Beyond Key Distribution

6.1 Encrypting a quantum message

A one-time pad hides a value by randomizing it. Quantum states carry two kinds of information—bit and phase—so a quantum pad must randomize both. This section proves that the resulting average erases everything, including correlations with a system the sender does not control.

6.1.1 Average over Pauli keys

Randomizing a value is not enough for a qubit, which has two degrees of freedom. Choose independent uniform bits \(a,b\) and apply \(X^aZ^b\). Averaging the resulting density matrices over the four equally likely choices gives \(I/2\) for every input state, so the ciphertext tells an eavesdropper nothing about the plaintext. A receiver who knows \((a,b)\) applies the inverse Pauli and recovers the state exactly, since any overall sign is unobservable.

The cost is two classical key bits per qubit in this construction. That is also known to be optimal for exactly encrypting an unknown qubit, which is why quantum encryption is expensive compared with the classical pad it generalizes.

Two limits belong with the claim. First, the channel hides the input but does not detect tampering: an attacker can still alter the encrypted state, and Section 6.1.3 shows exactly what happens when she does. Second, the strong statement is not about the ciphertext's marginal state but about its correlations. A message entangled with a reference must be hidden together with its correlations, and the averaged channel delivers that stronger property too.

6.1.2 Prove the Pauli average for an arbitrary qubit

Any qubit density operator can be written

where the real Bloch vector \((r_x,r_y,r_z)\) has length at most one. Conjugation by a Pauli either preserves or flips each component, and the four choices of \(X^aZ^b\) flip them in a pattern that averages to zero:

Summing the four rows cancels every component, leaving

The proof works for every Bloch vector, including mixed states, because nothing in it used \(|\mathbf r|=1\). More generally the channel acts on any operator \(A\) as

which is a complete depolarization: the output carries no information about the input operator at all. That is stronger than saying the output state is fixed, and it is what makes the next step work.

Expand a joint state on message \(Q\) and reference \(R\) in matrix units on \(Q\) and apply the identity term by term. Every term with a non-identity matrix unit is annihilated, and only the identity survives:

This is the statement a quantum encryption proof actually needs. The ciphertext is not merely uniform; it is uncorrelated with everything the sender kept. An adversary holding the reference learns nothing about the plaintext, and the receiver's inverse Pauli restores the original joint state exactly.

6.1.3 Show why encryption does not authenticate a quantum state

Suppose an attacker applies \(X\) to the encrypted qubit. After the receiver decrypts with the secret Pauli \(P\), the effective operation on the plaintext is

Paulis either commute or anticommute, so \(P^{\dagger}XP=\pm X\) for every possible key: the sign is a global phase and vanishes from the density matrix. The attacker has therefore enacted a logical \(X\) on the plaintext without knowing the key, and the receiver cannot tell that anything happened.

So the output remains hidden but may be wrong. Hiding and integrity are different requirements, and a pad that satisfies the first supplies none of the second.

A quantum authentication scheme adds a test whose acceptance and rejection behaviour is covered by a stronger security definition. It must protect a state the sender may not even know, including its entanglement with a reference; that rules out simply measuring the message to see whether it "looks right", since a measurement would destroy exactly the correlations the definition is about. Encryption and authentication use the same kinds of key material but answer different questions.

The distinction reappears in quantum key distribution. Eve can damage signals, and the protocol's response must be either to reject or to produce a key meeting its definition. No-cloning is genuinely useful in quantum cryptography, but it does not create a universal authentication mechanism: the object that needs an argument is the full encode, transmit, decode, and verify process.

6.2 Commitment and its limitations

Commitment is the cryptographic task of choosing now and revealing later. It is the natural test case for what quantum information can and cannot do, because it asks for two properties that pull in opposite directions.

6.2.1 Specify the cheating parties

Bit commitment asks Alice to commit to a bit now and open it later. Hiding means Bob cannot learn the bit before the opening; binding means Alice cannot change it afterwards. Each property protects a different honest party, which is why an argument that establishes one says nothing about the other.

In the standard non-relativistic two-party quantum model without extra restrictions, unconditional security for both properties is impossible. A simple illustration uses two ensembles: the equally weighted Z states and the equally weighted X states. Both give Bob \(I/2\), so the scheme is hiding as an average preparation. But Alice can keep half of \(|\Phi^+\rangle\) and postpone her basis measurement, obtaining a compatible opening in either basis.

That example exhibits a cheating strategy; it is not the general impossibility proof. And the no-go statement must not be exported to every model. Extra resources or restrictions—bounded quantum storage, computational assumptions, trusted hardware, relativistic signalling constraints—change the analysis, and each requires its own argument.

6.2.2 Construct a coherent cheating strategy

Consider a concrete proposal. To commit to 0, Alice sends a uniformly random Z eigenstate; to commit to 1, she sends a uniformly random X eigenstate. At opening she announces the basis and the bit, and Bob measures in that basis and checks agreement. Honest openings always pass, and both commitment ensembles average to \(I/2\), so the scheme appears perfectly hiding.

A cheating Alice does not send a random state at all. She prepares \(|\Phi^+\rangle\), sends Bob one half, and keeps the other without measuring it. At the opening she chooses which commitment to reveal:

• measuring her half in Z leaves Bob holding a matching Z state, so she can open 0;
• measuring her half in X leaves Bob holding a matching X state, so she can open 1.

In both cases Bob's conditional state matches the label she announces, and the check passes. Because she chooses between the two openings only after the commitment stage, the scheme is not binding.

No superluminal signal is involved. Bob's unconditioned state is \(I/2\) throughout, and he learns something only when Alice speaks—at which point the announcement itself determines what he can check. The attack uses coherent postponement, not any physical change in Bob's marginal state, which is why it survives every test Bob can perform on his own half.

6.2.3 Explain the mechanism behind the general obstruction

In the perfectly hiding case, Bob's reduced density operators for the two commitments are equal. Write two purifications of that shared state in a Schmidt basis aligned with Bob's system:

The coefficients \(\lambda_j\) are the same in both rows because the reduced state on Bob is the same. Only the vectors \(|a_j^{(b)}\rangle\) in Alice's private space differ, and any two orthonormal families of the same size are related by a unitary. So a unitary \(U\) on Alice's space satisfies

converting one purification into the other while leaving Bob's side untouched.

This is the mathematical reason hiding gives Alice room to change her opening. Approximate hiding requires a quantitative closeness argument—if the two states are only nearly equal, the unitary only nearly works—and interactive protocols require careful treatment of transcripts and coherent strategies. Mayers' impossibility result supplies that broader analysis within its model.

The theorem constrains unconditional two-party commitment with unrestricted coherent adversaries in the standard setting. It does not say that QKD is impossible: the honest parties' goals and the adversary's position are different, which is why one no-go result says nothing about the other task. Nor does it settle commitment under storage bounds, computational assumptions, trusted hardware, or relativistic arrangements; each of those models needs its own analysis.

Other quantum primitives—randomness generation, secret sharing, signatures, delegated computation—pose different security questions: who may collude, whether messages are classical or quantum, what must stay private, and whether verification is transferable. Before importing a QKD intuition, write the new ideal functionality and check which properties it demands. The final project asks for exactly that kind of disciplined comparison.

6.3 Protocol audit and final project

The last section is an exercise in accounting. Anyone can simulate a protocol; the skill this course aims to teach is knowing what a simulation did and did not establish, and being able to say so precisely.

6.3.1 Make a reviewable security argument

A reviewable claim has three kinds of support, and mixing them is the most common failure in student projects. Every statement in a dossier should be traceable to a calculation you performed, an assumption you stated, or a theorem you cited with its hypotheses.

Concretely: specify an ideal BB84 teaching implementation by defining its sources, bases, bit mapping, random choices, public messages, sample selection, reconciliation, verification, extractor seed, authentication resource, and abort rules. Reproduce the intercept–resend error calculation and the asymptotic entropy curve, labelling both as model calculations. Then write a separate finite-block ledger that starts from an explicitly assumed entropy bound, and identify the theorem you would need to replace that assumption with an experimental claim.

The comparison with post-quantum cryptography belongs in the same ledger, because the two approaches are often ranked by name rather than by resource.

A strong submission makes every claim traceable to one of the three categories and never lets a successful simulation stand in for a theorem.

6.3.2 Run a reproducible experiment and diagnose its limits

The downloadable BB84 laboratory uses only the Python standard library. It simulates ideal detections, uniform basis choices, random-basis intercept–resend on a chosen fraction of rounds, sifting, and public testing. A fixed seed makes a run reproducible; the pseudorandom generator is a teaching tool, not a source of cryptographic randomness.

python3 education/cryptography/examples/bb84_lab.py --signals 20000 --attack 0 --seed 7
python3 education/cryptography/examples/bb84_lab.py --signals 20000 --attack 0.2 --seed 7
python3 education/cryptography/examples/bb84_lab.py --signals 20000 --attack 1 --seed 7
python3 education/cryptography/tools/check_examples.py

Predict before running: the expected sifted QBERs are zero, 0.05, and 0.25. Then compare the predictions with the reported sample estimates and ask how far each one moved, given the size of the test sample. Three diagnostic points are worth keeping in view.

First, the program also prints the hidden raw-block error rate. That number is available only because this is a simulation; a real Alice and Bob cannot inspect all their disagreements without publishing the data they disagree about. Second, the finite-population calculation bounds a classical error string. It is explicitly not a phase-error certificate, which is the dashed step of the audit chain. Third, the module exposes syndrome decoding, Toeplitz hashing, a decoy-yield bound, and a key-budget function so that the calculations of Chapters 2, 4, and 5 can be reproduced, but a deterministic transcript plus hashing is not a secure end-to-end implementation: there is no quantum entropy bound and no authenticated channel.

6.3.3 Submit a protocol dossier with explicit acceptance criteria

The project is a dossier with five sections and a fixed rubric, so that "it worked" is never the criterion.

1. Specification. Give a diagram and an ordered transcript. State the basis probabilities, bit mapping, source model, block size, sample rule, acceptance threshold, and initial authentication resource. Identify exactly which systems Eve may control.
2. Attack study. Reproduce the three attack settings above with at least five seeds each. Report counts and rates separately, and compare the spread with the size of the test sample. Explain why an attack simulation cannot prove security.
3. Reconciliation and extraction. Trace the seven-bit syndrome example, demonstrate a two-error miscorrection, and verify a Toeplitz collision count by exhaustive enumeration. State which entropy premise would be needed to use the hash as an extractor.
4. Finite-block analysis. Reproduce the exact \(N=20\) sampling example and the 6080-bit budget. Name the missing protocol-specific theorem connecting your observations to the entropy input, with its attack and device assumptions.
5. Extension. Choose decoy-state estimation, MDI correlations, a CHSH visibility sweep, or the commitment attack. Derive one result and reproduce it numerically. Explain one assumption whose failure invalidates it.

Assessment rubric. Allocate 25% to a complete and consistent protocol specification, 25% to correct derivations and reproducible results, 25% to entropy, leakage, and error accounting, and 25% to the assumption audit and interpretation. A project that labels simulated agreement as a proof of secrecy has not met the central learning objective, however many trials succeeded.

For a reading extension, choose one linked primary paper and identify a theorem in it, its hypotheses, and the corresponding objects in your dossier. Distinguish a theorem you implemented from one you merely cited. That mapping—from a classroom model to a stated theorem and back—is the bridge to research-level cryptographic analysis.