List Privacy Amplification (LPA) in QKD

• List Privacy Amplification (LPA) is a relaxation of standard privacy amplification that extracts a list of candidate keys, ensuring one key remains secret even against quantum adversaries.
• It leverages the hidden index entropy to achieve an additive gain of log L in extractable key length while retaining smooth min-entropy and composable security.
• Explicit constructions using polynomial inner-product and Toeplitz-based hashing balance seed usage and computational efficiency, facilitating practical implementations.

Searching arXiv for the cited LPA papers to ground the article in current preprint metadata. List Privacy Amplification (LPA) is a relaxation of the final privacy-amplification step in quantum key distribution (QKD) in which Alice and Bob extract a list of $L$ candidate keys from a raw string $X$ correlated with an eavesdropper Eve, with the guarantee that at least one key is perfectly secret while Eve cannot identify which entry is secure (Kulkarni, 18 Mar 2026). In the formal setting introduced in “One Key Good, L Keys Better: List Decoding Meets Quantum Privacy Amplification” (Kulkarni, 18 Mar 2026), LPA preserves the standard adversarial model of privacy amplification with quantum side information, retains smooth min-entropy as the relevant entropy measure, but changes the task from unique-key extraction to list extraction. This relaxation is explicitly compared to the passage from unique decoding to list decoding in coding theory: allowing a short list of outputs exposes an additive $\log L$ gain in extractable key length (Kulkarni, 18 Mar 2026). Related work on list privacy outside QKD studies list-based privacy under utility constraints, but in a different operational model centered on function recoverability rather than composable secret-key extraction (Nageswaran et al., 2023).

1. Formal definition and ideal functionality

In the LPA setting, after sifting, error correction, and parameter estimation, Alice and Bob share an $n$-bit classical string $X \in \{0,1\}^n$ that is partially known to Eve, who holds a quantum system $E$ correlated with $X$. The joint state is a CQ state

$$\rho_{XE} = \sum_{x \in \{0,1\}^n} p_x\, |x\rangle\!\langle x|_X \otimes \rho_E^x.$$

Instead of extracting a single secret key, LPA requires that Alice and Bob produce $L$ candidate keys such that at least one is information-theoretically secret from Eve and Eve cannot determine which one (Kulkarni, 18 Mar 2026).

The formalization is given in the abstract cryptography framework as a resource construction from a noisy resource $(X,E)$ and an authenticated classical channel to an ideal list-key functionality $X$0 (Kulkarni, 18 Mar 2026). This functionality outputs $X$1 independently uniform $X$2-bit strings $X$3, chooses a secret index $X$4 uniformly at random, gives Alice and Bob the entire list together with $X$5, and gives Eve only the off-list keys $X$6, without revealing either $X$7 or $X$8 (Kulkarni, 18 Mar 2026). When $X$9, the functionality reduces exactly to the standard unique-key resource (Kulkarni, 18 Mar 2026).

The ideal joint state is written as

$\log L$0

where each $\log L$1 is maximally mixed on $\log L$2 bits (Kulkarni, 18 Mar 2026). The real-world protocol samples $\log L$3 independent strongly two-universal hash functions $\log L$4, computes $\log L$5, and then samples the secret index $\log L$6 after hashing and independently of $\log L$7 and $\log L$8 (Kulkarni, 18 Mar 2026).

Security is defined by trace-distance indistinguishability from the ideal list-key resource: $\log L$9 This list-$n$0-security notion is composable: no environment can distinguish the real protocol from $n$1 except with advantage $n$2 (Kulkarni, 18 Mar 2026). Operationally, this means that there is, up to $n$3, exactly one index $n$4 for which $n$5 is uniform and independent of Eve, while Eve’s view does not reveal which position is the good one (Kulkarni, 18 Mar 2026).

2. Relation to standard privacy amplification and list-based privacy

Standard privacy amplification with a quantum adversary is governed by the Quantum Leftover Hash Lemma (QLHL). For a CQ state $n$6, a strongly two-universal family $n$7, and $n$8, the QLHL states that

$n$9

provided

$X \in \{0,1\}^n$0

Thus one may extract approximately $X \in \{0,1\}^n$1 nearly uniform bits when $X \in \{0,1\}^n$2, and this bound is tight in the unique-key setting (Kulkarni, 18 Mar 2026).

LPA keeps the same adversarial model and the same smooth min-entropy measure, but replaces the requirement of a unique secret output by the weaker requirement that one element of a list be secret and hidden among the other entries (Kulkarni, 18 Mar 2026). The comparison to list decoding is explicit: unique decoding outputs a single codeword, list decoding outputs a short list of candidates; analogously, standard privacy amplification outputs one key, whereas LPA outputs a list and thereby exceeds the standard QLHL bound (Kulkarni, 18 Mar 2026).

The broader notion of list privacy appears in other contexts. “List Privacy Under Function Recoverability” (Nageswaran et al., 2023) studies a finite-alphabet setting in which a user releases a randomized response subject to a $X \in \{0,1\}^n$3-recoverability constraint for a function $X \in \{0,1\}^n$4, while minimizing the probability that a querier can place $X \in \{0,1\}^n$5 inside a list of prescribed size $X \in \{0,1\}^n$6. In that model, the privacy criterion is

$X \in \{0,1\}^n$7

and the optimal tradeoff curve is

$X \in \{0,1\}^n$8

(Nageswaran et al., 2023). This is not the same task as LPA in QKD, but it provides a related list-based privacy perspective in which privacy is measured by adversarial list failure under a utility constraint (Nageswaran et al., 2023). A plausible implication is that LPA belongs to a wider family of privacy notions where the object of protection is not unique reconstruction but ambiguity over a small candidate set.

3. Quantum List Leftover Hash Lemma

The central theorem of LPA is the Quantum List Leftover Hash Lemma (QLLHL) (Kulkarni, 18 Mar 2026). Let

$X \in \{0,1\}^n$9

If Alice and Bob sample $E$0 independent strongly two-universal hashes $E$1, define $E$2, and then sample a secret index $E$3 independently of everything else, then the protocol is list-$E$4-secure whenever

$E$5

This is Theorem 3.1 of (Kulkarni, 18 Mar 2026). Relative to the standard QLHL bound

$E$6

the list version yields an additive gain of $E$7, with the main asymptotic gain equal to $E$8 (Kulkarni, 18 Mar 2026).

The paper attributes this gain to the hidden index $E$9, which is selected after hashing and is initially hidden from Eve (Kulkarni, 18 Mar 2026). The joint variable $X$0 derives entropy from both $X$1 and the independent randomness of $X$2, so one obtains schematically

$X$3

Applying the standard QLHL to the $X$4-bit pair $X$5 then yields the list-extraction bound (Kulkarni, 18 Mar 2026). The paper describes this as the hidden index effectively contributing $X$6 bits of entropy (Kulkarni, 18 Mar 2026).

The result is also accompanied by a converse. Theorem 4.1 of (Kulkarni, 18 Mar 2026) shows that for any $X$7 there exists a worst-case source $X$8 for which any list-$X$9-secure protocol must satisfy

$$\rho_{XE} = \sum_{x \in \{0,1\}^n} p_x\, |x\rangle\!\langle x|_X \otimes \rho_E^x.$$0

The converse uses a syndrome source in which Eve learns a linear projection $$\rho_{XE} = \sum_{x \in \{0,1\}^n} p_x\, |x\rangle\!\langle x|_X \otimes \rho_E^x.$$1 of dimension $$\rho_{XE} = \sum_{x \in \{0,1\}^n} p_x\, |x\rangle\!\langle x|_X \otimes \rho_E^x.$$2, leaving $$\rho_{XE} = \sum_{x \in \{0,1\}^n} p_x\, |x\rangle\!\langle x|_X \otimes \rho_E^x.$$3 uniform on a coset of size $$\rho_{XE} = \sum_{x \in \{0,1\}^n} p_x\, |x\rangle\!\langle x|_X \otimes \rho_E^x.$$4 (Kulkarni, 18 Mar 2026). In that case, conditioning on Eve leaves effective support size at most $$\rho_{XE} = \sum_{x \in \{0,1\}^n} p_x\, |x\rangle\!\langle x|_X \otimes \rho_E^x.$$5, and the independent index contributes at most another $$\rho_{XE} = \sum_{x \in \{0,1\}^n} p_x\, |x\rangle\!\langle x|_X \otimes \rho_E^x.$$6 (Kulkarni, 18 Mar 2026). This establishes that the additive $$\rho_{XE} = \sum_{x \in \{0,1\}^n} p_x\, |x\rangle\!\langle x|_X \otimes \rho_E^x.$$7 gain is optimal up to lower-order terms.

4. Security interpretation, composability, and authentication

The phrase “at least one key is perfectly secret” has a precise meaning in the ideal functionality $$\rho_{XE} = \sum_{x \in \{0,1\}^n} p_x\, |x\rangle\!\langle x|_X \otimes \rho_E^x.$$8: the index $$\rho_{XE} = \sum_{x \in \{0,1\}^n} p_x\, |x\rangle\!\langle x|_X \otimes \rho_E^x.$$9 is uniformly random and known only to Alice and Bob, the key $L$0 is uniform and independent of Eve’s quantum system $L$1 and all off-list keys, and Eve’s view consists only of $L$2 together with the $L$3 off-list keys (Kulkarni, 18 Mar 2026). Because the real protocol is $L$4-close to the ideal resource, these properties hold except with probability at most $L$5 (Kulkarni, 18 Mar 2026).

Within abstract cryptography, a protocol $L$6 $L$7-constructs an ideal resource $L$8 if, for every environment $L$9,

$(X,E)$0

For LPA, the protocol constructs $(X,E)$1 with error $(X,E)$2, and standard composition theorems then imply additive accumulation of failure parameters across error correction, privacy amplification, and authentication (Kulkarni, 18 Mar 2026). The total QKD security parameter is written as

$(X,E)$3

where $(X,E)$4 comes from list privacy amplification (Kulkarni, 18 Mar 2026).

After generating the list, Alice must reveal $(X,E)$5 to Bob so that both can use the same final key. The paper proposes Wegman–Carter authentication for this step: Alice sends $(X,E)$6 together with a MAC tag using a short pre-shared key, and Eve cannot forge or modify $(X,E)$7 except with probability $(X,E)$8 (Kulkarni, 18 Mar 2026). The authentication cost is stated as only $(X,E)$9 bits of pre-shared key usage (Kulkarni, 18 Mar 2026). Once $X$00 is authenticated, both parties use $X$01 as an ordinary unique secret key, and the list structure disappears for subsequent cryptographic use (Kulkarni, 18 Mar 2026). This is the basis for the claim that LPA is fully composable with standard QKD and with primitives that consume a unique session key (Kulkarni, 18 Mar 2026).

5. Application to BB84-type QKD

For BB84, after sifting, Alice and Bob share $X$02 bits with bit error rate $X$03 and phase error rate $X$04. Finite-key analysis gives

$X$05

where $X$06 is a finite-size correction term of order $X$07 (Kulkarni, 18 Mar 2026). Standard privacy amplification then gives an asymptotic key rate

$X$08

which vanishes when $X$09; for symmetric channels this corresponds to the familiar $X$10 phase-error threshold (Kulkarni, 18 Mar 2026).

Under LPA, the extractable list-key length satisfies

$X$11

and therefore, after substituting the BB84 min-entropy lower bound,

$X$12

Requiring $X$13 yields

$X$14

(Kulkarni, 18 Mar 2026). For list size $X$15 and $X$16, this becomes asymptotically

$X$17

which the paper summarizes as a threshold shift from

$X$18

(Kulkarni, 18 Mar 2026).

According to (Kulkarni, 18 Mar 2026), this means that standard BB84 with unique-key privacy amplification cannot extract positive key beyond roughly $X$19 phase error, whereas BB84 with LPA can tolerate strictly larger phase error for any $X$20. The paper also proves tightness in the QKD setting via a matching intercept–resend attack: the attack can be tuned so that the bit and phase error rates lie exactly at the threshold predicted by QLLHL, and beyond the shifted threshold even list privacy amplification cannot generate key (Kulkarni, 18 Mar 2026). This shows that the increased tolerable phase-error threshold is not merely an artefact of analysis.

6. Explicit constructions and computational complexity

The QLLHL is stated for any strongly two-universal family, and (Kulkarni, 18 Mar 2026) gives two explicit constructions.

The first is a polynomial inner-product hash over $X$21. Assuming $X$22 and $X$23, the input $X$24 is represented as $X$25. For each list position $X$26, one samples $X$27 and $X$28, computes

$X$29

and sets

$X$30

before encoding as an $X$31-bit string (Kulkarni, 18 Mar 2026). The family is strongly two-universal, yields list-$X$32-security under the QLLHL bound, uses $X$33 random bits per hash, and runs in $X$34 bit operations overall, with $X$35 working memory per hash and $X$36 storage for all keys (Kulkarni, 18 Mar 2026).

The second construction is Toeplitz-based and operates over $X$37. For each list element $X$38, one samples a Toeplitz generator $X$39, defining an $X$40 Toeplitz matrix $X$41, samples an offset $X$42, and computes

$X$43

using convolution and FFT-based acceleration (Kulkarni, 18 Mar 2026). Toeplitz hashing is also strongly two-universal, satisfies the same list-$X$44 guarantee, uses $X$45 random bits per list element, and has total running time $X$46 for $X$47, with $X$48 FFT workspace and $X$49 key storage (Kulkarni, 18 Mar 2026).

Construction	Seed usage per list element	Time
Polynomial inner-product hash over $X$50	$X$51 bits	$X$52 total
Toeplitz-based list hash	$X$53 bits	$X$54 total

Both constructions satisfy the strong two-universality required by QLLHL (Kulkarni, 18 Mar 2026). The paper characterizes the trade-off as one between conceptual simplicity and FFT-based asymptotic acceleration: inner-product hashing is simpler and linear-time in $X$55, whereas the Toeplitz construction is more implementation-intensive but benefits from convolution-based computation (Kulkarni, 18 Mar 2026).

7. Conceptual significance, neighboring frameworks, and limitations

The stated reason for the $X$56 gain is index-hiding entropy. In standard privacy amplification, the key is a function $X$57 of the source alone, so all usable entropy must come from $X$58. In LPA, Alice and Bob derive many outputs $X$59, then choose the index $X$60 afterwards and keep it hidden from Eve. The pair $X$61 therefore draws entropy both from $X$62 and from the independent uniform index $X$63, yielding the additional $X$64 term (Kulkarni, 18 Mar 2026). The analogy with list decoding is structural rather than metaphorical: relaxing uniqueness opens degrees of freedom that are unavailable in the standard formulation (Kulkarni, 18 Mar 2026).

The paper explicitly contrasts LPA with classical fuzzy and list fuzzy extractors. Those constructions concern noisy inputs and classical adversaries, whereas LPA addresses a clean classical source $X$65 entangled with arbitrary quantum side information and provides a composable security statement in a quantum setting (Kulkarni, 18 Mar 2026). It states that LPA is the first approach to be simultaneously quantum, list-output, composable, and tight (Kulkarni, 18 Mar 2026).

Other forms of privacy amplification by list-like outputs exist in different settings. “Privacy Amplification via Shuffled Check-Ins” (Liew et al., 2022) studies a shuffle-model protocol in which each round outputs an unordered list of locally randomized reports from independently self-sampled users. There, privacy amplification arises from random participation and shuffling, and the RDP analysis is expressed as a binomial mixture over all possible list sizes $X$66 (Liew et al., 2022). This is not LPA in the QKD sense, but it shows that list-structured outputs also play a central role in differential privacy and shuffle-model amplification (Liew et al., 2022). This suggests a broader methodological theme: privacy gains can emerge when the released object is a list whose latent structure conceals the identity or status of a privileged element.

The limitations recorded in (Kulkarni, 18 Mar 2026) are concrete. The model assumes authenticated classical communication and trusted local devices; it is not device-independent. Finite-size corrections $X$67 may substantially reduce the asymptotic gain for small block lengths. For very large $X$68, the authentication cost of transmitting $X$69 scales as $X$70 bits of pre-shared key, which can materially reduce net key rate; accordingly, the paper suggests small constant list sizes such as $X$71 as more realistic (Kulkarni, 18 Mar 2026). It also does not treat device-independent QKD, continuous-variable QKD, or entropy accumulation frameworks, and identifies low-seed list privacy amplification as an open problem, asking whether nearly optimal seed length can be achieved while remaining information-theoretic (Kulkarni, 18 Mar 2026).

In summary, LPA is a composable reformulation of privacy amplification in which secrecy is attached not to a unique hash output but to a hidden position within a list. The resulting Quantum List Leftover Hash Lemma establishes that the secret index contributes an additive $X$72 to the extractable key length, the converse shows that this gain is tight, and the BB84 analysis shows that the effect translates into a genuine increase in tolerable phase error (Kulkarni, 18 Mar 2026). Within the technical landscape of list-based privacy notions, LPA is distinguished by its quantum adversarial model, its AC-level composability, and its explicit identification of hidden index entropy as a cryptographic resource (Kulkarni, 18 Mar 2026).