"Pretty strong" converse for the private capacity of degraded quantum wiretap channels

0.3 MB·

by  Andreas Winter

“Pretty strong” converse for the private capacity
of degraded quantum wiretap channels
Andreas Winter
ICREA and Departament de F´ısica, Grup d’Informacio´ Qua`ntica
Universitat Auto`noma de Barcelona, ES-08193 Bellaterra (Barcelona), Spain.
Abstract—In the vein of the recent “pretty strong” converse of [15], we do not reach a complete understanding of the full
for the quantum and private capacity of degradable quantum tradeoff between decoding error and privacy.
channels [Morgan/Winter, IEEE Trans. Inf. Theory 60(1):317-
333,2014],weusethesametechniques,inparticularthecalculus II. CQQ-WIRETAPCHANNELANDSTRONGCONVERSE
ofmin-entropies,toshowaprettystrongconversefortheprivate
The model we consider is that of a discrete memoryless
capacity of degraded classical-quantum-quantum (cqq-)wiretap
cqq-wiretap channel:
channels, which generalize Wyner’s model of the degraded
6
classical wiretap channel.
1 W :X −→S(B⊗E)
0 While the result is not completely tight, leaving some gap
2 between the region of error and privacy parameters for which x(cid:55)−→ρBxE,
theconverseboundholds,andalargerno-goregion,itrepresents
r a further step towards an understanding of strong converses of with a finite set X and finite dimensional Hilbert spaces B
p
wiretap channels [cf. Hayashi/Tyagi/Watanabe, arXiv:1410.0443 and E, of legal user and eavesdropper, respectively. Further-
A
for the classical case]. more, we shall assume most of the time that the channel is
Index Terms—quantum information, private capacity, strong
6 degraded, meaning that there exists a quantum channel (cptp
converse, smooth min-entropies.
2 map) D : L(B) → L(E) such that ρE = D(ρB) for all
x x

x∈X.IntroducingaStinespringdilationofD byanisometry
h] I. INTRODUCTION V :B (cid:44)→E(cid:48)⊗F, we have ρE(cid:48) =Tr VρBV†.
x F x
p One of the most outstanding successes of Shannon the- The objective of wiretap coding is for Alice to encode
- ory [23] is Shannon’s information theoretic treatment of messages in such a way that Bob can decode with small error
t
n cryptography [24], and the further development at the hands probability, and that Eve cannot distinguish messages except
a of Wyner, who introduced the wiretap channel model [36]. with small probability. To quantify errors, we use the purified
u
q While the achievability part for the wiretap channel is a well- distance
(cid:112)
[ understoodcombinationofchannelcodingandprivacyampli- P(ρ,σ)= 1−F(ρ,σ)2,

fication techniques, the converse, even the weak converse, of √ √
2 with the fidelity F(ρ,σ) = (cid:107) ρ σ(cid:107) between quantum
thegeneralizedwiretapchannelrequiredanewideainCsisza´r 1
v
states [16], [30], see [27].
1 and Ko¨rner’s contribution [3].
An n-block code of transmission error (cid:15) and privacy error
1 Characteristically, for multi-user scenarios strong converses
6 are hard to come by and not known in many instances. The δ for W consists of a stochastic map E :[M]−→Xn and a
6 POVM D =(D )M on Bn, such that for
presenceofanadversaryinthewiretapsetting,albeitapassive u u=1
0
. one, makes the wiretap capacity a multi-user problem, and ρUU(cid:98)En = 1 (cid:88) E(xn|u)|u(cid:105)(cid:104)u|U ⊗|uˆ(cid:105)(cid:104)uˆ|U(cid:98)
1 until recently only weak converses were known for Wyner’s M
0 u,uˆ,xn
originalproblem[3],[36].Thesamewasistrueforthe“static”
16 versionsofdistillationofsharedsecretkeybetweenAliceand ⊗TrBn(cid:2)ρBxnnEn(Duˆ⊗11)(cid:3),
: Bob from a prior three-way correlation with Eve [1], [18], the following hold:
v
where Tyagi and Narayan [28], Tyagi and Watanabe [29],
Xi and Watanabe and Hayashi [33] made progress only recently. P(ρUU(cid:98),∆UU(cid:98))≤(cid:15), (1)
r Most recently, Hayashi, Tyagi and Watanabe [15] (see also P(ρUEn,∆U ⊗ρEn)≤δ. (2)
(cid:101)
a
their [14]) have given an elegant, very insightful analysis of
strong converse rates for general classical wiretap channels, Here, ∆UU(cid:98) = M1 (cid:80)u|u(cid:105)(cid:104)u|U ⊗ |u(cid:105)(cid:104)u|U(cid:98), so that ∆U is the
yielding the complete strong converse in the degraded case. maximally mixed state, and ρ(cid:101)En is a suitable state on En.
Here,weextendtheirresultssomewhattothequantumcase, ThelargestnumberM ofmessagesundertheseconditionsis
looking at wiretap channels with classical input but quantum denotedM(n,(cid:15),δ).Then,theprivatecapacityisdefinedasthe
outputs,so-calledcqq-wiretapchannels.Insteadoftheelegant largest asymptotically achievable rate such that transmission
hypothesis testing method developed in [15], we use a rather error and privacy error vanish in the limit, i.e.
more blunt tool, the min-entropy calculus [22], [27]. Hence, 1
P(W):= inf liminf logM(n,(cid:15),δ).
while we can treat channels not amenable to the method (cid:15),δ>0 n→∞ n
Theorem 1 (Devetak [6]; Cai/Winter/Yeung [2]) LetW be Its proof relies on the calculus of min- and max-entropies,
a cqq-wiretap channel. Then its private capacity is given by of which we will briefly review the necessary definitions and
P(W)=sup 1P(1)(W⊗n), where properties; cf. [27] for more details.
n n
P(1)(W)=maxI(U :B)−I(U :E).
Definition 3 (Min- and max-entropy) For ρAB ∈S (AB),
≤
Here, the maximum is over joint distributions P of the the min-entropy of A conditioned on B is defined as
UX
channel input X and an auxiliary variable U, and the mutual H (A|B) := max max{λ∈R:ρAB ≤2−λ11⊗σB}.
min ρ
informations are with respect to the state σB∈S(B)
ρUXBE =(cid:88)P (u,x)|u(cid:105)(cid:104)u|U ⊗|x(cid:105)(cid:104)x|X ⊗ρBE. With a purification |ψ(cid:105)ABC of ρ, we define
UX x
u,x H (A|B) :=−H (A|C) ,
max ρ min ψAC
For degraded channels, it is given by the single-letter formula
with the reduced state ψAC =Tr ψ.
B
P(W)=P(1)(W)=maxI(X :F|E(cid:48)),
Definition 4 (Smooth min- and max-entropy) Let (cid:15) ≥ 0
where the maximum is over distributions P of the channel
X
and ρ ∈ S(AB). The (cid:15)-smooth min-entropy of A con-
input, and the conditional mutual information is with respect AB
ditioned on B is defined as
to the state
ρXE(cid:48)FE =(cid:88)PX(x)|x(cid:105)(cid:104)x|X(V ⊗11)ρBxE(V ⊗11)†. Hm(cid:15)in(A|B)ρ :=ρm(cid:48)≈a(cid:15)xρHmin(A|B)ρ(cid:48),
x where ρ(cid:48) ≈ ρ means P(ρ(cid:48),ρ)≤(cid:15) for ρ(cid:48) ∈S (AB).
(cid:15) ≤
In other words, w.l.o.g. one may assume U = X, and the
Similarly,
regularization is not necessary [13, Appendix A]. (cid:4)
H(cid:15) (A|B) := min H (A|B)
max ψ max ρ(cid:48)
ρ(cid:48)≈(cid:15)ρ
For completeness, we recall here the definition of the =−H(cid:15) (A|C) ,
min ψ
quantum information quantities: For a state ρ on a quantum
system X, the entropy is S(X) = S(ρX) = −Trρlogρ, with a purification ψ ∈S(ABC) of ρ.
the mutual information for a bipartite state ρXY is I(X : All min- and max-entropies, smoothed or not, are invariant
Y) = S(X)+S(Y)−S(XY), and the conditional mutual under local unitaries and local isometries.
information for a tripartite state ρXYZ is I(X : Y|Z) =
The following two lemmas show that min- and max-
S(XZ)+S(YZ)−S(Z)−S(XYZ).
entropies have properties close to those of the von Neumann
Itseemstobeunknownwhetherinthecqq-wiretapchannel entropy.
setting the regularization above is necessary, but it is quite
clear that the single-letterization in the classical case, by Lemma 5 (Data processing) For ρ∈S(ABC) and (cid:15)≥0,
Csiszar and Ko¨rner [3], does not work, due to the use of
H(cid:15) (A|BC)≤H(cid:15) (A|B),
chain rules, we would get information quantities conditioned min min
onquantumregisters.Furthermore,theresultsofSmith,Renes Hm(cid:15)ax(A|BC)≤Hm(cid:15)ax(A|B). (cid:4)
and Smolin [26] suggest that P(1) does not give the private
capacity. On the other hand, in the general quantum channel Lemma 6 (Chain rules [10], [31]) Let (cid:15),δ ≥ 0, η > 0.
case [2] it is well-known that the regularization is necessary: Then, with respect to the same state ρ∈S(ABC),
Foranisometry,suchthatEve’schannelisthecomplementary 2
H(cid:15)+2δ+η(AB|C)≤Hδ (B|C)+H(cid:15) (A|BC)+log ,
channel to Bob’s, there are instances where P(1) is strictly max max max η2
smallerthanP [11],[17],[25],[26].Alsoiftheeavesdropper’s (3)
channelisadegradedversion(eventrivially)oftheauthorized
2
channel,andthelatterisquantum,P(1) canbestrictlysmaller H(cid:15) (AB|C)≥Hδ (B|C)+H(cid:15)+2δ+2η(A|BC)−3log .(cid:4)
max min max η2
than P, as observed in [13].
(4)
Here we show the following pretty strong converse:
Proof of Theorem 2: We follow closely the initial
Theorem 2 Let W : X → S(B ⊗E) be a degraded cqq- steps of the analysis in [19, Thm. 14]. Consider an n-block
wiretap channel and (cid:15),δ ≥0 such that (cid:15)+2δ <1, then code with M messages, and transmission and privacy error
(cid:0)(cid:112) (cid:1) (cid:15) and is δ: message u (chosen uniformly) is encoded by a
logM(n,(cid:15),δ)≤nP(W)+O nlogn ,
distributionE(xn|u)andsentthroughthechannel,givingrise
where the implicit constant only depends on 1−(cid:15)−2δ. In to a ccqq-state between message U, input Xn, output Bn and
particular, under the above assumptions, environment En:
nl→im∞n1 logM(n,(cid:15),δ)=P(W). ρUXnBnEn = M1 u(cid:88),xnE(xn|u)|u(cid:105)(cid:104)u|U⊗|xn(cid:105)(cid:104)xn|Xn⊗ρBxnnEn.
The “trivial” converse shows that (asymptotic equipartition property) to a product of blocks of
i.i.d. states ρ⊗nP0(x). On the other hand, going to the S -
logM ≤Hδ (U|En)−H(cid:15) (U|Bn), x n
min max symmetrized state
cf. Renes and Renner [21]. Namely, according to the def-
inition of privacy given above, the reduced state ρUEn is ΩXnE(cid:48)nFnEn = 1 (cid:88) |xn(cid:105)(cid:104)xn|Xn⊗V⊗nρBnEnV†⊗n,
|τ(P )| xn
w1it(cid:80)hin |puu(cid:105)(cid:104)riufi|eUd⊗diρsEtann,ceheδncoefHaδpr(oUdu|Ectn)sta≥teloogf Mthe. Lfoikrme- 0 xn∈τ(P0)
M u (cid:101) min
wise, there exists a decoding cptp map D : L(Bn) → U(cid:98) we have, once more invoking Lemma 7,
such that (id ⊗ D)ρUBn is within (cid:15) purified distance from √
the perfectly correlated state 1 (cid:80) |u(cid:105)(cid:104)u|U ⊗|u(cid:105)(cid:104)u|U(cid:98), hence Hmηax(Fn|E(cid:48)n)ω ≤Hmη/ax2(Fn|E(cid:48)n)Ω
H(cid:15) (U|Bn)≤0. M u ≤H1−18η2(Fn|E(cid:48)n) ,
max min Ω
We apply the Stinespring dilation of the degrading map to
ρ, yielding where in the second line we have used Lemma 10. Now,
the uniform distribution Υ on the type class τ(P ) has the
ωUXnE(cid:48)nFnEn property Υ ≤ (n+1)|XP|P0⊗n, because it is on P0 that the
P0 0 0
= 1 (cid:88)E(xn|u)|u(cid:105)(cid:104)u|U ⊗|xn(cid:105)(cid:104)xn|Xn ⊗V⊗nρBnEnV†⊗n. probability weight of type classes of P0⊗n peaks, and so
M xn
u,xn Ω≤(n+1)|X|(cid:0)ΘXE(cid:48)FE(cid:1)⊗n,
With respect to this state, we now have (cf. Eq. (18) of [19]),
logM ≤Hδ (U|En)−H(cid:15) (U|E(cid:48)nFn) with
=Hmδin(U|E(cid:48)n)−Hm(cid:15)ax (U|E(cid:48)nFn) ΘXE(cid:48)FE =(cid:88)P0(x)|x(cid:105)(cid:104)x|X ⊗VρBxEV†.
min max
x
2
≤Hη (Fn|E(cid:48)n)−H(cid:15)+2δ+5η(Fn|E(cid:48)nU)+4log
max max η2 Thus,usingthesamereasoningasintheproofof[19,Thm.2],
2 we get
≤Hη (Fn|E(cid:48)n)−Hλ (Fn|E(cid:48)nXn)+4log ,
max max η2
(5) Hmηax(Fn|E(cid:48)n)ω ≤Hm1−in116η2(n+1)−|X|(Fn|E(cid:48)n)Θ⊗n
with λ := (cid:15)+2δ+5η. Here we have used the degradability ≤Hm312aηx2(n+1)−|X|(Fn|E(cid:48)n)Θ⊗n
property of the channel in the second line, in the third ≤nS(F|E(cid:48)) +O(cid:0)(cid:112)nlogn(cid:1),
Θ
line twice the chain rule for min-/max-entropies [Lemma 6,
Eqs. (3) and (4)], and in the last line data processing where we have once more invoked the AEP, Proposition 8.
(Lemma 5) for the max-entropy. Indeed, InsertingtheseupperandlowerboundsintoEq.(5),wefind
2
Hm(cid:15)+a3xη(AB|C)≤Hmηax(A|C)+Hm(cid:15)ax(B|AC)+logη2 logM ≤nI(X :F|E(cid:48))+O(cid:0)(cid:112)nlogn(cid:1).
(cid:107)
2 Nowwefacethecaseofgeneralencodings,andreduceitto
Hκ (AB|C)≥Hδ (B|C)+Hκ+2δ+2η(A|BC)−3log ,
max min max η2 the above form of constant type. Introduce another register T
holding the type t(xn) of xn, of dimension |T|≤(n+1)|X|,
which we apply with Fn ≡ A, U ≡ B and E(cid:48)n ≡ C, and
so that we have an extended joint state
with κ=(cid:15)+3η.
i.e.Ntohwe,daesnssuitmyeωXfonr,siismspulpicpiotyrtetdhaotntahesindgislteritbyuptieonclaosfs Xn, ρUXnBnEnT = M1 (cid:88)E(xn|u)|u(cid:105)(cid:104)u|U ⊗|xn(cid:105)(cid:104)xn|Xn
u,xn
τ(P0)=(cid:8)xn :∀x F(x|xn)=P0(x)(cid:9), ⊗ρBnEn ⊗|t(xn)(cid:105)(cid:104)t(xn)|T.
xn
where F(x|xn) is the relative requency of the letter x occur-
Imagine that T is handed to the eavesdropper; this clearly
ring in xn. With this assumption we show how to bound the
doesn’t increase Bob’s decoding error, but it can affect the
max-entropy terms on the r.h.s. of Eq. (5). Namely, all xn
privacyofthecode.Theideais,however,thatsincelog|T|≤
having non-zero probability are permutations of a fiducial xn.
0 O(logn), we can rectify this by hashing out O(logn) of the
Hence, on the one hand, we have
message, and the remainder will be almost as private as the
Hλ (Fn|E(cid:48)nXn) ≥Hλ(cid:98) (Fn|E(cid:48)n) original code: Indeed, let (cid:15)(cid:48) = (cid:15)+2ϑ and δ = δ+2ϑ, such
max ω ≥n(cid:88)maxP0(x)S(Fρ|xEn0(cid:48))ρx −O(cid:0)√n(cid:1), Nthat=st(cid:4)ilMlL(cid:15)(cid:5)(cid:48)+set2sδ(cid:48)L<u(cid:48) 1o,fheoqwueavlesri.zPeaLrtit=ionpo[Mly(cid:0)]lorgannd,oϑm−l1y(cid:1),inutop
x to a rest of size smaller than L, so that we can label the
by Lemma 7 (quasi-concavity of max-entropy) below, with elementsof(cid:83) L bypairs(u(cid:48),v)∈[N]×[L].ComputeU(cid:48)
√ u(cid:48) u(cid:48)
λ(cid:98) = λ 2−λ2 < 1, and a simple extension of Proposition 8 as a function of U (except for an event of probability ≤ 1),
N
so that we obtain a joint state Proposition 8 (Min- and max-entropy AEP [22], [27])
ρU(cid:48)XnBnEnT = 1 (cid:88) 1E(xn|u(cid:48),v)|u(cid:48)(cid:105)(cid:104)u(cid:48)|U(cid:48) ⊗|xn(cid:105)(cid:104)xn|Xn Let ρ∈S(HAB) and 0<(cid:15)<1. Then,
(cid:101) N L 1
u(cid:48),v,xn ⊗ρBxnnEn ⊗|t(xn)(cid:105)(cid:104)t(xn)|T nl→im∞nHm(cid:15)in(An|Bn)ρ⊗n ==Sli(mA|B1)Hρ (cid:15) (An|Bn) .
= 1 (cid:88)E(cid:101)(xn|u(cid:48))|u(cid:48)(cid:105)(cid:104)u(cid:48)|U(cid:48) ⊗|xn(cid:105)(cid:104)xn|Xn n→∞n max ρ⊗n
N
More precisely, for a purification |ψ(cid:105)∈ABC of ρ, denote
u(cid:48),xn
(cid:13) (cid:13)
⊗ρBnEn ⊗|t(xn)T(cid:105)(cid:104)t(xn)T|, µX := log(cid:13)(ψX)−1(cid:13), where the inverse is the generalized
xn
inverse (restricted to the support), for X = B,C. Then, for
where E(cid:101)(xn|u(cid:48)) = 1 (cid:80) E(xn|u(cid:48),v). This is a new code: every n,
L v
By the properties of random hashing, with high probability, (cid:114)
2
Bob can apply the same decoding as in the original code H(cid:15) (An|Bn)≥nS(A|B)−(µ +µ ) nln ,
min B C (cid:15)
to obtain an error ≤ (cid:15) + ϑ, and the privacy error for the
(cid:114)
combined register EnT is ≤δ+ϑ. Furthermore, the privacy 2
H(cid:15) (An|Bn)≤nS(A|B)+(µ +µ ) nln ,
error of the register T alone is ≤ ϑ. This has the important max B C (cid:15)
consequence that we can modify the encoding E(cid:101)(xn|u(cid:48)) to a and similar opposite bounds via Lemma 9. (cid:4)
slightly different one E(cid:48)(xn|u(cid:48))=Q(t(xn))E(cid:48)(xn|u(cid:48),t(xn)),
with a universal distribution Q over the types, such that Lemma 9 (Proposition 5.5 in [27]) Let ρ ∈ S(AB) and
ρ(cid:48)U(cid:48)XnBnEnT = 1 (cid:88)E(cid:48)(xn|u(cid:48))|u(cid:48)(cid:105)(cid:104)u(cid:48)|U(cid:48) ⊗|xn(cid:105)(cid:104)xn|Xn α,β ≥0 such that α+β < π2. Then,
N 1
u(cid:48),xn Hsinα(A|B) ≤Hsinβ(A|B) +log .
⊗ρBnEn ⊗|t(xn)(cid:105)(cid:104)t(xn)| min ρ max ρ cos2(α+β)
xn
= 1 (cid:88) (cid:88) E(cid:48)(xn|u(cid:48),P )|u(cid:48)(cid:105)(cid:104)u(cid:48)|U(cid:48) ⊗|xn(cid:105)(cid:104)xn|Xn For(cid:15),δ ≥0,(cid:15)+δ <1thiscanberelaxedtothesimplerform
N 0 1
P0typeu(cid:48),xn∈τ(P0) Hm(cid:15)in(A|B)ρ ≤Hmδax(A|B)ρ+log1−((cid:15)+δ)2. (cid:4)
⊗ρBnEn ⊗Q(P )|P (cid:105)(cid:104)P |T
xn 0 0 0
fulfills the decoding and eavesdropper constraints with trans- Lemma 10 (Dupuis [9]) Let ρ ∈ S(AB) and 0 ≤ (cid:15) ≤ 1.
mission error (cid:15)(cid:48) and privacy error δ(cid:48), and has a perfectly Then, √
independent type-register T. Hma1x−(cid:15)4(A|B)ρ ≤Hm(cid:15)in(A|B)ρ,
Consider now the codes obtained by using E(cid:48)(·|·,P ) for a
0 which can be rewritten and relaxed into the form (0≤δ ≤1)
fixed P (but always the same decoder for Bob). These have
transmi0ssion errors (cid:15)(P0) and privacy errors δ(P0). By the Hmδax(A|B)ρ ≤Hm√4i1n−δ2(A|B)ρ ≤Hm1−in14δ2(A|B)ρ. (cid:4)
direct sum over types P – with probability Q(P ) –, and the
√ 0 0
concavity of 1−x2, one can see that III. DISCUSSION
(cid:88) (cid:88) We showed that the min-entropic machinery employed in
(cid:15)(cid:48) ≥ Q(P )(cid:15)(P ), δ(cid:48) ≥ Q(P )δ(P ),
0 0 0 0 theanalysisofdegradablequantumchannels[4],[7],[19],can
P0type P0type be used equally, if not more easily, to obtain a pretty strong
and so converse for degraded quantum wiretap channels of the cqq
(cid:88) Q(P )[(cid:15)(P )+2δ(P )]≤(cid:15)(cid:48)+2δ(cid:48) <1, kind; the reason for focusing on this class of channels lies in
0 0 0
the availability of a single-letter formula.
P0type
For degraded ccc-wiretap channels, i.e. the original Wyner
and so there must exist a type P such that the encoding
0 model, Hayashi, Tyagi and Watanabe [15] have found a very
E(cid:48)(·|·,P ) has (cid:15)(P )+2δ(P )≤(cid:15)(cid:48)+2δ(cid:48) <1. But this code
0 0 0 elegantargument,viahypothesistesting,togivethetighterre-
has only O(logn) less information in the message, and has
sultthatif(cid:15)+δ <1,thenlim 1 logM(n,(cid:15),δ)=P(W).
the property that the encoder maps only into the type class n→∞ n
In fact, by phrasing error and privacy in terms of the trace
τ(P ), hence can use the previous bound:
0 distance D(ρ,σ) = 1(cid:107)ρ − σ(cid:107) ≤ P(ρ,σ), they show that
logM ≤logN +O(logn)≤nI(X :F|E(cid:48))+O(cid:0)(cid:112)nlogn(cid:1), this holds if and only2if: For 11−δ ≤ (cid:15) < 1 the above limit
gives the classical capacity C(W) of the channel from Alice
concluding the proof.
to Bob. It seems however that their technique does not easily
generalize to cqq-channels, as it exploits the classical nature
Lemma 7 (Lemma 10 in [19]) Let ρ ∈ S(AB) be a state
of the output signals.
and consider the state family ρAB = (U ⊗V )ρ(U ⊗V )†, √
i i i i i Similarly,if(cid:15)andδare“toobig”,namely 1−δ2 ≤(cid:15)<1,
with unitaries U on A and V on B, and probabilities p ;
define ρ:=(cid:80) piρ . Then, withi(cid:15)=(cid:15)√2−(cid:15)2 ≤(cid:15)√2, i we can easily see that Theorem 2 breaks: In that case,
i i i (cid:98)
1
Hm(cid:15)ax(A|B)ρ ≥Hm(cid:98)(cid:15)ax(A|B)ρ. (cid:4) nl→im∞nlogM(n,(cid:15),δ)=C(W),
where C(W) is the classical capacity of the cq-channel [6] I. Devetak. The private classical capacity and quantum capacity of a
W : x (cid:55)−→ ρB. Namely, choose any fixed xn, then for an quantumchannel.IEEETrans.Inf.Theory,51(2005),44–55.
asymptoticallyxerror-free and capacity-achieving0 code xn(m), [7] I.DevetakandP.W.Shor.Thecapacityofaquantumchannelforsimul-
taneous transmission of classical and quantum information. Commun.
with m = 1,...,N = 2nC(W)−o(n), consider encoding mes- Math.Phys.,256(2005),287–303.
sage m by the mixture (cid:15)2|x (m)(cid:105)(cid:104)x (m)|+(1−(cid:15)2)|xn(cid:105)(cid:104)xn|. [8] F. Dupuis. The decoupling approach to quantum information theory.
n n 0 0 PhDthesis,Universite´ deMontre´al(2009);arXiv:1004.1641.
This scheme has transmission error arbitrarily close to (cid:15) and
√ [9] F.Dupuis.privatecommunication(January2013).
privacy error ≤ 1−(cid:15)2 ≤δ. [10] F. Dupuis, M. Berta, J. Wullschleger and R. Renner. The decoupling
By ignoring the privacy constraint, our Theorem 2 includes theorem.arXiv:1012.6044(2010).
[11] D.ElkoussandS.Strelchuk.Superadditivityofprivateinformationfor
a proofof the strongconverse for theclassical capacityof cq-
anynumberofusesofthechannel.arXiv[quant-ph]:1502.05326(2015).
channels[20],[35];simplyconsideratrivialeavesdropperand [12] C. A. Fuchs and J. van de Graaf. Cryptographic Distinguishability
δ =0.Thisshowsthatfor(cid:15)<1,thelimitof 1 logM(n,(cid:15),δ) MeasuresforQuantum-MechanicalStates.IEEETrans.Inf.Theory,45
n (1999),1216–1227.
is bounded by C(W); cf. Wang and Renner [32].
[13] S. Guha, P. Hayden, H. Krovi, S. Lloyd, C. Lupo, J. H. Shapiro, M.
TakeokaandM.M.Wilde,“QuantumEnigmaMachinesandtheLocking
Capacity of a Quantum Channel”, Phys. Rev. X 4 (2014), 011016;
arXiv[quant-ph]:1307.5368.
[14] M. Hayashi, H. Tyagi and S. Watanabe. Secret Key Agreement: Gen-
eral Capacity and Second-Order Asymptotics. arXiv[cs.IT]:1411.0735
(2014).
[15] M.Hayashi,H.TyagiandS.Watanabe.StrongConverseforaDegraded
Wiretap Channel via Active Hypothesis Testing. Proc. Allerton 2014;
arXiv[quant-ph]:1410.0443.
[16] R. Jozsa. Fidelity for mixed quantum states. J. Mod. Opt., 41 (1994),
2315–2323.
[17] K.Li,A.Winter,X.-B.ZouandG.-C.Guo.PrivateCapacityofQuantum
ChannelsIsNotAdditive.Phys.Rev.Lett.,103(2009),120501.
[18] U.M.Maurer.Secretkeyagreementbypublicdiscussionfromcommon
information.IEEETrans.Inf.Theory,39,3(1993),733–742.
[19] C. Morgan and A. Winter. “Pretty Strong” Converse for the Quantum
CapacityofDegradableChannels.IEEETrans.Inf.Theory,60,1(2014),
317–333.
[20] T. Ogawa and H. Nagaoka. Strong converse to the quantum channel
codingtheorem.IEEETrans.Inf.Theory,45(1999),2486–2489.
[21] J.M.RenesandR.Renner.Noisychannelcodingviaprivacyamplifica-
tionandinformationreconciliation.IEEETrans.Inf.Theory,57(2011),
7377–7385.
[22] R. Renner. Security of Quantum Key Distribution. PhD thesis, ETH
Fig.1. Transmissionerror(cid:15)vs.privacyerrorδ:Belowthestraightlinewe Zu¨rich(2005);arXiv:quant-ph/0512258.
haveastrongconverse,abovethecirclethestrongconversecannothold. [23] C. E. Shannon. A Mathematical Theory of Communication. Bell Syst.
Tech.J.,27(1948),379–423&623–656.
[24] C.E.Shannon.CommunicationTheoryofSecrecySystems.BellSyst.
We leave it as an open problem to try and close the gap
Tech.J.,28,4(1949),656–715.
between the two regimes (see Fig. 1). [25] G. Smith and J. A. Smolin. Extensive Nonadditivity of Privacy. Phys.
Rev.Lett.,103(2008),120503.
ACKNOWLEDGMENTS [26] G.Smith,J.M.RenesandJ.A.Smolin.StructuredCodesImprovethe
Bennett-Brassard-84 Quantum Key Rate. Phys. Rev. Lett., 100 (2008),
It is a pleasure to thank Imre Csisza´r, Prakash Narayan, 170502.
Masahito Hayashi and Shun Watanabe for various discussions [27] M. Tomamichel. Quantum Information Processing with Finite Re-
sources: Mathematical Foundations. Springer Briefs in Mathematical
on wiretap channels, strong converses and the history of
Physics,vol.5,SpringerVerlag,HeidelbergNewYork,2016.
cryptography. The author was supported by the EU (STREP [28] H. Tyagi and P. Narayan. How Many Queries Will Resolve Common
“RAQUEL”), the ERC (Advanced Grant “IRQUAT”), the Randomness?IEEETrans.Inf.Theory,59,9(2013),5363–5378.
[29] H. Tyagi and S. Watanabe. Converses for secret key agreement and
Spanish MINECO (project project FIS2008-01236) with the
securecomputing.IEEETrans.Inf.Theory,61,9(2015),4809–4827.
support of FEDER funds, and the Generalitat de Catalunya [30] A. Uhlmann. The ‘Transition Probability’ in the State Space of a ∗-
(CIRIT project 2014-SGR-966). Algebra.Rep.Math.Phys.,9(1976),273–279.
[31] A.Vitanov,F.Dupuis,M.TomamichelandR.Renner.ChainRulesfor
SmoothMin-andMax-Entropies.arXiv[quant-ph]:1205.5231(2012).
REFERENCES
[32] L. Wang and R. Renner. One-Shot Classical-Quantum Capacity and
[1] R.AhlswedeandI.Csisza´r.Commonrandomnessininformationtheory HypothesisTesting.Phys.Rev.Lett.,108(2012),200501;arXiv[quant-
and cryptography — I. Secret sharing. IEEE Trans. Inf. Theory, 39, 4 ph]:1007.5456.
(1993),1121–1132. [33] S. Watanabe and M. Hayashi. Non-Asymptotic Analysis of Privacy
[2] N. Cai, A. Winter and R. W. Yeung. Quantum Privacy and Quantum Amplification via Re´nyi Entropy and Inf-Spectral Entropy. Proc. ISIT
WiretapChannels.ProblemsInf.Transm.,40,4(2004),318–336 2013,pp.2715–2719;arXiv[cs.IT]:1211.5252.
[3] I. Csisza´r and J. Ko¨rner. Broadcast Channels with Confidential Mes- [34] A. Winter. Coding Theorems of Quantum Information Theory. PhD
sages.IEEETrans.Inf.Theory,24,3(1978),339–348. thesis, Department of Mathematics, Universita¨t Bielefeld (1999).
[4] T. Cubitt, M.-B. Ruskai and G. Smith. The structure of degradable arXiv:quant-ph/9907077.
quantumchannels.J.Math.Phys.,49(2008),102104. [35] A.Winter.Codingtheoremandstrongconverseforquantumchannels.
[5] N. Datta, M. Mosonyi, M.-H. Hsieh and F. G. S. L. Branda˜o. Strong IEEETrans.Inf.Theory,45(1999),2481–2485.
conversesforclassicalinformationtransmissionandhypothesistesting. [36] A.D.Wyner.TheWire-TapChannel.BellSyst.Tech.J.,54,8(1975),
arXiv:1106.3089(2011). 1355–1387.