For $\mathbf{A}\in\mathbb{F}^{n\times m}$, suppose its singular values are $\sigma_1,\ldots,\sigma_{\min(n,m)}$.

Then, the Schatten $p$-norm of $\mathbf{A}$, where $p\in[1,\infty]$, is defined as [Ber09, Proposition 9.2.3]:

$\|\mathbf{A}\|_{\sigma p} \triangleq \begin{cases} \left[\sum_{i=1}^{\min(n,m)}\sigma_i^p(\mathbf{A}) \right]^{1/p}, & 1\leq p\lt\infty,\\ \sigma_\max(\mathbf{A}), & p = \infty.\end{cases}$

When $p=1$, we have the Schatten 1-norm, which is also called the trace norm or nuclear norm [Ber09, p. 549]:

$\text{tr}\langle\mathbf{A}\rangle \triangleq \|\mathbf{A}\|_{\sigma1} = \sigma_1(\mathbf{A})+\cdots+\sigma_{\min(n,m)}(\mathbf{A}).$

When $p=2$, we have the Frobenius norm:

$\|\mathbf{A}\|_F \triangleq \left[\text{tr}(\mathbf{A}^\ast\mathbf{A})\right]^{1/2} = \|\mathbf{A}\|_{\sigma2}.$

When $p=\infty$, we have the spectral norm:

$\|\mathbf{A}\|_{\sigma\infty} = \sigma_\max(\mathbf{A}).$

The secret key rate is the fraction of secure key bits produced per protocol round, where a round is the transmission of a quantum state through the quantum channel [Gra21, p. 38].

The secret key rate generally depends on the total number of rounds $M$ performed.

The asymptotic secret key rate (often just asymptotic key rate) is the secret key rate when $M\to\infty$ is assumed to simplify analysis.

• Assuming direct reconciliation, the asymptotic key rate of any quantum key distribution (QKD) protocol with one-way error correction is lower-bounded by the Devetak-Winter rate [DW05]:

  $r_\text{DW} = I(A;B) - I(A;E),$

  where $I$ denotes quantum mutual information, $A$, $B$ and $E$ are the random variables representing Alice’s, Bob’s and Eve’s raw key bits.

• An intuitive interpretation of the Devetak-Winter rate: the fraction of secret bits generated per round of using the protocol is equal to the amount of information shared by Alice and Bob, $I(A; B)$, minus the amount of information that Eve has on Alice’s part of the key, $I(A;E)$ [Wol21, p.145].

Assuming $M\to\infty$ is not realistic, and the security of a QKD protocol has to be analysed assuming a finite $M$ and generally finite resources.

Analysis of the secret key rate and associated security properties of a QKD protocol is called finite-key analysis [TLGR12], to be covered in the future.

Methods for analysing the security of quantum key distribution (QKD) schemes/protocols are still being developed [PAB+20, PR22].

• These methods combine existing cryptographic notions and techniques with quantum information theory.
• Depending on the implementation of the QKD scheme, physical laws governing the implementation (e.g., quantum-optical laws) also play a role.
• Compared to computational security, which can be reduced to complexity-theoretic reasoning based on the Turing machine, methods for analysing the security of QKD schemes are thus more involved and, in terms of the transdisciplinary effort required, more challenging.

The security of a QKD scheme is typically analysed in terms of the level of success of 1️⃣ individual attacks, 2️⃣ collective attacks and 3️⃣ coherent attacks; in 🔼 increasing order of power given to the adversary [Wol21, Sec. 5.3.1].

• Individual and collective attacks are usually considered in order to simplify the security analysis, but it is necessary to also consider coherent attacks in order to prove the security of a QKD scheme.
• We can analyse the different types of attacks by the way 😈 Eve interacts with 👩 Alice’s signals and how Eve processes the information she gets in this way.

• General procedure for extracting information from a quantum system:

  1. 😈 Eve attaches an ancilla system in the predefined state $|E\rangle_E\langle E|$ to the quantum state $\rho_A$ transmitted by 👩 Alice; $|E\rangle_E\langle E|$ and $\rho_A$ are density-matrix representations of quantum states.

     Please spend time understanding pure state, mixed state and density matrix.

  2. 😈 Eve then performs a unitary operation $\mathbf{U}$ on the composite system, which leaves the state of the ancilla system in the form:

     $\rho_E = \text{tr}_A\left(\mathbf{U}^\dagger \rho_A\otimes|E\rangle_E\langle E| \mathbf{U}\right),$

     where $\otimes$ is the Kronecker operator and $\text{tr}_A$ denotes partial trace.

     Please spend time understanding reduced density matrix and partial trace.

The security of a QKD scheme is also often analysed in terms of composability, short for universally composable security.

• Informally, we say a QKD scheme is composable if the key it produces is almost as good as if it were distributed with an ideal key distribution protocol [Van06, Sec. 12.2.6].
• A cryptographic primitive, which is secure when used with an ideally secret key, must still be secure if used with a QKD-distributed key.
• Composability is critical since QKD-derived secret keys are used in other applications, e.g., data encryption [JCM+22].

TODO: Trace distance criterion [PR22], security = correctness + secrecy [Gra21]. Asymptotic vs finite-key security analysis.

Security evaluation of practical QKD implementations involves evaluating the level of success of “quantum hacking” (i.e., side-channel attacks on QKD).

The joint state, $\rho_{AB}$, of two quantum systems $A$ and $B$ is separable [WN17, Definition 2.1.1] if there exists a probability distribution $\{p_i\}$, and sets of density matrices $\{\rho_i^A\}_i$ and $\{\rho_i^B\}_i$ such that

If such an expression for $\rho_{AB}$ does not exist, $\rho_{AB}$ is entangled [WN17, Definition 2.1.1].

Specifically, if $\rho_{AB}=|\psi\rangle\langle\psi|_{AB}$ is a pure state, then $|\psi\rangle_{AB}$ is separable if and only there exists $|\psi\rangle_A$ and $|\psi\rangle_B$ such that

$|\psi\rangle_{AB} = |\psi\rangle_A\otimes|\psi\rangle_B.$

Singular values, like eigenvalues, are an intrinsic property of a matrix. Unsurprisingly, they can be defined in terms of eigenvalues:

Singular values can also be defined through the operation called singular value decomposition:

Spectral theorem is one of the fundamental theorems of linear algebra [ABH09, Sec. 3.6].

Based on the spectral theorem, spectral decomposition is an essential tool in quantum theory [NC10, Box 2.2].

Multiple equivalent interpretations of the spectral theorem exist, e.g., [ABH09, Theorems 3.6.4 and 3.6.12].

The interpretation in Theorem 1 directly defines spectral decomposition, and is hence also called the spectral decomposition theorem.

Any normal operator, $\mathbf{M}$, has an outer product representation [KLM07, Sec. 2.4; Mey00, p. 517]:

$\mathbf{M} = \sum_i\lambda_i|i\rangle\langle i|,$

where

• $(\lambda_i, |i\rangle)$ are the eigenpairs of $\mathbf{M}$;
• $|i\rangle$ form an orthormal basis of the Hilbert space in which $\mathbf{M}$ is defined.

The outer products $\mathbf{P}_i \triangleq |i\rangle\langle i|$ are projectors that satisfy

• the completeness relation: $\sum_i\mathbf{P}_i = \mathbf{I}$; and
• the orthonormality relation: $\mathbf{P}_i\mathbf{P}_j = \delta_{ij}\mathbf{P}_i$, where $\delta_{ij}$ is the Kronecker delta.