Recovering Error-Free Cryptographic Keys from Noisy Quantum Key Distribution and Independent Eavesdropper Detection on the Receiving End

Abstract

This work considers the performance and feasibility of a challenge-response pair (CRP)-based key generation method integrated with multi-wavelength Quantum Key Distribution (QKD). In this design, Alice and Bob use independently derived information from the CRP mechanism to encode and recover the key without disclosing helper data. Simulations show that even when up to 40% of the data is corrupted, error-free key recovery is possible with longer response lengths. Another new advantage of this method is that eavesdropper detection is performed using only the statistics of the received quantum stream, as opposed to sacrificing a portion of the key for public comparison, as is required in other QKD schemes. The CRP mechanism and encoding scheme are explained, and the results of key recovery and error detection across various levels of data corruption are presented. The results show that according to the studied conditions, reliable key recovery and eavesdropper detection are possible without publicly comparing the key or using helper data, and it suggests that this approach can reduce classical reconciliation reliance and allow for reliable key recovery in noisy settings without extending security thresholds.

1. Introduction

The establishment of secure and reliable keys is fundamental to protecting data from adversaries. Quantum key distribution (QKD) is a method for key establishment and has emerged as a cornerstone of quantum-safe communication, offering security that remains intact even in the presence of quantum computers. Its unconditional security and ability to detect eavesdroppers through the fundamental principles of quantum mechanics make it an attractive alternative to classical cryptography, which relies on computational hardness assumptions and is increasingly threatened by advances in quantum algorithms.

Despite its theoretical security, the practical implementation of QKD faces significant challenges, specifically regarding noise and data loss. Transmission losses [1,2,3], environmental interactions, and equipment imperfections introduce noise and data loss that introduce errors and therefore degrade the quantum bit error rate (QBER). These obstacles can limit practical implementation by reducing achievable transmission distances and key rates [4,5]. Another persistent challenge lies in differentiating between errors caused by noisy quantum channels and those introduced by an eavesdropper. While QKD protocols like BB84 can detect Eve’s interference when error rates remain below a certain threshold, higher background noise levels can obscure this distinction and can compromise security. Accepting higher error thresholds without sacrificing security requires methods that not only tolerate noise but also maintain the ability to identify Eve’s presence. Additionally, limiting the number of reconciliation steps and the publicly shared information helps maintain security while keeping the protocol efficient.

Most QKD protocols use binary encoding with a single wavelength. However, exploring higher radix encoding and multi-wavelength schemes enables eavesdropping detection through the receiving party’s statistics without sacrificing the final key.

Beyond QKD, other security mechanisms address concerns with secure key establishment. One example relevant to this work is challenge-response pair (CRP) schemes. CRP mechanisms enable reproducible, authenticated key derivation without directly storing the key, thus reducing key exposure. Instead, legitimate parties incorporate shared mechanisms such as encrypted files, physical unclonable function (PUF), cryptographic tables, or other methods as a requirement during the key derivation process. This approach reduces key exposure and limits adversary capabilities because successful interception requires access to the shared mechanisms instead of the transmitted data alone. CRP mechanisms can be incorporated into existing protocols to enable reproducible, authenticated key derivation. This makes CRPs a useful addition to practical QKD, which currently lacks built-in authentication.

In this work, we propose the use of a CRP-based ephemeral key encapsulation-inspired mechanism integrated with multi-wavelength QKD to address both noisy key recovery and eavesdropper detection. By using CRP-based cryptographic tables, Alice and Bob can recover cryptographic keys in noisy conditions without disclosing helper data. Our work demonstrates error-free key recovery for simulated quantum channels with error rates up to 40%. This means that when up to 40% of the transmitted data is corrupted, our results show that key recovery is still possible. Furthermore, we show that Eve’s activity can be inferred directly at the receiving end (Bob) through statistical analysis of received transmission data, eliminating the need to expose key bits for Eve’s detection, as is required in other QKD protocols. This 40% is not increasing the security threshold but rather serves a practical limit for reliable key recovery in QKD without revealing any part of the final key.

The main contributions of this work include the introduction and implementation of a key encoding protocol that combines a CRP mechanism with QKD using two-wavelength transmission. The protocol is evaluated through simulation to quantify how state probabilities change under simulated channel noise and eavesdropping. We establish a baseline for performance and detection capability without sacrificing the final key. This characterization provides practical insight into how quaternary multi-wavelength QKD systems can leverage state statistics for eavesdropping detection. Finally, we discuss the tradeoffs and limitations of the approach, including how protocol parameters influence detection performance, noise tolerance, and the ability of the key encapsulation-like structure to recover from data loss due to noise.

This paper is organized as follows: Section 2 provides an overview of QKD protocols and related prior work. Section 3 describes the integration of the proposed methodology with a multi-wavelength QKD protocol. Section 4 discusses potential security considerations. Section 5 details the experimental setup and procedures. Section 6 presents the experimental results, while Section 7 analyzes and interprets these findings. Finally, Section 8 discusses potential directions for future research.

2. Background Information

2.1. Quantum Key Distribution (QKD)

In theory, QKD offers unconditional security, resistance to eavesdroppers, and maintains its security even with the development of quantum computers. For these reasons, among many others, there is much interest in QKD development as part of the shift toward quantum-safe cryptography [6,7].

The security of QKD protocols is based on quantum mechanical properties. Because of these properties, QKD protocols remain secure even with commercialization of quantum computers, making it a safer method compared to alternatives that are broken by quantum computers (e.g., Rivest–Shamir–Adleman (RSA) and Elliptic Curve Cryptography (ECC)) [8,9,10,11]. The No Cloning Theorem and properties of quantum measurement ensure security. The No Cloning Theorem ensures that a single quantum state cannot be cloned, meaning that an eavesdropper cannot intercept and make a copy of the data [9]. The properties of quantum measurement ensure that a single photon polarization state cannot be measured without changing the state in a way that Alice and Bob can detect [8,12]. For quantum entanglement protocols, eavesdropper detection is possible using the Bell Inequality [13,14,15]. These principles are the basis QKD security.

Noise and error rates remain major challenges for practical QKD implementations, and while post-processing error correction helps mitigate these issues, it comes at a cost to security and efficiency. Transmission distance, hardware imperfections, and environmental interactions all lead to increased communication errors, which consequently limit the achievable key rate. Optical fiber transmission is limited by signal loss over distance, whereas free-space transmission is affected by atmospheric effects. Early implementations demonstrated QKD over distances on the order of tens of kilometers [16]. Twin-Field QKD and post-measurement pairing QKD have enabled longer distances, and more recent QKD systems have achieved distances of hundreds of kilometers [17,18,19,20], which is an improvement but the methods introduce more complexity to the protocols. Furthermore, imperfections in devices can lead to security vulnerabilities that attackers could exploit. To address these errors, a variety of post-processing protocols have been developed for error reconciliation [21,22,23]. Some protocols include Cascade, Winnow, and low-density parity-check (LDPC) codes [24]. These methods require the exchange of redundant information over the classical channel, reducing efficiency, increasing latency, and potentially leaking partial information to adversaries. Other countermeasures also exist. For example, decoy-state protocols and active monitoring improve security but add complexity and cost [25,26]. As a result, there is strong motivation to explore protocol designs that limit the need for extensive error correction.

2.1.1. QKD Protocols

The goal of QKD protocols is to securely generate matching cryptographic keys between two parties Alice (sender) and Bob (receiver). While protocols differ in their details, generally, they aim to securely establish a shared key over an insecure channel.

QKD protocols can be divided into entanglement-based and prepare-and-measure schemes. Entanglement-based protocols use shared entangled states, while prepare-and-measure protocols involve transmitting prepared quantum states for measurement. Despite these differences, both rely on quantum measurement disturbance to detect interference during key distribution.

Generally, QKD protocols consist of two stages using two different channels: the quantum channel communication and the classical channel communication. The quantum channel is used to transmit quantum states, and the classical channel is used for reconciliation. The quantum channel is affected by noise and loss, while the classical channel is public but must be authenticated. QKD systems rely on distinct quantum and classical channels.

There are many notable QKD protocols [15,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41]. Among them, BB84 [13] is one of the earliest and most extensively studied protocols and has served as a reference point for many subsequent developments in QKD. To illustrate how the proposed protocol can be integrated with existing QKD schemes, we focus on BB84 due to its wide adoption and clear structure. While polarization-based protocols such as BB84 have been associated with limited key rates [42,43], they provide a reference for demonstrating protocol integration. The following section will provide a general overview of BB84, as a reference for discussing our protocol.

While BB84 provides a foundational framework for quantum key distribution, several extensions have been proposed to improve its efficiency and robustness. Multi-wavelength QKD framework integrated with a physical unclonable function (PUF) introduce security enhancement and efficiency [44]. The multiple wavelengths enable higher-dimensional encoding (ternary and quaternary) and increasing key generation throughput. Furthermore, high-dimensional QKD enables increased information capacity per photon and improved noise tolerance compared to binary encoding [45,46].

2.1.2. BB84 Protocol

BB84 was proposed by Charles Bennett and Gilles Brassard in 1984 [8]. In BB84, Alice sends data to Bob encoded in single-photon polarization states. The data is encoded in a way that allows Alice and Bob to generate matching secret keys from the transmitted photons [13].

The BB84 protocol encodes data in single-photon polarization states, using two bases: rectilinear ($[+]$) with $0°$ and $90°$, and diagonal ($[\times ]$) with $45°$ and $135°$ [47]. Alice prepares a random bit string, assigns each bit a random basis, and polarizes the photons accordingly. Bob independently measures each photon using a randomly chosen basis. After transmission, Alice and Bob reveal their basis choices over a classical channel and retain only the bits measured in matching bases, which ideally produce identical values. Figure 1 shows the BB84 encoding scheme. This part of the protocol is called sifting, and the resulting key is called the sifted key.

Figure 1. BB84 photon polarization encoding scheme used to encode binary 1’s and 0’s into single photon polarization states according to the BB84 protocol.

The next step is error rate estimation. Security is ensured by sacrificing a subset of the key to assess its error rate. If the observed error rate remains below a predefined threshold, the remaining bits are distilled into the final cryptographic key. Otherwise, the session is aborted because errors above the threshold indicate the possible presence of an eavesdropper. This process ensures that any interception leaves detectable traces, and allows QKD protocols such as BB84 to provide secure key establishment under realistic conditions [44].

Error rate estimation works because Eve’s interception affects the error rate. For Eve to interfere, she must choose one of the two bases and measure the photon. If Eve guesses the same basis as Alice, then Eve should not produce detectable errors. On average, Eve will guess correctly 50% of the time. However, if she guesses incorrectly, Eve will introduce detectable errors. This should result in $50\%\times 50\%=25\%$ error in Bob’s final key. If enough bits are sent and noise is low, Alice and Bob can detect eavesdropper error when they compare a subsection of their key [48].

2.1.3. QKD Equipment Vulnerabilities

Equipment limitations and imperfections introduce weaknesses in QKD protocols and motivate the need for approaches that can tolerate noise and vulnerabilities [49]. Equipment like single-photon sources may emit multiple or zero photons per pulse. Multi-photon pulses are vulnerable to photon number splitting (PNS) attacks, where Eve measures or stores extra photons for herself and forwards the remaining photons to Bob without detection [7,12,50]. Synchronization is another problem that QKD protocols face that can cause errors due to timing misalignment. Methods like qubit synchronization [51,52] and qubit clock synchronization [53] exist to address this issue. Single-photon detectors can also introduce vulnerabilities, because Eve may exploit imperfect timing biases or manipulate detectors in blinding attacks to extract information [7,50]. Countermeasures such as decoy states and photocurrent monitoring have been proposed to mitigate these threats [50,54,55,56], yet equipment imperfections continue to limit practical QKD performance, so methods to address noise and security are needed.

2.2. Error Correction in QKD

In QKD systems, the raw keys created after quantum transmission often have errors because of noise, signal loss, and imperfect equipment. To obtain identical keys, the communicating parties perform a series of classical post-processing steps over the classical channel. These steps include reconciliation and privacy amplification. A fundamental challenge in QKD is error correction because high error rates limit transmission distance, key rates, and feasibility of widespread implementation. Transmission loss increases exponentially over longer physical communication channel distances [2,3,57,58,59]. Methods to address errors include post-processing error correcting codes, quantum error correction, utilizing decoherence-free states, and quantum repeaters.

2.2.1. Error Correcting Codes

Post-processing error correcting codes and the use of helper data can mitigate errors [60]. These methods can require redundant information for correcting errors, which, in turn, can limit the overall efficiency and capacity of the quantum channel [61,62,63,64]. However, such post-processing methods often add complexity, increase computation time, and can leak information to adversaries [24,65,66].

Some QKD implementations rely on interactive error reconciliation algorithms such as Cascade and Winnow. These methods work by exchanging information over multiple communication rounds to find and correct bit errors in the key. Despite being effective at error correction, these schemes reveal additional information during communication, which can increase latency and information leakage. Winnow reduces the number of iterations compared to Cascade by using Hamming codes instead of binary search operation, but still requires multiple communication rounds. As a result, there has been significant interest in developing more efficient and less interactive reconciliation methods [21].

Other QKD implementations rely on forward error reconciliation protocols such as low-density parity-check (LDPC) codes. Unlike iterative protocols such as Cascade and Winnow, forward error correction schemes should only require one interaction in theory, and thus, reduce communication rounds and latency. While the LDPC decoding process requires greater computational and memory resources, it significantly reduces communication overhead by limiting reconciliation to a single information exchange. These post-processing tradeoffs motivate improvements that are addressed by our proposed key encoding approach.

2.2.2. Other Methods for Handling Errors

Beyond classical post-processing, several approaches attempt to address noise and loss in QKD systems at the physical and network levels. These include quantum error correction, trusted nodes, and quantum repeaters. The following summarizes each method:

1.

Quantum Error Correction: Quantum error correction takes into account quantum information constraints and is necessary for systems that use quantum data because existing classical computing error correction is not directly applicable due to differences in the behavior of quantum bits [67,68,69]. Some quantum error correction methods make assumptions about the location of errors in the system, while others do not require these assumptions, at the cost of complexity and number of quantum bits needed [68]. Decoherence-free states are robust against environmental interaction errors and offer another solution [4,5,70].

2.

Trusted Nodes: Another option for handling errors is to introduce trusted or untrusted relay nodes to read and transmit data between communicating parties and help overcome signal loss, but such a solution comes at the cost of security [59,71,72]. Trusted nodes introduce a security vulnerability because security is breached if any nodes are compromised. Ideally, security should be preserved even if the adversary controls a node. For this reason, untrusted relay node protocols are in development [71]. Because each relay node adds equipment cost and information vulnerability, minimizing the number of nodes is ideal for scalability. Wavelength-division multiplexing (WDM), entanglement QKD protocols, and satellite nodes can assist in the scalability and cost [7,58,59]. However, despite cost improvement, the major drawback of relay nodes is the security risk added by each node.

3.

Quantum Repeaters: Quantum repeaters are a technology theorized to restore the transmitted quantum information without measurement, and if developed, can enable longer transmission distances [58,71,72]. However, such technology continues to be a challenge that will likely rely on further development of quantum memory [58,59,71,72,73,74]. Additionally, even with ideal quantum repeaters, they also introduce additional costs and can be a target for adversary attacks.

With noise as a fundamental obstacle in QKD, error correction methods are vital for widespread implementation, and further research is needed for developing such methods.

2.3. Challenge Response Pair Mechanism

The Challenge Response Pairs (CRP) mechanism is used to verify the identity of a user or device, ensuring that access is granted only to authorized users. CRP systems consist of input parameters referred to as the challenge and corresponding output values referred to as the response [75,76]. In typical usage, the authenticating entity (e.g., server) sends a challenge to the user that is being authenticated (e.g., client). The user that is being authenticated uses a secret, such as a cryptographic table or encrypted file, to compute a response based on the challenge. The authenticating entity then verifies this response. If it matches the expected response, authentication is successful.

3. CRP-Based Ephemeral Key Encoding and Obfuscation Method for Independent Eavesdropping QKD Systems

In this section, we describe how the CRP-based key encoding mechanism proposed in [77,78] can be integrated with QKD. The CRP-based key encoding approach provides a mechanism to handle errors in transmitted encoded ephemeral keys. By embedding this method within a QKD framework, we aim to provide a theoretical approach that can support more reliable key recovery and error detection in future practical QKD implementations.

3.1. Ephemeral Key Encoding and Reconstruction of the Ephemeral Key

1.

Ephemeral Key and Response Generation:

Alice and Bob independently use a shared encrypted file to generate the same CRP mechanism and from this CRP mechanism, they generate the same set of responses R.

2.

Ephemeral key Encoding:

Alice generates and encodes an ephemeral key K by using this ephemeral key to select a subset of responses from her full set of responses. To encode K, Alice selects only those responses whose positions correspond to bits set to “1” in the ephemeral key. This subset of responses can be thought of as the encoded ephemeral key. Each bit of this subset is obfuscated following the process explained in the Section 3.4. Alice transmits this encoded ephemeral key to Bob in a process almost identical to BB84 by encoding her responses in single photon polarization states. These photons are sent through the quantum channel.

3.

Reception and Preliminary Processing:

Bob receives the qubits and measures them in his randomly chosen bases. After publicly exchanging the basis, he disregards all measurement outcomes obtained in mismatched bases and keeps only the outcomes where his measurement basis matches Alice’s basis. This gives a sifted subset of responses. However, Bob initially does not know which specific bit positions in K these responses represent.

4.

Error Detection via Response Matching:

Bob performs error detection by comparing each received response against the complete set of locally generated CRP responses. The detailed process is provided in Algorithm 1. The algorithm operates within a dynamically adjustable search window and computes the Hamming distance ($d_H(x,y)$) between each received response $R_{s_j}^{″}$ and every candidate $R_i$ in that window. The effect of different sizes of this search window is extensively studied in [79]. If no distances fall below the predefined threshold T, the response is tagged as a No Match; if exactly one candidate is within the threshold, it is recorded as a One Match; and if multiple candidates qualify, a Collision is logged.

The output of the algorithm consists of three lists—NoMatches, OneMatch, and Collisions—that summarize the classification results for all received responses.

Each OneMatch directly maps to a bit value of “1” in the ephemeral key, revealing a reliable correspondence between Alice’s transmitted subset and Bob’s generated table. The NoMatches and Collisions entries, on the other hand, identify error bits that require further processing in the next phase.

5.

Key Recovery:

Following the initial reconstruction, Bob analyzes the algorithm’s output to identify uncertain bits in the key. Positions recorded in the No Match or Collision categories indicate potential bit errors or alignment uncertainties introduced by channel noise, photon loss, or any other environmental effect. To correct these errors, Bob employs bit flipping and hash comparison. He sequentially flips one or more of the erratic bits within the uncertain regions and recomputes the hash of the reconstructed key $H\left(K^{\prime }\right)$. This hash is then compared against the reference hash of Alice’s ephemeral key $H\left(K\right)$, which was securely shared through the classical channel. If the hashes do not match, Bob continues flipping different combinations of the uncertain bits, re-evaluating the hash after each iteration. The process repeats until $H\left(K^{\prime }\right)=H\left(K\right)$, indicating that the correct key has been successfully reconstructed. See Algorithm 2 for further details.

Algorithm 1 Error Detection Protocol

Input: Subset of responses $\{R_{s_1}^{″},\dots ,R_{s_n}^{″}\}$, full set $\{R_1,\dots ,R_n\}$, window ${\gamma }_0$, threshold T        Output: Lists NoMatches, OneMatch, Collisions        Initialization   1: Set $i=1,j=1,\gamma ={\gamma }_0$   2: Initialize NoMatches, OneMatch, Collisions $\leftarrow \varnothing$ Main Comparison Loop   3: while $i\le n$ do   4:     Compute $d_H(R_{s_j}^{″},R_{i+k})$ for $k=0,\dots ,\gamma -1$   5:     if no $d_H(R_{s_j}^{″},R_{i+k})\le T$ then   6:         Append all $i+k$ to NoMatches   7:         $i\leftarrow i+1$, $j\leftarrow j+1$, $\gamma \leftarrow 2{\gamma }_0-1$   8:     else if exactly one $d_H(R_{s_j}^{″},R_{i+k})\le T$ then   9:         Append that index to OneMatch 10:         $i\leftarrow i+k+1$, $j\leftarrow j+1$, $\gamma \leftarrow {\gamma }_0$ 11:     else 12:         Identify $k_{min},k_{max}$ where $d_H(R_{s_j}^{″},R_{i+k})\le T$ 13:         Append all corresponding indices to Collisions 14:         $i\leftarrow i+k_{min}+1$; $\gamma \leftarrow {\gamma }_0+(k_{max}-k_{min})$ 15:         $j\leftarrow j+1$ 16:     end if 17: end while        Return: NoMatches, OneMatch, Collisions

Algorithm 2 Key Recovery

1: Input: N (length), $H\left(k\right)$ (Hash of Key), NoMatches[], OneMatch[], Collisions[]   2: Initialize $K^{\prime }$ as an array of zeros with length N   3: for each position $pos$ in OneMatch[] do   4:     Flip the bit at position $pos$ in $K^{\prime }$   5: end for   6: if NoMatches[] and Collisions[] are empty then   7:     Output: $K^{\prime }$   8: else   9:     Combine NoMatches[] and Collisions[] into a list of lists Combined[] 10:     for each combination $combo$ of bits from Combined[] do 11:         Flip the bits in $K^{\prime }$ according to $combo$ 12:         if $\mathcal{H}\left(K^{\prime }\right)=H\left(k\right)$ then 13:            Output: K 14:            break 15:         end if 16:     end for 17: end if 18: Output: Failed to find the key

3.2. Transmission of Quatrits with Two Wavelengths

While many QKD implementations encode binary (two states) information into single photon polarization using a single wavelength, our work encodes quatrit (four states) information using two wavelengths. To support the four state quatrits ($z_i\in \{0,1,2,3\}$), a single wavelength is insufficient because polarization alone offers only two orthogonal states within each measurement basis. To overcome this limitation, the proposed protocol employs a two-wavelength encoding scheme that doubles the number of distinguishable quantum states to encode data in. Each wavelength carries two orthogonal polarizations, allowing the combined system to represent four quatrits.

In this scheme, the two wavelengths are represented by distinct colors (green and red). Within each wavelength, photons are polarized according to one of two bases: the rectilinear basis (+), corresponding to horizontal ($0°$) and vertical ($90°$) polarizations, and the diagonal basis (×), corresponding to $45°$ and $135°$ polarizations as shown in Table 1.

Table 1. Polarization states associated with qubit polarization for encoding, where the color green and red represents wavelength color.

${\mathit{z}}_{\mathit{i}}$	+	×
0	0°	45°
1	90°	135°
2	0°	45°
3	90°	135°

3.3. Data Obfuscation

The protocol employs an obfuscation mechanism that masks the transmitted data stream and enables eavesdropper detection without revealing any portion of the secret key. This obfuscation technique is based on modular arithmetic and operates on subset of responses generated from the ephemeral key encoding. The input to the obfuscation process can be represented as binary sequence of length k bits,

$$\{x_1,x_2,\dots ,x_k\},x_i\in \{0,1\}.$$

This binary sequence is combined with a pre-shared stream of k quatrits (sometimes referred to as the nonce)

$$\{y_1,y_2,\dots ,y_k\},y_i\in \{0,1,2,3\},$$

which is known to both Alice and Bob. This pre-shared stream or nonce can also be replaced with a physical unclonable function or cryptographic table.

For each position i, the transmitted symbol $z_i$ is computed as

$$z_i\equiv (x_i+y_i)mod4.$$

(1)

The resulting sequence $\{z_1,z_2,\dots ,z_k\}$ therefore represents an obfuscated stream of quatrits to then be encoded into qubits (i.e., single photon polarization states) and sent through the quantum channel.

This modular transformation maps the original binary response state space into four state system, thereby masking the underlying key information.

When $x_i=0$, there is no effect of modular addition with $y_i$, and the transmitted value is

$$z_i=y_i.$$

When $x_i=1$, the operation shifts the shared quatrit value by one position within the symbol set $\{0,1,2,3\}$,

$$z_i\equiv (y_i+1)mod4.$$

with the modulo addition, ensuring that the result remains within the valid quatrit range.

Without knowledge of the shared stream $y_i$, an eavesdropper cannot distinguish whether a given transmitted symbol corresponds to $x_i=0$ or $x_i=1$, preventing direct inference of the original data.

At the receiver’s end, the inverse operation is applied to obtain the original stream:

$$x_i\equiv (z_i+3y_i)mod4.$$

(2)

The Equation (2) corresponds to combining the received sequence z with the shared stream $3y$ (the modular inverse of y) to retrieve the original bit sequence x.

Figure 2 illustrates the complete encoding and decoding process within the proposed QKD architecture. The shared quatrit stream y functions as a cryptographic mask that conceals the transmitted key information while simultaneously introducing a structured dependency between the transmitted and recovered symbols. Any unauthorized measurement or interception disrupts this structure and results in error patterns exceeding those predicted by the estimated quantum channel noise. Such deviations provide a quantifiable indicator of eavesdropper activity on the channel.

Figure 2. Schematic representation of the key encoding and decoding process in the obfuscation protocol. The shared stream of quatrits, denoted as y, is combined with the initial key stream x using the XOR operation to create z, which is transmitted through the quantum channel (QC). The receiver then applies the reverse operation with the shared stream $3y$ to retrieve the original key stream x.

3.4. Eavesdropper Detection Based on Probability Analysis

One of the challenges in QKD is distinguishing between errors caused by quantum channel noise and those deliberately introduced by an eavesdropper [80]. In protocols such as BB84, eavesdropper detection is performed by measuring the error rate introduced by an intercept-resend attack, which typically increases the QBER by about 25%. However, noise due to factors such as the channel, equipment, or environment can obscure Eve’s presence, making it difficult to determine whether the observed errors arise from non-eavesdropper sources or from eavesdropping because both cause the QBER to increase.

In this work, eavesdropper detection is performed through a probability analysis that exploits the structure of the proposed encoding scheme.

3.4.1. Quantum Channel Error Analysis

In this work, we assume a noisy quantum channel model in which polarization flips between complementary states. Under this model, quatrit symbols $\{0,1\}$ form one complementary pair and $\{2,3\}$ form the other. A channel error therefore causes a transmitted symbol to flip only to its complementary counterpart.

These transitions are deterministic for a given wavelength and measurement basis: each transmitted state can only transition to one other state. For example, in the rectilinear basis, a transmitted symbol $z_i=0$ (0°) can only flip to $z_i^{\mathsf{*}}=1$ (90°), and vice versa. Similarly, in the diagonal basis, $z_i=2$ can only flip to $z_i^{\mathsf{*}}=3$, and $z_i=3$ can only flip to $z_i^{\mathsf{*}}=2$.

Therefore, these transition limitations result in a reduced set of potential combinations that Bob can receive, which will be elaborated upon in the following sections. As shown in Table 2, ${\beta }_i=1$ denotes a forward flip (e.g., $0\to 1$ or $2\to 3$), and ${\beta }_i=-1$ denotes a backward flip (e.g., $1\to 0$ or $3\to 2$). A transmission without error corresponds to ${\beta }_i=0$.

Table 2. Representing the effect of a polarization flip on each transmitted photon. The Bits in and Bits out columns are the binary representation of the Quatrit in and Quatrit out representation, respectively. The value of ${\beta }_i$ corresponds to a single bit flip error which is represented in red.

Bits in	Quatrit in (${\mathit{z}}_{\mathit{i}}$)	Quatrit out (${\mathit{z}}_{\mathit{i}}^{\mathsf{*}}$)	Bits out	${\mathit{\beta }}_{\mathit{i}}$
00	0	1	01	1
01	1	0	00	$-1$
10	2	3	11	1
11	3	2	10	$-1$

The transmitted symbol is computed by Alice as using Equation 1 where $x_i$ is the binary response bit and $y_i$ is the pre-shared quatrit stream. In the presence of a channel error, Bob receives

$$z_i^{\mathsf{*}}\equiv (z_i+{\beta }_i)mod4.$$

Bob then applies the inverse obfuscation step to recover the received output

$$x_i^{\mathsf{*}}\equiv (z_i^{\mathsf{*}}+3y_i)mod4.$$

Substituting for $z_i^{\mathsf{*}}$ and simplifying yields

$$\begin{array}{cc}\hfill x_i^{\mathsf{*}}& \equiv (z_i+{\beta }_i+3y_i)mod4\hfill \\ & \equiv (x_i+y_i+{\beta }_i+3y_i)mod4\hfill \\ & \equiv (x_i+{\beta }_i)mod4.\hfill \end{array}$$

Table 3 shows all combinations of the input bit $x_i$ and the pre-shared nonce $y_i$, along with the corresponding outcomes of $x_i^{\mathsf{*}}$. For each case, the error term ${\beta }_i$ takes a value of either $+1$ or $-1$, resulting in exactly two possible erroneous quatrit outputs.

Table 3. Outcome of single bit flip errors on quatrit ($x_i^{\mathsf{*}}\equiv x_i+{\beta }_{i}mod4$). The table details the final output quatrits ($x_i^{\mathsf{*}}$) and their corresponding error values (${\beta }_i$) when each initial quatrit ($z_i$) is subject to a one-bit error, given a specific pre-shared nonce ($y_i$).

${\mathit{x}}_{\mathit{i}}$	${\mathit{y}}_{\mathit{i}}=0$	${\mathit{y}}_{\mathit{i}}=1$	${\mathit{y}}_{\mathit{i}}=2$	${\mathit{y}}_{\mathit{i}}=3$
0	$\begin{array}{cc}\hfill z_i& =0\hfill \\ \hfill {\beta }_i& =1\hfill \\ \hfill x_i^{\mathsf{*}}& =1\hfill \end{array}$	$\begin{array}{cc}\hfill z_i& =1\hfill \\ \hfill {\beta }_i& =-1\hfill \\ \hfill x_i^{\mathsf{*}}& =3\hfill \end{array}$	$\begin{array}{cc}\hfill z_i& =2\hfill \\ \hfill {\beta }_i& =1\hfill \\ \hfill x_i^{\mathsf{*}}& =1\hfill \end{array}$	$\begin{array}{cc}\hfill z_i& =3\hfill \\ \hfill {\beta }_i& =-1\hfill \\ \hfill x_i^{\mathsf{*}}& =3\hfill \end{array}$
1	$\begin{array}{cc}\hfill z_i& =1\hfill \\ \hfill {\beta }_i& =-1\hfill \\ \hfill x_i^{\mathsf{*}}& =0\hfill \end{array}$	$\begin{array}{cc}\hfill z_i& =2\hfill \\ \hfill {\beta }_i& =1\hfill \\ \hfill x_i^{\mathsf{*}}& =2\hfill \end{array}$	$\begin{array}{cc}\hfill z_i& =3\hfill \\ \hfill {\beta }_i& =-1\hfill \\ \hfill x_i^{\mathsf{*}}& =0\hfill \end{array}$	$\begin{array}{cc}\hfill z_i& =0\hfill \\ \hfill {\beta }_i& =1\hfill \\ \hfill x_i^{\mathsf{*}}& =2\hfill \end{array}$

Figure 3 presents an expansion of this mapping in Table 3 that models all possible transitions from a transmitted input $x_i$ to a received output $x_i^{\mathsf{*}}$ under a quantum channel error rate $\alpha$. Establishing the baseline channel error rate $\alpha$ requires calibration and characterization under trusted conditions. The diagram explicitly accounts for basis selection, measurement outcomes, and polarization flips. The conditional probabilities $P(x_i^{\mathsf{*}}\mid x_i)$ are obtained by summing the probabilities of all paths leading from $x_i$ to $x_i^{\mathsf{*}}$, resulting in:

$$\begin{array}{c}{P}_{noeve}(x_i^{\mathsf{*}}=0\mid x_i=0)={\displaystyle \frac{1-\alpha }{2}},\hfill \\ P_{noeve}(x_i^{\mathsf{*}}=1\mid x_i=0)={\displaystyle \frac{\alpha }{4}},\hfill \\ P_{noeve}(x_i^{\mathsf{*}}=2\mid x_i=0)=0,\hfill \\ P_{noeve}(x_i^{\mathsf{*}}=3\mid x_i=0)={\displaystyle \frac{\alpha }{4}},\hfill \\ P_{noeve}(x_i^{\mathsf{*}}=0\mid x_i=1)={\displaystyle \frac{\alpha }{4}},\hfill \\ P_{noeve}(x_i^{\mathsf{*}}=1\mid x_i=1)={\displaystyle \frac{1-\alpha }{2}},\hfill \\ P_{noeve}(x_i^{\mathsf{*}}=2\mid x_i=1)={\displaystyle \frac{\alpha }{4}},\hfill \\ P_{noeve}(x_i^{\mathsf{*}}=3\mid x_i=1)=0.\hfill \end{array}$$

Figure 3. Non-eavesdropper scenario probabilistic decision tree illustrating all possible transitions from a transmitted input $x_i$ to a received output $x_i^{\mathsf{*}}$ for all possible nonce $y_i$ under the quantum channel error model, accounting for basis selection, polarization flips, and measurement outcomes. The green color represents the photon polarization state in one wavelength. The red color represents the photon polarization state in the other wavelength. A question mark indicates a randomized state due to measurement. The pink text corresponds to the probability. The blue labels indicate possible variable values for each scenario.

Using this distribution, the expected number of occurrences of each received quatrit $x_i^{\mathsf{*}}$ in Bob’s sifted sequence can be estimated. The conditional probability distribution $P(x_i^{\mathsf{*}}\mid x_i)$ enables estimation of the expected occurrence rate of each received symbol in Bob’s sifted sequence. Under normal operating conditions, the appearance of invalid states is determined by the quantum channel error rate $\alpha$ and follows a predictable distribution. This expected behavior serves as a reference model, allowing deviations beyond the predicted noise-induced error to be identified as potential evidence of eavesdropping.

The Algorithm A1 in Appendix A shows how we implemented the quantum channel error. For simplicity and this initial work, we decided to simulate quantum channel error under the assumption that a quatrit will always flip to the incorrect value; and the quantum channel error rate determines the percentage of quatrits that flip to the incorrect value.

3.4.2. Differentiating Eavesdropping-Induced Errors from Channel Noise

The goal of the eavesdropper detection mechanism is to reliably distinguish errors caused by inherent quantum channel noise from those introduced by an intercept-resend adversary. This distinction is achieved by analyzing the statistical distribution of the recovered quatrits after de-obfuscation and comparing the observed error behavior to the expected distribution under normal channel conditions. The deviation between these two distributions, denoted as $\Delta$BER, serves as a decision metric that indicates whether the observed errors are consistent with channel noise alone or suggest the presence of an eavesdropper.

In this work, we adopt an error model in which quantum channel errors are treated as deterministic bit-flip events. Specifically, we assume that any channel error always results in an incorrect bit value at the receiver. Additionally, we model an intercept–resend eavesdropper who measures every transmitted qubit using a randomly chosen basis. When Eve’s measurement basis matches that of the sender, no error is introduced; when the bases differ, Eve’s measurement outcome is random, leading to a bit error with probability 50%. Under these assumptions, channel-induced errors and eavesdropper-induced errors contribute independently to the overall bit error rate.

The impact of an intercept-resend attack on the received symbol distribution is analyzed using the probabilistic decision tree shown in Figure 4. When Eve intercepts a quantum state, she performs a measurement in a randomly selected basis and resends the resulting state to Bob. If her basis choice coincides with Alice’s, the transmitted state remains unchanged; otherwise, the disturbance introduced by the measurement propagates through the channel and affects Bob’s final observation.

Figure 4. Eavesdropper scenario probabilistic decision tree illustrating all possible transitions from a transmitted input $x_i$ to a received output $x_i^{\mathsf{*}}$ for all possible nonce $y_i$ under the quantum channel error model, accounting for basis selection, polarization flips, and measurement outcomes. The green color represents the photon polarization state in one wavelength. The red color represents the photon polarization state in the other wavelength. A question mark indicates a randomized state due to measurement. The pink text corresponds to the probability. The blue labels indicate possible variable values for each scenario.

To compute the probability of each possible received symbol in the presence of eavesdropping, we follow the same tree-based probability analysis introduced in the previous section. By summing the probabilities of all paths that lead from a transmitted input $x_i$ to a recovered output $x_i^{\mathsf{*}}$, we obtain the conditional probability distribution $P(x_i^{\mathsf{*}}\mid x_i)$. The resulting probabilities are given by

$$\begin{array}{c}{P}_{yeseve}(x_i^{\mathsf{*}}=0\mid x_i=0)={\displaystyle \frac{3-2\alpha }{8}},\hfill \\ P_{yeseve}(x_i^{\mathsf{*}}=1\mid x_i=0)={\displaystyle \frac{1+2\alpha }{16}},\hfill \\ P_{yeseve}(x_i^{\mathsf{*}}=2\mid x_i=0)=0,\hfill \\ P_{yeseve}(x_i^{\mathsf{*}}=3\mid x_i=0)={\displaystyle \frac{1+2\alpha }{16}},\hfill \\ P_{yeseve}(x_i^{\mathsf{*}}=0\mid x_i=1)={\displaystyle \frac{1+2\alpha }{16}},\hfill \\ P_{yeseve}(x_i^{\mathsf{*}}=1\mid x_i=1)={\displaystyle \frac{3-2\alpha }{8}},\hfill \\ P_{yeseve}(x_i^{\mathsf{*}}=2\mid x_i=1)={\displaystyle \frac{1+2\alpha }{16}},\hfill \\ P_{yeseve}(x_i^{\mathsf{*}}=3\mid x_i=1)=0.\hfill \end{array}$$

From this distribution, the probability of observing symbols in the invalid state set $\{2,3\}$ at the receiver can be obtained by summing the corresponding terms. In the presence of eavesdropping, the probability of observing these invalid states is $(\alpha +0.5)/4$. In the absence of an eavesdropper, their occurrence is due only to channel noise and occurs with probability $\alpha /2$.

The difference between these two quantities defines the detection metric $\Delta$BER. This metric captures the excess error introduced by eavesdropping beyond what is expected from channel noise alone. If the observed rate of invalid states in Bob’s recovered sequence exceeds the noise-only expectation by more than $\Delta$BER, the deviation can be attributed to adversarial interference rather than normal channel imperfections. The expression for this difference is given by

$$\Delta \mathrm{BER}=P(x_i^{\mathsf{*}}\in \{2,3\}|Eve)-P(x_i^{\mathsf{*}}\in \{2,3\}|NoEve)={\displaystyle \frac{\alpha +0.5}{4}}-{\displaystyle \frac{\alpha }{2}}={\displaystyle \frac{1}{8}}-{\displaystyle \frac{\alpha }{4}}$$

(3)

This equation provides a quantitative measure for distinguishing errors introduced by an eavesdropper from those arising solely due to quantum channel noise. By comparing the observed rate of invalid states in Bob’s recovered sequence with the noise-only expectation, the receiver can determine whether the observed deviation is consistent with normal channel behavior or indicative of external interference.

For a given channel error rate $\alpha$, the expected occurrence of invalid states in the absence of eavesdropping is known analytically. Any excess beyond this baseline can be directly compared with the predicted value of $\Delta$BER. When the measured deviation approaches the theoretical $\Delta$BER corresponding to the estimated channel noise, the discrepancy cannot be explained by channel imperfections alone and instead indicates the presence of an intercept-resend attack.

In summary, whereas other QKD protocols sacrifice a shared portion of the key to estimate the overall error rate in their key, our protocol uses the receiver’s number of invalid states as a metric for estimating the error rate. Therefore, in our context, the estimated error rate is the rate of invalid states in the receiver’s key directly. In this work, the method for determining whether to abort due to eavesdropper detection is by comparing the receiver’s observed error rate with two other error rates: (1) the error rate without an eavesdropper based on the known channel error rate, and (2) the error rate with an eavesdropper based on the known channel error rate. If the difference between the observed error rate and the expected error rate without an eavesdropper is less than the difference between the observed error rate and the expected error rate with an eavesdropper, then there is no eavesdropper detected. Otherwise, an eavesdropper is detected, and the session is aborted. This can be summarized by the following formula:

$$\left\{\begin{array}{cc}0\hfill & \mathrm{if}\left|\mathrm{obs}-\mathrm{no}\_\mathrm{eve}\right|<\left|\mathrm{obs}-\mathrm{yes}\_\mathrm{eve}\right|\hfill \\ 1\hfill & \mathrm{otherwise}\hfill \end{array}\right.$$

where obs is the observed error rate, no_eve is the expected error rate without an eavesdropper, and yes_eve is the expected error rate with an eavesdropper.

This comparison allows Alice and Bob to infer eavesdropping activity without revealing any portion of their secret key. Rather than relying on absolute error values, the protocol exploits the structured difference between noise-induced and eavesdropping-induced error patterns, enabling reliable detection even in highly noisy channels.

3.5. Full Protocol Description

Combining the steps and information from the previous sections, the full protocol steps have been summarized here for clarity and completeness. The flow is presented in the Figure 5.

Figure 5. Overview of the full proposed protocol workflow from key generation to recovery. Alice generates an ephemeral key and encapsulates the key using her CRP responses. This encapsulated key is transformed using the data obfuscation technique from Section 3.3. The result is encoded in single photon polarization states and sent to Bob via the quantum channel. Bob measures the transmitted data. Alice and Bob compare basis choices and obtain sifted keys. Bob uses his CRP responses and un-obscures the data using the technique from Section 3.3. He performs an eavesdropper security check. Finally, he performs the key recovery step.

1.

Ephemeral Key Generation:

At the beginning of each protocol execution, Alice generates a new random ephemeral key. This key is uniformly sampled from ${\{0,1\}}^l$, where the bit-length l can be selected based on the desired security level. The ephemeral key is session-specific, meaning it is never reused across protocol runs and is discarded after successful completion. This ephemeral key plays two roles in the protocol. First, it serves as the secret key that Alice intends to convey implicitly to Bob through the protocol without transmitting it directly. Second, it acts as a selector that determines how Alice filters and encodes responses derived from the CRP mechanism.

2.

CRP-Based Challenge and Full Response Generation:

After generating the ephemeral key, Alice applies the CRP mechanism explained in Section 3. Alice first selects or constructs a challenge C and computes the full set of responses based on the protocol.

The protocol uses an encrypted file that is securely established according to the method described in [78]. Unlike systems that use a fixed seed, this file is updated regularly. Each new temporary key re-encrypts the file, creating a new seed for future sessions. Different challenges lead to different responses each time the file is used. This ongoing process of updating files and selecting challenges helps to rotate seeds. This reduces any patterns that might develop over time and allows for secure and immediate key reconstruction without the need to store keys.

3.

Ephemeral Key Encoding via Subset of Responses Selection:

In the third step, Alice encapsulates the ephemeral key K by using it to select a subset of responses from the full response set. Concretely, the bits of K define a deterministic selection rule that maps the ephemeral key to a subset index set.

4.

Obfuscation via Modular Combination with Shared Quatrit Stream:

Alice combines x with a pre-shared quatrit masking stream y, which is known only to Alice and Bob. This operation lifts the binary stream x into a quatrit stream z, effectively hiding the original value of x. As a result, even if an adversary gains partial information about the transmitted quantum states, they cannot directly infer the underlying binary data without knowledge of the shared quatrit stream. See Section 3.3.

5.

Encoding into Polarization States:

In the next step, Alice encodes each quatrit symbol z into a corresponding quantum polarization state according to Table 1.

6.

Transmission over a Two-Wavelength Quantum Channel:

Finally, Alice transmits the encoded polarization states over the quantum channel to Bob. The transmission is performed using two distinct optical wavelengths, enabling parallel or interleaved encoding of the polarization states across wavelength channels.

7.

Measurement of Incoming Quantum States:

Upon receiving the transmitted quantum states, Bob performs measurements on the incoming qubits using randomly chosen measurement bases, independently selected for each received state.

8.

Basis Sifting:

After measurement, Alice and Bob engage in a classical sifting procedure over an authenticated public channel. During this step, Alice reveals the basis information associated with each transmitted quantum state, while Bob discloses the bases he used for measurement. No symbol values are revealed during this exchange.

Only the positions for which Alice’s encoding basis matches Bob’s measurement basis are retained. All other positions are discarded.

9.

Regeneration of the Full CRP Response Set:

Using the challenge C previously communicated by Alice, Bob locally regenerates the full set of CRP responses.

10.

Step 10: Recovery of the Binary Symbol Sequence:

For each retained symbol in the sifted sequence, Bob applies the inverse modular operation to recover the original binary symbol x. Using the shared quadrature masking stream y and the measured quatrit stream z, Bob computes $x\equiv (3y+z)mod4$. Since $3\equiv -1(mod4)$, this operation effectively removes the masking applied by Alice in Step 4, yielding the original response bits. When no eavesdropping or excessive noise is present, the recovered values of x match Alice’s original symbols with high probability.

11.

Security Evaluation:

Unlike BB84, in the error detection step, Bob checks the observed error rate based on the number of invalid states present in his output, without communicating to Alice. If the error detection test is failed, then Alice and Bob abort and infer eavesdropper presence. Otherwise, Bob compares his received responses with his generated responses to find matches and construct a set of candidate keys. See Section 3.4.

12.

Key Recovery:

Bob iteratively generates candidate keys and compares the hash of each candidate key with Alice’s hash as the matching condition test. If a match is found, the key is successfully recovered. Otherwise, Bob continues testing candidates until all possibilities are exhausted or a predefined limit is reached. The end result of the protocol is a secure and identical cryptographic key between both parties, Alice and Bob.

The hash of the ephemeral key is sent over a classical channel. The hash function ensures that no useful information about the ephemeral key is able to be determined from the hash. The protocol does not share any extra information like syndrome data or parts of the key. The hash is only used for verification of the final key.

Pre-shared secrets, like the CRP table and nonce, help with authentication and establishing trust. However, these pre-shared secrets are not used to create the final encryption keys. Rather, the pre-shared secrets are for authentication and recovering keys without exposing the key directly. These shared secrets should be securely stored and should not be sent in plain text during the communication process. Eve cannot access the private CRPs. The nonce can be generated from a PUF which would allow Alice and Bob to obtain the same nonce without storing or transmitting it. This method lowers the chance of leaking stored secrets and also eliminates the need to keep a shared key or mask. This paper focuses on the key recovery process and integration with QKD. Further details on the pre-shared secrets are discussed in detail in previous work [48,78].

4. Security Discussion

This section considers security implications of the proposed scheme including an analysis of the two wavelengths, the CRP-based encapsulation style mechanism, and the size of the key space that an adversary would have to search under different assumptions about available knowledge.

4.1. Two Wavelength Considerations

In terms of the quantum transmission, our process of transmitting qubits is equivalent to the traditional BB84 protocol but with an extra wavelength. We can treat sending photons encoded with two wavelengths as two separate instances of the BB84 protocol. Since each instance is independent we expect that each instance is as secure as the standard BB84 protocol [47,81]. From here we will note that for the single-channel BB84 protocol, Shor and Preskill showed that security can be guaranteed so long as the measured phase and bit errors rates of the qubits are less than about $11\%$ [47]. Our goal is to derive a similar error bound that we can guarantee security. We will use the same mechanism as Shor and Preskill by seeing when the quantity $1-2H\left(x\right)$ goes to zero with Equation (4):

$$H\left(X\right)=-\sum _{x\in \chi }P\left(x\right){log}_b\left(P\left(x\right)\right),$$

(4)

being the Shannon entropy. To do this let us look at how we can encode a quatrit $z_i\in {\mathbb{Z}}_4$. We can encode $z_i$ by using a pair of bits that can be generated randomly. We can use the assumption that the two bits are generated independently of each other, thus given that a 0 could be generated with probability $P_{\mathrm{bit}}\left(0\right)=p$ and generating a 1 with probability $P_{\mathrm{bit}}\left(1\right)=1-p$, we get the probability $P\left(z_i\right)$ shown in Table 4:

Table 4. Encoding table for every possible quatrit $z_i\in {\mathbb{Z}}_4$.

Quatrit ${\mathit{z}}_{\mathit{i}}$	Binary Encoding	Probability $\mathit{P}\left({\mathit{z}}_{\mathit{i}}\right)$
0	00	$p^2$
1	01	$p\left(1-p\right)$
2	10	$p\left(1-p\right)$
3	11	${\left(1-p\right)}^2$

From here, we can use Table 4 to get our Shannon entropy to be

$$H\left(p\right)=-p^2{log}_4\left(p^2\right)-2p^2{log}_4\left(p(1-p)\right)-{(1-p)}^2{log}_4\left({(1-p)}^2\right).$$

(5)

We can use logarithms with base 4 because the information being sent is in base 4. Using Equation (5), we get that the quantity $1-2H\left(x\right)$ goes to zero at the exact same point $11\%$, which is equivalent to [47]. This suggests that each wavelength channel can be treated as an independent BB84 instance, and the Shor and Preskill bound is unchanged.

4.2. CRP-Based Key Encapsulation Considerations

To further the discussion on security we note that from [77,78] the security of the CRP and key recovery mechanisms rely heavily on two things:

• The security of the encryption algorithm used to encrypt the file.
• The security of the one-way function used in the CRP mechanism.

Smart choices for the encryption and one-way function would be to use NIST approved algorithms such as AES-256 and SHA-3.

4.2.1. Encapsulation Mechanism

The addition of an encapsulation style mechanism reduces direct information exposure because the only information Eve should receive via the quantum channel would be the subset of responses and not the key directly. Instead of sending the key itself, we send portions of responses that represent the key. The subset is approximately $50\%$ of the size of the total set of responses, which Eve does not have and thus cannot reconstruct a key from this information. Because of this, the subset response mechanism for encoding the key is not expected to reduce security, but rather, it may improve security because only an encoded version of the key is sent over the quantum channel.

4.2.2. Man-in-the-Middle Scenario

Consider an adversary, Eve, attempting to intercept messages between the legitimate parties according to a man-in-the-middle attack. In order to intercept, Eve must generate the secret output responses and nonce that are used in encoding and decoding the transmitted message. If she does not have access to this information, then Eve cannot produce the correct transformations to the transmitted data and thus cannot produce the correct output. According to Figure 5, this means that Eve knowing $z^{\prime }$ does not allow her to construct x because she does not have y nor the correct responses. Consequently, Eve’s resulting key will be inconsistent with Alice and Bob’s keys. This is consistent with other PUF protocols such as [82].

Next, if we assume that the adversary, Eve, cannot evaluate or learn the output responses from the CRP and she does not know the nonce, then Eve is only able to interact with transmitted quantum states via the quantum channel and public classical information via the classical channel. In this case, the security follows standard QKD arguments which is that any measurement or manipulation introduces detectable disturbance. This results in either Eve gaining negligible information or Alice and Bob aborting the protocol.

4.2.3. Challenge-Response Pair Space

The size of the CRP space depends on the parameters. For key size of 256 bits, using the formula presented in [78], CRP space can be calculated as being on the order of $3.46\times {10}^{348}$ which is presented as an upper bound of 825 bits of entropy. The CRPs are assumed to be independent and uniformly distributed.

4.3. Finding Eve’s Key Space

This section considers the amount of information an adversary may gain from knowledge of the system and its implications for the size of the key space. The size of the key space is first derived, and then the entropy and key space are analyzed.

4.3.1. Derivation

To see the key space Eve would have to search in her best case scenario (i.e., Alice and Bob’s worst case scenario) we will assume that Eve has the following information:

-

The subset of responses.

-

The challenges.

-

Knowledge of how the CRP works (Including the nonce y).

-

Knowledge of how the matching algorithm works (Algorithm 1).

The challenges and knowledge of how the CRP works would give insight on the key length N and the Hamming weight (i.e., the total number of ones) of the key $\omega$. Knowledge of how the matching algorithm works would give Eve knowledge of how big the window size (i.e., the maximum number of consecutive zeros can appear) $\gamma$ is.

Here we will make a set ${\mathbb{K}}_{N,\gamma ,\omega }\subseteq {\mathbb{K}}_N$ with ${\mathbb{K}}_n$ being the key space given the key length N and ${\mathbb{K}}_{N,\gamma ,\omega }$ being the key space given the key length N, window size $\gamma$, and Hamming weight $\omega$. Our goal here is to find the cardinality of ${\mathbb{K}}_{N,\gamma ,\omega }$. To start, we know an N-bit key will take the form of $\omega$ ones separated by a series of zeros according to the following structure:

$$\underset{{\gamma }_0}{\underbrace{00\cdots 0}}1\underset{{\gamma }_1}{\underbrace{00\cdots 0}}1\cdots 1\underset{{\gamma }_{\omega }}{\underbrace{00\cdots 0}},$$

where each ${\gamma }_m\in {\mathbb{Z}}_{\gamma +1}$ and represents the number of zeros in each run. Since we know that each key must have a length of N and Hamming weight of $\omega$, we get that the number of zeros in the key is $N-\omega$ based on the following constraint and sum:

$$\omega +{\gamma }_0+{\gamma }_1+\cdots +{\gamma }_{\omega }=N\Rightarrow {\gamma }_0+{\gamma }_1+\cdots +{\gamma }_{\omega }=N-\omega .$$

(6)

To be able to count the number of valid keys, we relate the sum in Equation (6) to a counting problem by looking at polynomials of the form:

$${\left(1+x+\cdots +x^{\gamma }\right)}^{\omega +1},$$

(7)

which we will map to a multi-nomial of multiple variables:

$$\left({\displaystyle \sum _{i_0=0}^{\gamma }}{x}_0^{i_0}\right)\left({\displaystyle \sum _{i_1=0}^{\gamma }}{x}_1^{i_1}\right)\cdots \left({\displaystyle \sum _{i_{\omega }=0}^{\gamma }}{x}_{\omega }^{i_{\omega }}\right)={\displaystyle \prod _{j=0}^{\omega }}\left({\displaystyle \sum _{i_j=0}^{\gamma }}{x}_j^{i_j}\right).$$

This allows us to find specific partitions of Equation (7). When we expand this we get a polynomial that looks similar to:

$${\displaystyle \prod _{j=0}^{\omega }}\left({\displaystyle \sum _{i_j=0}^{\gamma }}{x}_j^{i_j}\right)\sim x_0^0{x}_1^0\cdots x_{\omega }^0+x_0^1{x}_1^0\cdots x_{\omega }^0+x_0^0{x}_1^1\cdots x_{\omega }^0+\cdots +x_0^{\gamma }{x}_1^{\gamma }\cdots x_{\omega }^{\gamma }.$$

(8)

From here if we can calculate $\left|{\mathbb{K}}_{N,\gamma ,\omega }\right|$ by finding the number terms of the form $x_0^{{\gamma }_0}{x}_1^{{\gamma }_1}{x}_2^{{\gamma }_2}\cdots x_{\omega }^{{\gamma }_{\omega }}$ given the condition in Equation (6) as this gives us every possible way to arrange $\omega$ one’s and each run of zeros ${\gamma }_m$. We can drop the indices on all the $x_i$ terms since we care about all possible partitions not a fixed partition, and this gives us that all terms $x^{{\gamma }_0+{\gamma }_1+\cdots +{\gamma }_{\omega }}=x^{N-\omega }$. To find the coefficient of this term we can make the polynomial ${\left(1+x+\cdots +x^{\gamma }\right)}^{\omega +1}$ into the following rational function:

$${\left(1+x+\cdots +x^{\gamma }\right)}^{\omega +1}={\displaystyle \frac{{\left(1-x^{\gamma +1}\right)}^{\omega +1}}{{(1-x)}^{\omega +1}}}.$$

From here using binomial expansion on both the numerator and denominator we eventually get that:

$$\left|{\mathbb{K}}_{N,\gamma ,\omega }\right|={\displaystyle \sum _{i=0}^{⌊(N-\omega )/(\gamma +1)⌋}}{\left(-1\right)}^i\left({\displaystyle \genfrac{}{}{0pt}{}{\omega +1}{i}}\right)\left({\displaystyle \genfrac{}{}{0pt}{}{N-i(\gamma +1)}{\omega }}\right).$$

(9)

Thus we get that the total key space for keys with length N, maximum number of consecutive zeros $\gamma$, and Hamming weight $\omega$. In the case where Eve obtains only some of the subset of responses, but not all, then the minimum bound on the Hamming weight is ${\omega }^{\prime }$. The key space given the lower bound on the Hamming weight can be represented by summing over all Hamming weights from ${\omega }^{\prime }$ to N giving us a modification of Equation (9) which becomes:

$$\left|{\mathbb{K}}_{N,\gamma ,\omega \ge {\omega }^{\prime }}\right|={\displaystyle \sum _{k={\omega }^{\prime }}^N}{\displaystyle \sum _{i=0}^{⌊(N-k)/(\gamma +1)⌋}}{\left(-1\right)}^i\left({\displaystyle \genfrac{}{}{0pt}{}{k+1}{i}}\right)\left({\displaystyle \genfrac{}{}{0pt}{}{N-i(\gamma +1)}{k}}\right).$$

(10)

This gives the number of possible keys that have length N, window size $\gamma$ and at least a Hamming weight of ${\omega }^{\prime }$. The case which Eve has no knowledge of the Hamming weight can be considered a special case of Equation (10) where ${\omega }^{\prime }=0$, thus we get:

$$\left|{\mathbb{K}}_{N,\gamma ,\omega \ge 0}\right|={\displaystyle \sum _{k=0}^N}{\displaystyle \sum _{i=0}^{⌊(N-k)/(\gamma +1)⌋}}{\left(-1\right)}^i\left({\displaystyle \genfrac{}{}{0pt}{}{k+1}{i}}\right)\left({\displaystyle \genfrac{}{}{0pt}{}{N-i(\gamma +1)}{k}}\right),$$

(11)

which matches with a method of calculating the same sized key space that [79] obtained using a dynamic programming approach.

4.3.2. Entropy and Key Space Analysis

Using Equations (9)–(11) we can find the approximate key space Eve would have to search through given what she knows about the key. We can consider two cases about Eve’s knowledge. We will start with assuming Eve knows N, $\gamma$, and $\omega$ exactly. When using Equation (9) for a 256-bit key, for parameters such as $\gamma =5$ and $\omega =128$ we get a key space of approximately $2^{248.4266}$. If we took $\gamma =8$ we’d get $2^{251.3476}$ possible keys as seen in Figure 6.

Figure 6. Key entropy of a 256-bit key as function of maximum allowed consecutive zero $\gamma$ assuming known Hamming weight of $\omega =128$. The points corresponding to $\gamma =5$, $\gamma =8$, and $\gamma =11$ are highlighted in red together with their corresponding entropy values. Here we denote when $\gamma =5$ and $\gamma =8$ to show a range of parameters that would have a high level of entropy yet not cause high latency in the key matching algorithm. Note how we start to approach an entropy of $251.6$ as we increase $\gamma$, as denoted by the $\gamma =11$ term.

For the second assumption about Eve’s knowledge, in the case where Eve knows some of the subset of responses (giving her N and $\gamma$ exactly but only has a lower bound on the Hamming weight ${\omega }^{\prime }$), we can use Equation (10) under the same parameters as the last case $(\gamma =5,8,{\omega }^{\prime }=128)$ we get $2^{252.6743}$ and $2^{254.8468}$ keys respectively. In the special case that Eve has no knowledge of the hamming weight $({\omega }^{\prime }=0)$ we can use Equation (11) to generate Figure 7, which matches results from [79]. Compared to the first case, where Eve is assumed to know the exact Hamming weight, removing this assumption further increases the search complexity. Without access to the Hamming weight information, the effective key space increases from approximately $2^{248}$ to $2^{253}$ resulting in larger search space for Eve to explore. Although the constraint of limited consecutive zero slightly reduces the entropy of the ephemeral key, this reduction is rare if $\gamma$ is chosen within an appropriate range.

Figure 7. Key entropy of a 256-bit key as function of maximum allowed consecutive zero $\gamma$ with no knowledge of the Hamming weight. The points corresponding to $\gamma =5$, $\gamma =8$, and $\gamma =11$ are highlighted in red together with their corresponding entropy values. Here we denote when $\gamma =5$ and $\gamma =8$ to show a range of parameters that would have a high level of entropy yet not cause high latency in the key matching algorithm. Note how we start to approach an entropy of $\approx 256$ as we increase $\gamma$.

5. Methodology

5.1. Simulation Overview

The goal of the simulation was to implement the proposed protocol in Python 3.11.5 and evaluate its ability to recover a cryptographic key and distinguish eavesdropping noise across varying channel noise conditions. The protocol was implemented using Python, and 10,000 Monte Carlo simulations were run to simulate Alice and Bob distributing 256-bit long keys using different response lengths: 32, 64, 128, 256, and 512. For each response length, the protocol was tested across increasing channel error to study how noise in the channel affects key recovery performance and eavesdropper detection. Simulations were run for both the case with an eavesdropper and the case without one. Simulation results were analyzed using statistical tools in R.

5.2. Eavesdropper

In the simulation, the eavesdropper (Eve) is modeled as a random variable that interacts with each photon independently using an intercept and resend strategy. She intercepts all photons and measures each one in an independent, random basis choice. She replaces the photon by sending a photon according to her measurement outcome to Bob. This simplified model serves as a baseline to determine whether the protocol can distinguish between noise and an eavesdropper. Also, it allows us to quantify the protocol’s ability to recover keys in the presence of different noise levels. Future work will focus on more advanced and complex attack models.

5.3. Pre-Shared Stream

The pre-shared stream nonce is implemented using a pseudo-random number generator. In practice, the nonce can be generated on demand from another method, such as a PUF, enabling both parties to reconstruct the same value in real time without requiring storage or transmission of the nonce itself. This allows us to study the key recovery and eavesdropper detection performance.

5.4. Channel Errors

Channel errors are modeled as independent and identically distributed random events. In each trial, a transmitted photon may experience a channel error with a given probability which is incremented from 0 to 0.5 in steps of 0.01 (where 0 is 0% and 0.5 is 50% probability). When an error occurs, the photon state is altered to produce an incorrect measurement outcome when measured in the same basis as Alice. For example, if Alice transmits a photon polarized at 90 degrees, the photon polarization state will change to 0 degrees which ensures an incorrect measurement outcome when the same measurement basis is used. Each photon can experience at most one channel error event. The channel errors occur evenly throughout the transmitted data, rather than in bursts or clusters. In practice, channel noise may be more complex depending on the setup.

5.5. Key Recovery and Computational Considerations

The key recovery step is computationally intensive because it requires evaluating possible candidate keys. To address this, the simulation code was parallelized and executed on Northern Arizona University’s high-performance computer (HPC) in order to distribute the computations across nodes and speed up the run time. Computer nodes were equipped AMD EPYC 7542 32-Core processors @2.9 GHz. Each simulation job utilized up to 64 CPU cores with single-threaded execution per core. During the key recovery step, the number of possible keys to try can become large. If the number of possible keys reaches or exceeds 1 × 10²⁷, the simulation run is terminated, and the run is classified as a failed key recovery. This approximate threshold is used to ensure a practical computation time.

5.6. Scope and Assumptions

The primary objective of this work is to understand how the proposed protocol performs at key recovery and distinguishing eavesdroppers by analyzing statistical differences in the received data transmission. The simplified error model is an abstraction for corrupted transmitted data and helps test how well the proposed protocol can recover keys when different amounts of data are corrupted during transmission. The error model should not be interpreted as a detailed physical characterization of an optical channel or as simulating complex attacks, which is beyond the scope of this paper. This approach focuses on understanding how strong the protocol is against corrupted data in general and helps to define the limits of key recovery and detection without depending on specific noise models.

5.7. Summary of Terminology and Variables

1.

Key length: the length of the cryptographic key. This is equal to the number of responses. In this work, the key length is 256 bits.

2.

Response length: the number of bits per response. For example, for a 256-bit key with a response length of 32 bits, this means there are 256 responses where each response is 32 bits long. The response length is independent of the ephemeral key length. In this work, we use 32, 64, 128, 256, and 512 bits for response lengths.

3.

Channel Error: the probability that a photon polarization state changes in such a way as to produce an error. In this work, the channel error is increased from 0 to 0.5 in 0.01 increments (i.e., 0 to 50% in 1% increments).

4.

Key recovery rate: the number of keys successfully recovered divided by the total number of trials.

6. Results

This section presents the results showing the performance of the proposed protocol across increasing levels of channel noise for different response lengths (32, 64, 128, 256, and 512 bits). The results show performance limits and analyze key recovery capabilities and the ability to distinguish eavesdropper presence.

6.1. Key Recovery in the Presence of Noise

Our first experiment aims to quantify the ability to recover the ephemeral key in the presence of channel noise. Figure 8 shows the relationship between the successful key recovery rate and channel error rate averaged over 10,000 trials for each response length (32, 64, 128, 256, and 512 bits).

Figure 8. This plot shows the key recovery rate versus incrementing simulated quantum channel error rate from 0 to 50% for five different response lengths. The test was run with no eavesdropper. The x-axis is the channel error rate as a percentage. The y-axis is the successful key recovery rate as a percentage. The legend color indicates the response length used. The data was averaged over 10,000 trial runs for a 256-bit-long key.

Figure 8 shows that as channel error increases, shorter response lengths lose the ability to recover the key earlier, while longer response lengths continue to succeed at higher channel noise levels, demonstrating greater tolerance to channel error. For example, in Figure 8, the key recovery rate for the 32-bit response length falls sharply at a channel error rate of approximately 0.1 (10%). On the other hand, the 128-bit response length withstands more channel error and falls around 0.3 (30%). The protocol exhibits the best performance with a response length of 512 bits, and demonstrates that the system can withstand noise levels as high as $40\%$ at this response length. Unfortunately, increasing the response length comes at the cost of increasing latency (see Section 7 for more details).

The higher tolerance to corrupted data when using longer response lengths is likely due to a larger response space. Given the likelihood of identifying identical responses decreases as the response space grows, the probability of finding a collision during the error detection process reduces. This leads to less collisions and more efficient key recovery with longer responses. A comprehensive study of collision behavior is presented in [77,78].

Overall, this experiment assessed key recovery performance at various response lengths across channel error levels and demonstrates that the longest response length can recover the key even with noise as high as 40%. This error level is significantly higher than is typically seen in QKD studies, but is used to demonstrate the proposed scheme’s ability to recover a key under increasing noise levels. This represents a practical limit of reliable key recovery without revealing any subsection of the final key, as is required in many QKD schemes, and does not increase the existing security threshold rates. Eavesdropping was not included in this stage of evaluation, and the following section addresses eavesdropper detection.

6.2. Differentiating Eavesdropping from Channel Error

To assess the protocol’s effectiveness in accurately detecting the presence of an eavesdropper in the presence of noise, we ran simulations with different response lengths, both with and without the eavesdropper. The results examine the separation between error rate distributions which is used to distinguish eavesdropping from channel noise. Then, the results present the eavesdropping detection performance metrics.

6.2.1. Error Distribution Separation

In this work, eavesdropper detection is based on comparing the difference ($\Delta$BER) between the observed error and expected baseline error rate in the received transmission stream described in Section 3.4.2. This difference allows the receiver (Bob) to determine eavesdropper presence from looking at the received transmission alone, without revealing any portion of the final key as is required in other schemes. The ability to detect an eavesdropper depends on how distinct the error rate difference distributions are for scenarios with and without Eve. Therefore, it is useful to examine the separation between the error rate differences.

Figure 9 illustrates the error rate difference ($\Delta$BER) distributions for the eavesdropper (With Eve) and no eavesdropper (No Eve) distributions. This is shown at 40% channel noise using the shortest and longest response lengths, 32 bits and 512 bits, respectively. To compare how distinct each distribution is, we calculated the overlap between the two distributions, shown in Figure 9. For the shorter response length of 32 bits, the overlap is 13.78%, whereas for the longer response length of 512 bits, the overlap is 0.00%. This indicates that the separation between the eavesdropper and no eavesdropper distributions improves with increasing response lengths. As a result, detecting Eve is more accurate when using longer response lengths because the distributions are more distinct and farther apart compared to shorter response lengths.

Figure 9. Distribution of error rate deviation ($\Delta BER$) under no eavesdropper and eavesdropper scenario at 40% channel noise for response lengths 32 and 512. The x-axis is the difference in error rate $\Delta$BER. The y-axis is the probability density. The legend color indicates eavesdropper presence. The dashed line is the Youden threshold. Area in shadow shows the overlap between the With Eve and No Eve distributions. The left plot is for a response length of 32 bits. The right plot is for a response length of 512 bits. Increasing response length leads to 0% overlap between the two distribution.

This separation can be further quantified using the Kolmogorov–Smirnov (KS) test for measuring the maximum difference between the cumulative distribution functions of two distributions. In this case, the KS test can be used to quantify the similarity between the distribution when Eve is present versus when Eve is not present. For a response length of 32 bits, a two-sample KS test resulted in $D=0.86$ which indicates that the distributions are different but not fully dissimilar. For a response length of 512 bits, the two distributions were even more separate with $D=1.00$, indicating maximum dissimilarity. This metric supports that the difference in the error distributions is more distinct when using a response length of 512 bits compared to when using 32 bits.

The dashed lines in Figure 9 indicate the Youden threshold which is often used for determining a threshold that balances the true positive and false positive rate. At a response length of 512 bits, the threshold lies within a region of zero overlap, indicating that both false positive and false negatives are effectively eliminated. This is explored more in the next section.

6.2.2. Detection Performance Metrics

This section analyzes the eavesdropper detection performance across response lengths and channel error. We examine the receiver operating characteristic (ROC) curves, false positive rate, false negative rate, and accuracy.

Figure 10 shows the ROC curve for eavesdropper detection at 40% channel noise for response lengths 32 and 512 bits. The results demonstrate a strong ability to classify Eve’s presence across both response lengths. The area under the curve (AUC) is 0.9820 and 1.0000 for 32 bits and 512 bits, respectively. This perfect classification when using 512 bits is consistent with the zero overlap demonstrated in Figure 9 above. Because the distributions do not overlap, they can be distinguished and thus Eve can be accurately detected. The circled point on each ROC curve corresponds to the Youden optimal operating point. For 512 bits, this point is at the top left corner, indicating perfect classification with zero false positives and false negatives.

Figure 10. Receiver Operating Characteristic (ROC) curve for the eavesdropper detection at 40% channel noise for two different response lengths, 32 bits and 512 bits. The x-axis is the false positive rate. The y-axis is the true positive rate. The area under the curve (AUC) is 0.9820 for a response length of 32 bits. The AUC is 1.0000 for a response length of 512 bits. The dashed diagonal line indicates random performance.

In assessing the efficacy of the proposed eavesdropping method, we quantified key performance indicators: False Negative Rate (FNR), False Positive Rate (FPR), and accuracy. These metrics serve as benchmarks to evaluate the reliability and robustness of our method under different noise levels.

Table 5 summarizes a framework for categorizing detection instances into true-positives (TP), false-negatives (FN), false-positives (FP), and true-negatives (TN) [80]. We define them according to the formulas in Equations (12)–(14).

$$FNR={\displaystyle \frac{FN}{FN+TP}}$$

(12)

$$FPR={\displaystyle \frac{FP}{FP+TN}}$$

(13)

$$Accuracy={\displaystyle \frac{TP+TN}{TP+TN+FP+FN}}$$

(14)

Table 5. Terminologies for eavesdropper detection.

P	Judgment	Terminology
Exist	Exist	True-positive (TP)
	Not exist	False-negative (FN)
Not exist	Exist	False-positive (FP)
	Not exist	True-negative (TN)

The FNR and FPR of our eavesdropping detection system as functions of channel error rate are displayed in Table 6 and Table 7 for different response lengths, p, ranging from 32 to 512 bits. Table 7 shows that the protocol exhibits zero FPR when the channel error rate is below 30% across all response lengths. For longer response lengths above 128 bits, the protocol maintains robust performance, effectively judging the absence of eavesdropping even with channel error rates up to 40%. This demonstrates the system’s robust eavesdropping detection capabilities under noisy conditions.

Table 6. False negative rate (FNR) across channel error rate for different response lengths (p).

Channel Error Rate	p = 32	p = 64	p = 128	p = 256	p = 512
0	0	0	0	0	0
0.1	0	0	0	0	0
0.2	0	0	0	0	0
0.3	0.0013	0	0	0	0
0.4	0.0809	0.0232	0.0035	0	0
0.49	0.4539	0.4239	0.3939	0.3484	0.2904

Table 7. False positive rate (FPR) across channel error rate for different response lengths (p).

Channel Error Rate	p = 32	p = 64	p = 128	p = 256	p = 512
0	0	0	0	0	0
0.1	0	0	0	0	0
0.2	0	0	0	0	0
0.3	0.0002	0	0	0	0
0.4	0.0590	0.0135	0.0007	0	0
0.49	0.4346	0.4183	0.3807	0.3322	0.2916

Table 6 showcases the FNR which represents the protocol’s efficacy when an eavesdropper is present. Across all response lengths, the protocol consistently detects Eve’s activities up to 35% channel error rate. Longer response lengths show a tolerance above 40%, indicating a higher resilience in detection capabilities against noise in the channel.

The reason why the FPR and FNR values appear identical stems from the symmetrical distribution of errors observed in scenarios involving eavesdropping versus those without. However, in real-world settings, this symmetry might not hold, potentially leading to variations in the FPR and FNR values.

To evaluate the precision of our protocol across various response lengths, we calculated accuracy according to Equation (14). Figure 11 depicts that the protocol maintains an accuracy rate of 100% when the channel error rate is below 35%. High accuracy at relatively high noise levels supports that the protocol is robust and is a promising indicator of its reliability in practical, noisy scenarios.

Figure 11. Performance accuracy rate across incrementing simulated quantum channel error from 0 to 50% using response lengths 32, 64, 128, 256, and 512 bits. The x-axis is the channel error rate as a percent. The y-axis is the accuracy as a percent. The color shown in the legend indicates response length. The number of trials is 10,000. The key length is 256 bits. Accuracy is the proportion of correctly classified instances of eavesdropper presence out of all cases.

In summary, the results demonstrate that increasing the response length improves tolerance to corrupted data caused by channel noise and improves eavesdropper detection performance. Perfect eavesdropper detection is achieved for a response length of 512 bits, which is consistent with the increased separation observed in the error rate distributions. Additionally, this method uses receiver-side analysis alone which eliminates the need to share additional information and therefore reduces the amount of revealed information.

7. Discussion

This section discusses the computational tradeoffs of the proposed method, compares this approach to other methods, and considers the importance of independent eavesdropper detection.

7.1. Computational Overhead, Complexity, and Limitations

The results above showed that using higher response lengths can improve noise tolerance and eavesdropper detection. Additionally, this removes the need for multi-round classical reconciliation. However, increasing the response length leads to higher processing time and latency and shifts part of the cost to local computation. This overhead mainly stems from the generation and handling of cryptographic tables and from the receiver-side search and recovery procedure. In practice, this behavior reflects a tunable design trade-off rather than a fundamental limitation. For example, selecting moderate response lengths (e.g., 128–256 bits) allows the protocol to maintain strong robustness while remaining computationally practical for real-world QKD deployments with limited resources.

Table 8 quantifies how the choice of response length impacts the number of qubits required to transmit an encapsulated ephemeral key of different sizes. For a fixed key size, increasing the response length results in a proportional increase in the total transmitted qubits. This relationship highlights the practical scaling behavior of the protocol: shorter response lengths minimize transmission overhead, while longer responses provide improved robustness against channel noise at the cost of increased quantum resources.

Table 8. Number Of qubits needed for transmission of encapsulated ephemeral keys with various lengths.

Response Length	Key Size: 128	Key Size: 256	Key Size: 512
32	≈256 B	≈512 B	≈1 KB
64	≈512 B	≈1 KB	≈2 KB
128	≈1 kB	≈2 KB	≈4 KB
256	≈2 kB	≈4 KB	≈8 KB
512	≈4 kB	≈8 KB	≈16 KB

The main computational bottleneck is the key recovery process. During key recovery, candidate keys are created using a smaller set of possibilities based on a limited number of uncertain or mismatched positions. Therefore, the time complexity depends on how many uncertain positions there are. In the worst case, this is an exponential time complexity. The study in [77] analyzes how well the key recovery protocol performs and shows that longer responses are better at handling higher levels of noise because they are less likely to be the same, which lowers collision rates. According to the work in [77], the protocol can fix slightly more than 20 erratic bits while keeping the delay under 2 to 3 s. This computational limit is not unique to the protocol and can be improved in future work with more strategic search algorithms.

7.2. Comparison with Other Work

Compared to classical reconciliation techniques such as Cascade, LDPC, and Winnow, our CRP-based protocol achieves a different balance between communication and computation. The comparison between our work and these protocols is summarized in Table 9. Methods like Winnow and Cascade sacrifice bits during error reconciliation, and Cascade requires multiple interactive rounds and can leak information during this process. On the other hand, our method does not sacrifice any bits and eliminates communication rounds entirely and avoids revealing the final key. Furthermore, the key is never sent directly, but rather, it is encoded in responses combined with a nonce and transmitted in single-photon polarization states.

Table 9. Comparison of error correction mechanisms in QKD.

Metric	Our Protocol	LDPC	Cascade	Winnow
Communication Rounds	0	1	3–6	1–3
Bits Revealed	0	Moderate	High	Moderate
Latency	Low	Low	High	Medium
Approach	CRP	Belief Propagation	Binary Search	Hamming Code
Leakage via Reconciliation	None	Yes	Yes	Yes
Error Tolerance (Channel Error Rate)	High (<40%)	High (<25%)	Medium (<15%)	Medium (<10%)
Adaptivity to Channel Noise	High	Medium	Low	Medium

Other approaches may be more efficient depending on the noise level or other constraints. At lower noise levels, Cascade tends to be more efficient as it can tolerate noise levels up to 15%, whereas LDPC is more suitable for moderate noise less than 25%. Winnow can be a better choice for reduced communication rounds. However, as channel error rate increases, such protocols may fail to generate a key altogether due to the noise. In scenarios with very high noise, the proposed method has demonstrated the ability to recover keys and detect eavesdropping. Instead of focusing on maximizing efficiency, this approach is more suitable for still achieving key recovery reliability when channel conditions are unstable. This does not expand the security limit, but rather it shows the ability to recover keys in scenarios with high noise. Additionally, this is achieved without introducing additional redundancy which are commonly required in conventional approaches.

Using longer response lengths does not create redundancy in the usual error-correcting way where additional data is derived from the message and adds no new information. Instead, in our work, the additional length in each response helps make each response unique and easier to distinguish from other responses. This lowers the chance of collisions with other responses, which helps reduce errors and makes matching more reliable. This data is not directly accessible when intercepted because it is encoded in such a way that requires an adversary to have the full set of responses and knowledge of the response structure. Even if some response elements are corrupted during transmission, Bob may still be able to find a correct match in his full set of responses. To avoid the need for additional information exchanges in error correction methods like Cascade and Winnow, our method lets Alice and Bob create the same CRP tables independently. These identical CRPs enables the error detection and key recovery without additional communication rounds and helper data.

Similar to our work, other methods for detecting eavesdroppers using a threshold comparison approach also exist. For example, eavesdropper presence can be distinguished from noise by comparing a threshold to the estimated error rate using a sacrificed subsection of the final key in [80]. They select a detection threshold based on FPR and FNR. Their chosen error rates are more aligned with security thresholds than operational limits. In contrast, our work studies independently detecting Eve without exchanging any portion of the key. The reported 40% tolerance to reliably detect Eve highlights the robustness of our proposed method.

7.3. Importance of Independent Eavesdropping Detection

An important implication of this work is the protocol’s ability to support independent eavesdropping detection without relying on additional classical exchanges or partial key disclosure. Unlike many existing QKD schemes that depend on public reconciliation steps, our approach enables Alice and Bob to locally construct identical cryptographic tables using a shared CRP mechanism. As a result, an adversary attempting to compromise the system must not only interfere with the quantum channel but also reconstruct this independently generated structure, substantially increasing the attack complexity.

Another important aspect of this work is that Bob can assess the integrity of the quantum transmission solely from his measurement outcomes and local computations, without requiring explicit confirmation or auxiliary data from Alice. This self-contained verification preserves key confidentiality while minimizing information exposure during post-processing. By embedding consistency checks, appearing as measurable statistical deviations, directly into the encoding and recovery stages, the protocol effectively decouples eavesdropping detection from classical privacy amplification.

8. Future Work

Our work has demonstrated the ability to recover keys in the presence of higher noise using preliminary error model simulations. Future work includes evaluating the protocol using more complex quantum simulation and real implementation, optimizing protocol parameters, and quantifying the distance improvements for long-distance communication.

The next steps involve evaluating the protocol using more realistic quantum simulation tools that better resemble the behavior of real equipment such as photon loss, detector imperfections, and decoherence. These studies will provide a more realistic analysis of the protocol’s performance and help improve performance in practical settings. The current simulation can be extended to model the relationship between transmission distance and key recovery performance. Establishing this connection will allow protocol performance to be evaluated as a function of distance, but requires more complex simulation and modeling distance-dependent attenuation and other error rates related to distance. Because photon loss increases exponentially with distance and is a known limiting factor in QKD systems, the protocol’s demonstrated ability to recover keys in scenarios with up to 40% errors, suggests potential for improved distance tolerance beyond the tens of kilometers range typically reported for conventional QKD protocols without advanced techniques. Further improvements might be achievable by integrating our protocol into existing real world long-distance QKD frameworks which report distances around hundreds of kilometers. Future work may also include addressing synchronization which is a problem QKD protocols face. Synchronization can be addressed by incorporating other methods.

9. Conclusions

This work highlights the efficacy and benefits of the CRP-based ephemeral key encapsulation style technique integrated with QKD for effective error tolerance, key recovery, and eavesdropper detection. We demonstrate successful error-free key recovery with noise in the transmitted information blocks as high as 40%. This demonstrates a practical limit of reliable key recovery without revealing any part of the final key, as is needed in other QKD schemes, and provides a basis for future analysis of security thresholds. This work also shows excellent ability to distinguish eavesdropper presence from noise and suggests a promising direction for QKD operating in noisy and imperfect conditions.

10. Patents

1.

U.S. Patent Application Publication No. US 2025/0119279 A1 (published 10 April 2025) Error management for long distance quantum key distribution and symmetrical key distribution [83].

2.

U.S. Patent Application Publication No. US 2025/0167997 A1 (published 22 May 2025) Protocols with noisy response-based cryptographic subkeys. United States patent application US 18/885,226. 22 May 2025 [84].