COMPOSABLE SECURITY. Here we prove the composable secutiy of the AMDI-QCKA protocol. We first give the definitions of the security criteria for the QCKA. A QCKA protocol is εcor-correct if Pr(∃ i ∈ {2, ..., n}, s.t. S1 ̸= Si) ≤ εcor, (5) where Si (i ∈ {1, 2, ..., n}) is the final key of Ui. A QCKA protocol is called εsec-secret if ppass Σ D ρS1 ,E, |S1| |S1 ⟩⟨S1 | ⊗ σE ! ≤ ε sec , (6) · · where ppass is the probability of passing the protocol, D( , ) is the trace distance, σE is the system of the eavesdropper. Then, we provide the composable security proof for the AMDI-QCKA protocol and the final key rate formula.
COMPOSABLE SECURITY. This work formalizes CGKA security by considering appropriate functionalities in the UC framework [16]. This framework comes with a composition theorem, stating that UC- security implies security in an arbitrary environment. In particular, CGKA security phrased, as in 6 Note that the CIA is also implicit in the design of the 2-party SM protocol Signal [34]. 7 For example, the adversary is allowed to “bypass” the PKI and add new members with arbitrary keys. this paper, with respect to a single group implies security with respect to many groups, a setting not formalized until now. We note, however, that due to so-called commitment problem, some of our statements provide composition only with respect to a restricted class of environments. However, we believe that our statements are a solid indication for multi-group security (see below and Section 10 for more discussion). Phrasing CGKA security via UC functionalities also allows to abstract away irrelevant aspects and delegate some tasks to the simulator, which would otherwise require running the actual protocol as part of the security definition in seemingly unnatural places (or even have special “interpretation” algorithms as part of the CGKA definition in the active setting).
