{'fraction_non_alphanumeric': 0.047191970958787105, 'fraction_numerical': 0.013452914798206279, 'mean_word_length': 4.213748956303924, 'pattern_counts': {'":': 0, '<': 2, '<?xml version=': 0, '>': 8, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Security analysis of quantum key distribution with small block length and its application to quantum space communications

The security of real-world quantum key distribution (QKD) critically depends on the number of data points the system can collect in a fixed time interval. To date, state-of-the-art finite-key security analyses require block lengths in the order of 1E4 bits to obtain positive secret keys. This requirement, however, can be very difficult to achieve in practice, especially in the case of entanglement-based satellite QKD systems, where the overall channel loss can go up to 70 dB or more. Here, we provide an improved finite-key security analysis which can reduce the block length requirement by 14% to 17% for standard channel and protocol settings. In practical terms, this reduction could save entanglement-based satellite QKD weeks of measurement time and resources, thereby bringing space-based QKD technology closer to reality. As an application, we use the improved analysis to show that the recently reported Micius QKD satellite is capable of generating positive secret keys with a $1E-5$ security level.

Introduction.-Quantum key distribution (QKD) is arguably the most mature quantum technology today with full-stack systems already being deployed in real-world networks [1][2][3][4]. In the research community, the security of real-world QKD systems remains a central programme and much effort have been devoted to understanding the security of side-channels and systems with finite resources. Of particular importance is the nonasymptotic security of QKD-a theoretical programme that analyzes the security of finite-length keys and the security errors of parameter estimation, error correction, and privacy amplification [5].
In fact, the need for finite-key security was recognized long ago [6][7][8], but it is only in the recent decade that security proof techniques became more accessible. On this note, we refer to those based on entropic uncertainty relations [9], which are known to be pretty efficient in terms of the block length [10,11]. Here, block length is defined as the size of the sifted measurement data before parameter estimation; i.e., m = n + k, where n is the raw key length and k is the number of bits used for parameter estimation. Previously, one would typically need m > 10 5 to get a positive secret key [8]. Now, using the proof techniques based on entropic uncertainty relations, the block length requirement can be reduced to m > 10 4 , which gives an order of magnitude of saving [10,11].
For QKD systems deployed in standard optical networks, one can readily obtain their finite-key security since the measurement data size of these systems is typically large enough [4]. However, for QKD systems deployed in challenging environments such as space [12][13][14][15], obtaining their finite-key security can be an issue. In particular, owning to high channel loss and environmental challenges, these systems might not gather enough measurement data in short-time intervals. To overcome this issue, one can either spend more time to gather data (the simplest solution) or upgrade the QKD system's transmitter and receiver to achieve faster data collection rates. These solutions are straightforward for terrestrial-based QKD systems, but the same cannot be said for spacebased QKD systems. More specifically, the latter can only communicate with the ground stations over very precise time windows (essentially only over good passes) and upgrading in space may not be realistic with current technology [16]. These limitations hence suggest that spacebased QKD is a major scientific challenge. This is especially the case for entanglement-based satellite QKD (EB S-QKD), which is known to be slower than its prepareand-measure counterpart but offers the attractive possibility of untrusted node operation.
Very recently, it has been reported that the finite-key security of EB S-QKD has been demonstrated for the first time using an improved Micius QKD satellite [15]. There, the authors reported a positive key with a security parameter of 10 −10 based on the security proof technique of Ref [10]. However, the analysis there did not consider the cost of parameter estimation and hence the random sampling bound was not properly applied. As a result, this led to overly-optimistic secret key rates. Using their experimental data (m ∼ 10 3 ) and the methods from Refs. [10,11], we found that one would actually require a larger security parameter of 10 −5 in order to generate a positive key (see below).
In view of the above, it is thus timely to develop new proof techniques that would further sharpen the finitekey security of QKD systems with small block lengths, particularly those with block lengths m ∼ 10 3 to 10 4 . To that end, we present here an improved finite-key analysis which can further reduce the block length requirement by 14% to 17%. While the improvement is not dramatic (in the sense by several orders of magnitude), it could already save EB S-QKD many weeks of data collection and resources. Our main theoretical contribution is a new random sampling bound (without replacement), which improves pretty significantly the statistical accuracy of the parameter estimation procedure in the small block length regime. The inequality is presented in Lemma 2 and may be of independent interest to other problems. Using this refined analysis, we show that the improved Micius QKD system [15] is capable of generating positive keys with 10 −6 security; with the same level of security, no positive keys were found (numerically) with the analysis from Ref. [11].
Entanglement-based QKD.-In order to formally present our results, let us first introduce the BBM92 QKD protocol [17] in consideration. We assume that the QKD users, Alice and Bob, are given a 2m-partite quantum state ρ AB , which is derived from a larger (2m + 1)partite quantum system ABE. Here, the quantum system E is controlled by an adversary, Eve, who is computationally unbounded. We consider a protocol in which the basis choice is uniform and the raw key is randomly sampled from both bases [11]. This protocol is essentially the same as the BBM92 QKD protocol analyzed by Shor and Preskill [18] except that less than half of the sifted data will be used for parameter estimation (via random sampling): n bits for the raw key and k = m − n bits for parameter estimation. Importantly, in sampling from both bases, the errors will be uniformly distributed (and hence symmetrized) between the raw key pair and the random sample used for parameter estimation. This allows us to view the parameter estimation step as a standard random sampling problem, where the goal is to infer the error rate of the raw key pair using the error rate observed in the random sample (drawn without replacement).
The protocol is characterized by the block length, m, and three key distillation subroutines, i.e., parameter estimation, error correction, and privacy amplification, which we denote by pe, ec, and pa, respectively. The parameter estimation subroutine is parameterized by two numbers: pe = {k, δ}, where k ≤ m is some positive integer and δ ∈ (0, 1/2) is the tolerated error rate. The error correction and privacy amplification subroutines are parameterized by two positive integers and one positive integer, respectively: ec = {t, r} and pa = { }. The QKD protocol is described in Protocol. I (with only the details needed to illustrate the main technical results; for a more rigorous description, see Ref. [11]).
Security analysis.-Following standard QKD security definition [19,20], a QKD protocol is said to be ε qkdsecure if it is ε 1 -correct and ε 2 -secret, where 0 < ε 1 +ε 2 ≤ Settings: m, pe = {k, δ}, ec = {t, r} and pa = { } 1. Measurement. Alice and Bob agree on a random binary string Φ ∈ {0, 1} m over an authenticated public channel and measure their respective quantum signals using this string. They then agree on a random sample (drawn without replacement) of size k from the entire measurement data set and store them into two pairs of strings: (X, V ) for Alice and (Y, W ) for Bob. Here, X and Y are random strings taking values in {0, 1} n ; thus V and W take values in {0, 1} k . Note that m = n + k.
2. Parameter estimation using random sampling. Alice publicly sends V to Bob, who then computes the error rate between V and W , i.e., Zpe := |V ⊕ W |/k. If the error rate exceeds the tolerated error rate δ, they abort the protocol. Otherwise, they proceed to the next step. This decision is stored in a binary-valued flag Fpe ∈ { , ∅}, where means successful and ∅ means abort.
3. Error correction. Alice sends Bob a syndrome T of length r which is computed from her raw key X. Then Bob generates an estimate of Alice's raw key, X , from Y and T . To verify that the correction is successful, Alice computes a hash H(X) (of length t) of X and sends it to Bob, who then compares it with his hash H(X ). If the hash values are different (i.e., H(X) = H(X )), they abort the protocol; this decision is stored in Fec ∈ { , ∅}.
4. Privacy Amplification. Alice and Bob perform randomness extraction based on two-universal hashing to extract an identical secret key pair, SA and SB, each of length , from X and X , respectively.
Protocol I. BBM92 QKD with random sampling as adapted from Ref. [11]. ε qkd . The security parameter of the protocol is thus ε qkd . The correctness criterion captures the maximum probability that Alice's and Bob's output keys are different, and the secrecy criterion looks at how distinguishable Alice's output key is from the ideal output key (i.e., one that is uniformly distributed and independent of Eve's side-information E and all classical messages sent over the public channel). Importantly, this choice of security definition guarantees that the protocol is universally composable [19][20][21]: the pair of secret keys can be safely used in any cryptographic task, e.g., for encrypting messages, that requires a perfectly secret key.
With the definitions and relevant tools in place we are now ready to analyze the finite-key security of Protocol. I. The question which we would like to address here is the following: What is the maximum value of , the output secret key length, for a desired choice of security parameter ε qkd and protocol settings? To answer this question, we first have to identify the mathematical conditions for which the protocol is ε qkd -secure. These conditions (for the considered BBM92 QKD protocol) are given in Ref. [11,Theorem 2 and Theorem 3], which we restate in a concise form below: Theorem 1 (Adapted from Ref. [11]). For the QKD protocol described above with fixed settings, it is ε qkd -secure if there exists ν ∈ (0, 1/2 − δ] satisfying where the error functions due to privacy amplification and parameter estimation are defined as , , the binary entropy function. To illustrate the physical meaning (and importance) of ν, we first recall the parameter estimation step. There, Alice and Bob have to check if Z pe := |V ⊕ W |/k ≤ δ. If it is true, they proceed to the next step; otherwise they abort the protocol. The whole point of this exercise is to ensure that Z key := |X ⊕ Y |/n is very close to δ with very high probability. More formally, what we want is an exponential tail bound on the following event: Z pe ≤ δ ∩ Z key ≥ δ + ν. This describes the bad event that the parameter estimation step is successful (i.e., F pe = ) and that the error rate of the raw key pair exceeds δ by some constant positive term ν. In Refs. [10,11], it has been shown that the probability of this event, P pe := Pr Z pe ≤ δ ∩ Z key ≥ δ + ν , is upper bounded by which is based on Serfling's seminal work in probability inequalities for random sampling without replacement [22, Corollary 1.1]. As one can see from the above, the deviation term ν plays an important role in maximizing : a smaller deviation term ν means a larger secret key. However, ν cannot be arbitrarily small-this would make ε pe (ν) very large (which in turn is constrained by the security parameter, ε qkd ). Evidently, there is a delicate interplay between these error functions and it would pay off very well here if we can further sharpen Eq. (2). In the following, we present a new random sampling probability bound for parameter estimation, which may be of independent interest to other problems as well.
Lemma 2 (New sampling bound). Let Z key and Z pe be defined as above. Then for any ν > ξ > 0 such that m(δ + ξ) ∈ Z + , where ν := ν − ξ and Proof. To start with, let Z blk = m i=1 Z i be the total number of errors in the initial block of length m and Z blk = Z blk /m be the average error. Note that in QKD this information about the total error is not known to the users; we are modeling it here only for technical reasons. With this, we can write Pr Z pe ≤ δ ∩ Z key ≥ δ + ν as a sum of Pr Z pe ≤ δ ∩ Z key ≥ δ + ν ∩ Z blk ≥ Z pe + ξ and Pr Z pe ≤ δ ∩ Z key ≥ δ + ν ∩ Z blk < Z pe + ξ for some ξ > 0. The first term can be upper bounded using where the second inequality is implied from Ref [ as the latter event is implied from the former event, and where m err := m(δ + ξ) . Generally, we may assume m err = m(δ + ξ), i.e., δ + ξ is chosen such that m(δ + ξ) is a positive integer.
The above can be further written as Pr An upper bound can be obtained by noting that merr t=0 Pr[Z blk = t] Pr[Z key ≥ δ + ν|Z blk = t] ≤ Pr Z key ≥ δ + ν|Z blk = m err . Notice that the last term is given by the upper tail probability of the hypergeometric distribution given the total number of errors Z blk = m err is fixed, i.e., Pr[Z key ≥ δ + ν|Z blk = m err ] = Pr[Z key ≥ m err /m + (ν − ξ)|Z blk = m err ]. In the ideal case, the exact value of the upper tail probability can be computed (since the total number of errors is tightly bounded now), but this may introduce numerical inaccuracies due to the discrete nature of the distribution [23,24]. To that end, we use instead a probability inequality by Hush and Scovel [25], which provides pretty tight exponential bounds for hypergeometric distribution (at least in the settings for which we are interested in). This inequality reads where α merr := max 1 n + 1 Note that it is important for ν > ξ since the deviation term must be positive. We can in fact further simplify the bound by picking the right-side-hand term in α merr , i.e., exp (−2α merr (n 2 (ν − ξ) 2 − 1)) ≤ exp (−2Γ merr (n 2 (ν − ξ) 2 − 1)), where Γ merr := 1/(m err + 1) + 1/(m − m err + 1). It can be verified that Γ merr decreases with increasing m err and hence where ν := ν − ξ is a positive constant. Using Lemma. 2, the error function for parameter estimation now reads To maximize the secret key length, , we employ the following program parameterized by a bounded set of four-dimensional real vector, x = (α, β, ν, ξ). The block length m, tolerated error rate δ, correctness error 2 −t = 10 −(s+2) , and security parameter ε qkd = 10 −s are fixed.
where k = βm is the number of bits allocated to parameter estimation and r = 1.19h 2 (δ) is the expected error correction leakage. Here, α is the secret key rate, which is defined as the number of secret bits generated divided by the block length, i.e., /m. For comparison, we also run the same optimization for Theorem. 1, which uses Eq. (2) for parameter estimation. From Figure 1, we observe that the new analysis outperforms the existing analysis for both security levels, s = 6, 10: in particular, the minimum block length m has been reduced by about 14% to 17%. However, this improvement is not enough to obtain finite-key security for ε qkd = 10 −10 as reported by Ref. [15]; for that, we would need m > 4800 (for the new analysis) and m > 5800 (for the one based on Eq. (2)). We note that one can still obtain finite-key security using Eq. (2); however the smallest security error that we can find for a positive key is ε qkd = 10 −5 . Discussion and conclusion.-In this application study, we find that the improved Micius Satellite (arguably the most advanced QKD technology in space) would have to revise their security parameter from ε qkd = 10 −10 to 10 −6 . This means that the overall security error is four orders of magnitude bigger than reported. This revision immediately raises the following question: Is ε qkd = 10 −6 good enough for the space-based QKD? Unfortunately, the answer to this question is not trivial and may entail discussions beyond the scope of this work. For the start, we emphasize that the security statement ε qkd ≤ 10 −6 does not lend any concrete description to how the QKD system could have gone wrong. It is simply an upper bound on the probability that a bad event happens [20]; note that a QKD system which produces non-identical secret keys with probability 10 −6 has the same security as one that gives the entire secret key to Eve with probability 10 −6 . We note that one could also use the adversary's guessing probability as a metric to help determine a good value of ε qkd , e.g., see Ref. [26].
Nevertheless, we argue that one can at least refer to key streaming for some guidance. In this setting, we consider the use of a QKD system to generate a continuous stream of secret bits, where some portion of the earlier bits are used for authentication in subsequent rounds [19]. By composability, the security of the key stream is then ε stream ≤ vε qkd , where v is the number of times the users intend to operate the QKD system. With this, we now have a clear connection to how many times the users can operate the QKD system before it needs to be rebooted with a fresh secret key. To appreciate this connection, suppose ε stream has to respect some recommended security level, say 10 −5 , which is specified by some national standards organization. Then, it is clear that for some fixed ε qkd (determined by the system parameters), the number of times one can operate the QKD system, v, is limited. Applying this example to the improved Micius QKD satellite, we thus have v ≤ 10, i.e., not more than 10 rounds of QKD operation. This suggests that the improved Micius QKD satellite may have to be rebooted (with a fresh secret key for authentication) after every 10 QKD cycles, or equivalently, the generation of 60 secret bits.
In conclusion, we have presented an improved finitekey analysis for BBM92 QKD protocol with small block length. While the refined analysis gives pretty good improvements over existing methods, the problem of finitekey security with small block length is still a pressing one. This problem, as we have highlighted above, is especially relevant to long-range QKD systems such as satellitebased QKD, which will most likely form the backbone of the future quantum internet.