⚛️ quantum physics

Quantum Authenticated Key Expansion with Key Recycling

This paper presents and experimentally demonstrates a Quantum Authenticated Key Expansion (QAKE) protocol that uniquely integrates client authentication and key expansion into a single framework while enabling the full recycling of authentication keys, with security analyzed under an adapted AKE model and validated through experimental implementation.

Original authors: Wen Yu Kon, Jefferson Chu, Kevin Han Yong Loh, Obada Alia, Omar Amer, Marco Pistoia, Kaushik Chakraborty, Charles Lim

Published 2026-09-22

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Wen Yu Kon, Jefferson Chu, Kevin Han Yong Loh, Obada Alia, Omar Amer, Marco Pistoia, Kaushik Chakraborty, Charles Lim

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the digital age, the safety of our online lives rests on two pillars: keeping our data private and proving who we are. When you access a bank account or a medical record from a remote location, the system must be certain you are the right person, and it must ensure that no one else can see what you are doing. For decades, the standard way to handle this has been to use mathematical puzzles to create secret codes. However, as computers become more powerful, especially with the rise of quantum computing, these old puzzles are becoming easier to solve, threatening to unlock our secrets. To counter this, scientists have developed a method called quantum key distribution, which uses the fundamental laws of physics to create unbreakable codes. The challenge has been that while this method creates the secret code, it usually requires a separate, traditional system to verify identities, creating a complex and often inefficient two-step process.

A team of researchers at JPMorgan Chase has now demonstrated a way to merge these two tasks into a single, streamlined process. They have created a new protocol that not only generates a secret key using quantum physics but also verifies the identity of the users at the same time. More importantly, their system solves a major practical headache: in previous methods, the secret keys used to verify identity had to be changed after every single use, a process that is slow and difficult to manage across large networks. This new approach allows those identity keys to be reused safely, provided the session was successful. By combining authentication and key generation, and by allowing the keys to be recycled, the researchers have made a system that is not only more secure but also significantly more efficient for real-world use.

The researchers built their system on the concept of quantum key distribution, where two parties, traditionally called Alice and Bob, exchange particles of light to create a shared secret. In a standard setup, they would first have to prove who they are using a separate digital handshake, and only then would they generate the secret key. The new protocol, which the team calls Quantum Authenticated Key Expansion, integrates these steps. Instead of a long series of back-and-forth messages to verify identity and then another series to generate the key, the system performs the verification checks only twice during the entire exchange. This drastically reduces the amount of data that needs to be sent and processed, saving time and resources.

A critical innovation in this work is the ability to recycle the authentication keys. In many current systems, once a secret key is used to verify a user's identity, it is discarded to prevent hackers from stealing it and using it later. This means that every time a user logs in, the system must update the keys on every server involved, a massive logistical burden. The new protocol uses a clever trick: if the session is successful, the system uses the newly generated secret data to "mask" the old identity keys, effectively hiding them from any potential eavesdropper. This allows the same keys to be used again in the next session without compromising security. This feature is particularly valuable for cloud services, where a user might access a server from many different locations, as it eliminates the need to constantly update keys across a vast network of servers.

To prove their idea worked, the team did not just rely on computer simulations; they built a physical system using commercial quantum hardware. They connected two devices, acting as the sender and receiver, through a fiber optic link that simulated a distance of 45 kilometers. The system sent billions of light pulses, and the researchers processed the data to see if they could successfully generate a secret key while verifying identities. The experiment was a success. Despite the natural loss of signal over the distance and a small amount of noise in the system, the protocol generated a secure key at a rate of about 10 to the power of negative 5. While this number might seem small, it is comparable to, and in some cases slightly better than, standard quantum key distribution systems that do not include this integrated authentication. The key finding is that the system maintained its security and efficiency even with the added complexity of verifying identities and reusing keys.

The researchers also analyzed the security of their method in great detail, showing that it holds up against various types of attacks. They proved that even if an attacker tries to interfere with the messages or steal information, the system will detect the tampering and refuse to generate a key. The security relies on the fact that the keys used for verification are protected by the high quality of the new secret data generated in each session. If the protocol fails, the system simply discards the attempt and updates its internal labels, ensuring that no secrets are leaked. This rigorous testing gives confidence that the method is robust enough for practical deployment.

This work represents a significant step forward in making quantum security practical for everyday use. By combining identity verification with key generation and allowing for the reuse of authentication keys, the researchers have removed some of the biggest barriers to adopting quantum technology in cloud services and remote access. The ability to run this protocol on existing commercial hardware suggests that it could be integrated into current networks without requiring a complete overhaul of infrastructure. As quantum computers continue to develop, having a system that is both secure and efficient will be essential for protecting the sensitive data that powers our modern world. The team's success in demonstrating this in a real-world setting moves the technology from theoretical possibility to a tangible solution for the future of digital privacy.

Technical Summary: Quantum Authenticated Key Expansion with Key Recycling

Problem Statement

In the era of distributed digital services, remote access and cloud computing require robust security mechanisms for both authentication (verifying client identity) and data privacy (ensuring confidentiality of transferred data). While Quantum Key Distribution (QKD) addresses data privacy, current implementations often treat client authentication as a separate, classical protocol layer. This separation introduces inefficiencies, particularly regarding key management.

Traditional symmetric key cryptography requires frequent key refreshing to maintain long-term privacy, posing operational challenges for cloud service providers who must update authentication keys across multiple servers after every session. Furthermore, existing Quantum Key Distribution (QKD) protocols often rely on information-theoretic message authentication for every communication step, leading to significant authentication costs and reduced key rates. While previous proposals for key recycling (reusing authentication keys) exist, they often fail to account for experimental imperfections (such as loss, errors, and multi-photon events) or require the recycling of only partial keys (e.g., one-time pad masking keys), limiting their practical utility.

Methodology

The authors propose a Quantum Authenticated Key Expansion (QAKE) protocol that integrates entity authentication and key expansion into a single session. The methodology is built upon the following core components:

Integrated Protocol Design: Unlike standard QKD which separates authentication from key exchange, QAKE combines these tasks. The protocol follows a streamlined sequence:
- Label Agreement: Parties agree on a session label to select shared secrets.
- Quantum Transmission: Alice sends phase-randomized coherent BB84 states with decoy intensities to Bob.
- Sifting and Parameter Estimation: Bob announces detection rounds and basis choices. Alice performs parameter estimation using decoy-state analysis to bound single-photon events and error rates.
- Error Correction: Alice sends a syndrome to Bob to correct errors in the sifted key.
- Two-Step Authentication: Authentication is performed only in the final two communication steps. Alice validates Bob, and Bob validates Alice using hash-based tags derived from the corrected bitstring and shared secrets. This reduces the number of authentication tags from seven (in a standard separation) to two.
Key Recycling Mechanism: The protocol is designed to allow the reuse of authentication keys ( $K_h^1, K_2$ ) and masking keys ( $K_{mask}$ ) only if the protocol succeeds. If the protocol fails, the keys are updated or replaced. This is achieved by utilizing the corrected bitstring (which possesses high min-entropy when the protocol passes) to mask the authentication keys during tag generation. This approach relies on the Quantum Leftover Hash Lemma (QLHL) to ensure that the authentication keys remain secure even after being used to generate tags, provided the underlying bitstring has sufficient entropy.
Security Framework: The authors adapt the classical Authenticated Key Exchange (AKE) framework to the quantum regime. They define a multi-session security model where the protocol's security is reduced to single-session security under specific conditions. The security analysis establishes five distinct conditions:
- Robustness: The protocol succeeds in the absence of an adversary.
- Explicit Entity Authentication: Ensures that if one party accepts, the other must have been involved and accepted (with specific definitions for "full" and "almost-full" authentication).
- Match Security: Ensures that accepted parties generate identical keys.
- Key Secrecy: Ensures generated keys are uniform and secret from the adversary.
- Shared Secrets Privacy: Ensures that the shared secrets (authentication keys, seeds) remain private for future sessions, even if the current session fails or succeeds.
Experimental Implementation: The protocol was experimentally validated using ID Quantique Clavis XGR QKD systems in a back-to-back configuration with 10 dB of channel loss (emulating 45 km of fiber). Post-processing was performed offline using:
- Toeplitz Hashing: Implemented on a Virtex UltraScale+ FPGA for authentication and privacy amplification.
- LDPC Codes: Two-way Low-Density Parity-Check codes for error correction.
- Post-Selection: Data was post-selected to ensure balanced basis detection rates.

Key Contributions

Unified Protocol: The first protocol to integrate entity authentication and key expansion into a single quantum session, reducing communication overhead by limiting authentication to the final two steps.
Conditional Key Recycling: A practical implementation of key recycling that allows the entire authentication key set to be reused only upon successful protocol completion, eliminating the need for frequent key updates across distributed server networks when the session is valid. If the protocol fails, keys are updated to maintain security.
Robust Security Analysis: A comprehensive security proof adapted from classical AKE frameworks that explicitly accounts for experimental imperfections (loss, multi-photon events, finite-size effects) and provides separate security conditions for authentication and data privacy.
Experimental Validation: Successful demonstration of the QAKE protocol on commercial QKD hardware, achieving a key rate of approximately $10^{-5}$ with a Quantum Bit Error Rate (QBER) of ~2% and a detection rate of $10^{-4}$ .

Results

Key Rate Performance: Numerical simulations and experimental results indicate that QAKE offers a slightly higher key rate than standard QKD protocols that use separate authentication steps. This advantage is most pronounced in scenarios with high loss or small block sizes (e.g., satellite QKD) where the overhead of multiple authentication tags in traditional schemes is prohibitive.
Experimental Metrics: In three experimental runs with approximately $2 \times 10^{10}$ $2 \times 1 0^{10}$ signals sent:
- Average QBER: ~2%.
- Key Length Generated: ~ $2 \times 10^5$ bits.
- Detection Probability: ~ $1.03 \times 10^{-4}$ .
- The results aligned closely with theoretical simulations for an ideal setting.
Security Parameters: The protocol achieves a security parameter of $\epsilon_{sec} = 10^{-15}$ per session, allowing for an overall protocol security of $10^{-6}$ over $10^9$ sessions.

Significance

The paper claims that the QAKE protocol addresses a critical bottleneck in the deployment of quantum-secure remote access: the operational inefficiency of managing authentication keys in cloud environments. By enabling key recycling upon successful sessions, the protocol significantly reduces the communication resources required for cloud service providers to update client authentication keys across their infrastructure.

Furthermore, the work demonstrates that integrating authentication directly into the quantum process does not compromise security; rather, it provides a rigorous framework for composable security in a multi-session setting. The authors note that this approach allows for the secure reuse of privacy amplification seeds and authentication keys, provided the protocol passes, thereby making quantum-secure authentication more scalable and practical for real-world distributed systems. The paper also highlights that the proposed framework can be extended to other quantum variants, such as anonymous key exchange or client-server authentication without key generation.