Bob's global decoding strategy can thus be represented by a two-outcome projective measurement {$M_y$$^{\theta\sigma}_{y=0,1}$ with

$$M_y^{\theta\sigma} = \sum_{\theta,\sigma} (P_{\sigma}U_{\theta})^{\dagger} \left( \sum_{r=1}^{d/2} |i_{y,r}\rangle\langle i_{y,r}| \right) (P_{\sigma}U_{\theta})^{\dagger} \quad (5.3)$$

## 1-MUB-QCT Key Establishment Protocol (Single copy case)

### Protocol 1 1-MUB-QCT Key Establishment

**Setting:** : Single-copy encoding over a $d$-dimensional Hilbert space $A$, noisy and lossless quantum channel, $n$ channel use.

1. **Data generation:** Alice chooses $(x^n, \theta^n, \sigma^n, r^n)$, uniformly at random in {$0, 1\}^n \times [d + 1]^n \times [|P| \times [d/2]^n$

2. **Timelock:** Alice and Bob exchange timelocked information $(\theta^n, \sigma^n)$ using short-term secure encryption scheme (Enc, Dec).

3. **Quantum communication:** For $(k = 1; k \le n; k + +)$

* Encode and send $x$ over a qudit: Alice sends a single copy of the qudit state $|\psi_{x_k, r_k}^{\theta, \sigma}\rangle$ to Bob over the quantum channel.

* Receive qudit and decode $y$: Upon reception of the qudit state at the quantum channel output and knowing $(\theta_k, \sigma_k)$ Bob performs the measurement {$M_y$$^{\theta_k \sigma_k}$ and obtains outcome $y_k$.

4. **Classical post-processing:**

* Parameter estimation: Based on a random sampling of $(x^n, y^n)$ Alice and Bob estimate the bit error rate $p_e$. If $p_e$ is below some set threshold $\epsilon_{th}$, they abort.

* Finally Alice and Bob run an error correction algorithm followed by privacy amplification (PA) to obtain the final keys ($S_A; S_B$), of length $\ell$.

**Remark:** the generalization to the case of a lossy quantum channel could be addressed relatively simply, by adding a sifting phase.

## Security analysis

**Eavesdropping model** We consider the worst-case scenario where Eve has full access to the channel input, as depicted on Figure 5.2. This is similar to the strong locking scenario as considered in [GHK$^{+14}$]).
Hence from Eve's viewpoint, that does not know $r$, nor $S = (\theta, \sigma)$, the quantum state at channel input can be described by a density matrix $\rho_x$ with

$$ \rho_x = \frac{1}{|\theta||\sigma|} \sum_{\theta\sigma} P_{\sigma}U_{\theta} \left( \frac{2}{d} \sum_{r=1}^{d/2} |i_{x,r}\rangle\langle i_{x,r}| \right) (P_{\sigma}U_{\theta})^{\dagger} \quad (5.4) $$

**Optimal attack strategy** Due to the QCT security model, Eve strategy is restricted to two alternatives:

I. Eve stores the input quantum state $\rho_x$ in her quantum storage and later performs a measurement at time $t_{comp}$ given the information $(\theta, \sigma)$ that will then be revealed to her, and she obtains $z \in \{0, 1\}$.

II. Eve performs an immediate measurement on input state $\rho_x$ and obtains a classical outcome $\omega$. At time $t_{comp}$, she performs post-measurement classical decoding using $(\theta, \sigma)$ and $\omega$ to obtain $z \in \{0, 1\}$.

**Proposition 1 (Strategy II is optimal)** If Eve follows the strategy I, her success probability to guess the bit $x$ correctly can be upper bounded given the decoherence model described in Equation (5.1), as $P_{\text{guess}}^{I}(X|E) \le \frac{1}{2} + o(\frac{1}{d})$. If Eve follows strategy II, one simple strategy is to perform a measurement in a random MUB, followed by post-measurement decoding. This achieves success probability at least $\frac{1}{2} + \Omega(\frac{1}{d})$. We can prove a matching upper bound, indicating that this is essentially the optimal strategy, by considering the measurement in a fixed basis (Eve has no preferable measurement basis since the full set of MUBs forms 2-design). Based on the work of Berta et. al., on Quantum to Classical Randomness Extractors [BFW13] we can establish that such generic strategy II, reduces to applying a strong QC-extractor to $\rho_x$. Taking the parameters of the 1-MUB-QCT protocol into account, this proves that $P_{\text{guess}}^{II}(X|Z) \le \frac{1}{2} + \Omega(\frac{1}{d})$ and consequently that the optimal eavesdropping strategy is II.

**Performance Analysis** Since the MUB-QCT protocol defines an effective wire-tap scenario, the key rate in the asymptotic limit for the MUB-QCT protocol, can be derived using following Csiszár and Körner formula [CK78]:

$$ \begin{aligned} R &\ge I(X;Y) - I(X;Z) \ge H_{\min}(X|Z) - H(X|Y) \\ &\ge -\log_2 \left(\frac{1}{2} + \frac{1}{d}\right) - h_2(p_e) \end{aligned} \quad (5.5) $$

This allows to make several observations, regarding the properties of 1-MUB-QCT protocol

* **High noise tolerance for large $d$**: Similarly to high-dimensional QKD [CBKG02], 1-MUB-QCT protocol allows high resilience to noise by offering tolerable error rate of up to 50% for large $d$
*   **Fixed resource requirements:** The 1-MUB-QCT protocol can be implemented with only two detectors, irrespectively of $d$. This relaxes resource requirements compared to HD-QKD schemes, requiring $d$-single-photon detectors [DBD$^{+}$17].

*   **MDI security:** In the MUB-QCT protocol, the upper bound on Eve information can be achieved by only considering the input state and not Bob measurement's results. Consequently, the implementation of Bob's measurement device is not required to be trusted to guarantee security, as displayed on Figure 5.3.

<figure><img src="image_24.png" /><figcaption>Figure 5.3: MUB-QCT trust requirements compared with those of standard QKD, MDI-QKD and DI-QKD. MUB-QCT enjoys some MDI-type security features. This characteristic can have an important practical impact by allowing to relax key engineering constraints.</figcaption></figure>

## m-MUB-QCT with multiple quantum state copies

The 1-MUB-QCT protocol considered the quantum communication of a single qudit state $P_{\sigma}U_{\theta}|i_{x,r}\rangle$ from Alice to Bob. In such case we have shown that Eve's information vanishes as $O(1/d)$. This in principle leaves the room to operate secure key establishment, a higher number of copies, i.e. $m$ copies of $P_{\sigma}U_{\theta}|i_{x,r}\rangle$ per channel use: this is the $m$-MUB-QCT protocol.

Interestingly the $m$-MUB-QCT protocol could open the way to higher key rates and long-distance operation, while keeping implementation simple and using with coherent states with mean photon numbers $\sim m$.
Security analysis of *m*-MUB-QCT against restricted attacks

The proof for 1-MUB-QCT is valid against general attacks, in the QCT security model,
thanks to the reduction of Eve optimal strategy to observing the output of a strong ran-
domness extractor. In the multiple copy case, this proof strategy however does not carry
over. In particular, the randomization of a full set of MUBs defines a 2-design that is not
sufficient to randomize multiple copies, for *m* > 1.

We can however perform security analysis against restricted attacks, by considering
two relaxations:

*   *Individual attacks.* This corresponds to discard the possibility of correlated attacks over different channel use. We conjecture that individual attacks are likely to be the best strategy if the security of the ephemeral encryption is valid throughout the full session (during the *n* consecutive channel uses).

*   *Non-adaptative attacks.* This corresponds to assuming that Eve cannot update her attack strategy adaptively, over the *m* copies.

Under these restrictions, we can show that the optimal strategy corresponds to *Proactive MUB measurement*: in which Eve proactively measures each of the *m* copies in a different MUB and performs post-measurement decoding when learning *θ* and *σ*. Using the fact that the set of permutation operations commutes with MUB basis change, we can reduce to the simpler case without permutation, where Eve measures each copy in a different MUB, and learns the correct it only if her measurement basis coincides with *θ*. As a result, Eve's information increases linearly with *m* as $I^{\text{Pro}}(X; Z)_m = O(\frac{m}{d})$. This implies Eve cannot guess *x* perfectly when significantly less than *d* copies of the state $|\psi_{x;r}^{\theta,\sigma}\rangle$ are sent by Alice.

Performance Analysis

The proactive MUB measurement strategy allows secure key distribution with input states containing up to $O(d)$ photons, implying a significant performance increase, characterized by a $O(d)$-multiplication of key rate as shown in Figure 5.4. Analyzing the plot in Figure 5.4, we observe three distinct regimes, *Constant rate regime*: short distance, where the secret key rate is constant and commensurate; *Single copy regime*: where the key rate is similar to the single copy case, scaling as the transmissivity *T*; *Cutoff regime*: long distances, where detector dark count rates dominate, sharply limiting the secret key rate.

The possibility of sending multiple copies of the quantum state per channel use can
moreover be leveraged to perform *multiparty key distribution* between one Alice and
multiple Bobs

5.2.4 QCT: Challenges and Future work

The Quantum Computational Timelock framework constitute a promising route towards
real-world quantum cryptography (RWQC) with extended performance and functionali-
ties. In particular, our newly proposed MUB-QCT protocol enables everlasting security
<figure><img src="image_25.png" /><figcaption>Figure 5.4: Key rate per channel use as a function of distance, for *m*-MUB-QCT protocol against proactive MUB measurement strategy. The key rate at a given distance is maximized over the photon number *m*. The parameters assumed in the plots are: Loss 0.2dB/Km; $P_{dark} = 10^{-6}$; efficiency of detectors $\eta = 25\%$; visibility $V = 98\%$. Since MUB-QCT can be implemented with 2 detection modes (2-single photon detectors) we also plot 2-modes PLOB bound [PLOB17] as a benchmark.</figcaption></figure>

key establishment with reduced trust requirements at reception side, and with rates and reach significantly outperforming those of QKD. These theoretical results need to be consolidated but also experimentally tested and validated so that the relevance of the QCT approach for RWQC can be assessed.

This leads to interesting new challenges for quantum cryptography in hybrid quantum computational security models. On the theory side, a central challenge, that we have started to investigate, consists in proving the security of *m*-MUB-QCT against general attacks. We conjecture that secure key rate can be obtained with up to $m \sim O(\sqrt{d})$ against general attacks, guaranteeing significant performance improvement in practically achievable multimode regime, even though lower than in the restricted analysis presented on Figure 5.4. Another fascinating challenge, that we also intend to tackle, is related to the design of repeater schemes in the QCT security model.

Building MUB-QCT demonstrators will require to prepare, modulate and detect high-dimensional quantum encodings. Finding efficient and robust implementation schemes and performing experimental demonstrations will hence be very important in order to establish the practicality of the QCT approach. Multiple quantum systems demonstrated so far in the context of high-dimensional QKD constitute interesting reference points indicating the in-principle feasibility of MUB-QCT: they include temporal-spectral [NWS+13, AKBH07], orbital angular momentum (OAM) [SBF+17, MMLO+15] as well as spatial mode [DBD+17] encodings. In terms of dimensionality, existing time or spectral
encoding HD-QKD techniques indicate the possibility to operate with *d* as large as 10³
but also to envisage even much larger alphabet with existing or near-term technologies by
leveraging the specificities of the QCT framework.

**5.3 Towards real-world quantum cryptography**

**5.3.1 A holistic and engineering-driven approach**

The divergence between cryptography considered either through the computer sci-
ence lens or from the standpoint of real-world applications, is somehow already well-
acknowledged in modern cryptography and exemplified by the existence of different
IACR conferences such as Crypto [Cry] or Real-World Crypto (RWC) [RWC], with
distinct scope and positioning and yet tight links. We posit that such a distinction is now
becoming increasingly relevant in the context of practical quantum cryptography, and that
it is timely to consider the birth of an additional scientific and engineering community in
order to develop Real-World Quantum Crypto (RWQC).

This leads to the question of the objectives that RWQC should pursue. In particular,
if absolute security is not its horizon, can we define an alternative project, allowing to
demonstrate a clear security advantage over classical crypto, and yet better suited to prac-
tical contexts than abstract quantum cryptography? We answer positively to this question.
In particular, we believe that it is possible to address some if the core challenges of QKD,
at the application frontier, by trading the quest of absolute security for practical security
gains. In this perspective, RWQC emerges as a holistic approach characterized by a shift of
priorities towards objectives that integrate a dialectic dimension, balancing the ambition
to design cryptographic systems beyond classical reach with engineering constraints and
cost-benefit analysis. With the ambition of providing a cryptographic advantage in the
real-world; RWQC can be articulated around two main guiding principles, at logical and
physical levels.

**Enable security gain for real-world use cases**

Considering well-defined security models, the objective is to propose end-to-end security services relying on quantum cryptographic protocols that can provide a clear security gain with respect to classical cryptography.

The notion of end-to-end security is very important, and yet often overlooked. It indeed conditions the logical rationale of the choice of cryptographic primitives and their combination. An emblematic question is related to the use QKD as a key renewal technique for AES encryption. As we have seen in section 4.2, QKD enables some security gain, over classical cryptography alone, in terms of post-compromise security. However, the implicit use of AES encryption for secure communications implies that we consider a security model where AES is long-term secure. This also implies that the overall security gain that can be achieved by combining QKD key renewal with AES encryption is marginal
with respect to what can be achieved purely classical solutions based on symmetric cryp-
tography, as argued in [ANS20].

We however want to point out that there exist use-cases where the use of QKD can present strict security gain over classical cryptography (in that case PQC) alone. Such use-cases have in common the fact that QKD is used to securely transport (with OTP encryption) some *scarce and strategic high-security data only*, such as long-term secrets (health data, governmental secrets) or some high-level cryptographic keys.

* An emblematic example is the use of QKD for long-term-secure storage, based on proactive secret sharing, as initially proposed by J. Buchmann and his team [BBD+17], and recently demonstrated in Japan as well as in the OpenQKD project, to secure the storage of long-lived data such as medical records. We however note that QKD performance (key rates) is not yet sufficient to envisage long-term secure storage for large datasets [MGA+20].

* A promising direction consists in combining QKD and PQC in order to obtain clear gains from the combination, as in the recently proposed Muckle protocol [Exc20] where a hybrid key exchange protocol is specified and studied, that presents high reliability with respect to the failure of any of its (PQC and QKD) cryptographic components, but also a performance gain with respect to using PQC alone.

* Another interesting direction is to use QKD in the context of information-theoretic private information retrieval, where the challenge is to guarantee the privacy for data retrieved from shared database [KL21].

* Finally, another promising framework to demonstrate in practice a quantum cryptographic advantage consists in considering the combination of quantum cryptography with quantum sensing, for example in the context of secure time transfer [DSW+20].

**Engineer secure and cost-effective quantum hardware** Adopting security by design methodologies, the objective will be to build quantum cryptographic systems with a controlled engineering complexity - and therefore controlled cost - for which high security assurance levels can be reached.

The fact that quantum processes can be a source of cryptographic advantage in practice is in a sense obvious, for fundamental reasons related to the unique ability to describe security schemes occurring at the physical layer with the quantum formalism. It can indeed not only provide a complete description of the hardware, but also quantify how information can be exchanged, including bounds on information leakage. What however also represents an unsettled debate, and certainly a frontier for research on cryptographic hardware is to understand how can we transition from formal statements on information-theoretic security, to the engineering of systems with verifiable security properties, notably in terms of information leakage?
These challenges are at the heart of the current international effort towards the defi-
nition of standardized methods for security evaluation and certification of QKD [ISO20],
[ETS21], as well as QRNG [QRa], to which we actively participate in parallel with the
wider reflexion on the vulnerability analysis methodology and on the interplay between
theoretical and practical security developed in [KMQA21] and on the central role that en-
gineering complexity should be given. On a more fundamental level, these questions also
strongly resonate with device-independent and semi device-independent cryptography.
We note that the use of short-term secure computational assumption opens a promising
direction to make DI-QKD more practical. [MDCAF20]

**5.3.2 Renewed perspectives**

**Involvement of new stakeholders** Structured around engineering-driven objectives, RWQC will require the commitment of new stakeholders, in particular engineers and scientists from the real-world cryptography (RWC) and the cryptographic hardware and embedded systems (CHES) communities. We are convinced that the combination of these expertises with the ones of practical quantum cryptographers and quantum information theoreticians will allow to make decisive progress both a foundational and technological levels.

**Provable security for cyber-physical systems** In resonance with the current work on QKD and QRNG implementation security, but also Physical Unclonable Functions (PUFs), the interplay between quantum technologies and cyber-physical system security appear to us as a fascinating and largely unexplored field of research.

Quantum cryptographic techniques make in principle possible some very strong forms
of security by design, built around some physical and logical reduction to clear-cut pro-
cesses such as the quantum measurement of an elementary quantum system, or device-
independent characterization of measured correlations. In this perspective, security mod-
els and the interplay between logical and physical trust assumptions will play a central
role, as outlined in 5.2.1 and 5.2.2.

**Slow Information** I would like to conclude this chapter and this manuscript, by promot-
ing an alternative way to look at quantum cryptography and its applications, through the
concept and the metaphor of “Slow Information”. This concept is inspired by the “Slow
Food” movement [Pet13], founded in 1989 that promotes local, sustainable and quality
foods, with the ambition to be simultaneously protected from and included into the global
food system. This movement has grown into a global scale over the years [slo], around the
central idea that slowness is a key ingredient to differentiate from the food industry and
its deficiencies, and to coexist with it.

If we accept the relevance of drawing a parallelism between Food and Data, we can
then argue that the Slow Food principles provide interesting perspectives for our digital
and data-driven society, and envisage that quantum cryptography could play a decisive
role in building a “Slow information” islands around a few principles that we can sketch:

* Similarly to the focus on “slowness” in a era of fast-food and fast-paced industrialization of food production, the shift towards “Slow Information” and quantum cryptography would (and could) only target a small fraction of the classical data exchanged over modern networks, and *only over restricted geographical areas*, due signal-to-noise as well as trust constraints.

* Slow Information operates over network infrastructures whose physical layer can be fully characterized using quantum information tools. It targets application use-cases where a quantum cryptographic advantage can be reached, which implies relatively small data sets, for which long-term security is needed. This also conversely imply that Slow Information islands should expect to be operated very differently from modern classical networks, in which the physical layer constraints can be essentially abstracted and virtualized.

* Slow Information and the role of quantum networks would however not come as a replacement or in opposition to classical secure networks. They would rely on quantum cryptography, combined with computational cryptography, to protect highly confidential information presenting long-term security needs, with security levels unachievable classically. Based in particular around long-term-secure storage, such quantum networks extend our ability to manage confidential data without resorting to complete physical isolation.

* Slow information shall be based on precise trust assumptions notably with regard to tamper-proof security perimeters and quantum cryptographic systems implementations, that will need to be certified. It shall also be based on well-defined security models and provable security. We are here again tempted to draw a parallelism with the Slow Food movement and its promotion of high-quality products that rely on a cultural heritage whose protection and certification is required, with labels such as protected designation of origin, PDO, or protected geographical indication, PGI.
Bibliography

[AA15] Ryan Amiri and Erika Andersson. Unconditionally secure quantum signatures. *Entropy*, 17(8):5635–5659, 2015.

[AA21] Raphaël Aymeric and Romain Alléaume. Covert continuous variable quantum key distribution. *In Preparation*, 2021.

[AAWJ20] Romain Alléaume, Raphaël Aymeric, Cédric Ware, and Yves Jaouën. Technology trends for mixed qkd/wdm transmission up to 80 km. In *2020 Optical Fiber Communications Conference and Exhibition (OFC)*, pages 1–3. IEEE, 2020.

[ABB$^{+14}$] Romain Alléaume, Cyril Branciard, Jan Bouda, Thierry Debuisschert, Mehrdad Dianati, Nicolas Gisin, Mark Godfrey, Philippe Grangier, Thomas Länger, Norbert Lütkenhaus, et al. Using quantum key distribution for cryptographic purposes: a survey. *Theoretical Computer Science*, 560:62–81, 2014.

[ABF$^{+16}$] Gorjan Alagic, Anne Broadbent, Bill Fefferman, Tommaso Gagliardoni, Christian Schaffner, and Michael St Jules. Computational security of quantum encryption. In *International Conference on Information Theoretic Security*, pages 47–71. Springer, 2016.

[AC12] Scott Aaronson and Paul Christiano. Quantum money from hidden subspaces. In *Proceedings of the forty-fourth annual ACM symposium on Theory of computing*, pages 41–60, 2012.

[ACF20] Gildas Avoine, Sébastien Canard, and Loïc Ferreira. Symmetric-key authenticated key exchange (sake) with perfect forward secrecy. In *Cryptographers? Track at the RSA Conference*, pages 199–224. Springer, 2020.

[ADM$^{+14}$] Romain Alléaume, Ivo P Degiovanni, Alan Mink, Thomas E Chapuran, Norbert Lütkenhaus, Momtchil Peev, Christopher J Chunnilall, Vincente Martin, Marco Lucamarini, Martin Ward, et al. Worldwide standardization activity for quantum key distribution. In *2014 IEEE Globecom Workshops*, pages 656–661. IEEE, 2014.
[AKBH07] Irfan Ali-Khan, Curtis J Broadbent, and John C Howell. Large-alphabet quantum key distribution using energy-time entangled bipartite states. *Physical review letters*, 98(6):060503, 2007.

[All15a] Romain Alléaume. Hybrid classical quantum cryptography, January 2015. European Patent 3043508.

[All15b] Romain Alléaume. A hybrid security model for quantum cryptography allowing to design practical schemes for long-distance key distribution with everlasting security. In *QCrypt 2015*, 2015.

[All15c] Romain Alléaume. Practical quantum cryptography with everlasting security, October 2015. European Patent 3043507.

[All16] Romain Alléaume. Communication with everlasting security from short-term-secure encrypted quantum communication, October 2016. International Patent WO2016110582A1.

[All17] Romain Alléaume. Can we accelerate quantum cryptography commercial take-off? In *Central European Workshop on Quantum Optics*, 2017.

[All19a] Romain Alléaume. Développement industriel de la cryptographie quantique: Défis et opportunités. In *French Photonic Days, Bordeaux: "La photonique, nouvelle ère du quantique"*, 2019.

[All19b] Romain Alléaume. Quantum key distribution (qkd); device and communication channel parameters for qkd deployment - group specification qkd 012. 2019.

[AM16] Romain Alléaume and Adrien Marie. Phase reference sharing schemes for continuous-variable quantum cryptography, May 2016. European Patent EP3244566.

[ANNVLF15] Ulrik L Andersen, Jonas S Neergaard-Nielsen, Peter Van Loock, and Akira Furusawa. Hybrid discrete-and continuous-variable quantum information. *Nature Physics*, 11(9):713-719, 2015.

[ANS20] ANSSI. Should quantum key distribution be used for secure communications?, 2020.

[ARDL09] Romain Alleaume, François Roueff, Eleni Diamanti, and N Lütkenhaus. Topological optimization of quantum key distribution networks. *New Journal of Physics*, 11(7):075002, 2009.

[ARML06] Romain Alléaume, François Roueff, Oliver Maurhart, and N Lütkenhaus. Architecture, security and topology of a global quantum key distribution network. In *2006 Digest of the LEOS Summer Topical Meetings*, pages 38-39. IEEE, 2006.
[ARS<sup>+</sup>04] Romain Alléaume, Jean-François Roch, Darius Subacius, Anton Zavriyev, and Alexei Trifonov. Fiber-optics quantum cryptography with single photons. In *AIP Conference Proceedings*, volume 734, pages 287-290. American Institute of Physics, 2004.

[ARW<sup>+</sup>07] Romain Alléaume, M Riguidel, H Weinfurter, N Gisin, P Grangier, M Diagnati, Mark Godfrey, G Ribordy, J Rarity, M Peev, et al. Secoqc white paper on quantum key distribution and cryptography. Technical report, 2007.

[ATCR04] Romain Alléaume, François Treussart, Jean-Michel Courty, and Jean-François Roch. Photon statistics characterization of a single-photon source. *New Journal of physics*, 6(1):85, 2004.

[ATM<sup>+</sup>04] R Alléaume, F Treussart, G Messin, Y Dumeige, J-F Roch, A Beveratos, R Brouri-Tualle, J-P Poizat, and P Grangier. Experimental open-air quantum key distribution with a single-photon source. *New Journal of physics*, 6(1):92, 2004.

[ATSVY00] Dorit Aharonov, Amnon Ta-Shma, Umesh V Vazirani, and Andrew C Yao. Quantum bit escrow. In *Proceedings of the thirty-second annual ACM symposium on Theory of computing*, pages 705-714, 2000.

[BAL11] Aurélien Bocquet, Romain Alléaume, and Anthony Leverrier. Optimal eavesdropping on quantum key distribution without quantum memory. *Journal of Physics A: Mathematical and Theoretical*, 45(2):025305, 2011.

[BB84] Charles H. Bennett and Gilles Brassard. Quantum cryptography: Public key distribution and coin tossing. In *Proceedings IEEE International Conference on Computers, Systems and Signal Proceedings*, number 0, pages 175-179, 1984.

[BB14] Charles H Bennett and Gilles Brassard. Quantum cryptography: public key distribution and coin tossing. *Theor. Comput. Sci.*, 560(12):7-11, 2014.

[BBB<sup>+</sup>06] Eli Biham, Michel Boyer, P Oscar Boykin, Tal Mor, and Vwani Roychowdhury. A proof of the security of quantum key distribution. *Journal of cryptology*, 19(4):381-439, 2006.

[BBCM95] Charles H Bennett, Gilles Brassard, Claude Crépeau, and Ueli M Maurer. Generalized privacy amplification. *IEEE Transactions on Information Theory*, 41(6):1915-1923, 1995.

[BBD<sup>+</sup>17] Johannes Braun, Johannes Buchmann, Denise Demirel, Matthias Geihs, Mikio Fujiwara, Shiho Moriai, Masahide Sasaki, and Atsushi Waseda. Lin-cos: A storage system providing long-term integrity, authenticity, and confidentiality. In *Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security*, pages 461-468, 2017.
[BBR$^{+}$18] Alberto Boaron, Gianluca Boso, Davide Rusca, Cédric Vulliez, Claire Autebert, Misael Caloz, Matthieu Perrenoud, Gaëtan Gras, Félix Bussières, Ming-Jun Li, et al. Secure quantum key distribution over 421 km of optical fiber. *Physical review letters*, 121(19):190502, 2018.

[Bea96] Donald Beaver. Correlated pseudorandomness and the complexity of private computations. In *Proceedings of the twenty-eighth annual ACM symposium on Theory of computing*, pages 479–488, 1996.

[Ber09] Daniel J Bernstein. Introduction to post-quantum cryptography. In *Post-quantum cryptography*, pages 1–14. Springer, 2009.

[Ber18] Daniel J Bernstein. Is the security of quantum cryptography guaranteed by the laws of physics? *arXiv preprint arXiv:1803.04520*, 2018.

[BFK09] Anne Broadbent, Joseph Fitzsimons, and Elham Kashefi. Universal blind quantum computation. In *2009 50th Annual IEEE Symposium on Foundations of Computer Science*, pages 517–526. IEEE, 2009.

[BFW13] Mario Berta, Omar Fawzi, and Stephanie Wehner. Quantum to classical randomness extractors. *IEEE Transactions on Information Theory*, 60(2):1168–1192, 2013.

[BG20] Colin Boyd and Kai Gellert. A modern view on forward security. *The Computer Journal*, 2020.

[Blu83] Manuel Blum. Coin flipping by telephone a protocol for solving impossible problems. *ACM SIGACT News*, 15(1):23–27, 1983.

[BNPS19] Xavier Bonnetain, María Naya-Plasencia, and André Schrottenloher. Quantum security analysis of aes. *IACR Transactions on Symmetric Cryptology*, 2019(2):55–93, 2019.

[BOHL$^{+}$05a] Michael Ben-Or, Michał Horodecki, Debbie W Leung, Dominic Mayers, and Jonathan Oppenheim. The universal composable security of quantum key distribution. In *Theory of Cryptography Conference*, pages 386–406. Springer, 2005.

[BOHL$^{+}$05b] Michael Ben-Or, MichaÇ Horodecki, Debbie W. Leung, Dominic Mayers, and Jonathan Oppenheim. The universal composable security of quantum key distribution. In Joe Kilian, editor, *Lecture Notes in Computer Science*, volume 3378, pages 386–406–. Springer Berlin Heidelberg, 2005.

[Bra16] Gilles Brassard. Cryptography in a quantum world. In *International Conference on Current Trends in Theory and Practice of Informatics*, pages 3–16. Springer, 2016.
[BRS07] Stephen D. Bartlett, Terry Rudolph, and Robert W. Spekkens. Reference frames, superselection rules, and quantum information. *Rev. Mod. Phys.*, 79:555–609, 2007.

[BS16] Anne Broadbent and Christian Schaffner. Quantum cryptography beyond quantum key distribution. *Designs, Codes and Cryptography*, 78(1):351–382, 2016.

[BZ13] Dan Boneh and Mark Zhandry. Secure signatures and chosen ciphertext security in a quantum computing world. In *Annual Cryptology Conference*, pages 361–379. Springer, 2013.

[CBKG02] Nicolas J Cerf, Mohamed Bourennane, Anders Karlsson, and Nicolas Gisin. Security of quantum key distribution using d-level systems. *Physical review letters*, 88(12):127902, 2002.

[CCD$^{+}$15] Matthew Campagna, Lidong Chen, Özgür Dagdelen, Jintai Ding, Jennifer K. Fernick, Nicolas Gisin, Donald Hayford, Thomas Jennewein, Norbert Lütkenhaus, Michele Mosca, Brian Neill, Mark Pecen, Ray Perlner, Grégoire Ribordy, John M. Schanck, Douglas Stebila, Nino Walenta, William Whyte, and Zhenfei Zhang. Quantum safe cryptography and security: An introduction, benefits, enablers and challengers. Technical report, ETSI (European Telecommunications Standards Institute), June 2015.

[CEM17] Common Methodology for Information Technology Security Evaluation, Version 3.1, Revision 5, 2017.

[CGCG16] Katriel Cohn-Gordon, Cas Cremers, and Luke Garratt. On post-compromise security. In *2016 IEEE 29th Computer Security Foundations Symposium (CSF)*, pages 164–178. IEEE, 2016.

[CK78] Imre Csiszár and Janos Korner. Broadcast channels with confidential messages. *IEEE transactions on information theory*, 24(3):339–348, 1978.

[CK09] André Chailloux and Iordanis Kerenidis. Optimal quantum strong coin flipping. In *2009 50th Annual IEEE Symposium on Foundations of Computer Science*, pages 527–533. IEEE, 2009.

[CK11] Roger Colbeck and Adrian Kent. Private randomness expansion with untrusted devices. *Journal of Physics A: Mathematical and Theoretical*, 44(9):095305, 2011.

[CM97] Christian Cachin and Ueli Maurer. Unconditional security against memory-bounded adversaries. In *Annual International Cryptology Conference*, pages 292–306. Springer, 1997.
[Cré87] Claude Crépeau. Equivalence between two flavours of oblivious transfers. In *Conference on the Theory and Application of Cryptographic Techniques*, pages 350–354. Springer, 1987.

[Cry] IACR Conference Crypto. https://crypto.iacr.org/2021/.

[CTP+09] TE Chapuran, P Toliver, NA Peters, J Jackel, MS Goodman, RJ Runser, SR McNown, N Dallmann, RJ Hughes, KP McCabe, et al. Optical networking for quantum key distribution and quantum communications. *New Journal of Physics*, 11(10):105001, 2009.

[CW79] J Lawrence Carter and Mark N Wegman. Universal classes of hash functions. *Journal of computer and system sciences*, 18(2):143–154, 1979.

[CZC+21] Yu-Ao Chen, Qiang Zhang, Teng-Yun Chen, Wen-Qi Cai, Sheng-Kai Liao, Jun Zhang, Kai Chen, Juan Yin, Ji-Gang Ren, Zhu Chen, et al. An integrated space-to-ground quantum communication network over 4,600 kilometres. *Nature*, pages 1–6, 2021.

[DA07] Mehrdad Dianati and Romain Alléaume. Architecture of the secoqc quantum key distribution network. In *2007 First International Conference on Quantum, Nano, and Micro Technologies (ICQNM'07)*, pages 13–13. IEEE, 2007.

[DAG+11a] Y Dumeige, R Alléaume, P Grangier, F Treussart, and J-F Roch. Controling the single-diamond nitrogen-vacancy color center photoluminescence spectrum with a fabry–perot microcavity. *New Journal of Physics*, 13(2):025015, 2011.

[DAG+11b] Yannick Dumeige, Romain Alléaume, Philippe Grangier, François Treussart, and Jean-François Roch. Coupling of a single nitrogen vacancy colour centre in diamond, to a planar microcavity. In *2011 13th International Conference on Transparent Optical Networks*, pages 1–4, 2011.

[DAGS08] Mehrdad Dianati, Romain Alléaume, Maurice Gagnaire, and Xuemin Shen. Architecture and protocols of the future european quantum key distribution network. *Security and Communication Networks*, 1(1):57–74, 2008.

[DBD+17] Yunhong Ding, Davide Bacco, Kjeld Dalgaard, Xinlun Cai, Xiaoqi Zhou, Karsten Rottwitt, and Leif Katsuo Oxenløwe. High-dimensional quantum key distribution based on multicore fiber using silicon photonic integrated circuits. *npj Quantum Information*, 3(1):1–7, 2017.

[DFSS08] Ivan B Damgård, Serge Fehr, Louis Salvail, and Christian Schaffner. Cryptography in the bounded-quantum-storage model. *SIAM Journal on Computing*, 37(6):1865–1890, 2008.
[DFW14] Frederic Dupuis, Omar Fawzi, and Stephanie Wehner. Entanglement sampling and applications. *IEEE Transactions on Information Theory*, 61(2):1093–1112, 2014.

[DH76] Whitfield Diffie and Martin Hellman. New directions in cryptography. *IEEE transactions on Information Theory*, 22(6):644–654, 1976.

[DHP20] Benjamin Dowling, Torben Brandt Hansen, and Kenneth G Paterson. Many a mickle makes a muckle: A framework for provably quantum-secure hybrid key exchange. In *International Conference on Post-Quantum Cryptography*, pages 483–502. Springer, 2020.

[DL15] Eleni Diamanti and Anthony Leverrier. Distributing secret keys with quantum continuous variables: Principle, security and implementations. *Entropy*, 17(9):6072, 2015.

[DLL03] Fu-Guo Deng, Gui Lu Long, and Xiao-Shu Liu. Two-step quantum direct communication protocol using the einstein-podolsky-rosen pair block. *Physical Review A*, 68(4):042317, 2003.

[DM04] Stefan Dziembowski and Ueli Maurer. On generating the initial key in the bounded-storage model. In *International Conference on the Theory and Applications of Cryptographic Techniques*, pages 126–137. Springer, 2004.

[DSW+20] Hui Dai, Qi Shen, Chao-Ze Wang, Shuang-Lin Li, Wei-Yue Liu, Wen-Qi Cai, Sheng-Kai Liao, Ji-Gang Ren, Juan Yin, Yu-Ao Chen, et al. Towards satellite-based quantum-secure time transfer. *Nature Physics*, 16(8):848–852, 2020.

[DTA+04] Y Dumeige, F Treussart, R Alléaume, T Gacoin, J-F Roch, and P Grangier. Photo-induced creation of nitrogen-related color centers in diamond nanocrystals under femtosecond illumination. *Journal of luminescence*, 109(2):61–67, 2004.

[EC19] EC. https://ec.europa.eu/digital-single-market/en/news/future-quantum-eu-countries-plan-ultra-secure-communication-network, 2019.

[EHP+19] Tobias A Eriksson, Takuya Hirano, Benjamin J Puttnam, Georg Rademacher, Ruben S Luís, Mikio Fujiwara, Ryo Namiki, Yoshinari Awaji, Masahiro Takeoka, Naoya Wada, et al. Wavelength division multiplexing of continuous variable quantum key distribution and 18.3 tbit/s data channels. *Communications Physics*, 2(1):1–8, 2019.

[ELAB09] David Elkouss, Anthony Leverrier, Romain Alléaume, and Joseph J Boutros. Efficient reconciliation protocol for discrete-variable quantum key distribution. In *2009 IEEE International Symposium on Information Theory*, pages 1879–1883. IEEE, 2009.
[ETS21] ETSI QKD-ISG DGS/QKD-016-PP, QKD Common Criteria Protection Profile for QKD., 2021.

[EWL+10] Patrick Eraerds, Nino Walenta, Matthieu Legré, Nicolas Gisin, and Hugo Zbinden. Quantum key distribution and 1 gbps data encryption over a single fibre. *New Journal of Physics*, 12(6):063027, 2010.

[Exc20] Quantum-Secure Hybrid Key Exchange. Many a mickle makes a muckle: A framework for provably quantum-secure hybrid key exchange. In *Post-Quantum Cryptography: 11th International Conference, PQCrypto 2020, Paris, France, April 15–17, 2020, Proceedings*, volume 12100, page 483. Springer Nature, 2020.

[FDD+09] S Fossier, E Diamanti, T Debuisschert, A Villing, R Tualle-Brouri, and P Grangier. Field test of a continuous-variable quantum key distribution prototype. *New J. Phys.*, 11(4):045023, 2009.

[FGG07] A. Ferenczi, P. Grangier, and F. Grosshans. Calibration attack and defense in continuous variable quantum key distribution. In *Lasers and Electro-Optics, 2007 and the International Quantum Electronics Conference. CLEOE-IQEC 2007. European Conference on*, pages 1–1, June 2007.

[Fit17] Joseph F Fitzsimons. Private quantum computation: an introduction to blind quantum computing and related protocols. *npj Quantum Information*, 3(1):1–11, 2017.

[FLD+17] Bernd Fröhlich, Marco Lucamarini, James F Dynes, Lucian C Comandar, Winci W-S Tam, Alan Plews, Andrew W Sharpe, Zhiliang Yuan, and Andrew J Shields. Long-distance quantum key distribution secure against coherent attacks. *Optica*, 4(1):163–167, 2017.

[GG02] Frédéric Grosshans and Philippe Grangier. Continuous variable quantum cryptography using coherent states. *Phys. Rev. Lett.*, 88:057902, 2002.

[GGDL19] Shouvik Ghorai, Philippe Grangier, Eleni Diamanti, and Anthony Leverrier. Asymptotic security of continuous-variable quantum key distribution with a discrete modulation. *Physical Review X*, 9(2):021059, 2019.

[GHK+14] Saikat Guha, Patrick Hayden, Hari Krovi, Seth Lloyd, Cosmo Lupo, Jeffrey H Shapiro, Masahiro Takeoka, and Mark M Wilde. Quantum enigma machines and the locking capacity of a quantum channel. *Physical Review X*, 4(1):011016, 2014.

[GLLL+11] Ilja Gerhardt, Qin Liu, Antia Lamas-Linares, Johannes Skaar, Christian Kurtsiefer, and Vadim Makarov. Full-field implementation of a perfect eavesdropper on a quantum cryptography system. *Nature communications*, 2(1):1–6, 2011.
[GMR$^{+13}$] Marissa Giustina, Alexandra Mech, Sven Ramelow, Bernhard Wittmann, Johannes Kofler, Jörn Beyer, Adriana Lita, Brice Calkins, Thomas Gerrits, Sae Woo Nam, et al. Bell violation using entangled photons without the fair-sampling assumption. *Nature*, 497(7448):227–230, 2013.

[Gol09] Oded Goldreich. *Foundations of cryptography: volume 2, basic applications*. Cambridge university press, 2009.

[GRTZ02a] Nicolas Gisin, Grégoire Ribordy, Wolfgang Tittel, and Hugo Zbinden. *Quantum cryptography. Reviews of modern physics*, 74(1):145, 2002.

[GRTZ02b] Nicolas Gisin, Grégoire Ribordy, Wolfgang Tittel, and Hugo Zbinden. *Quantum cryptography*. *Rev. Mod. Phys.*, 74:145–195, Mar 2002.

[GVAW$^{+03}$] Frederic Grosshans, Gilles Van Assche, Jerome Wenger, Rosa Brouri, Nicolas J. Cerf, and Philippe Grangier. Quantum key distribution using gaussian-modulated coherent states. *Nature*, 421(6920):238–241, January 2003.

[Hat03] Lynn Hathaway. National policy on the use of the advanced encryption standard (aes) to protect national security systems and national security information. *National Security Agency*, 23, 2003.

[HCea17] Miguel Herrero-Collantes et al. Quantum random number generators. *Reviews of Modern Physics*, 89(1):015004, 2017.

[HFW$^{+13}$] D Huang, J Fang, D Wang, P Huang, and G Zeng. A wideband balanced homodyne detector for high speed continuous-variable quantum key distribution systems. In *QCrypt*, 2013.

[HHL$^{+15}$] Duan Huang, Peng Huang, Dakai Lin, Chao Wang, and Guihua Zeng. High-speed continuous-variable quantum key distribution without sending a local oscillator. *Opt. Lett.*, 40(16):3695–3698, Aug 2015.

[HKJJ$^{+14}$] Jing-Zheng Huang, Sébastien Kunz-Jacques, Paul Jouguet, Christian Weedbrook, Zhen-Qiang Yin, Shuang Wang, Wei Chen, Guang-Can Guo, and Zheng-Fu Han. Quantum hacking on Quantum Key Distribution using Homodyne Detection. *Phys. Rev. A*, 89:032304, Mar 2014.

[HLW$^{+15}$] Duan Huang, Dakai Lin, Chao Wang, Weiqi Liu, Shuanghong Fang, Jinye Peng, Peng Huang, and Guihua Zeng. Continuous-variable quantum key distribution with 1 mbps secure key rate. *Opt. Express*, 23:17511–17519, 2015.

[HQI21] Harvard Quantum Initiative HQI. Development of quantum interconnects (quics) for next-generation information technologies. *PRX Quantum*, 2:017002, 2021.
[HWY$^{+13a}$] Jing-Zheng Huang, Christian Weedbrook, Zhen-Qiang Yin, Shuang Wang, Hong-Wei Li, Wei Chen, Guang-Can Guo, and Zheng-Fu Han. Quantum hacking of a continuous-variable quantum-key-distribution system using a wavelength attack. *Phys. Rev. A*, 87:062329, Jun 2013.

[HWY$^{+13b}$] Jing-Zheng Huang, Christian Weedbrook, Zhen-Qiang Yin, Shuang Wang, Hong-Wei Li, Wei Chen, Guang-Can Guo, and Zheng-Fu Han. Quantum hacking of a continuous-variable quantum-key-distribution system using a wavelength attack. *Phys. Rev. A*, 87:062329, Jun 2013.

[IDQ21] IDQ. http://www.idquantique.com, 2021.

[ISO20] ISO/IEC JTC1 SC27 WG3, Security requirements, test and evaluation methods for quantum key distribution., 2020.

[JKJD$^{+12}$] Paul Jouguet, Sébastien Kunz-Jacques, Thierry Debuisschert, Simon Fossier, Eleni Diamanti, Romain Alléaume, Rosa Tualle-Brouri, Philippe Grangier, Anthony Leverrier, Philippe Pache, et al. Field test of classical symmetric encryption with continuous variables quantum key distribution. *Optics Express*, 20(13):14030–14041, 2012.

[JKJD13] Paul Jouguet, Sébastien Kunz-Jacques, and Eleni Diamanti. Preventing calibration attacks on the local oscillator in continuous-variable quantum key distribution. *Phys. Rev. A*, 87:062313, Jun 2013.

[JKJL$^{+13a}$] Paul Jouguet, Sébastien Kunz-Jacques, Anthony Leverrier, Philippe Grangier, and Eleni Diamanti. Experimental demonstration of long-distance continuous-variable quantum key distribution. *Nat Photon*, 7(5):378–381, 2013.

[JKJL$^{+13b}$] Paul Jouguet, Sébastien Kunz-Jacques, Anthony Leverrier, Philippe Grangier, and Eleni Diamanti. Experimental study on the gaussian-modulated coherent-state quantum key distribution over standard telecommunication fibers. *Nature Photonics*, 7:378, A1i381, 2013.

[Ken12] Adrian Kent. Quantum tasks in minkowski space. *Classical and Quantum Gravity*, 29(22):224013, 2012.

[KJJ15] Sébastien Kunz-Jacques and Paul Jouguet. Robust shot-noise measurement for continuous-variable quantum key distribution. *Physical Review A*, 91(2):022307, 2015.

[KL14] Jonathan Katz and Yehuda Lindell. *Introduction to modern cryptography*. CRC press, 2014.

[KL21] Wen Yu Kon and Charles Ci Wen Lim. Provably secure symmetric private information retrieval with quantum cryptography. *Entropy*, 23(1):54, 2021.
[KMQA21] Rupesh Kumar, Francesco Mazzoncini, Hao Qin, and Romain Alléaume. Experimental vulnerability analysis of qkd based on attack ratings. *Scientific Reports*, 22:9564, 2021.

[KQA15] Rupesh Kumar, Hao Qin, and Romain Alléaume. Coexistence of continuous variable qkd with intense dwdm classical channels. *New Journal of Physics*, 17(4):043027, 2015.

[Kra10] Hugo Krawczyk. Cryptographic extraction and key derivation: The hkdf scheme. In *Annual Cryptology Conference*, pages 631–648. Springer, 2010.

[KRBM07] Robert König, Renato Renner, Andor Bariska, and Ueli Maurer. Small accessible quantum information does not imply security. *Physical Review Letters*, 98(14):140502, 2007.

[KSDS19] Sebastian Kleis, Joachim Steinmayer, Rainer H Derksen, and Christian G Schaeffer. Experimental investigation of heterodyne quantum key distribution in the s-band or l-band embedded in a commercial c-band dwdm system. *Optics express*, 27(12):16540–16549, 2019.

[KTHW13] Jędrzej Kaniewski, Marco Tomamichel, Esther Hänggi, and Stephanie Wehner. Secure bit commitment from relativistic constraints. *IEEE Transactions on Information Theory*, 59(7):4687–4699, 2013.

[KWW12] Robert König, Stephanie Wehner, and Jürg Wullschleger. Unconditional security from noisy quantum storage. *IEEE Transactions on Information Theory*, 58(3):1962–1984, 2012.

[LAB$^{+}$08] Anthony Leverrier, Romain Alléaume, Joseph Boutros, Gilles Zémor, and Philippe Grangier. Multidimensional reconciliation for a continuous-variable quantum key distribution. *Physical Review A*, 77(4):042325, 2008.

[Lan14] Susan Landau. Highlights from making sense of snowden, part ii: What's significant in the nsa revelations. *IEEE Security & Privacy*, 12(1):62–64, 2014.

[LBGP$^{+}$07] Jérôme Lodewyck, Matthieu Bloch, Raúl García-Patrón, Simon Fossier, Evgueni Karpov, Eleni Diamanti, Thierry Debuisschert, Nicolas J Cerf, Rosa Tualle-Brouri, Steven W McLaughlin, et al. Quantum key distribution over 25 km with an all-fiber continuous-variable system. *Physical Review A*, 76(4):042305, 2007.

[LC97] Hoi-Kwong Lo and Hoi Fung Chau. Is quantum bit commitment really possible? *Physical Review Letters*, 78(17):3410, 1997.

[LC98] Hoi-Kwong Lo and Hoi Fung Chau. Why quantum bit commitment and ideal quantum coin tossing are impossible. *Physica D: Nonlinear Phenomena*, 120(1-2):177–187, 1998.
[LCQ12] Hoi-Kwong Lo, Marcos Curty, and Bing Qi. Measurement-device-independent quantum key distribution. *Phys. Rev. Lett.*, 108:130503, Mar 2012.

[LCT14] Hoi-Kwong Lo, Marcos Curty, and Kiyoshi Tamaki. Secure quantum key distribution. *Nature Photonics*, 8(8):595-604, 2014.

[LDGP$^{+07}$] Jérôme Lodewyck, Thierry Debuisschert, Raúl García-Patrón, Rosa Tualle-Brouri, Nicolas J. Cerf, and Philippe Grangier. Experimental implementation of non-gaussian attacks on a continuous-variable quantum-key-distribution system. *Phys. Rev. Lett.*, 98:030503, Jan 2007.

[LHA$^{+16}$] Daniel J Lum, John C Howell, MS Allman, Thomas Gerrits, Varun B Verma, Sae Woo Nam, Cosmo Lupo, and Seth Lloyd. Quantum enigma machine: Experimentally demonstrating quantum data locking. *Physical Review A*, 94(2):022315, 2016.

[LL11] Hoi-Kwan Lau and Hoi-Kwong Lo. Insecurity of position-based quantum-cryptography protocols against entanglement attacks. *Physical review a*, 83(1):012322, 2011.

[LL15] Cosmo Lupo and Seth Lloyd. Quantum data locking for high-rate private communication. *New Journal of Physics*, 17(3):033022, 2015.

[LMC05] Hoi-Kwong Lo, Xiongfeng Ma, and Kai Chen. Decoy state quantum key distribution. *Physical review letters*, 94(23):230504, 2005.

[Lo97] Hoi-Kwong Lo. Insecurity of quantum secure computations. *Physical Review A*, 56(2):1154, 1997.

[LSA$^{+18}$] Marco Lucamarini, Andrew Shields, Romain Alléaume, Christopher Chunnilall, Ivo Pietro Degiovanni, Marco Gramegna, Atilla Hasekioglu, Bruno Huttner, Rupesh Kumar, Andrew Lord, Norbert Lütkenhaus, Vadim Makarov, Vicente Martin, Alan Mink, Momtchil Peev, Masahide Sasaki, Alastair Sinclair, Tim Spiller, Martin Ward, Catherine White, and Zhiliang Yuan. Implementation security of quantum cryptography. *ETSI Group Specification Document*, 2018.

[LT19] AM Lewis and M Travagnin. A secure quantum communications infrastructure for europe. *JRC Technical Papers*, JRC116937, 2019.

[LUL19] Jie Lin, Twesh Upadhyaya, and Norbert Lütkenhaus. Asymptotic security analysis of discrete-modulated continuous-variable quantum key distribution. *Physical Review X*, 9(4):041064, 2019.
[LWW<sup>+</sup>10] Lars Lydersen, Carlos Wiechers, Christoffer Wittmann, Dominique Elser, Johannes Skaar, and Vadim Makarov. Hacking commercial quantum cryptography systems by tailored bright illumination. *Nat Photon*, 4(10):686–689, October 2010.

[LZL<sup>+</sup>20] Yang Li, Xiaofang Zhang, Yong Li, Bingjie Xu, Li Ma, Jie Yang, and Wei Huang. High-throughput gpu layered decoder of quasi-cyclic multi-edge type low density parity check codes in continuous-variable quantum key distribution systems. *Scientific Reports*, 10(1):1–11, 2020.

[MA17] Adrien Marie and Romain Alléaume. Self-coherent phase reference sharing for continuous-variable quantum key distribution. *Physical Review A*, 95(1):012316, 2017.

[MA20] Francesco Mazzoncini and Romain Alléaume. State of the art analysis in qci security. *QOSAC study report*, 4.1, 2020.

[MACdA06] Rex AC Medeiros, Romain Alléaume, Gérard Cohen, and Francisco M de Assis. Zero-error capacity of quantum channels and noiseless subsystems. In *2006 International Telecommunications Symposium*, pages 900–905. IEEE, 2006.

[Mak09] Vadim Makarov. Controlling passively quenched single photon detectors by bright light. *New J. Phys.*, 11(6):065003–, 2009.

[MAMD02] RA Michniak, R Alleaume, DN McKinsey, and JM Doyle. Alpha and beta particle induced scintillations in liquid and solid neon. *Nuclear Instruments and Methods in Physics Research Section A: Accelerators, Spectrometers, Detectors and Associated Equipment*, 482(1-2):387–394, 2002.

[Mau93] Ueli M Maurer. Secret key agreement by public discussion from common information. *IEEE transactions on information theory*, 39(3):733–742, 1993.

[May97] Dominic Mayers. Unconditionally secure quantum bit commitment is impossible. *Physical review letters*, 78(17):3414, 1997.

[May01] Dominic Mayers. Unconditional security in quantum cryptography. *Journal of the ACM (JACM)*, 48(3):351–406, 2001.

[MDCAF20] Tony Metger, Yfke Dulek, Andrea Coladangelo, and Rotem Arnon-Friedman. Device-independent quantum key distribution from computational assumptions. *arXiv preprint arXiv:2010.04175*, 2020.

[MGA<sup>+</sup>20] Philipp Muth, Matthias Geihs, Tolga Arul, Johannes Buchmann, and Stefan Katzenbeisser. Elsa: efficient long-term secure storage of large datasets (full version)? *EURASIP Journal on Information Security*, 2020:1–20, 2020.
[MM09] A Theodore Markettos and Simon W Moore. The frequency injection attack on ring-oscillator-based true random number generators. In *International Workshop on Cryptographic Hardware and Embedded Systems*, pages 317–331. Springer, 2009.

[MMLO$^{+}$15] Mohammad Mirhosseini, Omar S Magaña-Loaiza, Malcolm N O?Sullivan, Brandon Rodenburg, Mehul Malik, Martin PJ Lavery, Miles J Padgett, Daniel J Gauthier, and Robert W Boyd. High-dimensional quantum cryptography with twisted light. *New Journal of Physics*, 17(3):033033, 2015.

[MMMP99] Vicente Martin, Jesus Martinez-Mateo, and Momtchil Peev. Introduction to quantum key distribution. *Wiley Encyclopedia of Electrical and Electronics Engineering*, pages 1–17, 1999.

[MNR$^{+}$20] Miralem Mehic, Marcin Niemiec, Stefan Rass, Jiajun Ma, Momtchil Peev, Alejandro Aguado, Vicente Martin, Stefan Schauer, Andreas Poppe, Christoph Pacher, et al. Quantum key distribution: a networking perspective. *ACM Computing Surveys (CSUR)*, 53(5):1–41, 2020.

[Moc07] Carlos Mochon. Quantum weak coin flipping with arbitrarily small bias. *arXiv preprint arXiv:0711.4114*, 2007.

[MPZ20] Ueli Maurer, Christopher Portmann, and Jiamin Zhu. Unifying generic group models. *Cryptology ePrint Archive*, 2020.

[MSJ$^{+}$14] Xiang-Chun Ma, Shi-Hai Sun, Mu-Sheng Jiang, Ming Gui, Yan-Li Zhou, and Lin-Mei Liang. Enhancement of the security of a practical continuous-variable quantum-key-distribution system by manipulating the intensity of the local oscillator. *Phys. Rev. A*, 89:032310, Mar 2014.

[MSJL13] Xiang-Chun Ma, Shi-Hai Sun, Mu-Sheng Jiang, and Lin-Mei Liang. Wave-length attack on practical continuous-variable quantum-key-distribution system with a heterodyne protocol. *Phys. Rev. A*, 87:052309, May 2013.

[MWZ$^{+}$18] Yingqiu Mao, Bi-Xiao Wang, Chunxu Zhao, Guangquan Wang, Ruichun Wang, Honghai Wang, Fei Zhou, Jimin Nie, Qing Chen, Yong Zhao, et al. Integrating quantum key distribution with classical communications in backbone fiber network. *Optics express*, 26(5):6010–6020, 2018.

[NCS20] NCSC. Quantum security technologies, 2020.

[NSA20] NSA. Quantum key distribution (qkd) and quantum cryptography (qc), 2020.

[NWS$^{+}$13] J Nunn, LJ Wright, C Söller, L Zhang, IA Walmsley, and BJ Smith. Large-alphabet time-frequency entangled quantum key distribution by means of time-to-frequency conversion. *Optics express*, 21(13):15959–15973, 2013.
[PAB$^{+20}$] Stefano Pirandola, Ulrik L Andersen, Leonardo Banchi, Mario Berta, Darius Bunandar, Roger Colbeck, Dirk Englund, Tobias Gehring, Cosmo Lupo, Carlo Ottaviani, et al. Advances in quantum cryptography. *Advances in Optics and Photonics*, 12(4):1012-1236, 2020.

[PAL$^{+07}$] M Peev, Romain Alléaume, T Langer, Lutkenhaus N, Maurhart O., and Salvail L. The secoqc quantum key distribution network prototype: Principles, design and implementation. In *Globecom*. IEEE, 2007.

[PAM$^{+10}$] Stefano Pironio, Antonio Acín, Serge Massar, A Boyer de La Giroday, Dzmitry N Matsukevich, Peter Maunz, Steven Olmschenk, David Hayes, Le Luo, T Andrew Manning, et al. Random numbers certified by bell's theorem. *Nature*, 464(7291):1021-1024, 2010.

[PDC$^{+12}$] KA Patel, JF Dynes, I Choi, AW Sharpe, AR Dixon, ZL Yuan, RV Penty, and AJ Shields. Coexistence of high-bit-rate quantum key distribution and data on optical fiber. *Physical Review X*, 2(4):041010, 2012.

[PDL$^{+14}$] KA Patel, JF Dynes, M Lucamarini, I Choi, AW Sharpe, ZL Yuan, RV Penty, and AJ Shields. Quantum key distribution for 10 gb/s dense wavelength division multiplexing networks. *Applied Physics Letters*, 104(5):051123, 2014.

[Per95] Michael Perelman. Retrospectives: Schumpeter, david wells, and creative destruction. *Journal of Economic Perspectives*, 9(3):189-197, 1995.

[Pet13] Carlo Petrini. *Slow food nation: Why our food should be good, clean, and fair*. Rizzoli Publications, 2013.

[PGea18] Damián Pitalúa-García et al. Practical and unconditionally secure spacetime-constrained oblivious transfer. *Physical Review A*, 98(3):032327, 2018.

[PLOB17] Stefano Pirandola, Riccardo Laurenza, Carlo Ottaviani, and Leonardo Banchi. Fundamental limits of repeaterless quantum communications. *Nature communications*, 8(1):1-15, 2017.

[PMLA13] Stefano Pironio, Ll Masanes, Anthony Leverrier, and Antonio Acín. Security of device-independent quantum key distribution in the bounded-quantum-storage model. *Physical Review X*, 3(3):031007, 2013.

[PPA$^{+09}$] Momtchil Peev, Christoph Pacher, Romain Alléaume, Claudio Barreiro, Jan Bouda, W Boxleitner, Thierry Debuisschert, Eleni Diamanti, M Dianati, JF Dynes, et al. The secoqc quantum key distribution network in vienna. *New Journal of Physics*, 11(7):075001, 2009.
[PPS07] Kenneth G Paterson, Fred Piper, and Rüdiger Schack. Quantum cryptography: a practical information security perspective. *Nato Security Through Science Series D-Information and Communication Security*, 11:175, 2007.

[PTC+09] NA Peters, P Toliver, TE Chapuran, RJ Runser, SR McNown, CG Peterson, D Rosenberg, N Dallmann, RJ Hughes, KP McCabe, et al. Dense wavelength multiplexing of 1550 nm qkd with strong classical channels in reconfigurable networking environments. *New Journal of physics*, 11(4):045012, 2009.

[QC421] QC40. https://qiskit.org/events/physics-of-computation/, 2021.

[QFLM07] Bing Qi, Chi-Hang Fred Fung, Hoi-Kwong Lo, and Xiongfeng Ma. Time-shift attack in practical quantum cryptosystems. *Quantum Info. Comput.*, 7(1):73-82, 2007.

[QHQL07] Bing Qi, Lei-Lei Huang, Li Qian, and Hoi-Kwong Lo. Experimental study on the gaussian-modulated coherent-state quantum key distribution over standard telecommunication fibers. *Phys. Rev. A*, 76:052323, Nov 2007.

[Qi16] Bing Qi. Simultaneous classical communication and quantum key distribution using continuous variables. *Physical Review A*, 94(4):042340, 2016.

[QKA13a] Hao Qin, Rupesh Kumar, and Romain Alléaume. Saturation attack on continuous-variable quantum key distribution system. In *Emerging Technologies in Security and Defence; and Quantum Security II; and Unmanned Sensor Systems X*, volume 8899, page 88990N. International Society for Optics and Photonics, 2013.

[QKA13b] Hao Qin, Rupesh Kumar, and Romain Alléaume. Saturation Attack On Continuous-Variable Quantum Key Distribution System. In *Proc. SPIE 8899, Emerging Technologies in Security and Defence; and Quantum Security II; and Unmanned Sensor Systems X*, 88990N, volume 8899, pages 88990N-88990N-7, 2013.

[QKA16] Hao Qin, Rupesh Kumar, and Romain Alléaume. Quantum hacking: Saturation attack on practical continuous-variable quantum key distribution. *Physical Review A*, 94(1):012325, 2016.

[QKMA18] Hao Qin, Rupesh Kumar, Vadim Makarov, and Romain Alléaume. Homodyne-detector-blinding attack in continuous-variable quantum key distribution. *Physical Review A*, 98(1):012312, 2018.

[QL18] Bing Qi and Charles Ci Wen Lim. Noise analysis of simultaneous quantum key distribution and classical communication scheme using a true local oscillator. *Physical Review Applied*, 9(5):054008, 2018.
[QLP$^{+15}$] Bing Qi, Pavel Lougovski, Raphael Pooser, Warren Grice, and Miljko Bo-
brek. Generating the local oscillator locally in continuous-variable quan-
tum key distribution based on coherent detection. *Phys. Rev. X*, 5:041009,
Oct 2015.

[QRa] QRange. Qt flagship project 2018-2022.

[Rab05] Michael O Rabin. How to exchange secrets with oblivious transfer. *IACR Cryptol. ePrint Arch.*, 2005(187), 2005.

[Ren05] R Renner. Security of quantum key distribution (phd thesis). arXiv preprint quant-ph/0512258, 2005.

[Ren08] Renato Renner. Security of quantum key distribution. *International Journal of Quantum Information*, 6(01):1-127, 2008.

[RK05] Renato Renner and Robert König. Universally composable privacy amplification against quantum adversaries. In *Theory of Cryptography Conference*, pages 407-425. Springer, 2005.

[RR20] Joseph M Renes and Renato Renner. Are quantum cryptographic security claims vacuous? *arXiv preprint arXiv:2010.11961*, 2020.

[RRL$^{+21}$] Ravi Raghunathan, Guillaume Ricard, Baptiste Lefaucher, Antoine Henry, Filippo Miatto, Isabelle Zaquine, and Romain Alléaume. Parallelizable synthesis of arbitrary single-qubit gates with linear optics and time-frequency encoding. *In Preparation*, 2021.

[RRM$^{+18}$] Ravi Raghunathan, G Ricard, Filippo Miatto, Isabelle Zaquine, and Romain Alléaume. Single qubit arbitrary unitary synthesis using photonic spectral encoding. In *Quantum Technology International Conference (QTech 2018)*, 2018.

[RWC] RWC. https://rwc.iacr.org/.

[SAA$^{+10}$] C Simmon, M Afzelius, J Appel, A Boyer de la Giroday, SJ Dewhurst, N Gisin, CY Hu, A Jelezko, S Kröll, JH Müller, et al. Quantum memories: A review based on the european integrated project ?qubit applications (qap)? *European Physical Journal D*, 58:1-22, 2010.

[SAL22] Shihan Sajeed, Romain Alléaume, and Hoi-Kwong Lo. A direct look at quantum secure communication. *In Preparation*, 2022.

[Sas18] Masahide Sasaki. Quantum key distribution and its applications. *IEEE Security & Privacy*, 16(5):42-48, 2018.
[SBC$^{+15}$] Daniel B. S. Soh, Constantin Brif, Patrick J. Coles, Norbert Lütkenhaus, Ryan M. Camacho, Junji Urayama, and Mohan Sarovar. Self-referenced continuous-variable quantum key distribution protocol. *Phys. Rev. X*, 5:041010, Oct 2015.

[SBF$^{+17}$] Alicia Sit, Frédéric Bouchard, Robert Fickler, Jérémie Gagnon-Bischoff, Hugo Larocque, Khabat Heshami, Dominique Elser, Christian Peuntinger, Kevin Günthner, Bettina Heim, et al. High-dimensional intracity quantum cryptography with structured photons. *Optica*, 4(9):1006–1010, 2017.

[SBPC$^{+09}$] Valerio Scarani, Helle Bechmann-Pasquinucci, Nicolas J Cerf, Miloslav Dušek, Norbert Lütkenhaus, and Momtchil Peev. The security of practical quantum key distribution. *Reviews of modern physics*, 81(3):1301, 2009.

[SBV$^{+20}$] Pavel Sekatski, J-D Bancal, Xavier Valcarce, EY-Z Tan, Renato Renner, and Nicolas Sangouard. Device-independent quantum key distribution from generalized chsh inequalities. *arXiv preprint arXiv:2009.01784*, 2020.

[SC14] Valerio Scarani and Kurtsiefer Christian. The black paper of quantum cryptography: real implementation. *Theoretical Computer Science*, 560:27–32, 2014.

[SCB$^{+15}$] Shihan Sajeed, Poompong Chaiwongkhot, Jean-Philippe Bourgoin, Thomas Jennewein, Norbert Lütkenhaus, and Vadim Makarov. Security loop-hole in free-space quantum key distribution due to spatial-mode detector-efficiency mismatch. *Phys. Rev. A*, 91:062301, Jun 2015.

[Sch10] Christian Schaffner. Simple protocols for oblivious transfer and secure identification in the noisy-quantum-storage model. *Physical Review A*, 82(3):032308, 2010.

[Sch18] Bruce Schneier. Cryptography after the aliens land. *IEEE Security & Privacy*, 16(5):86–88, 2018.

[Seq] SequNet. Spin-off from telecom paris, 2008-2017.

[SFI$^{+11}$] Masahide Sasaki, Mikio Fujiwara, H Ishizuka, W Klaus, K Wakui, M Takeoka, S Miki, T Yamashita, Z Wang, A Tanaka, et al. Field test of quantum key distribution in the tokyo qkd network. *Optics express*, 19(11):10387–10409, 2011.

[SGG$^{+11}$] Jean-Loup Smirr, Sylvain Guilbaud, Joe Ghalbouni, Robert Frey, Eleni Diamanti, Romain Alléaume, and Isabelle Zaquine. Simple performance evaluation of pulsed spontaneous parametric down-conversion sources for quantum communications. *Optics express*, 19(2):616–627, 2011.
[Sho94] Peter W Shor. Algorithms for quantum computation: discrete logarithms and factoring. In *Proceedings 35th annual symposium on foundations of computer science*, pages 124–134. Ieee, 1994.

[Sho97] Victor Shoup. Lower bounds for discrete logarithms and related problems. In *International Conference on the Theory and Applications of Cryptographic Techniques*, pages 256–266. Springer, 1997.

[slo] Slow food movement.

[SML09] Douglas Stebila, Michele Mosca, and Norbert Lütkenhaus. The case for quantum key distribution. In *International Conference on Quantum Communication and Quantum Networking*, pages 283–296. Springer, 2009.

[SP00] Peter W Shor and John Preskill. Simple proof of security of the bb84 quantum key distribution protocol. *Physical review letters*, 85(2):441, 2000.

[SPD+10] Louis Salvail, Momtchil Peev, Eleni Diamanti, Romain Alléaume, Norbert Lütkenhaus, and Thomas Länger. Security of trusted repeater quantum key distribution networks. *Journal of Computer Security*, 18(1):61–87, 2010.

[Sti94] Douglas R. Stinson. Universal hashing and authentication codes. *Designs, Codes and Cryptography*, 4(3):369–380, 1994.

[TACR04] Francois Treussart, Romain Alléaume, Jean-Michel Courty, and Jean-François Roch. Emission properties of a single photon source. *Physica Scripta*, 2004(T112):95, 2004.

[TALF+02] François Treussart, Romain Alléaume, Véronique Le Floch, LT Xiao, J-M Courty, and J-F Roch. Direct measurement of the photon statistics of a triggered single photon source. *Physical review letters*, 89(9):093601, 2002.

[TALF+03] F Treussart, R Alléaume, V Le Floc'h, LT Xiao, J-F Roch, and J-M Courty. Photon statistics of a single photon source. In *Organic Nanophotonics*, pages 413–422. Springer, 2003.

[TALFR02] François Treussart, Romain Alléaume, Véronique Le Floc'h, and Jean-François Roch. Single photon emission from a single molecule. *Comptes Rendus Physique*, 3(4):501–508, 2002.

[Tow97] Paul D Townsend. Simultaneous quantum cryptographic key distribution and conventional data transmission over installed fibre using wavelength-division multiplexing. *Electronics Letters*, 33(3):188–190, 1997.

[TZS+04] Alexei Trifonov, Anton Zavriyev, Darius Subacius, Romain Alléaume, and Jean-François Roch. Practical quantum cryptography. In *Quantum Information and Computation II*, volume 5436, pages 1–11. International Society for Optics and Photonics, 2004.
[Unr10] Dominique Unruh. Universally composable quantum multi-party computation. In *Annual International Conference on the Theory and Applications of Cryptographic Techniques*, pages 486–505. Springer, 2010.

[Unr15] Dominique Unruh. Revocable quantum timed-release encryption. *Journal of the ACM (JACM)*, 62(6):1–76, 2015.

[VA20] Nilesh Vyas and Romain Alléaume. Everlasting secure key agreement with performance beyond qkd in a quantum computational hybrid security model. *arXiv preprint arXiv:2004.10173*, 2020.

[WEH18] Stephanie Wehner, David Elkouss, and Ronald Hanson. Quantum internet: A vision for the road ahead. *Science*, 362(6412), 2018.

[Wie83] Stephen Wiesner. Conjugate coding. *ACM Sigact News*, 15(1):78–88, 1983.

[WLW$^{+11}$] C Wiechers, L Lydersen, C Wittmann, D Elser, J Skaar, Ch Marquardt, V Makarov, and G Leuchs. After-gate attack on a quantum cryptosystem. *New J. Phys*, 13(1):013043–, 2011.

[WPGP$^{+12}$] Christian Weedbrook, Stefano Pirandola, Raúl García-Patrón, Nicolas J Cerf, Timothy C Ralph, Jeffrey H Shapiro, and Seth Lloyd. Gaussian quantum information. *Reviews of Modern Physics*, 84(2):621, 2012.

[WST08] Stephanie Wehner, Christian Schaffner, and Barbara M Terhal. Cryptography from noisy storage. *Physical Review Letters*, 100(22):220502, 2008.

[Wyn75] Aaron D Wyner. The wire-tap channel. *Bell system technical journal*, 54(8):1355–1387, 1975.

[XAX$^{+03}$] Lian-Tuan Xiao, Romain Alléaume, Quyen Dinh Xuan, Francois Treussart, Bernard A Journet, and Jean-françois Roch. Measurement of photon distribution in attenuated diode laser pulses. In *Physics and Simulation of Optical Devices XI*, volume 4986, pages 463–468. International Society for Optics and Photonics, 2003.

[XAX$^{+06}$] Quyên Dinh Xuân, R Alléaume, Liantuan Xiao, F Treussart, B Journet, and J-F Roch. Intensity noise measurement of strongly attenuated laser diode pulses in the time domain. *The European Physical Journal Applied Physics*, 35(2):117–121, 2006.

[XMZ$^{+20}$] Feihu Xu, Xiongfeng Ma, Qiang Zhang, Hoi-Kwong Lo, and Jian-Wei Pan. Secure quantum key distribution with realistic devices. *Reviews of Modern Physics*, 92(2):025002, 2020.
[YLL$^{+20}$] Juan Yin, Yu-Huai Li, Sheng-Kai Liao, Meng Yang, Yuan Cao, Liang Zhang, Ji-Gang Ren, Wen-Qi Cai, Wei-Yue Liu, Shuang-Lin Li, et al. Entanglement-based secure quantum cryptography over 1,120 kilometres. *Nature*, 582(7813):501–505, 2020.

[ZCP$^{+20}$] Yichen Zhang, Ziyang Chen, Stefano Pirandola, Xiangyu Wang, Chao Zhou, Binjie Chu, Yijia Zhao, Bingjie Xu, Song Yu, and Hong Guo. Long-distance continuous-variable quantum key distribution over 202.81 km of fiber. *Phys. Rev. Lett.*, 125:010502, Jun 2020.

[ZFQ$^{+08}$] Yi Zhao, Chi-Hang Fred Fung, Bing Qi, Christine Chen, and Hoi-Kwong Lo. Quantum hacking: Experimental demonstration of time-shift attack against practical quantum-key-distribution systems. *Phys. Rev. A*, 78:042333, Oct 2008.

[Zha19] Mark Zhandry. Quantum lightning never strikes the same state twice. In *Annual International Conference on the Theory and Applications of Cryptographic Techniques*, pages 408–438. Springer, 2019.