S-CAD: Selective Classical Advantage Distillation for Quantum Conference Key Agreement

Abstract: Quantum conference key agreement (QCKA) protocols utilize GHZ states to establish shared group keys between multiple parties. While previous work has shown that standard Classical Advantage Distillation (CAD) protocols can sometimes benefit QCKA performance, it was unknown if past results were asymptotically tight. In this work, we design a new CAD protocol, "Selective Classical Advantage Distillation (S-CAD)", for QCKA, which generalizes prior QCKA+CAD work and allows the parties to selectively enable or disable CAD. We derive an asymptotic proof of security against general coherent attacks, which outperforms prior work. Finally, we evaluate in a variety of simulated star network topologies, showing when S-CAD can help, and when it is best to disable CAD entirely.

• The paper introduces S-CAD, which enables selective activation of classical advantage distillation to optimize secret key rates in heterogeneous quantum networks.
• It details a GHZ-based QCKA framework with rigorous asymptotic security proofs that counter both collective and coherent attacks.
• Evaluation results show that selective CAD outperforms full or no CAD by effectively mitigating error leakage and enhancing performance in multi-party settings.

Selective Classical Advantage Distillation for Quantum Conference Key Agreement

Introduction and Motivation

Quantum Conference Key Agreement (QCKA) protocols enable the establishment of a shared cryptographic key among multiple parties by leveraging distributed GHZ states. QCKA offers resource advantages over pairwise QKD, especially in network settings, but practical deployments encounter heterogeneous noise profiles across links, often degrading overall key rates due to the weakest channel.

Classical Advantage Distillation (CAD) has previously extended the noise tolerance of two-party QKD. Prior work explored group-key CAD, but lacked tight asymptotic bounds and did not clarify optimal selective application of CAD in multi-user networks. This paper introduces Selective CAD (S-CAD), a protocol permitting individual parties to enable/disable CAD, and provides an asymptotic security proof against general attacks. The analysis yields insight into when distillation should be selectively applied to maximize secret key rates across varied topologies.

Figure 1: Protocol overview: GHZ-based QCKA establishes raw keys, followed by S-CAD with selective two-way classical distillation, then error correction and privacy amplification.

S-CAD Protocol Design

S-CAD generalizes CAD post-processing for QCKA by allowing each party to individually enable CAD based on their channel conditions. After standard GHZ-based QCKA generates raw keys, Alice and each Bob randomly permute their remaining systems and divide them into "Left" and "Right" halves.

For each bit, Alice computes the parity of her Left and Right bits and sends the parity announcement publicly. If a Bob has CAD enabled, he accepts a round only if his parity matches Alice’s; otherwise, he rejects. Bobs with CAD disabled always accept. All parties retain only Left bits in accepted rounds. Standard error correction and privacy amplification are then performed on the distilled keys.

This protocol design enables tailored mitigation of error leakage: parties with high-noise channels can reduce bit error rates through CAD, while parties with low-noise channels avoid unnecessary reductions in acceptance probability.

Security Analysis and Asymptotic Key-Rate Bounds

The security proof targets the asymptotic setting and covers collective and, via post-selection techniques, general coherent attacks. The key rate is determined by the difference between Eve's uncertainty (conditional entropy) and maximal error correction leakage, both derived from network observables.

Let $Q_{AB_j}$ denote Alice–Bob$_j$ bit error rates pre-CAD, and $Q_{AB_j}^{CAD}$ post-CAD. The error correction term is $\max_j h(Q_{AB_j}^{CAD})$, maximizing across Bobs.

After S-CAD, the probability of an accepted block is denoted $p_a$, derived as a function of individual link error probabilities. The security proof leverages symmetrization and the GHZ basis to minimize Eve’s information. The key-rate expression is:

$$\lim_{N \to \infty} \frac{\ell}{N} = \frac{p_a}{2}\left( H(A|EM) - \max_j h(Q_{AB_j}^{CAD}) \right)$$

where $H(A|EM)$ is bounded via optimization over constrained entropy contributions, determined by sampled $Z$ and $X$ basis error rates. The protocol supports optimal post-processing: after noise characterization, selective CAD activation maximizes net key rate.

Evaluation in Homogeneous and Heterogeneous Networks

Simulation results validate the theoretical bounds in star topologies with varying party counts ($p=2$ to $_j$0) and heterogeneous link noise.

Figure 2: S-CAD key rates (solid line) outperform prior QCKA+CAD bounds (dashed line), especially with selective application for high-noise Bobs.

Homogeneous networks ($_j$1 equal) show that enabling CAD for all parties is beneficial at high noise, but acceptance probability $_j$2 diminishes rapidly with increasing $_j$3. In these cases, disabling CAD entirely outperforms selective or full CAD unless noise is extreme.

Heterogeneous networks (one or more Bobs experiencing higher noise) demonstrate that selective CAD—enabling only for high-noise Bobs—yields higher overall key rates compared to all-on or all-off strategies, especially as noise disparity increases.

Figure 3: Key-rate curves for homogeneous three-Bob scenarios.

Figure 4: Impact of selective CAD with one high-noise Bob in a four-party network.

Figure 5: Selective CAD yields better key rates than full CAD as noise disparity increases among Bobs.

Figure 6: Key rate trends for larger ($_j$4) networks: selective CAD remains advantageous in heterogeneous settings, but full CAD loses efficacy in homogeneous configurations.

These evaluations confirm that selective activation of CAD is essential for optimizing multi-party QCKA performance in real-world networks with mixed channel conditions.

Practical Implications and Future Directions

S-CAD offers a flexible post-processing mechanism for QCKA, enabling quantum networking deployments to dynamically adapt distillation strategy based on observed channel noise. Practically, parties can estimate link error rates post-quantum stage and decide CAD activation to maximize net secret key yield.

Theoretically, the asymptotic security proof provides tight bounds and highlights the tradeoff between error correction leakage and acceptance probability in increasingly large or heterogeneous networks. The findings indicate fundamental limitations of group CAD in homogeneous high-noise settings as network size grows, motivating further protocol improvements.

Potential future work includes extending proofs to finite-key settings, exploring reuse of discarded raw key bits for subgroup keying or random number generation, and constructing CAD protocols with reduced sampling overhead or improved efficiency in large, nearly homogeneous networks.

Conclusion

The introduction of Selective Classical Advantage Distillation (S-CAD) for QCKA establishes an efficient, rigorously analyzed approach for multi-party quantum key agreement, maximizing secret key rates by selectively mitigating error correction leakage in heterogeneous networks. The theoretical analysis, supported by extensive evaluations, clarifies when and how CAD should be applied for optimal performance, setting the stage for adaptive, scalable quantum networking (2605.02588).