Asymmetric Coding BB84 Protocol

• The Asymmetric Coding BB84 Protocol is a quantum key distribution scheme that breaks the typical symmetric basis usage by encoding key bits primarily in the Z basis for efficiency improvements.
• It employs biased basis selection and selective test bit allocation to reduce sifting losses and streamline hardware implementation while maintaining rigorous error estimation.
• Composable security proofs using trace-distance methods ensure resilience against collective and coherent attacks, with finite-size corrections addressing practical statistical fluctuations.

The term "Asymmetric Coding BB84 Protocol" broadly refers to a class of quantum key distribution (QKD) protocols in which the traditional symmetry of the Bennett-Brassard 1984 (BB84) protocol—where both Z and X (computational and Hadamard) bases are used interchangeably for key generation and parameter estimation—is intentionally broken. This asymmetry may manifest as encoding all key information in a single basis, or by strongly biasing the probability of basis selection, or, in some constructions, by modifying the post-processing classical steps to eliminate sifting losses or incorporate additional cryptographic primitives. These modifications have been motivated by practical considerations in photonic hardware, the desire for improved efficiency, and rigor in composable security against a range of powerful adversarial strategies.

1. Formal Construction and Variants

Several constructions fall under the umbrella of "Asymmetric Coding BB84." The most canonical and rigorously analyzed variant is BB84-INFO-z, in which Alice encodes all key-carrying qubits in the Z basis, while both Z and X bases are sampled for parameter estimation to bound both bit and phase errors. This construction is formally described as follows (Boyer et al., 2017, Boyer et al., 2017):

• Initialization: Publicly fix parameters: number of INFO bits $n$, TEST-Z bits $n_z$, TEST-X bits $n_x$; error thresholds $p_{a,z}$, $p_{a,x}$; parity-check matrix $P_C$ and privacy amplification matrix $P_K$; total qubits $N=n+n_z+n_x$.
• Partitioning: Alice picks three disjoint random $N$-bit selection strings defining the positions of INFO (Z basis), TEST-Z (Z basis), and TEST-X (X basis) qubits.
• State Preparation: Alice generates a random $N$-bit string $i$. She prepares $|i_j\rangle_Z$ for INFO and TEST-Z positions, $|i_j\rangle_X$ for TEST-X positions.
• Transmission: The $N$ qubits are sent to Bob.
• Basis Revelation and Measurement: Alice reveals the basis partition; Bob measures each qubit in the corresponding basis, recording outcomes.
• Parameter Estimation: They compare outcomes for TEST-Z and TEST-X positions, compute sample error rates, and abort if thresholds exceeded.
• Error Correction: Alice sends a syndrome for the INFO bits; Bob corrects his corresponding string using $P_C$.
• Privacy Amplification: The final key is computed as $k = x P_K^\mathrm{T}$, where $x$ is Alice's INFO string.

Other constructions further simplify by using only three quantum states (the two $Z$-basis states and one $X$-basis state) for even further hardware simplification (Rusca et al., 2018). A more radical form, termed "Asymmetric Coding BB84" (AC-BB84) in (Serna, 2013), replaces classical sifting and error correction with a two-phase BB84-like exchange and "private reconciliation" based on a public random seed and asymmetric cryptography, enabling zero qubit loss in key generation in the absence of noise.

2. Composable Security Proofs and Statistical Analysis

Security proofs for asymmetric coding BB84 protocols typically depart from classical information-theoretic bounds in favor of trace-distance arguments between Eve's conditional states, guaranteeing composable security. The general method is as follows (Boyer et al., 2017, Boyer et al., 2017):

• Threat Model: Eve mounts a collective attack, applying an independent unitary operation on each transmitted qubit and storing all quantum side information.
• Key Distinguishability: Security is quantified by the trace distance $\frac{1}{2}\|\hat{\rho}_k - \hat{\rho}_{k'}\|_1$ between conditioned Eve states; a bound is established as a function of the minimum distance of $P_K$ and the probability of a hypothetical phase error string exceeding a threshold.
• Parameter Sampling: Since only test bits in $X$ provide an empirical bound on phase errors in $Z$-basis INFO bits, Hoeffding's inequality (or Serfling's bound for sampling without replacement) is invoked to relate the observed error rate on sample TEST-X bits to the (unmeasured) virtual phase error rate on INFO bits, yielding exponential suppression of Eve's success probability provided sufficient $n_x$.
• Finite-Size Corrections: The achievable key rate must be corrected by terms $\Delta(\epsilon)$ of order $O(\frac{\log(1/\epsilon)}{n})$ that account for statistical fluctuations in parameter estimation.
• Reliability (Correctness): The Z-basis error rate on INFO bits is upper-bounded with high probability by the observed error rate on TEST-Z bits, ensuring error-correcting codes succeed with exponentially high probability.

This approach supports composable security statements: the trace distance to ideal uniformity is less than $$\epsilon = \epsilon_{\mathrm{corr}} + \epsilon_{\mathrm{sec}}$$, with both terms exponentially small under suitable choice of code parameters and test sample sizes (Boyer et al., 2017).

3. Key-Rate Formulas and Asymptotic Regimes

The secret key rate of asymmetric coding BB84 protocols, particularly BB84-INFO-z, is essentially equivalent to that of standard BB84 in the asymptotic regime, modulo finite-size effects and the allocation of test bits. The principal result is (Boyer et al., 2017, Boyer et al., 2017):

$$r = \frac{m}{n} \geq 1 - h(e_x) - f_{\mathrm{EC}} h(e_z) - \Delta(\epsilon)$$

where $e_x$ and $e_z$ are observed phase and bit error rates on TEST-X and TEST-Z bits, $h(\cdot)$ is the binary entropy, $f_{\mathrm{EC}}$ is error correction inefficiency, and $\Delta(\epsilon)$ is the finite-size penalty. The security threshold—maximum tolerable error rates for positive rate—trace out the same boundary as standard BB84, $H_2(2p_{a,x}) + H_2(p_{a,z}) = 1$, where $H_2$ is the binary entropy (Boyer et al., 2017).

In finite-size scenarios, sampling exponents depend critically on the ratio $n_x / n$, accentuating the role of appropriate test allocation. In highly biased and practical applications, choosing $n_x$ and $n_z$ to optimize security and key rate is essential.

4. Hardware, Implementation, and Practical Trade-offs

A key motivation for asymmetric coding variants is practical hardware simplification:

• One-Basis INFO: Encoding all key bits in the Z basis (or bit basis) permits use of a single-basis preparation block and avoids optical modulators or polarization controllers for the X basis in key-generation rounds.
• Basis-Choice Asymmetry: Strongly biasing basis choice (e.g., $p_Z \gg p_X$) increases the sifting efficiency, as fewer rounds are discarded due to mismatched bases.
• Extra Test Bits: Because phase errors are only observed on X basis, $n_x$ must be sufficiently large to exponentially suppress the probability of undetected phase attacks, implying $N = n + n_z + n_x$ qubits per $n$ key bits (as opposed to $2n$ in standard BB84 for $n \ll N$).
• Passive Basis Choice: Passive implementations using non-polarizing beam splitters with adjustable transmittance enable receiver-side basis bias without fast electro-optic or mechanical switches. This is particularly advantageous in satellite or time-bin applications (Kawakami et al., 6 Jul 2025).
• Resource Reduction: The three-state variant requires only two Z-basis states and a single X-basis state, reducing Alice's modulator count and Bob's measurement settings. Bob's measurement can be implemented using two photon detectors (data line) and a single detection port for the monitoring basis, realized in time-bin architectures (Rusca et al., 2018).
• Key-Generation Efficiency: In AC-BB84, the asymmetry is used to eliminate all classical sifting, error correction, and privacy amplification in the noise-free case, with qubit-to-key efficiency reaching four bits per qubit, at the cost of added classical cryptographic primitives (Serna, 2013).

5. Extensions, Security Against Coherent Attacks, and Finite-Size Optimization

The composable security proofs for asymmetric BB84 protocols have been extended to security against arbitrary coherent attacks using universal-composability frameworks (Hayashi, 2022). Recent advances have provided closed-form second-order expansions for the optimal finite-size key length and basis choice probability. Specifically:

• Optimal Basis Allocation: The optimal phase-basis selection probability scales asymptotically as $n^{-1/4}$, allowing phase error estimation accuracy to be maintained while minimizing sifting loss. The corresponding second-order correction to the key length is of order $n^{3/4}$, significantly larger than the $n^{1/2}$ corrections in symmetric BB84 (Hayashi, 2022).
• Passive-Biased Implementations: Security is rigorously preserved when the receiver's basis choice is implemented via passive, potentially biased hardware such as beam-splitters, requiring adapted decoy-state and privacy analysis. Across practical ranges ($<120$ km fiber), key rates are negligibly impacted except at long distances (Kawakami et al., 6 Jul 2025).

6. Comparison to Related Protocols and Practical Limitations

Compared to standard (symmetric) BB84, asymmetric coding protocols offer the following trade-offs:

Property	Symmetric BB84	Asymmetric Coding BB84
INFO bits distributed	Both Z/X	Z only (INFO-z) / biased
Basis sifting	Discard $\approx$50%	Retain all or almost all
Phase-error detection	Both bases	Requires extra X-test bits
Hardware requirements	Modulators, switches	Fewer modulators/switches
Key rate (asymptotic)	$1-2h(Q)$	$1-h(e_x)-h(e_z)$ (identical)
Finite-size correction	$O(n^{-1/2})$	$O(n^{-1/4})$ (larger penalty)

A plausible implication is that asymmetric coding variants are well-suited for scenarios where hardware simplicity or efficiency is paramount, but the finite-key regime must be handled carefully due to greater finite-size statistical penalties. In channel scenarios where one basis experiences significantly lower error rates, the flexibility in tuning test sample allocations can be advantageous. However, improper allocation of test bits may degrade security exponents. For protocols relying on strong classical asymmetric cryptography (as in AC-BB84), computational assumptions and the need for authenticated public channels are critical considerations.

7. Summary and Outlook

The asymmetric coding BB84 family encompasses protocol modifications that strategically break or strongly bias the basis symmetry inherent in original BB84. These designs are motivated by hardware simplification, efficiency gains, and composable security under contemporary and practical adversarial models. The protocols retain full asymptotic security and reliability against collective and, with appropriate proofs, coherent attacks, with key rates matching those of the original protocol. Practical deployments must optimize the test-to-key ratio, address finite-size effects, and balance hardware advantages against the need for stringent statistical confidence in security parameters. The approach has influenced both theoretical advances in QKD security analysis and the realized architecture of current high-performance QKD systems (Boyer et al., 2017, Boyer et al., 2017, Rusca et al., 2018, Hayashi, 2022, Kawakami et al., 6 Jul 2025, Serna, 2013).