A Quantum Key Distribution Protocol with Selecting Announced States, Robust against Photon Number Splitting Attacks

Eguchi Makoto; Hagiwara Manabu; Hideki Imai

REVIEW

A Quantum Key Distribution Protocol with Selecting Announced States, Robust against Photon Number Splitting Attacks

Eguchi Makoto, Hagiwara Manabu, Hideki Imai

Quantum Physics · Submitted 8 Mar 2006 · 13 references

Pith's verdict: The hybrid BB84/SARG protocol idea is fresh, but the claimed 125 km ultimate limit rests on an impossible state-discrimination construction.

T0 · AI review

How this review was made: An AI referee (deepseek-v4-flash) read the paper on August 28, 2026 and answered a fixed list of questions about it. T0 is the starting level every paper gets. The levels describe how deeply Pith has checked the paper, never the authors.

T0 AI review An AI read the paper and answered a fixed list of questions.
T1 Audit Automatic checks that the references and files the paper relies on exist and match.
T2 Compute The paper's code or calculations re-run with the same results.
T3 Formal statement The claims written out in a formal math language a computer can read.
T4 Proof Those claims proved, and the proof checked by computer.

How Pith checks papers →

· 3 major objections · 5 minor · Ask about this paper · The compiled record · Read the full review →

Challenge this review Comment (0) Read on arXiv ↗

Cite ▾

arXiv IDquant-ph/0603066 (version 1)

Pith IDIAV4GOGR, Pith's permanent record of this paper and its review

CitationEguchi Makoto, Hagiwara Manabu, Hideki Imai. "A Quantum Key Distribution Protocol with Selecting Announced States, Robust against Photon Number Splitting Attacks." arXiv:quant-ph/0603066 (2006). https://pith.science/paper/IAV4GOGR

Cite this reviewBibTeX for Pith's review of this paper

Claim paper

Why Pith says this

Highlight any text to comment on it.

Editor's note

read the letter

Colleague,

Quick take: the protocol family here is a reasonable idea—interpolate between BB84 and SARG04 by having Alice choose, with probability a, which sifting rule to use. That is genuinely new as far as the cited literature goes, and the authors are upfront that a=1 recovers BB84 and a=0 recovers SARG04. The distance-dependent optimization is the right kind of question to ask.

The good parts: the protocol is simple and the comparison is done under a constant sifted-key-rate condition, which is a sensible way to compare implementations with different photon numbers. The reductions to known protocols are correct, and the algebra in Theorem 1—that storage-attack information increases with a and IRUD-attack information decreases with a—appears internally consistent under the stated model.

But the model itself has a load-bearing hole. Section III B claims there exist four orthogonal three-qubit states |Φ_j⟩ with ⟨Ψ_i|Φ_j⟩ = δ_ij/√2 for the four three-photon states. That cannot happen. If the Φ_j are orthonormal, then each Ψ_i would have squared norm 1/2, not 1, because only one term in the basis expansion is nonzero and it has magnitude 1/√2. So the whole unambiguous-discrimination measurement with p_ok=1/2 is not achievable. The correct USD success probability for those four states is about 0.293, not 0.5. Since the IRUD curve in Figure 2 uses p_ok=0.5, the crossover distance and the headline 125 km ultimate limit are not derived. The analysis also only evaluates two specific attacks at QBER=0, and Eve's maximal information is assumed to be the max of these two without proof—but the IRUD error alone already sinks the quantitative claim.

Verdict: this is a conditional idea, not a valid result as it stands. If the security analysis were redone with a correct USD bound, the distance comparison might still show a benefit, but the numbers in this version are unsupported. I would not cite the 125 km claim, and I would not send it to peer review in its current form; but I would encourage the authors to repair the attack analysis, because the hybrid-sifting concept is worth exploring. A serious referee would catch the IRUD error immediately, so if it goes to review, it should be with major-revision expectations.

Best, [Your name]

Referee report

Significance

The proposed protocol is simple and experimentally appealing because it modifies only the classical sifting procedure. The paper's explicit construction of the unambiguous-discrimination measurement for the four three-photon states is correct (I verified the existence of the orthogonal states |Phi_j> with overlap 1/sqrt(2), e.g., Phi1=(|010>+|100>+|101>+|110>)/2 and Phi3=(|000>-|011>)/sqrt(2)), so the p_ok=1/2 IRUD analysis is internally consistent. If the security model were complete, the optimization of a would be a useful contribution. However, the central quantitative claim rests on the unproven assumption that Eve's optimal PNS attack is the maximum of the two considered attacks, and the paper does not state the security criterion that defines the 100 km and 125 km limits.

Major objections (3)

[Section IV (definition of I^P after the two-attack formulas)] The paper sets Eve's maximal mutual information to I^P(a,eta)=max{I^S(a,eta), I^I(a,eta)} without proof. This maximum-over-two-attacks assumption is load-bearing for the headline claim that the robustness limit is extended from 100 km to 125 km: a general PNS attack could interpolate between storage and IRUD or use a different measurement strategy, potentially giving Eve more information and shortening the secure distance. The authors should either prove an upper bound for all PNS attacks or explicitly restrict the claim to the two considered attacks and qualify the abstract accordingly.
[Section IV, Figures 1 and 2] The manuscript never defines the security condition that determines the 'ultimate limit of robustness' at 100 km and 125 km. Without specifying the threshold on Eve's mutual information (e.g., I=1 or some secret-key-rate condition) used to extract these distances from the figures, the quantitative claims are not reproducible. Please state the criterion explicitly and show how it is applied to the plotted curves.
[Sections I and IV] The security analysis is carried out at QBER=0 and does not include error correction, privacy amplification, or finite-key effects. The abstract's unqualified claim that the protocol is 'more secure' than BB84 and SARG is therefore supported only for raw sifted-key information in an idealized model. The authors should either add the missing analysis (or at least a quantitative discussion) or weaken the claim to robustness against the two specific PNS attacks considered.

Minor objections (5)

[Section IV, sentence after Figure 1] The comparison 'I^I(0.5,eta_rho) <= I^I(1,eta_rho)' appears to contradict Theorem 1, which proves that I^I is strictly decreasing in a. If the intended comparison is with SARG (a=0), the expression should read I^I(0.5) <= I^I(0).
[Throughout] There are several typos: 'weal' should be 'weak', 'resprctively' should be 'respectively', 'paramter' should be 'parameter', and the abstract's phrase 'that ended up to be robust' is ungrammatical.
[Header/date] The date 'July 11, 2018' in the header is inconsistent with the arXiv submission date (March 2006); please use the original submission date or explain the discrepancy.
[Section IV, equation for I^I] The denominator of I^I(a,eta_rho) appears to contain mu_a^2, but the derivation in Section III.B yields p_3 proportional to mu^3, so the denominator should contain mu_a^3. If this is a typographical error, please correct it.
[Captions of Figures 1 and 2] The captions refer to 'area I' and 'area II' without defining these regions in the text; please add definitions (e.g., distance ranges) to make the figures self-contained.

How Pith checks papers → · Full audit of this paper →

The paper

The paper claims

A hybrid QKD protocol that mixes BB84- and SARG04-style sifting pushes the distance at which weak-pulse keys survive photon-number-splitting attacks from 100 km to 125 km.

The reading

The paper proposes a class of QKD protocols that splices together the classical announcement steps of BB84 and SARG04: with probability $a$ Alice announces an orthogonal state pair, and with probability $1-a$ a non-orthogonal pair. The central claim is that by tuning $a$ to the fiber length Alice and Bob can always do at least as well as, and beyond roughly 87.5 km strictly better than, either protocol alone against photon-number-splitting (PNS) attacks on weak laser pulses. The authors report that this pushes the maximum secure distance from the 100 km limit of SARG04 to about 125 km, under a specific two-attack security model. Because only the classical sifting procedure changes, the improvement is available to existing weak-pulse QKD hardware.

What carries the argument

The central object is the selecting-announcement parameter $a$: Alice uses BB84-style orthogonal-pair announcements with probability $a$ and SARG-style non-orthogonal-pair announcements with probability $1-a$, and the mean photon number is rescaled to $\mu_a = 2/(1+a)\,\mu_B$ so that the sifted key rate stays fixed. The argument is carried by the two explicit Eve-information formulas $I^S(a,\eta_\rho)$ and $I^I(a,\eta_\rho)$ for the storage and IRUD attacks, together with the classical optimal-measurement result (Lemma 1): the maximum information for distinguishing two states of overlap $\chi$ is $I(\chi)=1-H(\frac12(1+\sqrt{1-\chi^2}))$. This machinery reduces security against either attack to a one-variable optimization over $a$.

Extended reading notes

Core claim

Under the paper's security model, Eve is assumed to use one of two PNS attacks: the storage attack, where she keeps one photon from each multiphoton pulse until the basis is announced, or the intercept-resend-with-unambiguous-discrimination (IRUD) attack on three-photon pulses, and QBER is taken to be zero. For each attack the paper derives Eve's mutual information as a function of the selecting probability $a$ and the channel transmission $\eta_\rho$, and proves that the storage-attack information increases with $a$ while the IRUD information decreases with $a$. Consequently the best $a$ against each individual attack is $a=0$ (SARG-style) for storage and $a=1$ (BB84-style) for IRUD, and the optimum for the maximum of the two attacks sits at an intermediate $a$ that grows with distance. The paper concludes that the optimal-$a$ protocol is more secure than either protocol alone and that its ultimate robustness limit is about 125 km, compared with 100 km for SARG04.

Load-bearing premise

The analysis assumes Eve's strongest PNS attack is always one of two fixed strategies, storage or IRUD, with zero quantum bit error rate; if some other PNS strategy gives Eve more information, the computed 125 km secure distance would shrink.

Editorial extensions

If this is right

For fiber lengths up to about 87.5 km, Alice and Bob should set $a=0$ and run the SARG-style protocol; beyond that distance they gain by mixing in a growing BB84-style component.
At 100 km and beyond, $a=0.5$ already gives Eve less information than SARG04, so the hybrid outperforms the SARG limit at that distance.
With the optimal $a$, the maximum distance at which a key survives PNS attacks moves from 100 km to 125 km, within the paper's two-attack model.
Because the change is only in the classical announcement and sifting phases, existing weak-pulse QKD systems can adopt the protocol without a single-photon source.
The security comparison is made at QBER=0 and at fixed sifted key rate, so the distance claims describe ideal error-free operation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A fully general security proof covering all PNS strategies, not just the storage and IRUD pair, is the natural next step; until then the 125 km figure is conditional on that two-attack model.
The same selectable-announcement idea could be tried with other state sets, such as six-state or higher-dimensional encodings, where the optimal $a$ may behave differently.
A finite-key version of this protocol that includes error rates and statistical fluctuations could turn the asymptotic distance advantage into a practical threshold, though that calculation might shift the 125 km number.

Original abstract

We propose a new class of quantum key distribution protocol, that ended up to be robust against photon number splitting attacks in the weak laser pulse implementations. This protocol comprises of BB84 protocol and SARG protocol, especially in aspects of controlling classical sifting procedures of two protocols. The protocol is more secure than both of BB84 protocol and SARG protocol, and the ultimate limit of robustness in the proposed protocol expands as well than both of them.

The compiled record

The paper's own sentences, arranged, kept beside the review and separate from it. Each label is drawn from a closed vocabulary; the number beside it is the probability the classifier gave that label. Numbers in the tables are the authors', checked by code. No sentence in this record was written by a model.

Compiled by classifier-1.13.0 via TypeSafe API, question bank abstract-p1-20260923, 2026-09-23: 1 request, 2,942 input tokens.

What the abstract itself states, as probabilities: claims first 0.09 · states limitation 0.07 · human participants 0.02 · controlled comparison 0.58 · randomized assignment 0.03 · states quantitative result 0.07 · compares with prior results 0.96 · mentions code or data availability 0.02.

The abstract, sentence by sentence

arXiv listing abstract v1. Results and the main claim are underlined; show every role.

We propose a new class of quantum key distribution protocol, that ended up to be robust against photon number splitting attacks in the weak laser pulse implementations. This protocol comprises of BB84 protocol and SARG protocol, especially in aspects of controlling classical sifting procedures of two protocols. The protocol is more secure than both of BB84 protocol and SARG protocol, and the ultimate limit of robustness in the proposed protocol expands as well than both of them.

background contribution method result interpretation main claim

What the classifier reports for each sentence. The number is the probability it gave the label.
#	sentence	role	the authors' own work	states the main conclusion	strength
s0	We propose a new class of quantum key distribution protocol, that ended up to be robust against photon number splitting attacks in the weak laser pulse implementations.	contribution 0.97	0.86	0.75	asserted 1.00
s1	This protocol comprises of BB84 protocol and SARG protocol, especially in aspects of controlling classical sifting procedures of two protocols.	method 0.76	0.61	0.06	asserted 1.00
s2	The protocol is more secure than both of BB84 protocol and SARG protocol, and the ultimate limit of robustness in the proposed protocol expands as well than both of them.	result 0.93	0.74	0.66	asserted 1.00

What kind of paper the classifier reports this is: method or tool 1.00 · evidence from argument 0.60.

What was examined, and what was not

sources read

arXiv listing abstract v1

not examined

full text
figures and tables
references and citing sentences
relations to other papers

levels run

P abstract

not run

S sections
T body sentences
C citations
R cross-paper relations

Every quoted sentence on this record is the authors'. Every label is from Pith's closed vocabulary, with the probability shown beside it. Every number in the measurements table is the authors', checked by code. Record as JSON

Figures

**Figure 1.** FIG. 1: Security against PNS attacks with QBER = 0. In

**Figure 2.** FIG. 2: Security against PNS attacks when Alice and Bob

Figures reproduced from arXiv:quant-ph/0603066 by the authors.

References

Works cited (13)

[1]

Eve performs a procedure, in which she obtains 0 with the probability q and 1 with the probability 1 − q

View on Pith
[2]

When she gets 1, she only forwards the pulse to Bob using her lossless channel. When she gets 0, she performs one of the two PNS attacks. The attack probability q depends on both a type of her attack and the length of lossy channel, such that Alice and Bob do not notice any change in the expected raw rate and Eve remains undetected. A. Storage Attack We w...

View on Pith
[3]

Eve counts the number of photons in the pulse, us- ing photon number quantum nondemolition mea- surement. If the pulse contains only one photon, Eve discards the photon

View on Pith
[4]

When Eve detects that it is a multiphoton pulse, she keeps one of the photons in a quantum memory and forwards the remaining photons to Bob, using a perfectly transparent quantum channel, ηρ = 1

View on Pith
[5]

By the information in classical announcement phase, Eve correspondingly measures the photon stored in her quantum memory. When Eve applies a storage attack on a fraction q of the pulses, Bob’s raw detection rate is RS(q) = (1 − q)ηdµ + q ∑ n≥2 pn{1 − (1 − ηd)n−1} ≃ (1 − q)ηdµ + qηdp2. By Lemma 1, her mutual information of the key is I S Pr(q) = pηdp2 (1 −...

View on Pith
[6]

Eve measures the number of photons and discards a pulse containing less than three photons

View on Pith
[7]

On the pulse containing at least three photons, Eve performs the measurement M

View on Pith
[8]

If the result is conclusive, she sends a new photon prepared in the good state to Bob using a perfectly transparent quantum channel. If not conclusive, Eve discards the result and the pulse. When Eve applies the IRUD attack on a fraction p of the pulses, Bob’s raw detection rate and Eve’s mutual information are RI (q) = (1 − q)ηdµ + qpok ∑ n≥3 pn{1 − (1 −...

View on Pith
[9]

A. Ac ´in, N. Gisin, V. Scarani, Phys. Rev. A 69, 1 (2004)

View on Pith 2004
[10]

C. H. Bennett, G. Brassard, in Proceedings of the IEEE Conference on Computers, Systems and Signal Processing , Bangalore, India (IEEE, NewYork, 1984), pp. 175-179

View on Pith 1984
[11]

N. L¨ utkenhaus, Phys. Rev. A 61, 052304 (2000)

View on Pith 2000
[12]

A. Peres, Quantum Theory: Concepts and Methods , (Kluwer, Dordrecht, 1998), Sec. 9-5

View on Pith 1998
[13]

V. Scarani, A. Ac ´in, G. Ribordy, N. Gisin, Phys. Rev. Lett. 92, 5 (2004)

View on Pith 2004

Discussion

Disagree with the review, or know something it missed? Leave a comment, highlight any passage above to comment on it, or challenge this review formally.

[1] [1]

Eve performs a procedure, in which she obtains 0 with the probability q and 1 with the probability 1 − q

View on Pith

[2] [2]

When she gets 1, she only forwards the pulse to Bob using her lossless channel. When she gets 0, she performs one of the two PNS attacks. The attack probability q depends on both a type of her attack and the length of lossy channel, such that Alice and Bob do not notice any change in the expected raw rate and Eve remains undetected. A. Storage Attack We w...

View on Pith

[3] [3]

Eve counts the number of photons in the pulse, us- ing photon number quantum nondemolition mea- surement. If the pulse contains only one photon, Eve discards the photon

View on Pith

[4] [4]

When Eve detects that it is a multiphoton pulse, she keeps one of the photons in a quantum memory and forwards the remaining photons to Bob, using a perfectly transparent quantum channel, ηρ = 1

View on Pith

[5] [5]

By the information in classical announcement phase, Eve correspondingly measures the photon stored in her quantum memory. When Eve applies a storage attack on a fraction q of the pulses, Bob’s raw detection rate is RS(q) = (1 − q)ηdµ + q ∑ n≥2 pn{1 − (1 − ηd)n−1} ≃ (1 − q)ηdµ + qηdp2. By Lemma 1, her mutual information of the key is I S Pr(q) = pηdp2 (1 −...

View on Pith

[6] [6]

Eve measures the number of photons and discards a pulse containing less than three photons

View on Pith

[7] [7]

On the pulse containing at least three photons, Eve performs the measurement M

View on Pith

[8] [8]

If the result is conclusive, she sends a new photon prepared in the good state to Bob using a perfectly transparent quantum channel. If not conclusive, Eve discards the result and the pulse. When Eve applies the IRUD attack on a fraction p of the pulses, Bob’s raw detection rate and Eve’s mutual information are RI (q) = (1 − q)ηdµ + qpok ∑ n≥3 pn{1 − (1 −...

View on Pith

[9] [9]

A. Ac ´in, N. Gisin, V. Scarani, Phys. Rev. A 69, 1 (2004)

View on Pith 2004

[10] [10]

C. H. Bennett, G. Brassard, in Proceedings of the IEEE Conference on Computers, Systems and Signal Processing , Bangalore, India (IEEE, NewYork, 1984), pp. 175-179

View on Pith 1984

[11] [11]

N. L¨ utkenhaus, Phys. Rev. A 61, 052304 (2000)

View on Pith 2000

[12] [12]

A. Peres, Quantum Theory: Concepts and Methods , (Kluwer, Dordrecht, 1998), Sec. 9-5

View on Pith 1998

[13] [13]

V. Scarani, A. Ac ´in, G. Ribordy, N. Gisin, Phys. Rev. Lett. 92, 5 (2004)

View on Pith 2004