IEEE - Aerospace and Electronic Systems - March 2021 - 35

Amer et al.
the same basis is not observed to be in the original, prepared state) is too high (called a QKD protocol's noise tolerance) depends on the QCS of the protocol and is a key
statistic required in any security proof of a QKD protocol.
As an example, for BB84 without additional advanced
classical postprocessing, the theoretical noise tolerance is
11%[21] (with additional classical postprocessing such as
classical advantage distillation, this tolerance can be
increased to over 20%[22]-[24]). Note that we cannot distinguish between natural noise and noise induced by an
adversary. Thus, any talk of " noise " in a QKD protocol
must, necessarily, assume the worst case that the noise is
completely adversarial. Natural noise, therefore, is considered also noise induced by a potential adversary.
If the noise is not over the limit, then an error correction protocol, such as Cascade [25] or LDPC [26], is run,
again using the authenticated classical channel. This
allows B to " fix " the errors in his raw key. After this,
except with negligible probability, A and B now have a
correlated raw key-a string of classical bits. This error
correction protocol, however, leaks extra information to E
(this extra information is added on top of whatever information she already potentially has on the raw key based
on her attack performed during the actual QCS (i.e., her
probing of the quantum communication channel while it
was in use).
Finally, a privacy amplification protocol is run which
takes as input the error corrected raw-key and outputs a
(potentially much smaller) secret key which may then be
used for other cryptographic purposes. The security property of privacy amplification (and, thus, a QKD protocol)
guarantees that, except with negligible probability, the
secret key that is output is indistinguishable from a uniformly generated random key independent of any adversary; furthermore, this adversary has no computational
assumptions placed on it [27]. Privacy amplification is generally implemented using two-universal hash functions,
taking the error-corrected raw key, and hashing it down to
a smaller, secret key [28]. The size of the final secret key
depends on how much information E has on the raw-key.
Unlike classical communication, with quantum communication, one may bound E's maximal information based
only on observed noise. The noisier the channel, the more
information E potentially has on the raw key (before privacy amplification). Due to this increased information, privacy amplification is forced to shrink the raw key further
thus leading to a smaller final secret key.
The authenticated channel generally uses an information theoretic secure (i.e., " perfectly secure " ) message
authentication code (MAC) requiring a pre-shared secret
key. How this initial key is installed in the system
depends on the application-for instance, it can be hardcoded in the initial point-to-point link. Note that, to
retain perfect security, classical key distribution cannot
be used to establish this initial key. For any such MAC,
MARCH 2021

Figure 1.
Overview of a QKD protocol. On step (1), users begin with a
small preshared secret key k0 . They then perform the QCS of the
protocol which is the only part that actually uses quantum resources. They then sift this data and conduct parameter estimation
leading to the generation of a raw-key, as well as a bound on the
amount of information an adversary could have on the key. They
then run error correction followed by privacy amplification
(which involves choosing a random two-universal hash function
fðÁÞ and sending it to B) resulting in a new secret key k1 which
consists of the unused portion of k0 (some of k0 will be used for
the authenticated classical channel) denoted k00 combined with
the newly generated secret key after privacy amplification,
denoted as fðrkA Þ.

whenever a message is authenticated, some amount of
the key used for the creation of the MAC tag is depleted,
and so with a fixed amount of key information there is a
limited number of messages that can be sent. Note, however, that unlike information theoretically secure encryption (e.g., OTP), the size of the key for authentication
can be much smaller than the message being authenticated (roughly the log of the message size) [16]. Thus,
following the successful completion of a QKD protocol,
a suitably sized portion of the resulting secret key (after
privacy amplification) may be used to " refill " this
authentication key material, leaving additional bits left
over to be used for any other cryptographic task the user
wishes. That is, QKD will produce a new shared secret
key that is significantly longer than the key required to
authenticate messages and so a portion of it may be used
to replace the old, used, shared authenticated key (needed
to repeat QKD) while having new key material left over
for the user's application. See Figure 1 for a general outline of the operation of a QKD protocol.

EFFICIENCY AND NOISE TOLERANCE
Two important characteristics of any QKD protocol is its
efficiency and its noise tolerance. QKD protocols operate
in blocks of size N (typically N ¼ 104 up to N ¼ 109 ).
After a block has been sent through the QCS, it is processed in bulk through sampling, error correction, and privacy amplification leading to a new secret key which is
added to the key pool. However, as the noise increases, the
secret key produced shrinks in size, decreasing efficiency
(as one must still produce a block of size N before

IEEE A&E SYSTEMS MAGAZINE

IEEE - Aerospace and Electronic Systems - March 2021

Table of Contents for the Digital Edition of IEEE - Aerospace and Electronic Systems - March 2021