The 20-Year Gap That Kept Quantum Cryptography From Being Provably Safe

Quantum key distribution (QKD) is a way for two people to share a secret encryption key with security guaranteed by physics rather than by the assumption that some math problem is hard. Here is the mechanism, and then the specific gap this paper closed.

Why physics can guarantee a secret

Ordinary encryption rests on a bet: that no one can factor a huge number fast enough to break it. Quantum computers threaten that bet. QKD replaces the bet with a law of nature.

The law is this: you cannot measure a quantum system without disturbing it. If a sender (call her Alice) encodes information in the delicate quantum state of light and sends it to a receiver (Bob), then any eavesdropper (Eve) who intercepts and measures the light necessarily leaves a mark. Alice and Bob check for that mark. If the light arrives too disturbed, they know someone listened, and they throw the key away. If it arrives clean, physics guarantees Eve learned almost nothing.

That is the whole idea. The security doesn't come from Eve being unable to compute something. It comes from Eve being unable to look without leaving fingerprints.

The flavour that's easy to build

There are two ways to encode the light.

The old way sends single photons and counts them one at a time. This needs exotic detectors and special equipment.

The newer way — continuous-variable (CV) QKD — encodes information in the amplitude and phase of ordinary laser light, the same properties your fibre-optic internet already uses. It runs on standard telecom hardware. That makes it cheap and deployable today over city-scale distances.

Within CV-QKD, the most practical version is discrete-modulated (DM): instead of choosing from a smooth continuum of light states, Alice picks from a small menu of, say, four. Simpler to build, simpler to run.

So DM CV-QKD is the sweet spot: high key rates, real telecom fibre, off-the-shelf parts. Experimentally, it has looked wonderful for two decades.

The catch: "it works" is not "it's proven safe"

Here is the gap. A QKD system is only trustworthy if you can prove it's secure against the worst possible attacker. And the gold-standard proof has to clear three specific bars:

• Coherent attacks. The weak proofs only handled collective attacks, where Eve attacks each pulse the same way independently. A real adversary can attack the whole stream jointly, correlating her interference across all the pulses. That's a coherent attack, and it's much harder to rule out.
• Finite size. Real runs send a finite number of pulses, not infinitely many. Proofs that only work "in the limit of infinite data" don't protect an actual session.
• Composable. The key must stay secure when you plug it into a larger system and reuse it, not just in isolation.

For over twenty years, no proof cleared all three for DM CV-QKD. Every attempt cheated on at least one: restrict Eve to collective attacks, or pretend the light lives in a finite-dimensional space (it doesn't — light amplitude is a continuous, infinite-dimensional quantity), or only work for one specific menu of states, or fail to match the key rates everyone already knew were achievable.

So the field had a technology that worked beautifully and a security story with a hole in the middle. You could deploy it, but you couldn't honestly certify it.

What this paper actually did

It closes the hole. First complete, composable, finite-size proof against coherent attacks — with imperfect real-world detectors included. Two tools made it possible, and both are worth understanding because the ideas travel.

Tool one: an entropy accumulation theorem for infinite dimensions.

"Entropy" here means Eve's ignorance — how many bits of the key she genuinely cannot know. To bound security, you need to show this ignorance adds up across all the pulses in a run.

The problem with coherent attacks is that the pulses aren't independent, so you can't just sum up the ignorance pulse by pulse. An entropy accumulation theorem is a mathematical result that says: even when Eve correlates her attack across the entire stream, you can still lower-bound the total ignorance she has, pulse by pulse, as if you were adding independent contributions. It converts a hopelessly tangled joint problem into a running tally.

Such theorems existed for finite-dimensional systems. The authors built the first one that works for infinite-dimensional systems, with a clever constraint on the "marginals" (the individual per-pulse statistics) to keep it valid. That's the infinite-dimensional marginal-constrained entropy accumulation theorem — the machinery that finally handles coherent attacks on continuous light.

Tool two: dimension reduction.

The proof lives in infinite-dimensional space, where you cannot compute anything — a computer can't optimise over infinitely many numbers. The authors developed a rigorous way to squeeze the problem down to a finite, computable size without cheating: instead of assuming away the infinite tail (the earlier proofs' sin), they bound how much that tail could possibly contribute and account for it honestly. Now the security bound is a number a machine can actually calculate.

The result: key rates that match the known best-case (asymptotic) rates, beat the older collective-attack finite-size bounds, and stay positive past 70 km at realistic block sizes. A provably secure system that also performs.

The portable idea

Strip away the quantum physics and you're left with a move worth keeping: when a problem is infinite and correlated, don't fake finiteness or fake independence — bound them.

Two temptations always appear when a system is too big to analyse. One is to pretend the pieces are independent when they're entangled. The other is to truncate the infinite part and hope the tail doesn't matter. Both are lies that make the math easy and the conclusion false.

The disciplined alternative: find a theorem that lets correlated pieces be tallied as if independent while proving the error you're making is small (tool one), and truncate the infinite part while proving the discarded tail is bounded (tool two). You get a computable answer that is still true.

That pattern shows up far from quantum optics. Risk models that assume defaults are independent blow up in a crisis because defaults are correlated — the honest version bounds the correlation instead of ignoring it. Simulations of infinite systems in climate or fluid dynamics live or die on whether the truncation error is bounded or merely hoped away. The difference between an engineering demo and a certified guarantee is almost always this: did you assume the hard part away, or did you bound it?

Distilled from arXiv Quantum Physics