Cost of quantum secret key

Karol Horodecki; Leonard Sikorski; Mark M. Wilde; Siddhartha Das

arxiv: 2402.17007 · v2 · submitted 2024-02-26 · 🪐 quant-ph

Cost of quantum secret key

Karol Horodecki , Leonard Sikorski , Siddhartha Das , Mark M. Wilde This is my paper

Pith reviewed 2026-05-24 04:04 UTC · model grok-4.3

classification 🪐 quant-ph

keywords quantum secret keyresource theorykey costkey of formationprivacy dilutionrelative entropy of entanglemententanglement measuressingle-shot regime

0 comments

The pith

The regularized key of formation upper-bounds the key cost of a quantum state via privacy dilution.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper defines the key cost of a quantum state within a resource theory of secret keys, under the premise that entangled states with zero distillable key do not exist. It introduces the key of formation as a measure and proves that its regularization provides an upper bound on this cost. The proof centers on a privacy dilution protocol that turns states with ideal privacy into states with reduced privacy. A matching lower bound from the regularized relative entropy of entanglement follows, which establishes irreversibility of the creation-distillation cycle for certain states. For mixed states that behave like pure states in the privacy setting, several standard entanglement measures become identical.

Core claim

The regularized key of formation is an upper bound on the key cost of a quantum state. The proof proceeds by exhibiting the privacy dilution protocol, which converts states containing ideal privacy into states with diluted privacy. The key cost is also bounded from below by the regularized relative entropy of entanglement, implying irreversibility of privacy creation and distillation for a specific class of states.

What carries the argument

privacy dilution, the protocol that converts states containing ideal privacy into ones with diluted privacy

If this is right

The key cost is bounded from below by the regularized relative entropy of entanglement.
Privacy creation and distillation are irreversible for a specific class of states.
A number of entanglement measures coincide for mixed-state analogues of pure states in the privacy domain.
A yield-cost relation holds between privacy cost and distillable key in the single-shot regime.
Basic operational consequences follow for quantum devices.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

The framework draws direct parallels to the resource theory of entanglement, where similar equalities hold for pure states.
The single-shot yield-cost relation may constrain the efficiency of experimental key-generation protocols.
If the bounds are tight for many states, regularization could become the practical route to computing key cost.
The irreversibility result suggests that certain mixed states cannot be used efficiently in both directions of the privacy resource theory.

Load-bearing premise

The definition of key cost assumes that no entangled states exist with zero distillable key.

What would settle it

A concrete quantum state for which the achievable key cost exceeds the regularized key of formation would falsify the upper bound.

read the original abstract

In this paper, we develop the resource theory of quantum secret key. Operating under the assumption that entangled states with zero distillable key do not exist, we define the key cost of a quantum state, and device. We study its properties through the lens of a quantity that we call the key of formation. The main result of our paper is that the regularized key of formation is an upper bound on the key cost of a quantum state. The core protocol underlying this result is privacy dilution, which converts states containing ideal privacy into ones with diluted privacy. Next, we show that the key cost is bounded from below by the regularized relative entropy of entanglement, which implies the irreversibility of the privacy creation-distillation process for a specific class of states. We further focus on mixed-state analogues of pure quantum states in the domain of privacy, and we prove that a number of entanglement measures are equal to each other for these states, similar to the case of pure entangled states. The privacy cost and distillable key in the single-shot regime exhibit a yield-cost relation, and basic consequences for quantum devices are also provided. Importantly, our results presented here will remain valid even if entangled states with zero distillable key were shown to exist.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Desk Editor's Note private letter to a colleague

The paper defines key cost and key of formation for quantum secret key, shows regularized key of formation upper-bounds key cost via privacy dilution, and adds a REE lower bound plus some equalities for mixed privacy states.

read the letter

This paper defines the key cost of a quantum state or device in the resource theory of secret key and pairs it with a key of formation quantity. The main claim is that the regularized key of formation upper-bounds key cost, with the privacy dilution protocol supplying the operational link by turning ideal-privacy states into diluted ones. A lower bound comes from the regularized relative entropy of entanglement, which yields irreversibility for a class of states. For mixed-state analogues of pure privacy states the paper shows several entanglement measures coincide, and it gives single-shot yield-cost relations plus device consequences.

Referee Report

1 major / 1 minor

Summary. The paper develops a resource theory of quantum secret key. Operating under the assumption that entangled states with zero distillable key do not exist, it defines the key cost of a quantum state and device. It introduces the key of formation and shows via the privacy dilution protocol that the regularized key of formation upper-bounds the key cost. It further establishes a lower bound on key cost by the regularized relative entropy of entanglement (implying irreversibility for a class of states), proves equality of several entanglement measures for mixed-state analogues of pure states, and derives yield-cost relations in the single-shot regime. The authors state that all results remain valid even if the zero-distillable-key assumption fails.

Significance. If the central claims hold, the work supplies the first resource-theoretic treatment of quantum secret key, with operational bounds linking cost and formation quantities and a concrete privacy dilution protocol. It mirrors key features of entanglement theory (e.g., regularization, irreversibility, and measure equalities on restricted classes) while providing device-level consequences. Credit is given for the introduction of the key-of-formation quantity and the privacy-dilution construction, both of which receive explicit operational interpretations.

major comments (1)

[Abstract, first paragraph] Abstract, first paragraph: the key cost is introduced under the assumption that entangled states with zero distillable key do not exist. Although the manuscript asserts that the presented results (including the upper bound via privacy dilution) remain valid even if such states exist, the operational definition of key cost itself is conditional on the premise; an explicit argument showing why the privacy-dilution bound continues to hold independently of the assumption is needed to secure the central claim.

minor comments (1)

[Preliminaries] The notation distinguishing single-shot versus regularized quantities (key cost, key of formation) should be introduced with a dedicated table or explicit list in the preliminaries section to aid readability.

Simulated Author's Rebuttal

1 responses · 0 unresolved

We thank the referee for their careful reading and constructive feedback on the manuscript. We address the major comment below.

read point-by-point responses

Referee: [Abstract, first paragraph] Abstract, first paragraph: the key cost is introduced under the assumption that entangled states with zero distillable key do not exist. Although the manuscript asserts that the presented results (including the upper bound via privacy dilution) remain valid even if such states exist, the operational definition of key cost itself is conditional on the premise; an explicit argument showing why the privacy-dilution bound continues to hold independently of the assumption is needed to secure the central claim.

Authors: We agree that an explicit argument is needed to secure the central claim regarding the independence of the privacy-dilution bound. In the revised manuscript we will insert a short clarifying paragraph immediately after the definition of key cost (in the section introducing the resource theory). The argument will state that the privacy dilution protocol itself operates solely on states with positive distillable key and uses only LOCC to dilute their privacy content; it therefore supplies an achievable upper bound on the number of ideal key states required without invoking the non-existence of zero-key states. Consequently the regularized key-of-formation bound remains valid even if the assumption is dropped, and the operational definition of key cost can be understood via the infimum over all protocols achieving the target state. We will also revise the abstract to remove any potential ambiguity. revision: yes

Circularity Check

0 steps flagged

No significant circularity; definitions and bounds are independently derived

full rationale

The paper introduces the key cost under a stated assumption but explicitly asserts that all presented results (including the main upper bound via privacy dilution) remain valid even if the assumption fails. The core claim equates regularized key of formation to an upper bound on key cost through an explicit protocol, with no reduction by construction to fitted parameters, self-definitions, or self-citation chains. No equations or steps in the provided text exhibit the enumerated circular patterns; the derivation is self-contained against external benchmarks.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 3 invented entities

The central claim rests on one domain assumption about the non-existence of zero-distillable-key states and introduces three new entities without external falsifiable evidence.

axioms (1)

domain assumption Entangled states with zero distillable key do not exist
Invoked to define the key cost (abstract, opening sentence); authors note results remain valid even if the assumption fails.

invented entities (3)

key cost no independent evidence
purpose: Quantify the privacy investment required to produce a given quantum state or device
Newly defined quantity central to the resource theory
key of formation no independent evidence
purpose: Auxiliary quantity used to bound the key cost
Introduced to study properties of the key cost
privacy dilution no independent evidence
purpose: Protocol that converts ideal privacy into diluted privacy
Core protocol underlying the upper-bound result

pith-pipeline@v0.9.0 · 5747 in / 1518 out tokens · 33409 ms · 2026-05-24T04:04:51.990799+00:00 · methodology

discussion (0)

Reference graph

Works this paper leans on

19 extracted references · 19 canonical work pages

[1]

untwisting incorrect unitaries,

work page
[2]

applying correct unitaries. The first step is easy to perform because it suffices for Bob to apply the following unitary operation: τ PEC 1 := LmaxO i=1 hX a̸=⊥ |a⟩ ⟨a|serr[i] ⊗ U † a,TA′[i]TB′[i]+ |⊥⟩⟨⊥|serr[i] ⊗ 1 a,TA′[i]TB′[i] i . (S101) 20 Performing the second step requires auxiliary system C initially in state |1⟩C that will be used as a counter. T...

work page
[3]

After these steps, both of them have to swap systems eA′ and A′ to obtain a corrected shield in system A′ and the state |⊥⟩⊗(n+Lmax) in systems eA′ and TA′

apply Ushift scor[i]C. After these steps, both of them have to swap systems eA′ and A′ to obtain a corrected shield in system A′ and the state |⊥⟩⊗(n+Lmax) in systems eA′ and TA′. It only remains to reset the counter by performing Ushift scor[i]C † n times. The description of IPA is as follows. Algorithm 3 Inverting PA 1: procedure IPA(AA′bS1SoutTA′,βx) 2...

work page
[4]

Alice creates ϕ⊗n := P|A|n−1 s=0 √λs|es⟩A′′, and transforms it into eσδ,n := (1 − ε)σδ,n + ε|∅⟩ ⟨∅| by replacing an atypical s with an error state |∅⟩ ⟨∅|, which however occurs with probability less than O(ε)

work page
[5]

Alice applies a unitary transformation that maps |es⟩A′′ into |s⟩A′′. Then she performs coherently a classical encoding C based compression algo- rithm [73] which transforms eσδ,n into σ′ δ,n = (1 − ε) 1 N dn−1X c,c′=0 q λs(c)λs(c′)|c⟩ ⟨c′| + ε|∅⟩ ⟨∅|, (S123) where c is a codeword of the encoding C, the clas- sical encoding maps s 7→ c, and s(c) = C −1(c)...

work page
[6]

Alice performs a two-outcome POVM on the sys- tem A′′ that determines if the system is in the state |∅⟩ or not. If the system A′′ is in the state ∅, Alice publicly communicates this to Bob, and they both replace the system A′B′ with the |∅∅∅∅⟩ABA′B′ state, trace out system A′′, and stop the Privacy Dilution in a failure state, which happens with probabili...

work page
[7]

Alice measures the system A and communicates the result of this measurement x ≡ c ⊕ r publicly to Bob

work page
[8]

Bob performs the unitary transformation |x ⊖ c⟩ → |c⟩ on system B

work page
[9]

Alice and Bob coherently apply the inverse of the compression algorithm C, which transforms |c⟩ back into |s⟩ and |c′⟩ into |s′⟩, respectively

work page
[10]

Alice traces out system A, and Bob traces out the corre- sponding system holding the state of the message |x⟩ ⟨x|

Alice and Bob perform the algorithms to correct phase errors, i.e., apply IPA ◦ PEC◦ PA. Alice traces out system A, and Bob traces out the corre- sponding system holding the state of the message |x⟩ ⟨x|

work page
[11]

phase er- rors

Alice changes coherently a basis state |s⟩A′′ into |es⟩A′′, by applying WA′′ = X s∈T δn |es⟩ ⟨s| + X s /∈T δn |s⟩ ⟨s| + |∅⟩ ⟨∅|, (S124) while Bob changes |s′⟩B to |fs′⟩B analogously. In the next section, we prove that the resulting state (tak- ing into account an error event) of the Dilution Protocol is equal to eγδ,n given in (S116). E. Correctness of th...

work page
[12]

Draw s at random with probability ps in order to produce an approximation ofγ(ψs) from the related private state γd∗n(Φ+)

work page
[13]

For each i ∈ [k], apply Pi to produce a θ- approximation γ+ ≈(ψs) of the state γ+

work page
[14]

If s ̸= s0, trace out some of the subsystems of γ+ ≈(ψs) to obtain the θ-approximation γ≈(ψs) of kO i=1 γ(ψi)⊗li(n). (S147)

work page
[15]

If s ̸= s0, apply the permutation πs to the local subsystems of γ≈(ψs) to create a θ-approximation of γ(ψs)

work page
[16]

dis- tance

Erase the symbol s, producing a mixed state over typical labels s. By construction, the above protocol P creates a θ- approximation of the state eρn, which is locally unitarily equivalent to ρn given in (S138). Let V ≡ VA ⊗ VB de- note the unitary transforming eρn into ρn. Now, by the triangle inequality, the construction of P, and (S138), we obtain V P(γ...

work page
[17]

(S252) These states have vanishing device-independent key cost with increasing dimension ds

for which it is proven in [43], that device independent 34 key is (strictly) upper bounded by KD(ρΓ), there is K ε C(ρAB) ≤ K ε C(ρΓ AB) ≤ 1√ds + 1. (S252) These states have vanishing device-independent key cost with increasing dimension ds. Interestingly, however, they have a device-dependent key rate equal to one. It corresponds to the fact that these s...

work page
[18]

S is closed under tensor product,

work page
[19]

Note that, as an example, the set of all pure states sat- isfies the conditions above

every quantum state ρ can be written as a convex combination of elements from S. Note that, as an example, the set of all pure states sat- isfies the conditions above. A convex-roof measure ES, with respect to the set S of ρ, is then ES(ρ) = inf {(pi,ρi)}i X i pif(ρi) (S255) for some real non-negative valued function f, where the infimum is taken over eve...

work page

[1] [1]

untwisting incorrect unitaries,

work page

[2] [2]

applying correct unitaries. The first step is easy to perform because it suffices for Bob to apply the following unitary operation: τ PEC 1 := LmaxO i=1 hX a̸=⊥ |a⟩ ⟨a|serr[i] ⊗ U † a,TA′[i]TB′[i]+ |⊥⟩⟨⊥|serr[i] ⊗ 1 a,TA′[i]TB′[i] i . (S101) 20 Performing the second step requires auxiliary system C initially in state |1⟩C that will be used as a counter. T...

work page

[3] [3]

After these steps, both of them have to swap systems eA′ and A′ to obtain a corrected shield in system A′ and the state |⊥⟩⊗(n+Lmax) in systems eA′ and TA′

apply Ushift scor[i]C. After these steps, both of them have to swap systems eA′ and A′ to obtain a corrected shield in system A′ and the state |⊥⟩⊗(n+Lmax) in systems eA′ and TA′. It only remains to reset the counter by performing Ushift scor[i]C † n times. The description of IPA is as follows. Algorithm 3 Inverting PA 1: procedure IPA(AA′bS1SoutTA′,βx) 2...

work page

[4] [4]

Alice creates ϕ⊗n := P|A|n−1 s=0 √λs|es⟩A′′, and transforms it into eσδ,n := (1 − ε)σδ,n + ε|∅⟩ ⟨∅| by replacing an atypical s with an error state |∅⟩ ⟨∅|, which however occurs with probability less than O(ε)

work page

[5] [5]

Alice applies a unitary transformation that maps |es⟩A′′ into |s⟩A′′. Then she performs coherently a classical encoding C based compression algo- rithm [73] which transforms eσδ,n into σ′ δ,n = (1 − ε) 1 N dn−1X c,c′=0 q λs(c)λs(c′)|c⟩ ⟨c′| + ε|∅⟩ ⟨∅|, (S123) where c is a codeword of the encoding C, the clas- sical encoding maps s 7→ c, and s(c) = C −1(c)...

work page

[6] [6]

Alice performs a two-outcome POVM on the sys- tem A′′ that determines if the system is in the state |∅⟩ or not. If the system A′′ is in the state ∅, Alice publicly communicates this to Bob, and they both replace the system A′B′ with the |∅∅∅∅⟩ABA′B′ state, trace out system A′′, and stop the Privacy Dilution in a failure state, which happens with probabili...

work page

[7] [7]

Alice measures the system A and communicates the result of this measurement x ≡ c ⊕ r publicly to Bob

work page

[8] [8]

Bob performs the unitary transformation |x ⊖ c⟩ → |c⟩ on system B

work page

[9] [9]

Alice and Bob coherently apply the inverse of the compression algorithm C, which transforms |c⟩ back into |s⟩ and |c′⟩ into |s′⟩, respectively

work page

[10] [10]

Alice traces out system A, and Bob traces out the corre- sponding system holding the state of the message |x⟩ ⟨x|

Alice and Bob perform the algorithms to correct phase errors, i.e., apply IPA ◦ PEC◦ PA. Alice traces out system A, and Bob traces out the corre- sponding system holding the state of the message |x⟩ ⟨x|

work page

[11] [11]

phase er- rors

Alice changes coherently a basis state |s⟩A′′ into |es⟩A′′, by applying WA′′ = X s∈T δn |es⟩ ⟨s| + X s /∈T δn |s⟩ ⟨s| + |∅⟩ ⟨∅|, (S124) while Bob changes |s′⟩B to |fs′⟩B analogously. In the next section, we prove that the resulting state (tak- ing into account an error event) of the Dilution Protocol is equal to eγδ,n given in (S116). E. Correctness of th...

work page

[12] [12]

Draw s at random with probability ps in order to produce an approximation ofγ(ψs) from the related private state γd∗n(Φ+)

work page

[13] [13]

For each i ∈ [k], apply Pi to produce a θ- approximation γ+ ≈(ψs) of the state γ+

work page

[14] [14]

If s ̸= s0, trace out some of the subsystems of γ+ ≈(ψs) to obtain the θ-approximation γ≈(ψs) of kO i=1 γ(ψi)⊗li(n). (S147)

work page

[15] [15]

If s ̸= s0, apply the permutation πs to the local subsystems of γ≈(ψs) to create a θ-approximation of γ(ψs)

work page

[16] [16]

dis- tance

Erase the symbol s, producing a mixed state over typical labels s. By construction, the above protocol P creates a θ- approximation of the state eρn, which is locally unitarily equivalent to ρn given in (S138). Let V ≡ VA ⊗ VB de- note the unitary transforming eρn into ρn. Now, by the triangle inequality, the construction of P, and (S138), we obtain V P(γ...

work page

[17] [17]

(S252) These states have vanishing device-independent key cost with increasing dimension ds

for which it is proven in [43], that device independent 34 key is (strictly) upper bounded by KD(ρΓ), there is K ε C(ρAB) ≤ K ε C(ρΓ AB) ≤ 1√ds + 1. (S252) These states have vanishing device-independent key cost with increasing dimension ds. Interestingly, however, they have a device-dependent key rate equal to one. It corresponds to the fact that these s...

work page

[18] [18]

S is closed under tensor product,

work page

[19] [19]

Note that, as an example, the set of all pure states sat- isfies the conditions above

every quantum state ρ can be written as a convex combination of elements from S. Note that, as an example, the set of all pure states sat- isfies the conditions above. A convex-roof measure ES, with respect to the set S of ρ, is then ES(ρ) = inf {(pi,ρi)}i X i pif(ρi) (S255) for some real non-negative valued function f, where the infimum is taken over eve...

work page