses a quantum distance between two states

rather than the classical information. In BGM09,

BBBGM02, and BBBMR06, the classical mutual in-

formation between Eve’s information (after an opti-

mal measurement) and the ﬁnal key was calculated

(by using the trace distance between two quantum

states); although we should note that in BGM09 and

BBBMR06, the trace distance was used for the proof

of security of a single bit of the ﬁnal key even when all

other bits are given to Eve, and only the last stages of

the proof discussed bounding the classical mutual in-

formation. In the current paper, on the other hand, we

use the trace distance between the two quantum states

until the end of the proof, which avoids composability

problems that existed in the previous works.

Therefore, this proof makes a step towards making

BGM09, BBBGM02, and BBBMR06 prove compos-

able security of BB84 (namely, security even if Eve

keeps her quantum states until she gets more infor-

mation when Alice and Bob use the key, rather than

measuring them in the end of the protocol). This ap-

proach also applies (similarly) to the BB84 security

proof in BGM09.

ACKNOWLEDGEMENTS

The work of TM and RL was partly supported by the

Israeli MOD Research and Technology Unit.

REFERENCES

Bennett, C. H. and Brassard, G. (1984). Quantum cryptog-

raphy: Public key distribution and coin tossing. In In-

ternational Conference on Computers, Systems & Sig-

nal Processing, IEEE, 1984, pages 175–179.

Biham, E., Boyer, M., Boykin, O. P., Mor, T., and Roy-

chowdhury, V. (2006). A proof of the security of quan-

tum key distribution. J. Cryptol., 19(4):381–439.

Biham, E., Boyer, M., Brassard, G., van de Graaf, J.,

and Mor, T. (2002). Security of quantum key dis-

tribution against all collective attacks. Algorithmica,

34(4):372–388.

Biham, E. and Mor, T. (1997a). Bounds on information

and the security of quantum cryptography. Phys. Rev.

Lett., 79:4034–4037.

Biham, E. and Mor, T. (1997b). Security of quantum cryp-

tography against collective attacks. Phys. Rev. Lett.,

78:2256–2259.

Boyer, M., Gelles, R., and Mor, T. (2009). Security of

the bennett-brassard quantum key distribution proto-

col against collective attacks. Algorithms, 2(2):790–

807.

Christandl, M., K

onig, R., and Renner, R. (2009). Posts-

election technique for quantum channels with appli-

cations to quantum cryptography. Phys. Rev. Lett.,

102:020504.

Mayers, D. (2001). Unconditional security in quantum

cryptography. J. ACM, 48(3):351–406.

Nielsen, M. A. and Chuang, I. L. (2010). Quantum compu-

tation and quantum information. Cambridge univer-

sity press.

Renner, R. (2008). Security of quantum key distribution.

Int. J. Quantum Inf., 6(01):1–127.

Renner, R., Gisin, N., and Kraus, B. (2005). Information-

theoretic security proof for quantum-key-distribution

protocols. Phys. Rev. A, 72:012332.

Shor, P. W. and Preskill, J. (2000). Simple proof of security

of the bb84 quantum key distribution protocol. Phys.

Rev. Lett., 85:441–444.

Security Against Collective Attacks of a Modiﬁed BB84 QKD Protocol with Information only in One Basis