Probability key distribution (PKD), proposed by Hua-Lei Yin in arXiv:2408.13602 (2024), claims unconditionally secure key distribution between any two users with no quantum channel between them: each user locally prepares and measures phase-randomized weak coherent states, the secret random phase-mapping rule costs an mlog⁡2mm\log_{2}m-bit pre-shared key per session, and a 'provable quantum one-way function' plus 'random information negotiation' (XOR-masking of fresh quantum random numbers with Toeplitz-hashed pre-shared key material) are claimed to give a distance-independent net key rate of about 20 Mbps. If correct, this would overturn the standard understanding that information-theoretically secure key distribution requires quantum communication and that purely classical public discussion cannot expand a pre-shared key. This task asks for an independent rigorous determination of PKD's security status — a composable unconditional-security proof in a standard unbounded-adversary model, or a concrete attack on the stated protocol — together with a characterization of how far the per-session pre-shared-secret consumption (secret mapping rule plus information-theoretically secure authentication) can be reduced while preserving unconditional security.

Background

Key distribution — letting two distant parties share a secret bit string — underpins all of symmetric cryptography. Shannon's analysis of the one-time pad (XOR of a message with a truly random key of equal length, used once) showed that perfectly secret encryption requires a key as long as the message, so information-theoretically secure systems cannot rest on distributed keys alone: fresh keys must keep being distributed. Classically, key distribution is only computationally secure, resting on one-way functions — functions that are easy to compute but infeasible to invert, whose very existence is a famous open problem of complexity theory (their existence would imply P≠NPP\neq NP). Quantum key distribution (QKD) escapes this by encoding key material in quantum states that any eavesdropping attempt disturbs; it has been demonstrated over 508 km and 1002 km in the measurement-device-independent and twin-field configurations (protocol families that remove detector side channels and beat the point-to-point rate–loss limit, respectively). But QKD requires a quantum channel carrying quantum states between the users, which is expensive, rate-limited by channel loss, and poorly suited to mobile users. A classical information-theoretic result sharpens the tension: Maurer's theory of secret-key agreement by public discussion (1993) shows that two parties who communicate only over a public authenticated channel can distill secret key only from correlated randomness in which they hold an informational advantage over the eavesdropper; without such an advantage, public discussion cannot expand pre-shared secret material at all.

Against this backdrop, PKD makes an extraordinary claim. In each session, Alice and Bob each locally prepare pairs of weak coherent states (the quantum states of ideal laser pulses, with Poisson-distributed photon number; here with mean photon number μ≈0.1\mu\approx0.1) whose signal-pulse phase is φ=θ+rπ\varphi=\theta+r\pi, where rr is a bit from a quantum random number generator (QRNG, a device producing bits from quantum measurement noise) and the global phase θ\theta is one of mm values selected through a random mapping rule — a random bijection from log⁡2m\log_{2}m-bit strings to phases, shared between Alice and Bob by one-time pad at a cost of mlog⁡2mm\log_{2}m pre-shared bits per session and protected against tampering by information-theoretically secure authentication (Wegman–Carter-style hashing, here linear-feedback-shift-register Toeplitz matrices — matrices constant along diagonals, used as keyed hash functions). Each user interferes their own pulse pairs locally, keeps the bit rr as raw key upon a detector click, and publicly announces click events and detectors; Alice then transmits her phase strings XOR-masked with Toeplitz-hashed pre-shared key material ('random information negotiation'), letting Bob sort and flip his raw key to correlate with hers. Error correction and privacy amplification (compression of a partially secret string by a universal2_2 hash family, in which any two distinct inputs collide with probability at most the inverse of the output length) then yield ℓ≤n−λ−log⁡2(2/εcor)−2log⁡2(3/2εsec)\ell\le n-\lambda-\log_{2}(2/\varepsilon_{\rm cor})-2\log_{2}(3/2\varepsilon_{\rm sec}) secret bits — i.e. a key that is equal for both parties except with probability εcor\varepsilon_{\rm cor} and within εsec\varepsilon_{\rm sec} of unknown to Eve — where nn is the raw-key length (the number of successful detection events in the session) and the error-correction leakage is λ=nfh(E)\lambda=nfh(E) at bit error rate E≈25%E\approx25\%, with ff the error-correction efficiency factor and hh the binary Shannon entropy function. The paper's security argument rests on two claimed observations: that generating a phase-randomized weak coherent state through the secret random mapping rule is a 'provable quantum one-way function' (phase randomization turns the coherent state into a Poisson mixture of photon-number states that hides the global phase, and the secret random rule prevents Eve from exploiting the non-uniform phase-probability distribution), and that XOR-masking fresh quantum random numbers with key material hashed from a reused long pre-shared key K⃗fix\vec{K}_{\rm fix} is unconditionally secure because Eve, seeing only ciphertexts of never-leaking quantum random numbers, is restricted to ciphertext-only attacks. Note that, unlike a standard one-way function, this construction is keyed: its description (the mapping rule) is secret, shared by one-time pad.

The paper itself lists open issues: the mlog⁡2mm\log_{2}m-bit per-session pre-shared-key consumption for the mapping rule plus its information-theoretically secure authentication is an acknowledged overhead to be reduced and optimized across sessions; the explicit quantum-state preparation and measurement steps were promised to be removable in a 'next work'; the constructed quantum one-way function's broader implications (relations to classical one-way functions, quantum zero-knowledge proofs, quantum secure multiparty computation) were flagged as future directions; and the negotiated quantum random numbers must never be reused as encryption keys for other messages. The promised next work appeared the same day as arXiv:2408.13613, which builds a 'generalized one-way function' and a PKD variant based solely on classical data processing with raw-key bit error rate improved from 25%25\% to 18.2%18.2\%. Neither preprint has been published in a peer-reviewed journal, and an August 2026 topical review of quantum one-way functions (Nikolopoulos, arXiv:2608.05754) explicitly distinguishes public-description one-way functions from secret device-specific mappings whose security collapses once the mapping is characterized.

Problem Statement

Establish, by independent rigorous analysis, whether probability key distribution (PKD) — as specified in arXiv:2408.13602 (optical variant, protocol steps (i)–(v) with its supplementary security analysis) and arXiv:2408.13613 (fully classical variant) — is unconditionally secure as claimed, and determine at what pre-shared-secret cost such security can hold. These two deliverables resolve one overarching objective: deciding whether PKD can deliver unconditionally secure key distribution without a quantum channel at the claimed rates. Specifically:

(1) Security determination — an answer of either form is admissible and settles this deliverable, provided it resolves the security status of both specified variants (the optical variant of arXiv:2408.13602 and the fully classical variant of arXiv:2408.13613): (a) a rigorous security proof: a formal adversary model (Eve with unbounded computation who observes all classical transcripts and public announcements permitted by the protocol, and whatever quantum systems the model grants her), a composable (i.e., remaining secure under arbitrary composition with other protocol executions) or at least ε\varepsilon-secret/ε\varepsilon-correct security statement at the generality of the source claims, covering the multi-session reuse of the long key K⃗fix\vec{K}_{\rm fix}, the per-session random mapping rule, and the authentication of its transmission, together with the proof; or (b) a concrete attack: an explicit eavesdropping strategy against the stated protocol that extracts information about the final key beyond the claimed εsec\varepsilon_{\rm sec}, demonstrated on a finite instance with concrete parameters (for example m=1024m=1024 phases, mean photon number μ=0.1\mu=0.1, N=109N=10^{9} pulse-pair rounds in one session) by computed or simulated Eve information or key-recovery probability.

(2) Pre-shared-key cost frontier: determine how far the per-session pre-shared-secret consumption — the mlog⁡2mm\log_{2}m bits consumed to share the random mapping rule by one-time pad plus the bits consumed by information-theoretically secure authentication of those transmissions — can be reduced while preserving the unconditional-security claim, or establish that no finite consumption suffices because the scheme is insecure (in which case deliverable (1) must justify that conclusion). Answers that repair or delimit the construction must state exactly which component of the original security argument fails.

References

  1. Hua-Lei Yin, "Unconditionally secure key distribution without quantum channel", arXiv:2408.13602 (submitted 24 August 2024, v1), DOI: 10.48550/arXiv.2408.13602, https://arxiv.org/abs/2408.13602
  2. Hua-Lei Yin, "Generalized one-way function and its application", arXiv:2408.13613 (submitted 24 August 2024, v1), DOI: 10.48550/arXiv.2408.13613, https://arxiv.org/abs/2408.13613
  3. Georgios M. Nikolopoulos, "Quantum One-Way Functions and Related Cryptographic Primitives", arXiv:2608.05754 (submitted 6 August 2026, v1), DOI: 10.48550/arXiv.2608.05754, https://arxiv.org/abs/2608.05754
  4. C. E. Shannon, "Communication Theory of Secrecy Systems", Bell System Technical Journal 28(4), 656-715 (1949), DOI: 10.1002/j.1538-7305.1949.tb00928.x, https://doi.org/10.1002/j.1538-7305.1949.tb00928.x
  5. U. M. Maurer, "Secret key agreement by public discussion from common information", IEEE Transactions on Information Theory 39(3), 733-742 (1993), DOI: 10.1109/18.256484, https://doi.org/10.1109/18.256484