A min-entropy uncertainty relation for finite size cryptography

A min-entropy uncertainty relation for finite size cryptography


Apart from their foundational significance, entropic uncertainty relations play a central role in proving the security of quantum cryptographic protocols. Of particular interest are thereby relations in terms of the smooth min-entropy for BB84 and six-state encodings. Previously, strong uncertainty relations were obtained which are valid in the limit of large block lengths. Here, we prove a new uncertainty relation in terms of the smooth min-entropy that is only marginally less strong, but has the crucial property that it can be applied to rather small block lengths. This paves the way for a practical implementation of many cryptographic protocols. As part of our proof we show tight uncertainty relations for a family of Rényi entropies that may be of independent interest.

Entropic uncertainty relations form a modern way to characterize the uncertainty inherent in several quantum measurements. As opposed to more traditional methods of capturing the notion of uncertainty, they have the advantage that they are able to quantify uncertainty solely in terms of the measurements we consider, and are independent of the state to be measured. To see this clearly, let us explain the notion of entropic uncertainty in more detail (also, see Wehner and Winter (2010) for a survey). Suppose we are given a state on which we can make one of possible measurements with outcomes labelled . Let denote the probability of observing outcome when making the measurement labelled on the state . For each measurement, we can consider some form of entropy of the outcome distribution such as for example the Shannon entropy . An entropic uncertainty relation in terms of the Shannon entropy is then determined by the average () over the individual entropies. More precisely, such a relation states that for all states


where is a constant that depends solely on the measurements. For example, if is a single qubit state, and we consider measurements in the Pauli and eigenbases, we have Maassen and Uffink (1988). To see why (1) for is indeed connected with uncertainty, note that if the outcome is certain with respect to some measurement on the state (), then the outcome of at least one other measurement is uncertain (). Similarly, the larger the value of , the more uncertain these outcomes are. The value of thus give a natural measure of the incompatibility of different sets of measurements. Strong uncertainty relations have the property that is large.

From a cryptographic perspective, uncertainty relations in terms of the min-entropy 1 are of particular interest, since the min-entropy determines how many random bits (key) can be extracted from  König et al. (2009). In a cryptographic setting, it is thereby often interesting to consider a slight extension of the notion of uncertainty relations above. Namely, instead of measuring one state , we imagine that an adversary prepares with some probability a state (labelled by some classical label ) which we subsequently measure. Since entropic uncertainty relations hold for any state, they do in particular hold for any state that the adversary may have prepared. Yet, the distribution over measurement outcomes may of course depend on . Uncertainty relations with respect to such classical side information thus take the form


for some constant depending on the measurements we make. Averaging over bases and classical information K, the conditional min-entropy is given by (see appendix)


For example, imagine that is an -qubit state and we perform one of the possible measurements given by measuring each qubit independently in one of the two BB84 bases Bennett and Brassard (1984), i.e., in the eigenbasis of Pauli or . It is known that in this case for any . This is also optimal as there exists a state that attains this lower bound.

Measurements in BB84 bases are indeed common in many quantum cryptographic protocols. In particular, they are used in two-party cryptographic protocols in the bounded Damgård et al. (2005, 2007) and noisy-storage model Wehner et al. (2008); Schaffner et al. (2008); König et al. (2009). These models allow for the secure implementation of any two-party cryptographic primitive under the assumption that the adversary’s quantum memory device is bounded and imperfect. This includes interesting primitives such as oblivious transfer, bit commitment, and even secure identification of e.g. a user to an ATM machine. The security of all protocols in this model crucially rests on the existence of uncertainty relations in terms of min-entropy Damgård et al. (2005, 2007); Damgaard et al. (2007); Wehner et al. (2008); Schaffner et al. (2008); König et al. (2009); Berta et al. (2011a). Yet, the value of for BB84 bases is usually too low to be cryptographically useful. In particular, a low value for means that the adversary’s memory must be very limited and/or noisy for security to be possible Damgård et al. (2005, 2007); König et al. (2009) at all. Furthermore, a low value of means that any experiment implementing such protocols can tolerate only a small amount of bit flip errors and losses Schaffner et al. (2008); Wehner et al. (2010); Schaffner (2010). For instance, if is the bit flip error on the channel connecting Alice and Bob, then security for the cryptographic primitive known as oblivious transfer is possible if  Schaffner (2007); Wehner et al. (2010), where is the binary Shannon entropy.

Motivated by this need to obtain a strong uncertainty relation for BB84 bases, that is, a large , the authors of Damgård et al. (2007) considered the so-called smooth min-entropy . Intuitively, a lower bound on this quantity tells us that we do indeed have min-entropy at least , except for some small error parameter . Formally, this quantity is defined as (see appendix)


where is -close to in terms of the purified distance Tomamichel et al. (2010).

It turns out that at the expense of such a small error , a much stronger uncertainty relation can indeed be obtained. In particular, it has been shown Damgård et al. (2007) that for measurements in the BB84 bases and any ,




Using this relation in a cryptographic protocol only yields an additional error in the overall security error, and it is widely employed in the protocols of Damgård et al. (2007); Damgaard et al. (2007); Schaffner (2007); König et al. (2009); Wehner et al. (2010); Schaffner (2010).

From a theoretical (asymptotic) viewpoint, this uncertainty relation is certainly sufficient. Yet, when it comes to putting any of such protocols into a practical experiment it has a small caveat: whereas decreases exponentially in the number of qubits , for a large amount of uncertainty, i.e., , the convergence is extremely slow. For example, for  Schaffner (2010) corresponding to , we need to even have ! In an experiment using weak coherent pulses, with frequency of 1GHz and Poisson parameter it takes approximately seconds to generate such an  Schaffner (2010) if there are absolutely no losses of any kind. However, compared to the generation time, a more significant inconvenience is that the classical post-processing of such large block lengths is time-consuming.

I Results

To implement aforementioned protocols, it would thus be desirable to have a relation that is useful for significantly smaller values of . Here, we prove such a relation that makes a statement for any desirable fixed error . In particular, we show that for any qubit quantum state and measurements in BB84 bases




At the first glance, it may be hard to see that is indeed large. However, applying it to the example from Schaffner (2010) (see above) by plugging in demonstrates that for the same , whenever . Comparing this with calculations in the previous section, the required block length is approximately  times smaller. Figure 1 provides a comparison of these two bounds. We see that even for large , the required bound on the block length given by (6) is large.

Figure 1: (Color online) This plot shows the minimal required block length on a logarithmic scale of base , in order to achieve an error parameter . The dashed curves are plotted for the previous known bound (6), while the solid lines are obtained from our new analysis (8). The different colors represent the fixed values of the lower bound , with values 0.45, 0.46, 0.47, 0.48, and 0.49 respectively. As increases, the plotted bounds get relatively higher.

Our relation can readily be applied to any BB84 based two-party protocols in the bounded (or noisy)-storage model, and enables experiments for significantly smaller values of . For example, it enables the experimental implementation of Ng et al. (2012) with instead of for the same error parameter .

Furthermore our relation can be extended to the case of six-state protocols, i.e., measurements in Pauli , and eigenbases as suggested in Schaffner (2007); Damgaard et al. (2007); Berta et al. (2011a). For this case we obtain




This yields a similar improvement over the relation analogous to (5) proven in Damgård et al. (2007).

A crucial step in our proof is to show tight uncertainty relations for conditional Rényi entropies of order , denoted by . These may be of independent interest. Previously, such relations were only known for single qudit measurements for , , and (see e.g. Wehner and Winter (2010, 2008); Bosyk et al. (2012)). More precisely, we show that for measurements on -qubit states in BB84 bases, the minimum values of the conditional Rényi entropies for any are




Similarly, for measurements in the six-state bases


Ii Proof

Let us now explain the proof of our results. A technical derivation including all details may be found in the appendix. For simplicity, we restrict ourselves to the case of BB84 measurements. An extension for six-state protocols is analogous and can be found in the appendix. To obtain (8) we proceed in four steps. First, we will prove a tight uncertainty relation in terms of the -Rényi entropy when is just an qubit state. Second, we show how to extend this result to an uncertainty relation for qubits, giving us (11). The third step is to reintroduce as outlined in the introduction. Finally, we relate the Rényi entropies of order to the smooth min-entropy.

Step 1 - A single qubit uncertainty relation:

For the case when and are classical the conditional -Rényi entropy reduces to the simple form


The relevant -Rényi entropy for a single qubit state (where k denotes some classical information associated with the state ) is


Here , where denotes the measurement operator


with the Hadamard matrix. To minimize the -Rényi entropy for values of , it it sufficient to maximize the summation term. Defining


we first rewrite as functions of two variables: and . The Bloch sphere condition for a qubit gives , which serves as a constraint in maximizing (17). Switching to spherical coordinates and evaluating the partial derivatives of (17) according to multiple independent variables, we prove


Moreover, the minimal -Rényi entropy is achieved on an eigenstate of either measurement basis.

Step 2 - A relation for -qubits: To extend the one qubit uncertainty relation to multiple qubits, the central problem is to prove that the lower bound on the conditional entropy scales linearly with the block length . This essentially implies that for a system of qubits, the entanglement across qubits does not give rise to a lower minimal -Rényi entropy. In our analysis, we show this by first considering the last qubit measured, conditioned on all the previous measurement bases and values. That is, we consider a -qubit normalized density operator , where denotes the last qubit and the remaining qubits, and write


where with the corresponding normalized density operator


Since the uncertainty relation for one qubit (18) holds for any density operator, it holds in particular for . By induction, it is then easily shown that the minimal entropy is additive.

Step 3 - Classical side information : After Steps 1 and 2, we established a tight uncertainty relation for a binary string conditioned on the basis string . Namely, we have


for any -qubit state . In this step, we obtain the conditioning with relation to classical side information K. In other words, we need to evaluate with


By observing the independence of and K, we show that the bounds of these values coincide, implying that


Step 4 - Relation to the min-entropy: As motivated previously, the final desired measure of entropy is the smooth min-entropy . A recent work Tomamichel et al. (2009) has shown that a lower bound can be obtained for this quantity. Namely, we have for any state and


This combined with (23) implies the claim


It is worth noting that as , the maximum is obtained for , implying that as the system size approaches infinity, the optimal bound is still given by (5). That is, in terms of a bound which comes from the Shannon entropy. However, our analysis provides a better alternative to bound the smooth min-entropy for finite system sizes, and hence is more useful for practical implementations.

Iii Conclusions

We have proven entropic uncertainty relations that pave the way for a practical implementation of BB84 and six-state protocols Schaffner (2007); Damgård et al. (2005, 2007); Wehner et al. (2008); Schaffner et al. (2008); König et al. (2009); Damgaard et al. (2007); Wehner et al. (2010); Schaffner (2010) at small block length. Indeed, our relation has already been employed in Ng et al. (2012) for an experimental implementation of bit commitment in the bounded/noisy-storage model.

It is an interesting open question whether similarly strong relations can also be obtained with respect to quantum side information Berta et al. (2010); Coles et al. (2011); Berta et al. (2011a). This would allow security statements for such protocols in terms of the quantum capacity Berta et al. (2011a) of the storage device, rather than the classical capacity König et al. (2009) or the entanglement cost Berta et al. (2011b). For the six-state case this has been done (implicitly) in Berta et al. (2011a) for the special case of a Rényi type entropy of order , yielding however again a slightly weaker uncertainty relation as might be possible for other values of . As the amount of uncertainty is the the key element in being able to tolerate experimental errors and losses in said protocols, it would be nice to extend our result to this setting.


In this appendix, we provide the technical details that lead to our claims. In section A, the complete proof for the uncertainty relation for BB84 bases (measurements in eigenstates of Pauli and ) is presented. In section B, similar methods are used to derive bounds for six-state bases (measurements in eigenstates of Pauli , and ).

We first restate the definitions of the relevant entropic quantities. Given any finite-dimensional Hilbert space , let denote the set of sub-normalized density operators on , and denote the set of normalized density operators on . For and , the conditional min-entropy of given is defined as


and the conditional min-entropy of given is defined as


The smooth conditional min-entropy of given and is defined as


where is an -ball in terms of the purified distance with


the (generalized) fidelity Tomamichel et al. (2010).

The conditional -Rényi entropies are defined as


where (possible) inverses are understood as generalized inverses. Note that there exist also slightly different definitions of conditional -Rényi entropies in the literature.

Iv A. Uncertainty relation for BB84 measurements

Step 1 : Single qubit relation

For any qubit state we have to examine the quantities


with , and the Hadamard matrix. Since the choice of measurements is uniform, we get

Theorem A. 1.

Let , and with . Then we have for BB84 measurements as in (IV.0.1) that


We evaluate the term


where and . For any one qubit state , we have the Bloch sphere condition


and can therefore parametrize and by polar coordinates


where , and . can then be rewritten as a function depending on the variables , , and


The partial differential of with respect to becomes


Since in the range of , and are positive, we obtain , which implies that the maximum is attained at . The partial differential of with respect to at becomes


For a stationary point of , (39) is zero and the solution is obtained at three points: . The characteristics of the endpoints are the same, hence it suffices to analyze either. It remains to analyze the characteristic of these stationary points. To do so, we evaluate the second partial derivative at these points as a function of


To determine if the stationary point is a local minima or maxima, we show the positivity/negativity of these functions over the interval . Note that and , while is always increasing since . Hence is negative, implying the endpoints correspond to a local maxima. On the other hand, note that the second term in (41) is exactly of the form as stated in Lemma C.1 with . With this, we conclude that the point is a local minimum. This leaves the endpoints as the only candidates for optimal parameters that achieve the maxima of . Evaluating then provides us the bound


and plugging this back into (IV.0.1) gives (33). ∎

Step 2 : Relation for -qubits

The goal is to prove that for any -qubit state measured independently on each qubit in BB84 bases, the minimal output -Rényi entropy is additive. Let first with the first system denoted by and the second by . We have


where and . Now assume that we have a one qubit upper bound


for . Note that the second summation term in (43) corresponds to of the single qubit density operator


where . Hence we have


The following lemma generalizes this argument to arbitrary .

Lemma A. 1.

For measured independently on each qubit in BB84 bases, the minimal conditional -Rényi entropy of with respect to is additive.




where for and . Assuming the same upper bound as in (44) we get


Combining this with the one qubit uncertainty relation derived before, we obtain the following.

Corollary A. 1.

For with , and measured independently on each qubit in BB84 bases, we have


Step 3 : Classical side information K

In Corollary A.1 we have obtained an uncertainty relation for any -qubit states . But generally we want to consider -qubit states labelled with classical information , and we need to make a relation to the quantity for the state . That is, the -Rényi entropy is also conditioned on classical information . This quantity is evaluated as


where the difference is that now is conditioned on the classical information . However, in our case is chosen randomly regardless of what state is prepared. Thus and we get


Step 4 : Relation to the min-entropy

After obtaining a bound on , we now link this to a bound on . It is shown in (Tomamichel et al., 2009, Theorem 7) that for , , and


Thus the smooth conditional min-entropy is lower bounded by general conditional -Rényi entropies, with a correction term growing logarithmically in . For the Shannon entropy () this term diverges, but considering the bound is very useful. Namely, the smooth conditional min-entropy of given is bounded to


Note that the maximum value of (53) is obtained for different values of , as and varies.

V B: Uncertainty relation for six-state measurements

In this section, we make use of the same methods as in Appendix A. We derive an uncertainty relation for any -qubit state measured independently on each qubit in six-state bases. For the single qubit version, we have to consider


with , and the matrix that cyclically permutes the eigenbases of Pauli , , and .

Theorem B. 1.

Let , and with . Then we have for six-state measurements as in (V) that


We evaluate the term


where and . Parametrizing this in terms of spherical coordinates, we write