Pith. sign in

REVIEW 2 major objections 5 minor 78 references

Efficient Multi-basis Quantum Position Verification Secure against Generalized Adversaries

T0 review · 2 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Quantum key distribution can be authenticated by spacetime position alone, with security inherited from the QKD, QPV, and hash sub-protocols.

desk verdict The QPV security analysis is genuinely useful, but the key-exchange protocol at the heart of the paper cannot be instantiated because Protocol 2's codebook is internally inconsistent. read the letter →

arxiv 2506.03549 v2 pith:KRBM325P submitted 2025-06-04 quant-ph cs.CR

Wen Yu Kon , Ignatius William Primaatmaja , Kaushik Chakraborty , Charles Lim This is my paper
classification quant-phcs.CR MSC 81P94 PACS 03.67.Dd
keywords quantumpositionverificationkeydistributionlocationcredentialsQKDauthenticationboundedmemorymulti-basisQPVBB84statessemidefiniteprogramming
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to make quantum key distribution work when the two parties share no pre-shared secret and no public-key infrastructure, using only their spacetime coordinates as credentials. The authors replace the authenticated message steps of a delayed-authentication QKD protocol with quantum position verification (QPV) sub-protocols, and prove that the composed protocol is secure whenever the QKD, QPV, and hash sub-protocols are: Theorem 3 bounds the trace-distance security by $2\varepsilon_{\mathrm{QKD}} + 2\delta + (4\lceil l_K/2\rceil + 2)\varepsilon_{\mathrm{QPV}}$. To close the QPV bottleneck, the paper also generalizes the QPV adversary to mixed states, general channels, input-dependent loss, and shared randomness; tightens the trace-distance bound with a semidefinite program; and proposes a multi-basis QPV that prepares only BB84 states while measuring in many bases. If correct, the protocols let a party at a trusted location exchange keys without any cryptographic credential other than being there.

What carries the argument

The load-bearing object is the reduction of authentication to QPV: a delayed-authentication QKD protocol leaves only one authenticated bit for Bob, so a single QPV run can replace that bit (Protocol 1), and the remaining authenticated hash message from Alice can be sent by a QPV-based message-authentication protocol that transmits only the hash key through QPV runs (Protocols 2-3). Security is then a decomposition of the trace distance into independent terms controlled by the QKD security parameter, the $\delta$-almost strongly 2-universal hash property, and the QPV soundness and robustness parameters. For the QPV analysis itself, the key machinery is a partial purification that lifts mixed states and general quantum channels to pure states and unitaries, a transmission/error partition with a classical-rounding argument, and an NPA-hierarchy semidefinite program whose dual solution lower-bounds the trace distance between low-error strategies.

What would settle it

An adversarial strategy using more than $n/6 - q_0$ qubits of entangled memory that passes the QPV error threshold with probability above $\varepsilon_{\mathrm{QPV}}$, or a concrete non-random $f$ admitting a low-error strategy, would invalidate the error-rate lower bound on which Theorems 3, 7, and 10 rest.

Watch

Extended reading notes

Core claim

The central claim is that position-verification-based authentication can replace both final authentication steps in QKD: Theorem 3 states that Protocol 3 is $(2\varepsilon_{\mathrm{QKD}} + 2\delta + (4\lceil l_K/2\rceil + 2)\varepsilon_{\mathrm{QPV}})$-secure, with robustness $\varepsilon^{\mathrm{rob}}_{\mathrm{QKD}} + (\lceil l_K/2\rceil + 3)\varepsilon^{\mathrm{rob}}_{\mathrm{QPV}}$, where $\varepsilon_{\mathrm{QKD}}$ and $\varepsilon_{\mathrm{QPV}}$ are the security parameters of the QKD and QPV sub-protocols and $\delta$ bounds hash collisions. The paper's supporting discoveries are a generalized QPV adversary model with a purification theorem and transmission/error partition, an SDP-based lower bound on the trace distance between low-error QPV strategies, and a multi-basis QPV protocol whose loss tolerance scales like $1/n$ while using only BB84 state preparation.

Load-bearing premise

The proof only holds when the adversary's quantum memory is bounded well below the protocol length (roughly $q \le n/6 - q_0$) and when the basis-choice function is random; if either condition fails, the QPV soundness that the composed key-exchange theorem inherits disappears.

Editorial extensions

If this is right

  • QKD deployments in protected locations such as data centers could drop pre-shared keys and public-key infrastructure, using position alone for authentication.
  • Because the QKD and QPV stages are decoupled, a key can be generated first and later activated at a designated spacetime point by performing the QPV steps.
  • The generalized adversary analysis extends QPV security to mixed-state and general-channel attacks, while the SDP trace-distance bound tightens the achievable error tolerance.
  • Multi-basis QPV with BB84 state preparation and multiple measurement bases offers a simpler implementation path with loss tolerance that still scales like $1/n$.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The anonymity property the authors note is likely to be useful beyond QKD: because only location is checked, several parties at the same place can use one position credential without revealing which individual acted.
  • The modular trace-distance decomposition should transfer to other QKD protocols with delayed authentication and other QPV sub-protocols, provided their soundness and robustness parameters are plugged in.
  • A direct experimental test of the multi-basis scheme would measure the deviation threshold for three to five measurement bases; matching the predicted $1/n$ loss-tolerance cutoff would support the numerical SDP analysis.
  • If a larger-memory QPV attack is found, the composition theorem may survive but the protocol would need a different QPV sub-protocol, so the practical security of the whole construction tracks progress on QPV itself.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. The paper develops QKD protocols in which a party's spacetime coordinate serves as the authentication credential, taking quantum position verification (QPV) as the underlying sub-protocol. Protocol 1 uses a single QPV run to replace Bob's final authenticated bit in a delayed-authentication QKD protocol; Protocol 3 removes the one-way authenticated channel by sending the hash key through a QPV-based message-authentication primitive (Protocol 2). The main theorem (Theorem 3) reduces the security of Protocol 3 to the security of the QKD, QPV, and hash sub-protocols. The paper also contributes to QPV analysis: a purification-based generalization of the bounded-memory adversary model to mixed states and general quantum channels, an SDP-based lower bound on the trace distance between low-error QPV strategies, and a multi-basis QPV variant using BB84 states.

Significance. If the reduction in Theorem 3 is correct, the paper provides a clean modular route to QKD without pre-shared keys or public-key infrastructure, using position as the only credential. The appendices contain formal proofs for the key-exchange reduction, and the SDP-based trace-distance bound is a concrete improvement over earlier bounds. The paper is also transparent about many limitations, such as the bounded-memory assumption and the mismatch between QKD and QPV adversary models. However, the claimed instantiation of Protocol 2 has a parameterization error that breaks the key-exchange protocol as written, and the multi-basis QPV protocol is not proven secure against the entangled adversaries considered elsewhere. These issues are fixable in principle, but they are load-bearing for the paper's main claims.

major comments (2)
  1. [Sec. IV.B (Protocol 2) and Appendix B] The codeword set as written cannot support an injective encoding. With c in {0,1}^{2l_C+2}, Hamming weight l_K+2, and c_1 = c_{2l_C+2} = 1, the number of available codewords is binomial(2l_C, l_K), not binomial(2l'_C, l'_C). The stated condition binomial(2l'_C, l'_C) > 2^{l_K} forces l'_C approximately l_K/2, hence 2l_C is approximately l_K and binomial(2l_C, l_K) is at most polynomial in l_K, not 2^{l_K}. Therefore no injective map enc: K -> C exists, so Protocol 2 cannot be instantiated, and Protocol 3, which relies on Protocol 2 for authenticated key transfer, is not executable as written. The likely intended fix is to define the Hamming weight as l_C+2 rather than l_K+2; this would make the counting consistent with the security proof's statement that there are l_C runs with C_i = 0. Equation (B3) also has the inequality direction reversed: the condition needed is l'_C > l_K/2, not l'_C <= l_K/2, and the security bound in Theorems 2 and 3 should be stated in terms of the actual minimal l_C.
  2. [Sec. V.E (Protocol 4)] The multi-basis QPV protocol is presented as a main contribution, but its soundness is only analyzed for an adversary with no entanglement. The SDP in Eq. (13) and the numerical results in Fig. 4 concern unentangled attackers, and the text states only that 'we expect' the loss tolerance with entanglement to improve. Since the generalized-adversary analysis in Secs. V.A-V.D is for the single-qubit BB84 protocol, the multi-basis protocol's security against the bounded-memory entangled adversaries used elsewhere remains an open conjecture. Please either provide a proof for the entangled case, cite one, or explicitly label this as a heuristic contribution rather than a proven secure protocol.
minor comments (5)
  1. [Appendix B] The synchronization discussion refers to 'C_1 = C_{2l_C+1} = 1', but the codebook definition fixes c_{2l_C+2} = 1; this off-by-one inconsistency should be corrected.
  2. [Appendix B, Eq. (B5)] The intermediate expression '2 ceil(l_K/4) epsilon_QPV' is inconsistent with the final '2 ceil(l_K/2) epsilon_QPV' in the same displayed inequality; this should be cleaned up.
  3. [Sec. V.E (Protocol 4)] The role of the function f' in Protocol 4 is not specified beyond being public; if security requires f' to be a random function or to satisfy particular combinatorial properties, this should be stated explicitly.
  4. [Abstract and Sec. V.C] The abstract's claim of generalizing the QPV adversary should be tempered by the explicit requirement q <= n/6 - q0 and the use of a random function f in Theorems 7-10; these restrictions are present in the body but should be visible in the summary of contributions.
  5. [General] There are numerous typographical and formatting issues, including 'V erifier', 'T ransfer', 'inforamtion', and inconsistent use of 'robust' vs 'robustness'; a careful proofreading pass is needed.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: Theorem 3 is a modular composition bound whose inputs are the sub-protocol security parameters; the only self-citation (Ref. [16]) is corroborated by an independent reference and is not load-bearing. A non-circular correctness issue in Protocol 2's codebook count is noted in the rationale.

full rationale

The derivation chain is modular rather than circular. Theorem 1 is proved by writing the actual state as a mixture over the parameter-estimation, hash-check, and QPV events, and then applying the QKD security parameter, the hash family's 2-universal collision bound 1/l_T, and the QPV soundness parameter epsilon_QPV; none of these quantities is redefined in terms of the theorem's conclusion. Theorem 2 similarly takes the QPV soundness and robustness and the hash family's delta as exogenous inputs; the proof in Appendix B bounds the probability of changing the codeword from 0 to 1 by the QPV winning probability, which is an assumption, not a restatement of the theorem. Theorem 3 is an explicit composition result: Appendix C splits into cases 10, 01, and 11 and reduces each term to epsilon_QKD, delta, and epsilon_QPV using the same sub-protocol assumptions. The QPV security improvements in Section V are also self-contained: Theorem 4 uses standard purification and Stinespring dilation, Theorem 5 uses covering-number estimates, Theorem 7 uses a counting argument over classical roundings, and Theorem 11's SDP lower bound is justified by the NPA hierarchy and weak duality; the figures are simulations of the proven bounds, not fits to data. The only self-citation is Ref. [16] for delayed-authentication QKD, but it is accompanied by the independent Ref. [15], and the main theorems are conditional on any epsilon_QKD-secure QKD sub-protocol, so the self-citation is not load-bearing. Separate from circularity, there is an internal correctness concern: Protocol 2 selects codewords with two fixed boundary ones and Hamming weight l_K+2, giving only binomial(2l_C, l_K) available codewords, while the stated condition binomial(2l'_C,l'_C) > 2^{l_K} yields 2l_C - l_K = O(log l_K), so the available codebook is subexponential and cannot provide an injective encoding for a seed of length l_K. This is an instantiation flaw, not a circularity, and does not raise the circularity score.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The central claims rest on standard security definitions, on the existence of delayed-authentication QKD from cited prior work, and on the bounded-memory/random-function model for QPV. No free parameters are fitted to data; the numerical SDP bounds are computed, not fitted.

assumptions (5)
  • standard math QKD security definitions and ideal functionality (trace distance to ideal state)
    Used throughout Sec. III and Appendix A as the standard security framework.
  • domain assumption Existence of QKD protocols with delayed authentication that are εQKD-secure and whose final authentication can be replaced by a QPV check
    Invoked in Sec. III and Appendix A, relying on Refs. [15,16].
  • domain assumption QPV adversary has bounded quantum memory q ≤ n/6 - q0 and f is a random function
    Central to Theorems 7-10 in Sec. V.C; if violated, the QPV soundness bound fails.
  • domain assumption Fixed time intervals between QPV internal rounds and between QPV runs, with Δt larger than each run
    Used in Sec. IV.B and Appendix B to rule out synchronization attacks.
  • domain assumption Parties at the claimed spacetime coordinate are honest
    Stated in the security models of Sec. III.A and IV.A; inherent to location credentials.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Efficient Multi-basis Quantum Position Verification Secure against Generalized Adversaries." pith.science (2026). https://pith.science/paper/KRBM325P

@misc{pith2026250603549,
  author       = {Pith},
  title        = {Pith review of: Efficient Multi-basis Quantum Position Verification Secure against Generalized Adversaries},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KRBM325P}},
  note         = {Machine review of arXiv:2506.03549}
}
read the original abstract

Quantum position verification (QPV) enables multiple verifiers to certify a prover's location using quantum communication and physical assumptions. With experimental demonstrations of QPV becoming increasingly feasible, enhancing the practicality and security of QPV protocols is more important than ever. In this work, we make three key contributions toward this goal. First, we introduce a robust QPV protocol in which the verifier's state preparation is independent of channel loss, improving reliability in real-world conditions. Second, we refine existing security analysis techniques to bolster protocol resilience against experimental imperfections. Third, we identify and address some implicit assumptions present in existing security analyses, providing a framework to eliminate such assumptions. Additionally, as an example of QPV application beyond location verification, we illustrate how QPV can be leveraged for authenticating classical communication in quantum key distribution.

Figures

Figures reproduced from arXiv: 2506.03549 by the authors.

Figure 1
Figure 1. FIG. 1. Spacetime diagram illustrating the classical and quan [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. FIG. 2. Plot of error tolerance rate against entangled adver [PITH_FULL_IMAGE:figures/full_fig_p012_2.png] view at source ↗
Figure 3
Figure 3. FIG. 3. Plot comparing the trace distance bound for [PITH_FULL_IMAGE:figures/full_fig_p013_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: FIG. 4. Plot of Deviation against Transmission for proposed [PITH_FULL_IMAGE:figures/full_fig_p014_4.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

78 extracted references · 69 canonical work pages

  1. [1]

    Message Exchange: Message M sent from sender to receiver

    work page

  2. [2]

    The sender sends the tag T to the receiver

    T ag Generation: Sender randomly selects a key K ∈ {0, 1}lK and generates a tag by hashing the message T = hK (M ). The sender sends the tag T to the receiver

    work page

  3. [3]

    Encoding Phase : Sender encodes key into a codeword C = enc(K)

    work page

  4. [4]

    Synchronization Signal: The sender and receiver agree on a time tstart to begin the message transfer

    work page

  5. [5]

    (b) If Ci = 0, the sender provides no response (i.e

    QPV Sub-protocol Runs : Repeat for i = 1, · · ·, 2lC + 2: (a) Receiver performs a QPV sub-protocol with the sender at tstart + (i − 1)∆t. (b) If Ci = 0, the sender provides no response (i.e. ⊥), while if Ci = 1, the sender replies with honest responses. (c) Receiver records ˆCi = 0 if the QPV fails and ˆCi = 1 if the QPV passes

    work page

  6. [6]

    If any checks fail, the protocol is aborted

    T ampering Check: The receiver checks that ˆC1 = ˆC2lC +2 = 1 and HW ( ˆC) = lC + 2. If any checks fail, the protocol is aborted

    work page

  7. [7]

    Otherwise, the message authentication is deemed to have failed

    Key Decoding : If the checks pass, the receiver decodes key ˆK = dec( ˆC). Otherwise, the message authentication is deemed to have failed

    work page

  8. [8]

    ˆT = h ˆK ( ˆM )

    Message Authentication: The receiver hashes the received message ˆM and checks if it matches the received tag, i.e. ˆT = h ˆK ( ˆM ). The message authentication passes if a match is obtained. parties are honest) and εQP V-sound (probability of adversary forcing QPV to pass). For QPV sub-protocols that requires multiple internal rounds, the security model ...

    work page

Show all 78 references
  1. [9]

    Quantum T ransmission Phase: Alice and Bob transfer quantum information, and at the end of the step, Alice generates an Alice raw key SA and Bob generates a Bob raw key SB

  2. [10]

    Sifting and Error Correction: Alice and Bob exchange classical information ( MA, MB), where MA are messages from Alice to Bob and MB are messages from Bob to Alice. They use these messages, along with their respective raw keys to perform sifting, error correction, and paramete...

  3. [11]

    If IP E,A= 1, Alice sends the computed tag T to Bob

    Alice’s Authenticated Message: Alice randomly selects a seed K ∈ {0, 1}m and computes a message tag T = hK (M ). If IP E,A= 1, Alice sends the computed tag T to Bob. Otherwise, Alice sends a random T to Bob

  4. [12]

    If IP E,A= 1, Alice participates in the message transfer honestly

    Authenticated Message T ransfer: After Bob receives the messages, he requests his verifiers to initiate location- based authentication sub-protocol with Alice to receive the seed K as the authenticated message. If IP E,A= 1, Alice participates in the message transfer honestly....

  5. [13]

    if ˆT = T ′

    Message Check: Bob uses the received seed K to compute a tag from his classical messages T ′ = hK (M ′), and checks if it matches the tag received, i.e. if ˆT = T ′. If they match, Bob labels an indicator I = 1, otherwise they label the indicator I = 0

  6. [14]

    If Bob’s indicator signals that the hash matches ( I = 1) and believes parameter estimation passes ( IP E,B), Bob behave honestly in the QPV

    Quantum Position V erification Sub-protocol: Alice requests her verifiers to initiate a partial QPV sub-protocol. If Bob’s indicator signals that the hash matches ( I = 1) and believes parameter estimation passes ( IP E,B), Bob behave honestly in the QPV. Otherwise, Bob does n...

  7. [15]

    Otherwise, Alice aborts and sets KA =⊥

    Privacy Amplification: If the QPV indicator indicates that QPV passed, IQP V = 1, and the parameter estimation passed, IP E,A= 1, Alice performs privacy amplification on her corrected keys to generateKA. Otherwise, Alice aborts and sets KA =⊥. If Bob’s indicator I = 1 and para...

  8. [16]

    p10 is small

    Case 10: Bob does not participate in the QPV sub- protocol, which renders it challenging for an adver- sary to force the QPV sub-protocol to pass, i.e. p10 is small

  9. [17]

    For the former, Alice’s non-participation in sending key K makes it difficult for an adversary to pass the message authentication

    Case 01: Alice can fail to generate keys due to pa- rameter estimation or the QPV sub-protocol. For the former, Alice’s non-participation in sending key K makes it difficult for an adversary to pass the message authentication. For the latter, Alice pa- rameter estimation passi...

  10. [18]

    activate

    Case 11: Similar to case 01, where both Alice’s and Bob’s decision to generate a key means keys are unlikely to be tampered with and thus keys are secret by QKD security. More formally, the security can be presented as Theorem 3. Consider Protocol 3 with a QKD sub- protocol th...

  11. [19]

    Alice receives the qubit prepared by verifier 1, ψθ z Q, where the state is prepared in basis θ = f (x, y) and with bit value z

  12. [20]

    Alice and Bob receive x and y respectively. They independently apply quantum channels E xr AQ and E yr B on their respective quantum subsystems, which may generate classical messages MA and MB to get ρxy RMAMB QAB = P r pr |r⟩ ⟨r|R ⊗ Exr AQ( ψθ z ψθ z Q ⊗ E yr B (σr AB))6

  13. [21]

    In other words, Alice splits AQ → A1A2 and Bob splits B → B1B2, with both parties sending out A2 and B2 respectively

    Alice and Bob redistribute their quantum sub- systems, with Alice sending her message and part of her quantum sub-systems to Bob and vice versa. In other words, Alice splits AQ → A1A2 and Bob splits B → B1B2, with both parties sending out A2 and B2 respectively. 6 The quantum ...

  14. [22]

    Alice and Bob receive the quantum states ex- changed and the other bitstring, with A′ = A1B2 and B′ = B1A2

  15. [23]

    We note that there are five main areas of generalization over the current analysis [9, 10]:

    Alice and Bob independently perform POVMs {AmAmB rxy zA } and {BmAmB rxy zB } on sub-systems A′ and B′ respectively, and responds with zA and zB respectively. We note that there are five main areas of generalization over the current analysis [9, 10]:

  16. [24]

    The inclusion of shared randomness R

  17. [25]

    The use of mixed states σAB instead of pure states

  18. [26]

    Having general quantum channels E xr AQ and E yr B in- stead of assuming that the channels are unitaries

  19. [27]

    Lifting the assumption that loss η is independent of inputs ( x, y)

  20. [28]

    In this study, we examine only the first four general- ization, leaving the final generalization for future work

    Allowing unbounded classical outputs from the quantum channels. In this study, we examine only the first four general- ization, leaving the final generalization for future work. We note that if the set of prepared states are qubit states in the X and Z basis, the state prepara...

  21. [29]

    Formulate a description that can encompass all q- qubit strategies, and argue that we can discretize this set of strategies into a δ-net, where any strat- egy is δ-close to the center of a net in some distance measure

  22. [30]

    Consider the same or an optimal set of strate- gies with low error rate for fixed ( x, y), and show that the distance between two low error strategies corresponding to the different measurement basis θ = f (x, y) is not small, being some distance ˜δ apart

  23. [31]

    This allows the construc- tion of a classical rounding strategy, where mes- sages x and y can be compressed and still recover f (x, y)

    By choosing δ < g(˜δ), we can assign each net to a strategy, and when one of these low error rate strategies are considered for an ( x, y) pair, we can correctly classify them. This allows the construc- tion of a classical rounding strategy, where mes- sages x and y can be com...

  24. [32]

    This results in an upper bound in the winning probability since the remaining pairs do not have low error

    For bounded memory size q, and if there exists a classical rounding, when a random function f is used, then except with small probability, there is a maximum number of (x, y) pairs that can achieve a low error strategy. This results in an upper bound in the winning probability...

  25. [33]

    The proof therefore concludes via contradiction that if the error rate detected is low and the mem- ory size is bounded, no such q-qubit strategy can exist and thus with high probability, the response must be from a party at P . B. Purifying Attack Strategy The first generaliz...

  26. [34]

    l1,r pairs of (x, y) satisfying pe|rxy ≤ εthresη, pt|rxy ≥ ηthres and the matching condition,

  27. [35]

    l2,r pairs of (x, y) satisfying pe|rxy ≤ εthresη, pt|rxy < ηthres and the matching condition,

  28. [36]

    l3,r pairs of (x, y) satisfying pe|rxy > ε thresη, pt|rxy ≥ ηthres and the matching condition,

  29. [37]

    We term the strategy for each r as a sub-strategy with (εthres, ηthres, l1,r, l2,r, l3,r, l4,r)-partition

    l4,r pairs of (x, y) satisfying pe|rxy > ε thresη, pt|rxy < ηthres and the matching condition. We term the strategy for each r as a sub-strategy with (εthres, ηthres, l1,r, l2,r, l3,r, l4,r)-partition. In this definition, there is no explicit assumptions on the r and ( x, y)-d...

  30. [38]

    Verifiers also communicate and agree on a time tP,i

    For i = 1, · · ·, N, repeat the following process: (a) V erifier Preparation: At the start of round i, the first and second verifiers randomly select x′ i ∈ [2n] and y′ i ∈ [2n] respectively. Verifiers also communicate and agree on a time tP,i. (b) Quantum State T ransfer: A t...

  31. [39]

    activation

    Deviation Estimation : V1 and V2 computes the deviation δzsθ = Nzsθ Nsθ − ηp(z|sθ) for each outcome z, state s and basis choice θ, where Nzsθ is the number of rounds with outcome z for state s and basis choice θ and Nsθ = P z Nzsθ . The verifier check if the total deviation δT...

  32. [40]

    Shor, Algorithms for quantum computation: discrete logarithms and factoring, in Proceedings 35th Annual Symposium on Foundations of Computer Science (1994) 16 pp

    P. Shor, Algorithms for quantum computation: discrete logarithms and factoring, in Proceedings 35th Annual Symposium on Foundations of Computer Science (1994) 16 pp. 124–134

    1994

  33. [41]

    C. H. Bennett and G. Brassard, Quantum cryptogra- phy: Public key distribution and coin tossing, Theoreti- cal Computer Science 560, 7 (2014)

    2014

  34. [42]

    C. H. Bennett, G. Brassard, and N. D. Mermin, Quan- tum cryptography without bell’s theorem, Physical Re- view Letters 68, 557 (1992)

    1992

  35. [43]

    A. K. Ekert, Quantum cryptography based on bell’s the- orem, Physical Review Letters 67, 661 (1991)

    1991

  36. [44]

    F. Xu, X. Ma, Q. Zhang, H.-K. Lo, and J.-W. Pan, Secure quantum key distribution with realistic devices, Reviews of Modern Physics 92, 025002 (2020)

    2020

  37. [45]

    Portmann and R

    C. Portmann and R. Renner, Security in quantum cryp- tography, Reviews of Modern Physics 94, 025008 (2022)

    2022

  38. [46]

    J. L. Carter and M. N. Wegman, Universal classes of hash functions, Journal of Computer and System Sciences 18, 143 (1979)

    1979

  39. [47]

    Mosca, D

    M. Mosca, D. Stebila, and B. Ustao˘ glu, Quantum key distribution in the classical authenticated key exchange framework, in Post-Quantum Cryptography , edited by P. Gaborit (Springer Berlin Heidelberg, Berlin, Heidel- berg, 2013) pp. 136–154

    2013

  40. [48]

    Bluhm, M

    A. Bluhm, M. Christandl, and F. Speelman, A single- qubit position verification protocol that is secure against multi-qubit attacks, Nat. Phys. 18, 623 (2022)

    2022

  41. [49]

    L. m. c. Escol` a-Farr` as and F. Speelman, Single-qubit loss-tolerant quantum position verification protocol se- cure against entangled attackers, Phys. Rev. Lett. 131, 140802 (2023)

    2023

  42. [50]

    Allerstorfer, A

    R. Allerstorfer, A. Bluhm, H. Buhrman, M. Christandl, L. Escol` a-Farr` as, F. Speelman, and P. V. Lunel, Mak- ing existing quantum position verification protocols se- cure against arbitrary transmission loss, arXiv preprint arXiv:2312.12614 (2023)

    2023

  43. [51]

    Asadi, R

    V. Asadi, R. Cleve, E. Culf, and A. May, Linear gate bounds against natural functions for position- verification, Quantum 9, 1604 (2025)

    2025

  44. [52]

    Kanneworff, M

    K. Kanneworff, M. Poortvliet, D. Bouwmeester, R. Aller- storfer, P. V. Lunel, F. Speelman, H. Buhrman, P. Steindl, and W. L¨ offler, Towards experimental demon- stration of quantum position verification using true single photons (2025), arXiv:2502.04125 [quant-ph]

    2025 arXiv

  45. [53]

    Buhrman, N

    H. Buhrman, N. Chandran, S. Fehr, R. Gelles, V. Goyal, R. Ostrovsky, and C. Schaffner, Position-based quantum cryptography: Impossibility and constructions, SIAM Journal on Computing 43, 150 (2014)

    2014

  46. [54]

    E. O. Kiktenko, A. O. Malyshev, M. A. Gavreev, A. A. Bozhedarov, N. O. Pozhar, M. N. Anufriev, and A. K. Fe- dorov, Lightweight authentication for quantum key dis- tribution, IEEE Transactions on Information Theory 66, 6354 (2020)

    2020

  47. [55]

    W. Y. Kon, J. Chu, K. H. Y. Loh, O. Alia, O. Amer, M. Pistoia, K. Chakraborty, and C. Lim, Quantum au- thenticated key expansion with key recycling (2024), arXiv:2409.16540 [quant-ph]

    2024 arXiv

  48. [56]

    Escol` a-Farr` as and F

    L. Escol` a-Farr` as and F. Speelman, Quantum position verification in one shot: parallel repetition of the f -bb84 and f -routing protocols (2025), arXiv:2503.09544 [quant- ph]

    2025 arXiv

  49. [57]

    Tomamichel, C

    M. Tomamichel, C. Schaffner, A. Smith, and R. Ren- ner, Leftover hashing against quantum side informa- tion, IEEE Transactions on Information Theory 57, 5524 (2011)

    2011

  50. [58]

    M. M. Wilde, Quantum Information Theory , 2nd ed. (Cambridge University Press, 2017)

    2017

  51. [59]

    W. Peter, Algorithm 950: Ncpol2sdpa—sparse semidef- inite programming relaxations for polynomial optimiza- tion problems of noncommuting variables, ACM Trans- actions on Mathematical Software 41 (2015)

    2015

  52. [60]

    Diamond and S

    S. Diamond and S. Boyd, CVXPY: A Python-embedded modeling language for convex optimization, Journal of Machine Learning Research (2016), to appear

    2016

  53. [61]

    O’Donoghue, E

    B. O’Donoghue, E. Chu, N. Parikh, and S. Boyd, SCS: Splitting conic solver, version 3.2.7, https://github. com/cvxgrp/scs (2023)

    2023

  54. [62]

    Vershynin, Introduction to the non-asymptotic anal- ysis of random matrices, in Compressed Sensing: Theory and Applications, edited by Y

    R. Vershynin, Introduction to the non-asymptotic anal- ysis of random matrices, in Compressed Sensing: Theory and Applications, edited by Y. C. Eldar and G. Kutyniok (Cambridge University Press, 2012) p. 210–268

    2012

  55. [63]

    M. C. Caro, H.-Y. Huang, M. Cerezo, K. Sharma, A. Sornborger, L. Cincio, and P. J. Coles, Generaliza- tion in quantum machine learning from few training data, Nat. Commun. 13, 4919 (2022)

    2022

  56. [64]

    J. H. van Lint, Mathematical background, inIntroduction to Coding Theory (Springer Berlin Heidelberg, Berlin, Heidelberg, 1999) pp. 1–21

    1999

  57. [65]

    Navascu´ es, S

    M. Navascu´ es, S. Pironio, and A. Ac ´ ın, Bounding the set of quantum correlations, Phys. Rev. Lett. 98, 010401 (2007)

    2007

  58. [66]

    Navascu´ es, S

    M. Navascu´ es, S. Pironio, and A. Ac ´ ın, A convergent hi- erarchy of semidefinite programs characterizing the set of quantum correlations, New Journal of Physics10, 073013 (2008)

    2008

  59. [67]

    Boyd and L

    S. Boyd and L. Vandenberghe, Convex Optimization (Cambridge University Press, 2004). Appendix A: Secure Key Exchange with One-way Location Authentication Security Analysis To aid in our analysis, we define a few important events: • ΩM : Message sent by Bob MB matches that rece...

    2004

  60. [68]

    Ω M : Event where messages match, MA = ˆMA and MB = ˆMB (equivalently M = M ′)

  61. [69]

    Ω P E,Aand ΩP E,B: Event where Alice and Bob believes parameter estimation passes, IP E,A= 1 and IP E,B= 1

  62. [70]

    Ω ′ P E,Aand Ω ′ P E,B′: Event where IP E,A= 1 and IP E,B = 1 if they are determined from MA and MB (un- tampered messages)

  63. [71]

    Ω K: Event where the sending of authenticated hash function key is successful ( K = ˆK)

  64. [72]

    Ω T : Event where tag T is not tampered by the adversary

  65. [73]

    the tags match ˆT = h ˆK(M ′)

    Ω H : Event where I = 1, i.e. the tags match ˆT = h ˆK(M ′). If the QPV sub-protocol (step 6) and authenticated message transfer (steps 3 to 5) are replaced by perfect authen- tication channels, both Alice and Bob would decide to jointly generate keys in the event where the me...

  66. [74]

    The purification can be performed in two steps

    Partial Purification We first define the winning probability by through an optimization problem: max σr AB ∈S2q E xr AQ∈Cq+1,E yr B ∈Cq {Axyr z },{Bxyr z } X rzxy pr |X ||Y|Tr h (Πf (x,y) z ⊗ Axyr z ⊗ Bxyr z )ρxyr A′B′V i subj.to X xyr pr |X ||Y|Tr[(IV ⊗ Axyr ⊥ ⊗ Bxyr ⊥ )ρxyr ...

  67. [75]

    Let ∥.∥ be any norm on points x ∈ Rd

    Net Size of Purified Strategy It is known that the upper bound of the covering number of a hypersphere with norm 1 can be given by [23] Theorem 12. Let ∥.∥ be any norm on points x ∈ Rd. The covering number for a δ-net for a norm-ball of unit radius can be bounded by |N | ≤ 1 +...

  68. [76]

    6 Let us choose δ < ˜δ 6

    Proof of Thm. 6 Let us choose δ < ˜δ 6 . Consider δ-nets NS, NA and NB, corresponding to that for the set of pure states of dimension 4 q in Euclidean norm, the set of unitaries acting on Hilbert space with dimension 3( q + 1) in operator norm, and the set of unitaries acting ...

  69. [77]

    7 For a fixed classical rounding of size k, it is possible to implement a maximum of 2 k × (2k)2n × (2k)2n = 2k(2n+1+1) functions

    Proof of Thm. 7 For a fixed classical rounding of size k, it is possible to implement a maximum of 2 k × (2k)2n × (2k)2n = 2k(2n+1+1) functions. Therefore, for a random function f , the probability that we can find a suitable fA and fB such that g(fA(x), fB(y), λ) and f (x, y)...

  70. [78]

    Proof of Thm. 9 We can compute the total error of any sub-strategy with ( εthres, ηthres, {l1,r, l2,r, l3,r, l4,r}r)-partition by perr|r = 1 22n 4X i=1 li,rperr|i, (E6) where perr|i is the average error for events in their respective partitions. We can lower bound this error p...

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.