Three-Setting QKD Protocol

• The three‐setting protocol is a quantum key distribution variant that uses three signal states instead of four to exploit mismatched measurement outcomes.
• It employs two orthonormal bases and retains non-key rounds for parameter estimation, enabling linear bounds on Eve’s attack operator overlaps.
• Its asymptotic security analysis under depolarizing channels yields an 11% error tolerance, matching the performance of standard BB84.

Searching arXiv for the specified protocol and closely related work. arxiv_search("(Krawec, 2016) three-state quantum cryptographic protocol BB84")

Searching for adjacent literature on three-state QKD and BB84 threshold analyses. arxiv_search("three-state BB84 asymptotic key rate mismatched measurement outcomes")

The three-setting protocol, as documented in the analysis of a three-state quantum cryptographic protocol, is a variant of BB84 quantum key distribution in which Alice transmits only three signal states rather than the four states of standard BB84, while Bob measures in one of two orthonormal bases and all non-key rounds are retained for channel estimation. Its defining technical feature is that mismatched measurement outcomes are not discarded but are used to infer linear bounds on overlaps in Eve’s attack operator, yielding an asymptotic lower bound on the key rate that remains positive up to an error rate of $11\%$, matching the four-state BB84 threshold under the depolarizing-channel model (Krawec, 2016).

1. Protocol class and state space

The protocol is defined on a qubit Hilbert space $\mathcal{H}$ with two orthonormal bases. The first is the computational, or $Z$-basis,

$\mathcal{B}=\{\ket{0},\ket{1}\}.$

The second is a basis

$\mathcal{A}=\{\ket{a},\ket{\bar a}\}$

parameterized by a public real number $\alpha\in(0,1)$, with

$$\ket{a}=\alpha\ket{0}+\beta\ket{1},\qquad \ket{\bar a}=\beta\ket{0}-\alpha\ket{1},\qquad \beta\equiv\sqrt{1-\alpha^2}.$$

In the special case $\alpha=1/\sqrt2$, one recovers $\ket{a}=\ket{+}$ and $\ket{\bar a}=\ket{-}$ (Krawec, 2016).

The protocol is “three-state” because Alice’s signal alphabet contains $\mathcal{H}$0, $\mathcal{H}$1, and $\mathcal{H}$2, but not $\mathcal{H}$3. This asymmetry distinguishes it from four-state BB84 while preserving a two-basis structure. A plausible implication is that the protocol seeks state-economy at the preparation stage without abandoning the basis-based estimation strategy characteristic of BB84.

2. Round structure and raw-key extraction

On each round, Alice chooses to send $\mathcal{H}$4 or $\mathcal{H}$5 each with probability $\mathcal{H}$6, or $\mathcal{H}$7 with probability $\mathcal{H}$8. Bob chooses to measure in $\mathcal{H}$9 with probability $Z$0, and otherwise in $Z$1. After public basis announcement, only the rounds in which Alice sent $Z$2 or $Z$3 and Bob measured in $Z$4 contribute to the raw key (Krawec, 2016).

The classical raw-key variables $Z$5 are characterized by the quantum bit error rate

$Z$6

All remaining rounds are retained for parameter estimation, including the deliberately preserved mismatched-basis events. This differs from a common simplification in which only matched-basis statistics are treated as relevant. Here, the mismatched data are structurally part of the security proof rather than merely auxiliary observations.

3. Mismatched-basis parameter estimation

Parameter estimation uses three classes of observed data:

• the raw-key basis error $Z$7;
• the $Z$8-basis error

$Z$9

• all mismatched-basis probabilities

$\mathcal{B}=\{\ket{0},\ket{1}\}.$0

for $\mathcal{B}=\{\ket{0},\ket{1}\}.$1 (Krawec, 2016).

These observed frequencies are used to form linear bounds on real overlaps

$\mathcal{B}=\{\ket{0},\ket{1}\}.$2

associated with Eve’s attack operator $\mathcal{B}=\{\ket{0},\ket{1}\}.$3. In particular,

$\mathcal{B}=\{\ket{0},\ket{1}\}.$4

$\mathcal{B}=\{\ket{0},\ket{1}\}.$5

and the Cauchy–Schwarz bound gives

$\mathcal{B}=\{\ket{0},\ket{1}\}.$6

Finally, these quantities are inserted into the expression for $\mathcal{B}=\{\ket{0},\ket{1}\}.$7 to bound $\mathcal{B}=\{\ket{0},\ket{1}\}.$8 (Krawec, 2016).

The significance of this step is methodological. The protocol does not treat Eve’s influence only through aggregate error rates; it reconstructs constraints on specific ancilla overlaps. This suggests that the informational content of mismatched events compensates for the missing fourth signal state.

4. Asymptotic security analysis and key-rate lower bound

The security proof is carried out under collective attacks in the asymptotic limit $\mathcal{B}=\{\ket{0},\ket{1}\}.$9, with key rate

$\mathcal{A}=\{\ket{a},\ket{\bar a}\}$0

Conditioning on key rounds and assuming symmetric $\mathcal{A}=\{\ket{a},\ket{\bar a}\}$1-basis error,

$\mathcal{A}=\{\ket{a},\ket{\bar a}\}$2

the argument establishes

$\mathcal{A}=\{\ket{a},\ket{\bar a}\}$3

where $\mathcal{A}=\{\ket{a},\ket{\bar a}\}$4 and $\mathcal{A}=\{\ket{a},\ket{\bar a}\}$5 are Eve-conditioned states corresponding respectively to no bit flip and bit flip in the $\mathcal{A}=\{\ket{a},\ket{\bar a}\}$6-basis (Krawec, 2016).

The entropies satisfy

$\mathcal{A}=\{\ket{a},\ket{\bar a}\}$7

$\mathcal{A}=\{\ket{a},\ket{\bar a}\}$8

with

$\mathcal{A}=\{\ket{a},\ket{\bar a}\}$9

Since $\alpha\in(0,1)$0, the resulting lower bound is

$\alpha\in(0,1)$1

where one may safely replace $\alpha\in(0,1)$2 by any $\alpha\in(0,1)$3 on $\alpha\in(0,1)$4 (Krawec, 2016).

For practical estimation, one sets

$\alpha\in(0,1)$5

and then minimizes the bound over the allowed range of $\alpha\in(0,1)$6. The proof relies on lemmas concerning block-diagonal states and strong subadditivity, so the key-rate expression is not a heuristic approximation but the endpoint of an entropy-based lower-bound argument.

5. Depolarizing-channel specialization and comparison with BB84

For a depolarizing channel of parameter $\alpha\in(0,1)$7, symmetry yields

$\alpha\in(0,1)$8

Numerically minimizing the asymptotic lower bound over

$\alpha\in(0,1)$9

produces exactly the BB84 key-rate curve

$$\ket{a}=\alpha\ket{0}+\beta\ket{1},\qquad \ket{\bar a}=\beta\ket{0}-\alpha\ket{1},\qquad \beta\equiv\sqrt{1-\alpha^2}.$$0

which remains positive up to

$$\ket{a}=\alpha\ket{0}+\beta\ket{1},\qquad \ket{\bar a}=\beta\ket{0}-\alpha\ket{1},\qquad \beta\equiv\sqrt{1-\alpha^2}.$$1

Under this channel model, the three-state protocol therefore tolerates the same maximum noise as the four-state BB84 protocol once mismatched-basis parameter estimation is included (Krawec, 2016).

This equality of thresholds is the principal comparative result. It does not mean that the protocols are identical at the signal level; rather, it indicates that the reduced signal alphabet does not degrade the asymptotic depolarizing-channel threshold when the full observed data are exploited. A common misconception is that removing one signal state must necessarily reduce tolerable noise. The result shows that, in the asymptotic analysis presented, that conclusion does not follow.

6. Assumptions, scope, and interpretive boundaries

The security proof assumes collective attacks by Eve, modeled as an identical, independent unitary on each round, with extension to coherent attacks via standard de Finetti or post-selection arguments. It also assumes the asymptotic key rate

$$\ket{a}=\alpha\ket{0}+\beta\ket{1},\qquad \ket{\bar a}=\beta\ket{0}-\alpha\ket{1},\qquad \beta\equiv\sqrt{1-\alpha^2}.$$2

perfect qubits, and no side-channels. The symmetry conditions

$$\ket{a}=\alpha\ket{0}+\beta\ket{1},\qquad \ket{\bar a}=\beta\ket{0}-\alpha\ket{1},\qquad \beta\equiv\sqrt{1-\alpha^2}.$$3

may be optionally enforced for the $$\ket{a}=\alpha\ket{0}+\beta\ket{1},\qquad \ket{\bar a}=\beta\ket{0}-\alpha\ket{1},\qquad \beta\equiv\sqrt{1-\alpha^2}.$$4-basis error model (Krawec, 2016).

These assumptions delimit the article’s scope. The result concerns asymptotic security rather than finite-key performance, and it abstracts away from implementation-level imperfections. It therefore establishes a lower bound in an idealized but standard cryptographic regime. Within that regime, the central conclusion is precise: by keeping and exploiting all mismatched measurement outcomes, one can bound the critical overlaps in Eve’s ancilla and derive a compact key-rate lower bound whose depolarizing-channel specialization coincides with the BB84 expression $$\ket{a}=\alpha\ket{0}+\beta\ket{1},\qquad \ket{\bar a}=\beta\ket{0}-\alpha\ket{1},\qquad \beta\equiv\sqrt{1-\alpha^2}.$$5 (Krawec, 2016).