Parallel Device-Independent Quantum Key Distribution

A prominent application of quantum cryptography is the distribution of cryptographic keys that are provably secure.Recently, such security proofs were extended by Vazirani and Vidick (Physical Review Letters, 113, 140501, 2014) to the device-independent (DI) scenario, where the users do not need to trust the integrity of the underlying quantum devices.The protocols analyzed by them and by subsequent authors all require a sequential execution of N multiplayer games, where N is the security parameter.In this work, we prove unconditional security of a protocol where all games are executed in parallel.Besides decreasing the number of timesteps necessary for key generation, this result reduces the security requirements for DI-QKD by allowing arbitrary information leakage of each user's inputs within his or her lab.To the best of our knowledge, this is the first parallel security proof for a fully device-independent QKD protocol.Our protocol tolerates a constant level of device imprecision and achieves a linear key rate.Key Distribution (KD) is a task where two parties establish a common secret by communicating through a public channel.It is a necessary step for symmetric key cryptography (i.e., for protocols that require a shared secret) in a setting where a secure communication channel is initially not available.Thus KD is a primitive foundational to information security.Information theoretically secure KD is impossible for classical protocols (i.e., protocols that exchange bits).Thus all classical solutions must necessarily rely on computational assumptions.Widely used protocols, such as the Diffie-Hellman-Merkle key exchange protocol [11] and those making use of digital signatures (e.g., as in the implementation of Secure Sockets Layer) all rely on the computational security of public key cryptography.The hardness assumptions underlying all known public key cryptography are mathematically unproven.The practical security of these solutions are being challenged on the one hand by the rapidly increasing and widely available high performance computing power, and on the other hand, by new insights into the design flaws.For example, Adrian et al. [1] recently showed how Diffie-Hellman-Merkle could fail in practice.A further threat to all widely used public-key-based KD protocols is that they are not secure against quantum cryptanalysis.With universal quantum computer within sight [10] and quantumresilient protocols yet to emerge, these challenges call for alternative and fundamentally more secure solutions for KD.Quantum mechanics provides such a solution.The quantum key distribution (QKD) protocol of Bennett and Brassard [7] and its several subsequent variants have been proved to be unconditionally secure (i.e., against a computationally all-powerful adversary) [19,18,26,25,6].Experimental networks implementing QKD have been developed and deployed with increasingly large scales.With the rapid advances of quantum information technologies, QKD protocols may be widely adopted in the near future.A major challenge for QKD (and other quantum information tasks) is that quantum information is extremely fragile.How could a user of a QKD protocol be sure that the quantum devices are operating according to the specifications?This consideration motivates the field of deviceindependent (DI) quantum cryptography, pioneered by Ekert [13] and Mayers and Yao [20].The goal of DI quantum cryptography is to develop protocols and prove security in a strictly black-box fashion, with the only trusted assumption being that quantum physics is correct and complete, and that the users have the ability to restrict information transmission.The field has seen enormous success in recent years, including the achievement of fully device-independent and robust security proofs for QKD [30,21,3,12,2].All the known secure DI-QKD protocols are sequential in the following sense.Alice and Bob share a two-part quantum device D = (D 1 , D 2 ), each of which is treated as a black box which accepts classical inputs and returns classical outputs.Alice creates a random input X 1 , gives it to her device D 1 , and receives an output A 1 .Meanwhile, Bob gives a random input Y 1 to his device D 2 and receives an output B 1 .This process is repeated sequentially N times to obtain X 1 , . . ., X N , Y 1 , . . ., Y N , A 1 , . . ., A N , B 1 , . . ., B N .(These data are then used to determine whether a certain Bell inequality has been violated, and if so, these registers are then postprocessed using information reconciliation and privacy amplification to obtain the final shared key.)The sequential assumption means specifically that output A i is recorded before the device gains knowledge of X i+1 .The question addressed by the current paper is the following: is the sequential assumption in DI-QKD necessary?We show that, in fact, it can be removed: we prove robust DI-QKD in a more general model where there is no time-ordering assumption on the generation of the outputs