High-rate and computationally-efficient seedless extractors for device-independent quantum cryptography

Abstract: Device-independent (DI) quantum cryptography provides secure cryptography with minimal trust in, or characterisation of, the used quantum devices. An essential component of DI protocols is the use of randomness extractors for privacy amplification, but these typically require an initial seed of randomness that introduces a potential vulnerability. To solve this problem, the security of seedless extractors was proven in Quantum 9, 1654 (2025). The core idea was to use the Bell violation of the raw data, rather than its min-entropy, as the extractor promise. However, the large fluctuations in the Bell inequality used required many rounds to precisely estimate the Bell violation, consuming substantial randomness and making the protocol very inefficient. In this work, we present a new proof technique based on a truncation method that allows the user to estimate the protocol parameters with an asymptotically vanishing fraction of rounds and, as a consequence, achieves the optimal rate of one key bit per singlet. Notably, we prove this result using seedless extractors that can be implemented efficiently.

• The paper introduces polynomial-time linear seedless extractors for device-independent randomness generation, removing the need for an independent random seed while preserving composable security under memoryless devices.
• A truncation-based proof reduces the estimation fraction to p_est = n^-1/3, achieving the optimal asymptotic rate of one secret bit per singlet at maximal CHSH violation.
• The protocol produces a positive asymptotic key rate above a CHSH win probability of approximately 0.828, although finite-size security currently requires at least 205,642 rounds under the stated parameters.

Overview

This paper addresses a central post-processing bottleneck in device-independent (DI) quantum cryptography: privacy amplification. In standard DI protocols, randomness extractors require an initial random seed, which introduces an additional trust assumption and potential vulnerability. Prior work by Foreman and Masanes ("Seedless extractors for device-independent quantum cryptography," Quantum 9, 1654) showed that, for memoryless devices, the degree of Bell inequality violation of the raw data can serve as the extractor's statistical promise in place of min-entropy, enabling fully deterministic extraction. That result, however, suffered from two deficiencies: the seedless extractors were proven to exist but had no known polynomial-time implementation, and the protocol was extremely inefficient—more rounds were consumed estimating the Bell violation than were needed to certify the output, because bounding an $n$-fold product of Bell operators required suppressing large statistical fluctuations.

The present work resolves both problems. The authors introduce a truncation-based proof technique that allows the estimation phase to consume only an asymptotically vanishing fraction of rounds ($p_{\mathrm{est}} = n^{-1/3}$), yielding the optimal asymptotic rate of one key bit per singlet. Moreover, they show that linear functions—binary matrices computable in $O(mn)$ time—suffice as seedless extractors, so the entire extraction step is efficiently implementable.

Protocol

The setting is one-party DI randomness generation with two non-communicating, memoryless devices (Alice and Bob) interacting over $n$ rounds against an adversary Eve holding system $E$. Each round is independently designated an estimation round (with probability $p_{\mathrm{est}} = n^{-1/3}$) or a raw-key generation round. Estimation rounds use uniformly random CHSH inputs $(x_i, y_i)$ and record $z_i = a_i + b_i + x_i y_i \bmod 2$; the protocol aborts unless the winning frequency meets a threshold $w_{\mathrm{th}} \in (w_q + \Delta, w_q]$, where $w_q = 3/4$ is the classical bound and $p_{\mathrm{est}} = n^{-1/3}$0 the Tsirelson value. Generation rounds fix inputs $p_{\mathrm{est}} = n^{-1/3}$1; Alice's outcomes form the raw key $p_{\mathrm{est}} = n^{-1/3}$2, which is mapped to the final key $p_{\mathrm{est}} = n^{-1/3}$3 via a full row-rank binary matrix $p_{\mathrm{est}} = n^{-1/3}$4.

Security is expressed in the universally composable sense: the trace distance between the actual key state (with Eve also learning the estimation set $p_{\mathrm{est}} = n^{-1/3}$5 after execution) and the ideal state with a uniform key must be at most $p_{\mathrm{est}} = n^{-1/3}$6. The main theorem gives the achievable key length

$p_{\mathrm{est}} = n^{-1/3}$7

with $p_{\mathrm{est}} = n^{-1/3}$8 and $p_{\mathrm{est}} = n^{-1/3}$9 the modified binary entropy. The asymptotic rate is $O(mn)$0, which is positive once $O(mn)$1 (CHSH value above roughly $O(mn)$2) and reaches 1 at maximal violation. A positive key length requires $O(mn)$3 rounds even at maximal CHSH violation under the chosen parameterization—a concrete finite-size cost the authors note could be improved by optimizing $O(mn)$4 and $O(mn)$5, which they leave open.

The truncation technique

The proof's core difficulty is bounding the trace distance between actual and ideal states without requiring many rounds to concentrate the empirical CHSH win rate. The earlier approach bounded the expectation of an $O(mn)$6-fold product of Bell operators, which is highly sensitive to perturbations of the global state and forced heavy sampling. Here, the authors instead decompose $O(mn)$7 into a truncated part $O(mn)$8 and a remainder, where $O(mn)$9 projects onto eigenvectors $n$0 of the per-round CHSH operators whose frequency profile satisfies a constraint tied to a relaxed threshold $n$1. Since $n$2 and the no-abort operator $n$3 commute (both diagonal in the same eigenbasis), the trace distance splits into two terms: security of the truncated state plus twice the truncation error $n$4.

The truncation error is controlled via a Chernoff-style bound: optimizing over the adversary's freely chosen per-round eigenvalue parameter $n$5 yields quantities $n$6, and Lemma 2 shows there exists a $n$7 such that the exponent is at most $n$8 whenever the frequency vector lies outside $n$9. This gives $E$0, fixed to $E$1 by the choice of $E$2.

The first term—the extractor's performance on the truncated state—is handled through an exact algebraic identity (Lemma on indicator functions): the deviation of the linear map's output distribution from uniform is supported only on nonzero codewords of the row space of $E$3. Combined with Lemma 3, which shows the raw-key observable $E$4 flips the index $E$5 but preserves $E$6 in the eigenbasis, any matrix element surviving inside the truncated subspace has Hamming weight $E$7, where $E$8. Lemma 4 establishes this weight bound from the defining inequality of $E$9. Finally, Lemma 5 proves via the probabilistic method—interpreting $p_{\mathrm{est}} = n^{-1/3}$0 as the generator matrix of a random binary linear code and bounding its weight distribution—that matrices $p_{\mathrm{est}} = n^{-1/3}$1 exist satisfying $p_{\mathrm{est}} = n^{-1/3}$2 for all weights $p_{\mathrm{est}} = n^{-1/3}$3. Summing binomial coefficients up to weight $p_{\mathrm{est}} = n^{-1/3}$4 via the entropy tail bound yields the second $p_{\mathrm{est}} = n^{-1/3}$5 contribution, completing the proof.

Two structural reductions make the analysis tractable. First, Naimark dilation followed by Jordan's lemma reduces arbitrary POVMs on arbitrary Hilbert spaces to projective qubit measurements, block-diagonalized per round; the triangle inequality over the resulting mixture justifies assuming qubits throughout. Second, the spectral decomposition of the CHSH operator (well known from prior literature but restated for self-containment) provides the explicit eigenvalue parametrization used in the optimization.

Significance of the results

Three claims stand out. First, seedless extraction with efficient extractors: linear functions over $p_{\mathrm{est}} = n^{-1/3}$6 suffice, removing both the seed vulnerability and the computational intractability of the previously known constructions. Second, optimal rate: one bit per singlet asymptotically, meaning the estimation overhead vanishes as $p_{\mathrm{est}} = n^{-1/3}$7 rather than dominating the output. Third, the connection between seedless-extractor rates and the weight distribution of linear error-correcting codes, which the authors identify as likely of independent interest within the broader program relating privacy amplification to coding theory.

The security guarantee holds for arbitrary adversarially chosen initial states $p_{\mathrm{est}} = n^{-1/3}$8, Hilbert space dimensions, and measurements, subject only to the memorylessness assumption; abort probability under honest implementations is exponentially small in $p_{\mathrm{est}} = n^{-1/3}$9 when $(x_i, y_i)$0 is strictly below the achieved win rate.

Limitations and open questions

The paper is explicit about several restrictions. The analysis is tailored to the CHSH scenario: the reduction to qubits relies on Jordan's lemma, which applies only when each party has two projectors, and does not extend to scenarios with more inputs or outputs. The authors state that extension to other bipartite binary-input/binary-output inequalities (e.g., tilted CHSH) or multipartite Mermin/Svetlichny settings should be direct, but generalization to arbitrary Bell scenarios is nontrivial; they conjecture it may be achievable by applying the truncation method at the level of correlation matrices within the NPA hierarchy. The memoryless-device assumption remains essential and removing it—extending to the fully general DI setting—is identified as an important next step. Additionally, Lemma 5 is an existence result via the probabilistic method; explicit efficiently constructible matrices satisfying the row-space weight condition are not given, though the authors conjecture that generator matrices of BCH codes are promising candidates. Finally, the specific choices $(x_i, y_i)$1 and $(x_i, y_i)$2 are convenient rather than optimal, and finite-size performance—particularly the $(x_i, y_i)$3 threshold—could likely be substantially improved.

Conclusion

This work upgrades seedless extraction in DI cryptography from an existence statement to a practical construction: polynomial-time linear extractors, a truncation-based security proof requiring only a vanishing fraction of estimation rounds, and the optimal asymptotic rate of one secret bit per singlet for one-party DI randomness generation under the CHSH scenario. The remaining gaps—generalization beyond two-input/two-output Bell tests, removal of the memorylessness assumption, and explicit extractor constructions—are clearly delineated and appear tractable with the techniques introduced here.