Quantum-Resistant Quantum Teleportation Xin Jin,1, ∗ Nitish Kumar Chandra,2, ∗ Mohadeseh Azari,2 Jinglei Cheng,1 Zilin Shen,3 Kaushik P. Seshadreesan,2 and Junyu Liu1, † 1 Department of Computer Science, University of Pittsburgh, Pittsburgh, Pennsylvania 15260, USA 2 Department of Informatics and Networked Systems, University of Pittsburgh, Pittsburgh, Pennsylvania 15260, USA 3 Purdue University, West Lafayette, Indiana 47907, USA
arXiv:2604.16101v1 [quant-ph] 17 Apr 2026
(Dated: April 20, 2026) Quantum teleportation requires classical control bits transmitted via a classical communication channel, which are vulnerable to quantum adversaries. We propose a quantum-resistant quantum teleportation (QRQT) framework protected by post-quantum cryptography (PQC), with a comprehensive security analysis. By applying PQC to protect the classical control bits, QRQT renders quantum teleportation fully quantum-resistant and eliminates the classical attack surface. Our analysis reveals that quantum memory is a hidden bottleneck linking physical and computational security. Its finite coherence time simultaneously limits the communication distance, constrains the tolerable PQC overhead, and restricts the adversary’s attack window. Under realistic parameters (1 ms coherence, fiber-optic propagation), the maximum secure teleportation distance ranges from ∼191 km (FrodoKEM-1344) to ∼199 km (Kyber512), quantifying the security-distance tradeoff imposed by the selected PQC scheme. We show a joint classical–quantum attack probability 𝑃 joint (𝑡) exhibits a non-monotonic, Bell-shaped profile due to the opposing time dependencies of classical cryptanalysis and quantum decoherence, thereby establishing a bounded optimal attack window after which the probability of adversarial success decays exponentially. Complementing the attack probability analysis we further analyze how leakage of the classical correction bits affects the security of quantum teleportation, where confidentiality relies on keeping these bits secret until the receiver completes the recovery. To capture realistic patterns of time dependent exposure, we consider four stochastic leakage scenarios: independent exponential, sequential, burst, and correlated leakage, when the eavesdropper manages to compromise the receiver’s quantum system. We also account for decoherence in the entangled resource by modeling amplitude damping on the receiver’s half of the shared Bell pair. For each scenario, we derive closed form expressions for the average Holevo quantity and the average teleportation fidelity as functions of time. Based on the Holevo quantity, our information theoretic analysis provides measurement independent upper bounds on the information extractable by an adversary, which can help assess leakage risks in quantum communication and assist in developing protocols that are robust against such attacks.
I.
INTRODUCTION
Quantum teleportation is a core communication primitive for quantum networks, enabling quantum states to be transferred, coordinated, and processed across remote nodes [1, 2]. Introduced by Bennett et al. in 1993, teleportation enables the transfer of an unknown quantum state using shared entanglement and classical communication, without direct physical transmission of the quantum system itself [3]. Teleportation fundamentally builds block for long distance entanglement distribution, quantum repeater protocols, and distributed quantum computing architectures [4–9]. As quantum networking advances from isolated demonstrations to scalable systems, teleportation should be viewed not merely as a canonical protocol of quantum information theory, but as an operational primitive whose security is essential to quantum network infrastructure [10–13]. While shared entanglement supplies the quantum resource for teleportation, state transfer is completed only when the associated classical information reaches the receiver. Alice (sender) performs a joint measurement on the unknown input qubit and her share of an entangled pair, while Bob (receiver) holds the other share. This measurement produces two classical outcomes that must be communicated to Bob [14]. Bob
∗ These two authors contributed equally to this work. † [email protected]
then uses this information to determine the corresponding Pauli correction to recover the original state. The classical channel therefore carries the measurement outcomes that determine the recovery operation at the receiver. Any delay, corruption, or compromise of this classical information directly affects the completion of the protocol, making the correction channel a critical part of both the functionality and the security of quantum teleportation [15, 16]. This reliance on classical information introduces a fundamental security asymmetry: while the quantum correlations are established without transmitting information, its successful and trustworthy completion also depends on a classical channel that can be vulnerable [17, 18]. In practice, the entangled quantum channel is often treated as the main object of protection, whereas the classical correction channel is commonly assumed to be authenticated or secured using conventional public key cryptography [19]. Such assumptions become problematic in the presence of quantum capable adversaries, because widely used public key schemes such as Rivest-Shamir-Adleman (RSA) [20] and the Digital Signature Algorithm (DSA) [21] derive their security from integer factorization and the discrete logarithm problem, both are vulnerable to Shor’s algorithm [22]. The classical correction channel thus becomes a natural attack surface: it carries the information required to complete state recovery, its protection is commonly delegated to public-key schemes that are broken by Shor’s algorithm. Protecting only the quantum states is therefore insufficient, securing teleportation end-to-
2 end requires quantum-resistant authentication of the classical correction path as well [23]. Several existing approaches can be used to authenticate or secure the classical correction channel, but they can be operationally cumbersome or infrastructure intensive in scalable teleportation networks. Wegman-Carter authentication [24] provides information theoretic message authentication, it requires pre-shared secret keys whose distribution and periodic refresh become increasingly burdensome as the number of nodes and teleportation rounds grows. Quantum key distribution (QKD), a method for establishing shared secret keys using quantum states, offers another possibility for securing the classical channel [25]. However, it still relies on an initially authenticated classical channel, and in practice it requires each protected link to be paired with dedicated QKD hardware and supporting infrastructure [26, 27]. Quantum digital signatures provide an alternative approach [28], but their practical deployment remains constrained by limitations in transmission distance, signature overhead, and multi-party scalability. As a result, a practical gap remains between solutions that provide strong security but require substantial infrastructure and coordination overhead, and those that would offer the scalable public-key functionality needed for large-scale quantum communication systems [29, 30]. Post quantum cryptography (PQC) provides a practical response to the problem of securing the classical correction channel while preserving the deployment advantages of public key cryptography. Since launching its PQC standardization effort in 2016, NIST has advanced PQC from a research direction to a deployable standards framework [31]. In 2022, NIST selected CRYSTALS Kyber for key encapsulation and CRYSTALS Dilithium and SPHINCS+ among its first post quantum digital signature candidates, and in 2024 finalized FIPS 203, FIPS 204, and FIPS 205, which specify algorithms derived from these schemes [32, 33]. Kyber and Dilithium are lattice based constructions built from module lattice assumptions related to Learning With Errors (LWE) and Short Integer Solution, while SPHINCS+ provides algorithmic diversity through a stateless hash based design [34, 35]. This progress makes it timely to revisit teleportation security from a post quantum perspective, particularly for the classical correction channel, where public key protection is especially well suited to networked settings because it can secure protocol critical classical information without requiring pairwise pre-shared secret keys or dedicated quantum security infrastructure [26, 36], while still relying on standard public key management and authentication mechanisms. Building on recent progress in post quantum cryptography, we propose the Quantum-Resistant Quantum Teleportation (QRQT) framework, which applies PQC to the classical control channel of quantum teleportation (See Fig. 1). QRQT leaves the underlying teleportation protocol and entanglement resource unchanged, but protects the Bell measurement outcomes that must be delivered to the receiver for state reconstruction. It therefore secures the protocol critical classical correction path, ensuring that the information required for Pauli correction remains protected against quantum enabled adversaries.
Integrating PQC into teleportation is not a purely cryptographic substitution. The use of PQC-protected classical communication introduces additional processing and transmission delay before Bob can obtain the measurement outcomes and apply the required Pauli correction. During this interval, the receiver’s qubit must remain stored in quantum memory, so the success of the protocol is also constrained by coherence time [37–40]. The PQC latency therefore translates into a physical resource constraint: the longer the classical correction path takes to complete, the greater the risk that decoherence will destroy the stored quantum state before recovery is possible. Computational security on the classical channel thus becomes directly coupled to physical reliability on the quantum side. We consider an adversary whose goal is to intercept and recover the transmitted quantum state, requiring simultaneous access to both the classical correction outcomes and the stored quantum state. This creates a time-dependent joint constraint on the adversary: a longer transmission window provides more time to break the PQC-authenticated classical channel, but also increases the probability that the quantum state has decohered and is no longer recoverable. Conversely, a shorter window preserves the quantum state but limits the time available for classical cryptanalysis. Successful interception therefore requires the adversary to compromise both channels within the same coherence window. To assess QRQT security comprehensively, we develop a hybrid threat model that jointly captures adversarial behavior on both the classical and quantum channels. On the classical side, we model attack success probabilities against LWE-based cryptosystems underlying standardized post-quantum encryption schemes. On the quantum side, we consider an active interception strategy in which an adversary attempts to substitute, extract, or temporarily retain entangled qubits intended for the receiver through a SWAP-type interaction; related interception and entanglement-tampering scenarios have been studied in the contexts of unreliable entanglement assistance, malicious entanglement in quantum networks, and active eavesdropping on quantum communication channels [41–43]. This formulation enables us to quantify attack success under realistic temporal constraints, thereby capturing the interplay between PQC-induced latency and decoherence in finite quantum memory. To analyze this coupled security problem, we use two complementary frameworks. The first is an explicit attack analysis that captures adversarial behavior on both the classical and quantum channels, allowing us to quantify attack success probabilities under finite computation time, communication latency, and quantum memory constraints. The second component is an information theoretic analysis based on the Holevo quantity, which quantifies the information an adversary can extract from partial correction data together with access to Bob’s quantum state. Together, the two components allow us to distinguish between concrete protocol compromise and residual information exposure, thereby providing a more complete characterization of QRQT security. The main contributions of this work are as follows: • We propose the Quantum-Resistant Quantum Telepor-
3 tation (QRQT) framework (See Fig. 2), which protects the classical correction channel of quantum teleportation using post-quantum cryptography, and identify the resulting joint security tradeoff between cryptographic protection and quantum memory constraints. Specifically, because the receiver must store the entangled qubit while awaiting PQC-protected correction bits, communication distance, tolerable cryptographic overhead, and the adversary’s attack window become fundamentally coupled. This contribution highlights that the classical attack success probability grows with computation time, whereas the quantum interception probability decays as the entangled state decoheres, giving rise to a joint security landscape that cannot be captured by analyzing either channel in isolation. • If decoherence occurs before the correction bits are received, the original quantum state cannot be faithfully reconstructed, undermining both fidelity and practical feasibility. The interaction between cryptographic latency and quantum coherence remains largely unexplored, raising a fundamental question: under what temporal and physical conditions can QRQT remain both secure and operational? Motivated by this constraint, we quantitatively analyze the feasibility of QRQT by evaluating multiple standardized PQC algorithms and estimating the minimum coherence time required for successful state reconstruction across varying communication distances and security parameters.
and discusses future directions for integrating PQC protected teleportation into scalable quantum networks.
II.
PRELIMINARIES
In this section, we review the fundamental concepts used throughout the paper. We first review the quantum teleportation protocol, examine how noise degrades quantum information through the amplitude damping channel, discuss the role of Pauli corrections as an encryption mechanism, and introduce the von Neumann entropy and the Holevo quantity used in the security analysis. We further discuss the lattice-based cryptographic hardness assumption underlying post-quantum security and the teleportation fidelity metric.
A.
Quantum Teleportation Protocol
Quantum teleportation [3, 14] is a fundamental protocol in quantum information processing that enables the transfer of an arbitrary unknown quantum state between two spatially separated parties using shared entanglement and classical communication (see Fig. 1). The protocol relies on two essential resources: • a pre-shared entangled state, typically a maximally entangled Bell pair, and • a classical communication channel used to convey measurement outcomes.
• We formulate a hybrid threat model that jointly captures lattice-based attacks on the classical channel and SWAP-based interception on the quantum channel, and characterize the resulting time-dependent joint attack probability.
Let the input state to be teleported be a single qubit |𝜓 ⟩ = 𝛼 |0⟩ + 𝛽 |1⟩ , with |𝛼 | 2 + |𝛽 | 2 = 1. The teleportation procedure proceeds as follows:
• We further present an information theoretic analysis based on the Holevo bound and introduce four physically motivated stochastic leakage models, namely independent, sequential, burst, and correlated leakage, that capture common qualitative patterns of information exposure arising in statistical failure and communication error processes. This framework enables us to quantify the residual information available to an adversary and to characterize how partial, delayed, and correlated leakage lead to time dependent degradation of the teleported quantum state. The remainder of the paper is organized as follows. Section II reviews the background theory relevant to this work. Sections III and IV present the QRQT framework, analyze memory lifetime limitations, and develop the hybrid threat model along with the corresponding attack success probability. Sections V, VI, and VII present an information theoretic analysis of the teleportation protocol under an amplitude damping noise model for different scenarios, with particular focus on the Holevo quantity, the fidelity of the quantum state, and their time dependent behavior under four stochastic models of classical leakage. Finally, Section VIII concludes the paper
1. Alice performs a joint Bell basis measurement on the input qubit and her half of the shared entangled pair, projecting the combined system onto one of four Bell states. 2. The measurement outcome is encoded into two classical bits (𝑚 1, 𝑚 2 ) ∈ {0, 1}2 . (Throughout this paper, 𝑚 1 ≡ 𝑀1 and 𝑚 2 ≡ 𝑀2 . These symbols denote the same classical bits and are used interchangeably in some sections for notational convenience and clarity.) 3. Alice transmits these classical bits to Bob over a classical communication channel. 4. Upon receiving the measurement outcomes, Bob applies the conditional Pauli operation 𝑈𝑚1𝑚2 = 𝑍 𝑚2 𝑋 𝑚1 to his qubit, thereby recovering the original state |𝜓 ⟩. In the ideal setting, assuming perfect entanglement, noiseless quantum operations, and error free classical communication, the teleportation protocol reconstructs the input state at Bob’s location with unit fidelity.
4
𝑀2
PQC protected classical channel
Sends state |𝜓 ⟩
𝐻
Alice
Potential eavesdropper access
√ |𝛽 00 ⟩ = ( |00⟩ + |11⟩ )/ 2
𝑀1
Pre shared Bell pair 𝑋 𝑀1
𝑍 𝑀2
Recovered state |𝜓 ⟩
Bob Solid line = quantum system Blue dashed line = classical bits (𝑀1 , 𝑀2 ) Blue shaded region = PQC protected classical channel
FIG. 1: Quantum Resistant Quantum Teleportation (QRQT) framework. Alice performs a Bell state measurement on her input qubit |𝜓 ⟩ and her half of the Bell pair |𝛽 00 ⟩ = √1 (|00⟩ + |11⟩). A cnot gate followed by a Hadamard gate and computational basis measurements 2 yield two classical outcomes 𝑀1 and 𝑀2 . These control bits are sent to Bob through a PQC protected classical channel, while Bob retains his entangled qubit in quantum memory. Upon receiving the bits, Bob applies Pauli corrections 𝑋 𝑀1 and 𝑍 𝑀2 to recover |𝜓 ⟩.
(a) Traditional Quantum Teleportation
(b) QRQT Framework
(c) Joint Threat Model
(d) Information Theoretic Analysis
FIG. 2: Overview of the QRQT framework. (a) Standard teleportation with classical public-key protection, vulnerable to Shor’s algorithm. (b) QRQT replaces the classical link with PQC; Bob holds the qubit in quantum memory during PQC processing. (c) Hybrid threat model combining lattice attacks on the classical channel and SWAP interception on the quantum channel. (d) Holevo-bound analysis of information leakage under decoherence and classical key compromise.
5 B.
Quantum Noise and the Amplitude Damping Channel
In realistic settings, quantum systems inevitably interact with their surrounding environment, leading to decoherence and the loss of quantum information. Such noise processes are mathematically described by completely positive trace preserving maps, which are commonly represented using the Kraus operator formalism [14]. A particularly relevant noise model for many physical qubit implementations is the amplitude damping channel, which captures energy relaxation mechanisms such as spontaneous emission in optical platforms or energy decay in superconducting qubits [44, 45]. The amplitude damping channel acting on a single qubit is characterized by the Kraus operators √ 1 √ 0 0 𝛾 , 𝐸1 = , (1) 𝐸0 = 0 0 0 1 −𝛾 where 𝛾 ∈ [0, 1] denotes the probability of energy decay. When a qubit with density matrix 𝜌 undergoes amplitude damping, its evolution is described by EAD (𝜌) = 𝐸 0 𝜌𝐸 0† + 𝐸 1 𝜌𝐸 1† .
(2)
In this work, we use the amplitude damping channel as a representative model for such decoherence processes, which lead to degradation of the teleported quantum state.
C.
Pauli Corrections and Encryption of Quantum Information
The Pauli operators {𝐼, 𝑋, 𝑌 , 𝑍 } form a complete orthonormal basis for single qubit operators. In the quantum teleportation protocol, the specific Pauli correction applied by Bob is determined by the outcome of Alice’s Bell state measurement. The required unitary operation takes the form 𝑈 𝑀1 𝑀2 = 𝑍 𝑀2 𝑋 𝑀1 ,
(3)
where (𝑀1, 𝑀2 ) ∈ {0, 1}2 denote the classical bits communicated by Alice. This conditional correction reverses the random Pauli operator induced by the Bell measurement and enables Bob to recover the original quantum state. Prior to receiving the classical information, however, Bob’s qubit remains correlated with Alice’s measurement outcome. When averaged over the unknown correction bits, Bob’s reduced state is maximally mixed and therefore reveals no information about the input state. From an information theoretic perspective, the absence of the correction bits effectively hides the teleported quantum information. Any observer without access to the classical outcomes perceives Bob’s qubit as carrying no extractable information about the input state. In this sense, the teleportation protocol provides a form of physical layer encryption, with the classical correction bits acting as a decryption key [46]. Consequently, partial or complete leakage of the correction bits undermines this protection and can allow an adversary to infer information about the original quantum state.
D.
Von Neumann Entropy and Quantum Ensembles
The von Neumann entropy [14] is the standard measure of entropy for quantum states and generalizes classical Shannon entropy to the quantum setting. For a state described by a density matrix 𝜌, it is defined as 𝑆 (𝜌) = −Tr 𝜌 log2 𝜌 , (4) and quantifies the mixedness of the state. In quantum information theory, an ensemble of states is represented as E = {𝑝𝑖 , 𝜌𝑖 }, where 𝜌𝑖 is prepared with probability 𝑝𝑖 . The corresponding average state is ∑︁ 𝜌 avg = 𝑝𝑖 𝜌𝑖 . (5) 𝑖
The Holevo quantity is then given by ! ∑︁ ∑︁ 𝜒 (E) = 𝑆 𝑝𝑖 𝜌𝑖 − 𝑝𝑖 𝑆 (𝜌𝑖 ), 𝑖
(6)
𝑖
which upper bounds the accessible classical information that can be extracted from the ensemble by any measurement. In the present setting, the Holevo quantity provides an information theoretic upper bound on how much Eve can learn from partial classical knowledge together with access to Bob’s quantum system. In later sections, we use this framework to analyze residual information exposure under different stochastic leakage models and relate it to the information contained in the teleported quantum state.
E.
Lattice-Based Cryptography and the LWE Problem
The classical channel protection employed in this work relies on post quantum cryptographic schemes whose security reduces to lattice problems, that is, computational problems defined over highly regular geometric point sets in high dimensional spaces that are believed to be hard to solve efficiently. The central hardness assumption is the Learning With Errors (LWE) problem [47]. In this problem, one is given a public matrix 𝐴 ∈ Z𝑞𝑛×𝑚 and noisy samples of the form p = 𝐴⊤ sk + e
(mod 𝑞),
(7)
and the goal is to recover the hidden vector sk. More specifically, 𝐷 Z,𝜎𝑒 𝑞 is a secret vector that plays the role of the hidden key, 𝑞 is a modulus that fixes the arithmetic range, 𝑚 is the number of samples, and e ∈ 𝐷 Z,𝜎𝑒 𝑞 is an error vector drawn from a discrete Gaussian distribution with standard deviation 𝜎𝑒 ·𝑞. Here, the public matrix 𝐴 is known to everyone and provides the structured linear data from which the samples are formed, while the notation Z𝑞 means that all arithmetic is performed modulo 𝑞, so values wrap around after reaching the modulus. The error vector e represents deliberately added random noise, with smaller errors more likely than larger ones. Intuitively, LWE can be viewed as a noisy system of linear equations. Without the error term, the secret vector could in principle be recovered using standard linear algebra. The
6 added noise, however, makes this recovery task computationally difficult, and this difficulty is what gives LWE based cryptographic schemes their security. Standardized post quantum schemes such as CRYSTALS Kyber and FrodoKEM derive their security from module LWE and plain LWE variants, respectively [32, 33]. Here, plain LWE refers to the original form of the problem, whereas module LWE introduces additional algebraic structure that improves efficiency while maintaining the same general hardness foundation. The best known classical attacks against LWE proceed through BKZ (Block Korkine Zolotarev) lattice reduction [48, 49]. In broad terms, lattice reduction attempts to replace a given lattice basis by another basis that spans the same lattice but consists of shorter and more nearly orthogonal vectors, since such a basis is more useful for cryptanalysis. A lattice basis B = (b1, . . . , b𝑚 ) is simply a set of vectors whose integer linear combinations generate all points of the lattice. BKZ works on this basis and iteratively improves it. More precisely, BKZ applies an exact shortest vector oracle within successive blocks of dimension 𝛽 to produce a reduced basis whose Gram Schmidt vectors b̃𝑖 decrease in length at a predictable rate. The block dimension 𝛽 controls the strength of the reduction: a larger block size generally yields a better reduced basis, but at a significantly higher computational cost. The shortest vector oracle is an idealized subroutine that finds the shortest nonzero vector inside a given block, while the Gram Schmidt vectors are an orthogonalized version of the basis vectors that make the geometry of the reduced basis easier to analyze. The quality of the reduced basis is commonly characterized by the root Hermite factor 𝛿 root , defined so that the shortest reduced vector satisfies 1/𝑚 ∥b1 ∥ ≈ 𝛿 𝑚 , root (det Λ)
(8)
where Λ is the lattice and 𝑚 is its rank [50]. Here, det Λ is the determinant of the lattice, which measures the effective volume of a fundamental cell, and the rank 𝑚 is the number of basis vectors. Smaller values of 𝛿 root correspond to stronger reduction and therefore to more effective attacks. To model the structure of a BKZ reduced basis analytically, one often adopts the Geometric Series Assumption (GSA), which is a standard heuristic description of how the orthogonalized basis vectors shrink under reduction. Under this assumption, the Gram Schmidt norms decay geometrically: −2(𝑖 −1) ∥ b̃𝑖 ∥ = ∥ b̃1 ∥ 𝛿 root ,
(9)
which provides a convenient analytic approximation to the output of BKZ reduction [50]. In other words, the GSA assumes that the orthogonalized vectors decrease in a regular geometric pattern, making the behavior of BKZ easier to model mathematically. The computational cost of BKZ is commonly parameterized by 𝛿 root through the empirical relation 𝑎 log2 𝑇BKZ = − 𝑏, (10) log2 𝛿 root where 𝑎 and 𝑏 are empirical scaling constants encoding the adversary’s hardware throughput and algorithmic efficiency [49].
This relation captures the practical tradeoff between attack quality and runtime: achieving a smaller root Hermite factor, and hence a stronger reduction, generally requires substantially more computation. Once lattice reduction has been carried out, the secret is recovered by Nearest Planes enumeration [51]. At each Gram Schmidt layer 𝑖, the algorithm searches over integer coefficients within a radius 𝑑𝑖 and succeeds with probability governed by √ (11) erf 𝑑𝑖 ∥ b̃𝑖 ∥ 𝜋/(2𝑠) , where 𝑠 is the LWE noise standard deviation. Conceptually, this step attempts to identify the lattice point closest to the noisy target after the basis has been sufficiently reduced. The search radius 𝑑𝑖 controls how far the algorithm explores at each layer, and the error function appears because the success probability is determined by the Gaussian statistics of the noise. Thus, the overall attack has two main ingredients: lattice reduction, which transforms the basis into a more favorable geometric form, and a subsequent decoding step, which uses that reduced basis to recover the hidden secret. The success of this process depends both on the quality of the reduction and on the magnitude of the underlying noise. These definitions are used in Section IV B to construct a time dependent classical attack model.
III.
QRQT FRAMEWORK AND SECURITY ANALYSIS UNDER QUANTUM-MEMORY CONSTRAINTS
QRQT Framework. The proposed Quantum-Resistant Quantum Teleportation (QRQT) framework extends the standard teleportation protocol by integrating post-quantum cryptography into the classical channel. As illustrated in Fig. 1, the system consists of two parties, Alice and Bob, sharing an entangled Bell pair and communicating via a classical control link secured by a PQC primitive EPQC . Let |𝜓 ⟩ denote the input state, {𝑀1, 𝑀2 } the measurement outcomes. This section formalizes the QRQT operations and the corresponding timing constraints. In QRQT, the teleportation process can be described as a quantum classical hybrid map: TQRQT = R Bob ◦ EPQC ◦ MAlice ◦ UBell ◦ PBell, where TQRQT represents the overall map from Alice’s input quantum state to the reconstructed state on Bob’s side under PQC secured teleportation. Specifically, PBell denotes the preparation of the shared Bell pair |𝛽 00 ⟩ = √1 (|00⟩ + |11⟩), 2 UBell denotes the Bell basis transformation implemented by a CNOT gate and a Hadamard gate, MAlice denotes Alice’s measurement, which produces the two classical bits (𝑀1, 𝑀2 ), EPQC denotes the PQC based encryption and decryption of these bits, and R Bob denotes Bob’s reconstruction by applying the Pauli corrections 𝑍 𝑀2 𝑋 𝑀1 . For successful teleportation, Bob’s quantum memory must preserve coherence throughout the entire delay of the classical channel, including both cryptographic and transmission
7 latencies: 𝜏𝑚 = 𝑇 PBell + 𝑇UBell + 𝑇 EPQC + 𝑇MAlice + 𝑇comm + 𝑇RBob
(12)
where 𝜏𝑚 denotes the effective quantum memory lifetime limit, representing the minimum coherence time required to preserve the stored qubit until the classical correction bits are received. Thus, 𝑇coh > 𝜏𝑚 . (13) The individual timing components are: 𝑇 PBell , the Bell-pair preparation and distribution time; 𝑇UBell , the Bell-basis transformation latency; 𝑇MAlice , Alice’s measurement time; 𝑇 EPQC , the PQC encryption and decryption delay; 𝑇comm = 𝑑/𝑣 fiber , the distance-dependent classical communication delay over optical fiber (𝑣 fiber ≈ 2×105 km/s); and 𝑇RBob , the time for Bob’s local Pauli corrections. Among these, 𝑇comm dominates at long distances (≈ 5 𝜇s/km), while all local operations remain in the nanosecond range (see Appendix B 1 for platform-specific estimates). 𝑇 EPQC captures the computational delay introduced by post-quantum encryption and decryption, while 𝑇comm represents the classical communication time. The interplay between these classical-layer delays and quantum-layer decoherence defines the operational feasibility region of QRQT, as quantified below and formalized in Section IV. In the QRQT protocol, Alice secures the two correction bits (𝑀1, 𝑀2 ) using a hybrid PQC scheme: a lattice-based keyencapsulation mechanism (e.g., CRYSTALS-Kyber) establishes a one-time session key 𝐾, which is then used to symmetrically encrypt the correction bits via AES, yielding ciphertext (𝐶 1, 𝐶 2 ). Bob decapsulates 𝐶 1 , decrypts 𝐶 2 , and applies Pauli corrections 𝑍 𝑀2 𝑋 𝑀1 to recover the teleported state. The full protocol specification is provided in Appendix D. Memory lifetime limit analysis. Having established 𝜏𝑚 as the lower bound on quantum memory coherence required for successful QRQT, we now demonstrate how this constraint governs the operational feasibility of the QRQT framework. By quantifying this relationship across different PQC schemes and communication distances, we identify the minimal physical conditions (e.g., communication distance) under which QRQT remains both secure and realizable. The PQC computing time is estimated using the JEDI BullSequana XH3000 supercomputer (𝑅max = 4.50 PFlop/s) benchmark [52]; the details of the estimation method are provided in Appendix C. We assume spontaneous parametric down-conversion (SPDC) Bell-pair generation [53, 54] and fiber-optic delivery for the quantum teleportation experiment; the data used for estimating the feasibility boundary are given in Appendix B 2. TABLE I: PQC overhead and maximum distance (𝑇coh = 1 ms). Algorithm
Sec. 𝑇enc (𝜇 s) Max Dist. (km)
Kyber512 Kyber768 Kyber1024 FrodoKEM-640 FrodoKEM-976 FrodoKEM-1344
128 192 256 128 192 256
2.3 3.1 4.2 15.7 28.4 45.1
198.5 198.3 198.1 195.9 194.3 191.0
Our results show the tradeoff between PQC robustness and quantum memory requirements: stronger PQC algorithms
impose heavier processing delays, which shrink the effective distance window for teleportation. PQC security levels should therefore be chosen in light of physical memory limits and network distance targets. Distance–security tradeoffs. The maximum feasible communication distance is determined by subtracting fixed delays from the coherence window and multiplying by the propagation speed in fiber: 𝑑 max = (𝑇coh − 𝑇fixed ) · 𝑣 fiber,
(14)
2 × 105 km/s.Here 𝑇fixed
with 𝑣 fiber ≈ = 𝑇 PBell + 𝑇UBell + 𝑇 EPQC + 𝑇MAlice + 𝑇RBob collects all distance-independent delays, so that the distance-dependent contribution reduces to 𝑇comm = 𝑑/𝑣 fiber . For example, with a practical coherence time of 𝑇coh = 1 ms (consistent with state-of-the-art trapped-ion and rare-earth doped solid-state memories [55–57]), the maximum distance drops from ∼ 200 km with lightweight schemes such as Kyber512 to below 192 km for heavy-weight schemes such as FrodoKEM-1344. This shows that memory lifetime, rather than raw cryptographic strength, sets the fundamental limit on secure teleportation distances. The derived linear relation provides a design guideline for balancing PQC selection with physical-layer capabilities. For a given quantum memory technology, we can invert Eq. (14) to determine the strongest PQC scheme that maintains real-time feasibility. The analysis above establishes the physical feasibility region of QRQT by quantifying how PQC overhead and communication distance jointly constrain the available coherence window. A complementary and equally important question is whether the protocol remains secure within this feasible region: specifically, can an adversary targeting both the classical and quantum channels simultaneously succeed before decoherence destroys the intercepted quantum information? We address this question in the following section by developing a joint classical–quantum threat model.
IV.
JOINT THREAT MODEL
To evaluate the overall security of the Quantum-Resistant Quantum Teleportation (QRQT) framework, we establish a joint threat model that unifies the quantum-side and classicalside adversarial assumptions. The goal is to capture the temporal coupling between physical quantum coherence and postquantum computational hardness that determines whether an attack can succeed before decoherence destroys useful information. We consider an adversary, Eve, who can target both the quantum and classical channels of the teleportation protocol. On the quantum channel, Eve is assumed capable of coherently interacting with qubits distributed over optical fiber and, in the strongest scenario, performing a SWAP-based interception that redirects Bob’s entangled qubit into her own quantum memory (detailed in Sec. IV A). We do not assume that legitimate parties perform entanglement verification or active monitoring; this deliberate omission establishes an upper bound on adversarial capability.
) U R G R . ( 0 % , . (
. \ E H U
0 H P R U \ O L I H W L P H Q V 4 X D Q W X P F R K H U H Q F H W L P H Q V
0 H P R U \ O L I H W L P H Q V
8
7 U D S S H G L R Q V K
! î P D U J L Q
% , . (
. \ E H U % , . ( ) U R G R . ( 0
' L V W D Q F H P
/ H Y H O / H Y H O / H Y H O
(a)
. \ E H U
1 9 F H Q W H U V 6 & F D Y L W \ P V ) O X [ R Q L X P P V ) U R G R . ( 0
' L V W D Q F H P
(b)
FIG. 3: Quantum memory lifetime vs. communication distance for different PQC schemes. (a) Short-range view (0–100 m) on a symlog scale. (b) Long-range view (0–500 m) with quantum-memory coherence benchmarks (top, log scale) and PQC requirements (bottom, linear); coherence times exceed PQC needs by >100×. The slope (≈ 5 𝜇s/km) reflects fiber propagation delay; the intercept reflects PQC processing time. See Appendix B 4 for the full derivation.
On the classical channel, which is treated as public and unauthenticated [3, 14, 27, 58, 59], Eve may eavesdrop on, intercept, or delay the PQC-protected correction bits. Her classical attack capability is modeled in terms of lattice-reduction effort against the underlying LWE instance (detailed in Sec. IV B). The joint model couples these two attack surfaces through a shared time parameter: classical cryptanalytic progress improves with time, whereas the quantum information available to Eve degrades due to decoherence, creating the temporal competition analyzed below.
A.
fiber transmission path (or compromise an intermediate relay node) and apply an approximately ideal SWAP unitary 𝑈 SWAP between the traveling photonic mode and a local ancilla, transferring the legitimate qubit into her quantum memory with sufficient fidelity [61]. • Classical attack capability: Concurrently, Eve can intercept, delay, or attempt to break the PQC-protected classical correction information (𝑀1, 𝑀2 ), with a classical cryptanalytic budget denoted 𝑇BKZ (see Section IV B), and perform the necessary Pauli corrections 𝑍 𝑀2 𝑋 𝑀1 within the coherence-limited time window.
Quantum Side Security: SWAP Attack
On the quantum channel, we assume a physically powerful adversary (Eve) capable of performing coherent interactions with transmitted qubits. The strongest practical attack is modeled as a SWAP attack, where Eve replaces Bob’s half of the entangled pair with her own ancilla and stores the legitimate qubit in her quantum memory (see Fig. 4 for the circuit-level description). Operationally, Eve inserts a unitary 𝑈 SWAP between Bob’s qubit 𝐵 and her ancilla 𝐸, effecting the transformation 𝑈 SWAP |𝑥⟩𝐵 |𝑦⟩𝐸 = |𝑦⟩𝐵 |𝑥⟩𝐸 . This redirects the entanglement from the (𝐴, 𝐵) pair to the (𝐴, 𝐸) pair, leaving Bob with the dummy state |0⟩ while Eve inherits the full teleportation correlation [14]. Such intercept-and-resend strategies on entangled links have been studied in the context of quantum network routing security [26, 60] and unreliable entanglement assistance [42]. To enable quantitative evaluation, we make the following implementation assumptions: • Physical access: Eve can physically access or replace the
• Absence of active monitoring: The legitimate parties do not deploy frequent randomized entanglement verification, high-sensitivity timing or optical-statistics checks, or decoy-state probing, so that the substitution remains undetected. These assumptions collectively define a worst-case adversarial model; practical countermeasures that relax them are discussed after the formal analysis below.
SWAP attack model for quantum teleportation
The SWAP attack can be formalized as a completely positive trace-preserving (CPTP) map. Let the initial state be |Ψ0 ⟩𝐶𝐴𝐵𝐸 = |𝜑⟩𝐶 ⊗ |Φ+ ⟩𝐴𝐵 ⊗ |0⟩𝐸 ,
(15)
where√|𝜑⟩𝐶 = 𝑎|0⟩ + 𝑏 |1⟩ is Alice’s input, |Φ+ ⟩𝐴𝐵 = (|00⟩ + |11⟩)/ 2 is the shared entangled state, and |0⟩𝐸 is Eve’s ancilla.
9 Bell measurement on (𝐶,𝐴)
Alice
𝑀2 𝐶 |𝜓 ⟩
𝐻
𝐴 |Φ+ ⟩𝐴𝐵
PQC attack
𝑀1
|0⟩ (Bob)
𝐵
|0⟩𝐸
𝑋 𝑀1
QM
𝑍 𝑀2
|𝜓 ⟩ (Eve)
decoherence window
SWAP
𝑇coh
Eve
FIG. 4: Quantum circuit schematic of the SWAP attack on QRQT. Initially, a Bell pair |Φ+ ⟩𝐴𝐵 is shared between Alice (qubit 𝐴) and Bob’s traveling qubit 𝐵. Eve intercepts qubit 𝐵 and swaps it with her ancilla |0⟩𝐸 , thereby transferring the remote half of the entangled pair from Bob to Eve and leaving Bob with the dummy state |0⟩. Alice then measures her input |𝜓 ⟩ (qubit 𝐶) and qubit 𝐴 in the Bell basis, obtaining outcomes (𝑀1, 𝑀2 ). If Eve also breaks the PQC-protected classical channel, she can apply 𝑍 𝑀2 𝑋 𝑀1 to recover |𝜓 ⟩; Bob still receives the protocol signals (a qubit and two correction bits) but, because his Bell-half has been replaced by a dummy state, the standard teleportation correction no longer reconstructs |𝜓 ⟩ at his side.
Eve applies a SWAP unitary 𝑈 SWAP between Bob’s qubit 𝐵 and her ancilla 𝐸, 𝑈 SWAP |𝑥⟩𝐵 |𝑦⟩𝐸 = |𝑦⟩𝐵 |𝑥⟩𝐸 , which is a general exchange of two qubit registers. The physical significance in the present context is that Bob’s qubit 𝐵 is not an isolated state but one half of the entangled pair |Φ+ ⟩𝐴𝐵 . The SWAP operation transfers that entanglement from Bob to Eve yielding |Ψ1 ⟩𝐶𝐴𝐸𝐵 = |𝜑⟩𝐶 ⊗ |Φ+ ⟩𝐴𝐸 ⊗ |0⟩𝐵 .
(16)
Eve now holds the teleportation resource which was originally Bob’s. When Alice performs her Bell measurement on (𝐶, 𝐴), Eve’s qubit collapses to a state related to |𝜑⟩ by a Pauli operator, exactly as in the standard teleportation protocol. By intercepting Alice’s classical correction bits, Eve can apply the appropriate Pauli correction to her qubit and perfectly reconstruct |𝜑⟩. Bob still receives a qubit and the two classical correction bits through the normal protocol flow, but because his Bell-half has been replaced by the dummy state |0⟩𝐵 , the standard Pauli correction 𝑍 𝑀2 𝑋 𝑀1 no longer reconstructs |𝜑⟩ at his side. Time-dependent success probability. Eve’s success depends on her ability to preserve coherence in memory until Alice’s classical bits are received. To model the finite memory lifetime without committing to a hardware-specific noise process, we adopt a phenomenological depolarizing parametrization for the recovered-state fidelity: 1 𝐹 (𝑡) = 1 + 𝑒 −𝑡 /𝑇coh , (17) 2 where 𝑇coh is the quantum memory coherence time. This form captures the essential physics: 𝐹 (0) = 1 for a freshly stored state and 𝐹 → 1/2 as 𝑡 → ∞, reflecting complete loss of quantum information to the maximally mixed state. We emphasize that this is a conservative phenomenological model, not a
first-principles derivation tied to a specific platform; a full treatment would require platform-dependent noise operators (e.g., 𝑇1 /𝑇2 relaxation for superconducting qubits, or spectral diffusion for solid-state memories). The depolarizing-channel form is chosen because it provides a single-parameter upper bound on the fidelity decay and is widely adopted in analyses of optical and solid-state quantum memories [61–64], where it accurately describes short- to intermediate-time coherence loss under weak coupling to a thermal bath. Operationally, 𝐹 (𝜌, |𝜓 ⟩) = ⟨𝜓 |𝜌 |𝜓 ⟩ equals the probability that the decohered state 𝜌 passes the projective verification test |𝜓 ⟩⟨𝜓 | [63]. Under optimal Pauli correction, Eve’s attack success probability equals: 1 𝑃SWAP (𝑡) = 𝐹 (𝑡) = 1 + 𝑒 −𝑡 /𝑇coh (18) 2 High fidelity (𝐹 ≈ 1) means Eve preserves the quantum information well; low fidelity (𝐹 → 1/2) means decoherence has destroyed the coherent information, reducing Eve’s state to the maximally mixed qubit. Quantum teleportation is known to be intrinsically secure against passive eavesdropping on the quantum channel, yet it still requires authentication of the accompanying classical messages to prevent man-in-the-middle attacks [58, 65]. Previous studies have examined teleportation fidelity under various noise and loss mechanisms [61, 64] and how the Holevo bound constrains the accessible information in noisy quantum channels [62, 63]. Meanwhile, the classical control channel remains susceptible to side-channel leakage and timing-based inference attacks [66–68]. Building on these results, we formalize the SWAP-style interception as a CPTP map and couple it with a time-dependent quantum-memory fidelity model. By linking the coherence-limited attack window on the quantum side with the cryptanalytic runtime on the classical side, we obtain a joint model of adversarial success in PQC-protected teleportation. The SWAP attack formalized above assumes an idealized adversary who can execute a perfect unitary swap on the traveling qubit without introducing detectable disturbances. In practice, several verification mechanisms available to the legitimate parties would significantly constrain such an attack. Entanglement verification: Alice and Bob can periodically perform entanglement witness measurements or Bellinequality (CHSH) tests on a randomly selected subset of shared pairs [69]. Any SWAP interception breaks the correlations of the tested pair, producing a detectable drop in the Bell parameter 𝑆 below the classical bound 𝑆 ≤ 2. Timing-based detection: Inserting a SWAP gate and rerouting the photonic mode introduces additional optical-path delay and loss. Statistical monitoring of arrival-time jitter and channel transmittance can flag anomalous deviations from the expected profile [67, 68]. Decoy-state probing: Borrowing from QKD practice, Alice can inject decoy states at random intervals to probe channel integrity. Discrepancies in the measured error rate or photonnumber statistics reveal the presence of an active interception device [70]. Our model deliberately omits these countermeasures to establish an upper bound on adversarial capability: the SWAP
10 success probability 𝑃 SWAP (𝑡) quantifies the worst-case scenario in which Eve is undetected. If a detection probability 𝑃det is incorporated, the effective joint attack probability reduces eff (𝑡) = (1 − 𝑃 ) 𝑃 to 𝑃joint LWE (𝑡) 𝑃 SWAP (𝑡), which strictly tightdet ens the security guarantees derived in this work. Thus, our analysis provides a conservative baseline; real-world deployments with active monitoring will enjoy stronger protection than the bounds reported here.
B.
Classical Side Attack Analysis
On the classical channel, the adversary targets the postquantum primitive EPQC used to protect the teleportation correction bits. To model the classical attack, we focus on PQC and adopt the minimal assumption that the classical-side protection reduces to an underlying Learning-With-Errors (LWE) instance, and we model adversarial effort in terms of lattice-reduction attacks against LWE. In particular, we do not explicitly model protocol-specific constructions (such as Kyber or FrodoKEM) nor do we perform separate cost estimates of symmetric-key primitives (e.g., AES). In practice, the lattice-reduction stage required to recover the LWE secret dominates the overall cost of classical attacks; therefore, it is reasonable to characterize attack cost by the hardness of LWE alone. Additional overheads, such as brute-force work against AES or Kyber group operations, are smaller and can typically be offset by linearly scaling the number of compute resources. Consequently, whether the PQC attack is solvable or merely requires more machines is determined primarily by the complexity of solving LWE. For this reason, we simplify the classical attack model in this work to the problem of breaking LWE and focus on this dominant complexity. BKZ Attack Model. Building on the LWE formulation and BKZ lattice-reduction framework introduced in Section II E, we now specify the attack model used in Section IV C. The detailed cryptographic parameter choices and communication security assumptions are provided in Appendix E 3; the derivation of the relationship between 𝑛, 𝑚, and ∥𝑏˜1 ∥ is given in Appendix F. Recall that BKZ reduction combined with NearestPlanes enumeration yields a runtime 𝑇BKZ governed by the empirical fit in Eq. (10). In our analysis, the coefficients (𝑎, 𝑏) are treated as tunable parameters; representative calibration values are reported in Appendix E 8. In this work, the decoding success probability 𝑃LWE represents the overall success probability of a classical latticereduction attack against the LWE instance. Specifically, it models the probability that a BKZ-reduced basis, when followed by a Nearest-Planes decoding step, successfully recovers the secret. Under the Geometric Series Assumption (GSA), this probability can be approximated using the product-oferror-function model [48, 51]. Combined with the BKZ runtime estimate in Eq. (10), this formulation provides a direct mapping between the runtime of lattice reduction and the expected success rate of the corresponding attack. Attack Success Probability. Under the Geometric Series
Assumption (GSA), the attack success probability is [51]: √ ! 𝑚 Ö 𝑑𝑖 ∥𝑏˜𝑖 ∥ 𝜋 𝑃LWE = erf , (19) 2𝑠 𝑖=1 where 𝑏˜𝑖 denotes the 𝑖-th Gram–Schmidt vector of the BKZreduced basis, 𝑠 denotes the standard deviation as noise magnitude of Gaussian error distribution used in the LWE error terms e, 𝑑𝑖 represents the integer search radius used in the NearestPlanes enumeration for the 𝑖-th search layer, and 𝛿 root is the root-Hermite factor characterizing the reduction quality. By combining the BKZ runtime model with the NearestPlanes success function under the GSA, we derive a closedform expression linking the attack success probability 𝑃LWE to the lattice-reduction runtime 𝑇BKZ : ! √ 𝑚 Ö 𝑑𝑖 ∥𝑏˜1 ∥ 𝜋 −2(𝑖 −1) log 𝑇𝑎 +𝑏 2 BKZ 𝑃LWE = erf . (20) 2 2𝑠 𝑖=1 This derivation is detailed in Appendix E 7. It turns the qualitative notion of attack feasibility into a time-dependent probability model parameterized by computational power and algorithmic complexity. Here ∥𝑏˜𝑖 ∥ denotes the length of the 𝑖-th orthogonalized basis vector, governed by the reduction quality −2(𝑖 −1) 𝛿 root under the GSA relation ∥𝑏˜𝑖 ∥ = ∥𝑏˜1 ∥𝛿 root . Note that the parameters (𝑎, 𝑏) in the BKZ runtime model are unrelated to the basis vectors; they are empirical constants reflecting computational capability. For efficient numerical evaluation, we adopt a Padé-type rational approximation of the error function [71], which yields a closed-form expression for log2 𝑃 LWE with sub-10−3 global accuracy while preserving analytic differentiability. The derivation, explicit formula, and numerical validation are provided in Appendix F 5.
C.
Joint Classical-Quantum Attack Probability Model
The key insight is the opposite time dependence: 𝑃LWE (𝑡) increases as Eve gains computation, while 𝑃SWAP (𝑡) decreases due to quantum decoherence. For a joint attack to succeed, Eve must break LWE and preserve quantum coherence within the same time budget 𝑡 (where 𝑡 denotes the BKZ attack time, i.e., 𝑡 = 𝑇BKZ ). We model the joint success probability as the product 𝑃LWE · 𝑃SWAP , reflecting the statistical independence of the two constituent events conditioned on the shared time parameter 𝑡. This factorization is justified on the following grounds. First, the LWE attack on the encrypted classical messages 𝑀1 and 𝑀2 is fundamentally a cryptanalytic task: recovering the private key from the publicly available PQC public key via lattice reduction. This is a purely computational process that can be initiated at any time: before, during, or after the quantum measurements, which proceeds entirely independently of the quantum channel. In our model, we assume that Eve launches both attacks concurrently at 𝑡 = 0, so that the elapsed time 𝑡 parameterizes both processes simultaneously. Second, the two attacks operate on physically disjoint channels and consume non-competing resources: the SWAP
11 - R L Q W $ W W D F N 3 U R E D E L O L W \ Pjoint = PLWE × PSWAP PLWE(t)
3 U R E D E L O L W \
t *max = 16 V Pjoint = 0.645
PSWAP(t)
PSWAP( ) = 1/2
Pjoint(t)
7 L P H t V H F R Q G V PSWAP(t) = 12 (1 + e t/Tcoh) Pjoint = PLWE PSWAP
m = 30 Tcoh = 20 V a = 0.3 b = 2.7 s = 2
FIG. 5: Joint attack probability vs. time. 𝑃 LWE (green) grows with BKZ runtime; 𝑃SWAP (red, dashed) decays toward 1/2 as Eve’s quantum memory decoheres (𝑇coh = 20 s). Their product 𝑃joint (blue, dash-dotted) peaks at 𝑡 ∗ ≈ 16 s, forming a bounded attack window. Parameters: 𝑚 = 30, 𝑠 = 2, 𝑎 = 0.3, 𝑏 = 2.7. Weak LWE parameters are used for visual clarity; realistic dimensions (e.g., 𝑚 ≥ 256) shift 𝑡 ∗ by orders of magnitude while preserving the non-monotonic structure.
interception requires coherent quantum hardware to capture and store a traveling photon, whereas the LWE cryptanalysis requires classical (or quantum) computational resources for lattice reduction. Neither resource expenditure constrains or assists the other. Third, the decoherence of Eve’s quantum memory is a Markovian physical process governed by the coupling between her storage device and its thermal environment; it proceeds independently of whether the BKZ algorithm running on a separate classical processor has converged. Fourth, there is no information coupling between the two sub-attacks: partial progress on the LWE instance does not reveal any property of the stored quantum state (or vice versa), so the conditional probability of one event given the other equals its marginal probability. The only coupling between the two channels is temporal: both probabilities are parameterized by the same elapsed time 𝑡, which is already captured by their explicit time dependence rather than by a statistical correlation. Combining Eq. (20) and Eq. (18), the joint classical-quantum attack probability is: 𝑃joint = 𝑃LWE · 𝑃 SWAP
(21)
√ ! ∥𝑏˜1 ∥ 𝜋 1 𝑃joint = erf · 1 + 𝑒 −𝑡 /𝑇coh 2𝑠 2 𝑖=1 (22) This product exhibits a characteristic bell-shaped curve (Fig. 5). The maximum occurs at an optimal attack time 𝑡 ∗ = arg max𝑡 𝑃joint (𝑡), beyond which quantum decoherence dominates and the attack becomes infeasible. This unified model reveals a fundamental security principle distinct from classical cryptography: neither computational hardness nor quantum coherence alone determines security. Instead, security emerges from their temporal com𝑚 Ö
𝑎
𝑑𝑖 2 log2 𝑡 +𝑏
· (−2) (𝑖 −1)
petition. Systems with longer quantum memory coherence times possess wider vulnerability windows, creating a counterintuitive tradeoff: quantum advantage comes at the cost of extended attack opportunities during PQC processing. To √ ensure 𝑃joint (𝑡) < 𝜖 √ for security parameter 𝜖, both 𝑃LWE (𝑡) < 𝜖 and 𝑃 SWAP (𝑡) < 𝜖 must hold. This couples cryptographic parameter selection (affecting 𝑃 LWE ) with quantum memory characteristics (affecting 𝑃SWAP ), establishing a new design constraint for QRQT systems. The joint threat model developed above quantifies the probability that a specific attack strategy succeeds within a given time budget. However, it does not address a more fundamental question: how much information is inherently accessible to an adversary, regardless of the particular attack she employs? An adversary with partial knowledge of the classical correction bits, whether obtained through side-channel leakage, timing analysis, or partial cryptanalytic progress, may extract information from Bob’s quantum state without fully breaking the PQC scheme. To establish a complementary, strategy-independent security benchmark, we turn to an information-theoretic analysis based on the Holevo bound. This approach provides an upper limit on the classical information extractable from the quantum ensemble under any measurement, thereby capturing the worst-case information leakage as a function of both quantum decoherence and classical key compromise.
V.
INFORMATION-THEORETIC SECURITY ANALYSIS
While quantum teleportation is often analyzed under the assumption of perfect quantum resources and secure classical channels, practical implementations face a broader set of challenges. In addition to noise and imperfections affecting the entangled states, vulnerabilities can arise through leakage of the classical communication used to convey the correction information. Since the classical bits effectively serve as a “Pauli one-time pad” [14], concealing the quantum state until Bob applies the correction, any partial or full compromise of these bits can lead to significant information leakage. Moreover, if Eve gains access to Bob’s quantum system in addition to the classical correction data, this poses a serious threat to the entire teleportation process. Understanding the impact of classical information leakage requires careful analysis of how much knowledge about the quantum state can be inferred from the compromised classical bits. A natural tool for this analysis is the Holevo Information [72], which provides an upper bound on the accessible classical information that can be extracted from a quantum ensemble. Prior to receiving the correction bits, Bob’s qubit remains in a maximally mixed state, encoding hidden information about Alice’s measurement outcome. The arrival of the classical bits effectively “decrypts” this hidden information, restoring the original state. In this work, we investigate how classical information leakage over time affects the security and fidelity of teleported quantum state in quantum teleportation. We consider scenarios where an eavesdropper, Eve, gains partial access both to
12 the classical communication channels and to Bob’s quantum system, potentially through device tampering, side-channel attacks, or physical theft [10, 73–75]. Our goal is to model the dynamics of leakage and quantify, at each moment in time, the residual amount of information about the correction bits that remains concealed. To capture a range of plausible time dependent leakage behaviors, we introduce four stochastic models motivated by temporal patterns commonly studied in stochastic processes, reliability theory, and event dynamics [76–79], • Independent exponential leaks: the two classical correction bits leak independently over time, each according to its own exponential leakage rate. • Sequential leaks: leakage proceeds in stages, with one correction bit becoming vulnerable only after the other has been compromised. • Burst leaks: both correction bits are leaked simultaneously following a single discrete compromise event. • Correlated leaks: leakage of the two bits occurs with nontrivial statistical correlations parameterized by a tunable correlation factor. For each leakage model, we derive closed-form expressions for the expected residual Holevo information, E[𝜒 (𝑡)], and the corresponding optimal average fidelity, 𝐹 (𝑡), achievable by an adversary at a given time 𝑡. These expressions allow us to quantitatively track how information hidden within the quantum system degrades over time as classical leakage progresses. Our analysis also accounts for quantum decoherence by modeling imperfections in the entangled resource through an amplitude damping channel acting on one qubit of the Bell pair. Imperfections in the quantum resource degrade the fidelity of the teleported state [80, 81], while vulnerabilities in the classical communication channel threaten its security. In particular, the protocol depends on the integrity and latency of the classical correction channel relative to the adversary’s ability to access or disrupt it. Interception, delay, or modification of the correction bits can leak information to an eavesdropper and can also affect the reconstructed quantum state. By deriving explicit time dependent bounds on the accessible information under several leakage models, our work provides practical guidance for setting critical Holevo information thresholds and designing teleportation protocols that can help counter such attacks.
A.
Role of Holevo Information in Teleportation Security
In the quantum teleportation protocol [3], the outcome of Alice’s Bell state measurement, specified by two classical bits (𝑚 1, 𝑚 2 ) ∈ {0, 1}2 , determines the Pauli operation [82] 𝑈𝑚1𝑚2 = 𝑍 𝑚2 𝑋 𝑚1 that Bob must apply in order to reconstruct the original quantum state |𝜓 ⟩. Until Bob receives this classical information, his qubit is described by a statistical mixture over
all possible Pauli corrections. Thus, Bob’s reduced state prior to correction is, 1 𝜌 Bob = 𝐼, (23) 2 where 𝐼 denotes the identity operator. This maximally mixed state reflects complete local uncertainty: without access to the classical bits (𝑚 1, 𝑚 2 ), Bob’s quantum system carries no locally accessible information about the input state or Alice’s measurement outcome. Any measurement performed on Bob’s qubit before the classical communication is received yields outcomes that are statistically independent of Alice’s measurement results. From an information theoretic perspective, the teleportation protocol distributes the information needed for recovery across two resources: the classical correction bits (𝑚 1, 𝑚 2 ) and Bob’s quantum system. Neither resource alone is sufficient to reconstruct the input state; only their combination allows successful recovery of |𝜓 ⟩. For an ensemble of states {𝑝 (𝑚1,𝑚2 ) , 𝜌 (𝑚1,𝑚2 ) }, the Holevo information is defined as ∑︁ 𝜒 = 𝑆 𝜌 avg − 𝑝𝑚1𝑚2 𝑆 𝜌 (𝑚1,𝑚2 ) , (24) (𝑚 1 ,𝑚 2 )
where the ensemble averaged state is ∑︁ 𝜌 avg = 𝑝𝑚1𝑚2 𝜌 (𝑚1,𝑚2 ) .
(25)
(𝑚 1 ,𝑚 2 )
In the ideal teleportation protocol, each conditional state 𝜌 (𝑚1,𝑚2 ) is pure and therefore satisfies 𝑆 (𝜌 (𝑚1,𝑚2 ) ) = 0. The Holevo information then reduces to, 𝜒 = 𝑆 (𝜌 avg ).
(26)
𝐼 Since 𝜌 avg = , the von Neumann entropy evaluates to 2 𝑆 (𝜌 avg ) = 1 bit. This quantifies the ensemble level information associated with the unknown correction data, even though Bob’s reduced state alone does not reveal Alice’s measurement outcome. This separation between quantum and classical information in teleportation motivates the analysis of how partial or delayed leakage of the correction bits affects an adversary’s ability to reconstruct the teleported state, which is one of the main focuses of this work.
B.
Security Implications for Quantum Communication
To analyze quantum teleportation in the presence of leakage of the classical correction bits, the disclosure of (𝑚 1, 𝑚 2 ) can be modeled as a stochastic process that captures partial, delayed, or time dependent information exposure. Under such leakage, the adversary’s incomplete knowledge of the measurement outcomes induces a classical quantum ensemble of conditional states on Bob’s system. The Holevo information provides an information theoretic upper bound for analyzing how much information can be inferred from this ensemble under partial knowledge of the correction bits. This formalism therefore enables a quantitative assessment of how stochastic
13 leakage of the correction bits affects the adversary’s information about the teleported quantum state. This perspective highlights that the security of quantum teleportation is not determined solely by the quantum resources employed, such as shared entanglement, but also by the assumptions made regarding the confidentiality of the accompanying classical communication. Consequently, protecting classical communication channels and mitigating classical side channel leakage are essential for limiting an adversary’s information about the input state in teleportation based quantum communication systems.
The unnormalized conditional state on Bob’s system is then ′ 𝜌 3(𝑚1,𝑚2 ) = Tr12 |Φ𝑚1𝑚2 ⟩ ⟨Φ𝑚1𝑚2 | 12 ⊗ 𝐼 3 𝜌 123 . (30) All conditional states are related by Pauli conjugation. For the reference outcome (𝑚 1, 𝑚 2 ) = (0, 0), the normalized conditional state is 𝑎 𝑐 𝜌 00 = ∗ , (31) 𝑐 𝑏 with 𝑎 = |𝛼 | 2 +𝛾 |𝛽 | 2,
VI.
HOLEVO INFORMATION WITH AN AMPLITUDE-DAMPED BELL PAIR
We analyze the Holevo information associated with quantum teleportation when the shared entangled resource is affected by amplitude damping on Bob’s subsystem. Throughout this section, qubit 1 denotes the unknown input state held by Alice, qubit 2 denotes Alice’s share of the Bell pair, and qubit 3 denotes Bob’s share. The amplitude damping channel acts locally on qubit 3 prior to Alice’s Bell measurement and classical communication. Our objective is to characterize how noise in the entangled resource modifies the ensemble of conditional output states on Bob’s system and the resulting information-theoretic bounds on accessible classical information.
A.
Effect of Amplitude-Damping Channel
The shared entangled state between qubits 2 and 3 is initially prepared as, 1 |Φ+ ⟩ 23 = √ |00⟩ + |11⟩ . (27) 2 An amplitude damping channel with parameter 𝛾 ∈ [0, 1] acts on qubit 3 and is described by the Kraus operators, √ 1 √ 0 0 𝛾 𝐸0 = , 𝐸1 = . (28) 0 0 0 1 −𝛾 Applying the channel yields the mixed two-qubit state ′ 𝜌 23 = (𝐼 ⊗ 𝐸 0 ) |Φ+ ⟩ ⟨Φ+ | (𝐼 ⊗ 𝐸 0 ) + (𝐼 ⊗ 𝐸 1 ) |Φ+ ⟩ ⟨Φ+ | (𝐼 ⊗ 𝐸 1 )
= 12
√︁
√︁
|00⟩ ⟨00| + 1 − 𝛾 |00⟩ ⟨11| + 1 − 𝛾 |11⟩ ⟨00| + (1 − 𝛾) |11⟩ ⟨11| + 𝛾 |10⟩ ⟨10| .
(29)
This noisy entangled state serves as the quantum resource for teleportation.
𝑏 = (1−𝛾)|𝛽 | 2,
√︁ 𝑐 = 𝛼𝛽 ∗ 1 − 𝛾, (32)
and 𝑎 + 𝑏 = 1. This state is the conditional teleported output corresponding to the reference Bell measurement outcome in the presence of amplitude damping on Bob’s half of the Bell pair. For a general Bell outcome, the unnormalized conditional state is 1 𝜌 3(𝑚1,𝑚2 ) = 𝑋 𝑚1 𝑍 𝑚2 𝜌 00 𝑍 𝑚2 𝑋 𝑚1 . (33) 4 Since the noise acts only on Bob’s subsystem, all Bell outcomes remain equiprobable, with 𝑝𝑚1𝑚2 = 1/4. Dividing by these probabilities gives the normalized conditional states (𝑚 1 ,𝑚 2 ) 𝜌 3,norm = 𝑋 𝑚1 𝑍 𝑚2 𝜌 00 𝑍 𝑚2 𝑋 𝑚1 .
(34)
(𝑚 1 ,𝑚 2 ) The ensemble {𝑝𝑚1𝑚2 , 𝜌 3,norm } therefore characterizes Bob’s quantum system before the classical correction bits are received.
C.
Spectral Properties of the Conditional States
All conditional states are unitarily equivalent and therefore share the same eigenvalue spectrum. The determinant of the reference state 𝜌 00 is given by, 𝐷 = 𝑎𝑏 − |𝑐 | 2 = 𝛾 (1 − 𝛾)|𝛽 | 4 . As a result, each conditional state has eigenvalues, √ 𝜆± = 12 (1 ± 𝛿), 𝛿 = 1 − 4𝐷.
(35)
(36)
The von Neumann entropy of each conditional state depends only on this eigenvalue spectrum. Substituting the eigenvalues into the definition of the entropy yields, 𝑆 indiv = −𝜆+ log2 𝜆+ − 𝜆 − log2 𝜆 − 1+𝛿 1+𝛿 1−𝛿 1−𝛿 =− log2 − log2 . 2 2 2 2
(37)
This can be written compactly as, B.
Bell Measurement and Conditional Output States
Alice performs a Bell basis measurement on qubits 1 and 2, with outcomes labeled by (𝑚 1, 𝑚 2 ) ∈ {0, 1}2 . Let ′ ′ 𝜌 123 = |𝜓 ⟩ ⟨𝜓 | 1 ⊗ 𝜌 23 ,
|𝜓 ⟩ = 𝛼 |0⟩ + 𝛽 |1⟩ .
𝑆 indiv = ℎ(𝛿),
(38)
where 1+𝑥 1+𝑥 1−𝑥 1−𝑥 ℎ(𝑥) = − log2 − log2 . 2 2 2 2
(39)
14 D.
E.
Ensemble Average State and Holevo Information
The ensemble average state of Bob’s qubit, prior to receiving the classical correction bits, is defined as, ∑︁ (𝑚 1 ,𝑚 2 ) 𝜌 avg = 𝑝𝑚1𝑚2 𝜌 3,norm , (40) 𝑚 1 ,𝑚 2 (𝑚 1 ,𝑚 2 ) where 𝜌 3,norm denotes the normalized conditional state associated with the Bell measurement outcome (𝑚 1, 𝑚 2 ), and
𝑝𝑚1𝑚2 is the corresponding outcome probability. For general outcome probabilities, the ensemble average state can be written in the form, 𝐽 𝐾 𝜌 avg = ∗ , (41) 𝐾 1−𝐽
Holevo Information under Amplitude Damping
The Holevo Information for the ensemble of conditional states indexed by (𝑚 1, 𝑚 2 ) takes the closed form, √︁ 𝜒 (𝛾, |𝛼 | 2 ) = 1 − ℎ 1 − 4𝛾 (1 − 𝛾) (1 − |𝛼 | 2 ) 2 , (52) where |𝛼 | 2 = |⟨0|𝜓 ⟩| 2 specifies the input state and ℎ(𝑥) denotes the binary entropy function. This gives an upper bound on the classical information about the Bell measurement outcome that can be extracted from Bob’s quantum system alone, prior to receiving the classical correction bits.
where 𝐽 = 𝑎𝑝 0 + 𝑏𝑝 1,
𝐾 = 𝑐 Δ0 + 𝑐 ∗ Δ1 .
(42)
𝑝 0 = 𝑝 00 + 𝑝 01,
𝑝 1 = 𝑝 10 + 𝑝 11,
(43)
Δ0 = 𝑝 00 − 𝑝 01,
Δ1 = 𝑝 10 − 𝑝 11 .
(44)
Here,
and
In the symmetric case where all Bell measurement outcomes are equally likely, 𝑝𝑚1𝑚2 = 1/4, we have 𝑝 0 = 𝑝 1 = 1/2 and Δ0 = Δ1 = 0, which gives, 1 𝐽 = , 2
𝐾 = 0,
(45)
and hence, 1 𝜌 avg = 𝐼 . (46) 2 This reflects the fact that, under the equiprobable outcome assumption, Bob’s reduced state is maximally mixed before the classical correction bits are received. For general probabilities, the eigenvalues of 𝜌 avg are, √︁ (avg) 𝜆± = 12 (1 ± Δ), Δ = (1 − 2𝐽 ) 2 + 4|𝐾 | 2, (47) and therefore 𝑆 (𝜌 avg ) = ℎ(Δ).
(48)
The Holevo Information associated with the ensemble of conditional states is then given by, ∑︁ (𝑚 1 ,𝑚 2 ) 𝜒 = 𝑆 (𝜌 avg ) − 𝑝𝑚1𝑚2 𝑆 𝜌 3,norm . (49) 𝑚 1 ,𝑚 2
Since all conditional states are related to 𝜌 00 by Pauli conjugation, they have the same entropy 𝑆 indiv = ℎ(𝛿). Hence, 𝜒 = ℎ(Δ) − ℎ(𝛿).
(50)
For uniform outcome probabilities, where 𝜌 avg = 12 𝐼 and 𝑆 (𝜌 avg ) = 1, this reduces to, 𝜒 = 1 − ℎ(𝛿).
(51)
FIG. 6: Holevo Information 𝜒 (𝛾, |𝛼 | 2 ) as a function of the amplitude damping parameter 𝛾 for several fixed input amplitudes |𝛼 | 2 . The curves are symmetric about 𝛾 = 0.5 because 𝜒 depends on 𝛾 only through the factor 𝛾 (1 − 𝛾) under the equiprobable outcome assumption 𝑝𝑚1𝑚2 = 1/4.
In Fig. 6, we plot the Holevo Information 𝜒 (𝛾, |𝛼 | 2 ) as a function of the amplitude damping parameter 𝛾 for several fixed input amplitudes |𝛼 | 2 = |⟨0|𝜓 ⟩| 2 . We consider ideal local operations and measurements, with the only imperfection being amplitude damping acting on Bob’s half of the shared Bell pair prior to Alice’s Bell measurement. Since the noise acts only on Bob’s subsystem, the four Bell measurement outcomes (𝑚 1, 𝑚 2 ) ∈ {0, 1}2 remain equiprobable, and we take 𝑝𝑚1𝑚2 = 1/4. In this model, 𝜒 is the Holevo Information of the ensemble (𝑚 1 ,𝑚 2 ) {𝑝𝑚1𝑚2 , 𝜌 3,norm } of conditional states on Bob’s qubit indexed by Alice’s Bell outcome. It provides an information theoretic upper bound on the amount of classical information about (𝑚 1, 𝑚 2 ) that can be extracted from Bob’s quantum system by any measurement performed without access to the classical outcomes. At 𝛾 = 0, the entangled resource is maximally entangled and the conditional states are pure Pauli rotations of the input state, yielding 𝜒 = 1 bit. As 𝛾 increases toward 0.5, amplitude damping reduces the purity of the conditional states, decreasing their distinguishability and thereby reducing 𝜒. The symmetry around 𝛾 = 0.5 follows from the eigenvalue gap √︁ 𝛿 = 1 − 4𝛾 (1 − 𝛾) (1 − |𝛼 | 2 ) 2, (53)
15 which depends on 𝛾 only through 𝛾 (1 − 𝛾). Because 𝛾 (1 − 𝛾) is maximized at 𝛾 = 0.5, the conditional states are most mixed and 𝜒 attains its minimum at that point. In contrast, as 𝛾 → 0 or 𝛾 → 1, the conditional states become pure, and the Holevo Information approaches its maximum value.
dependent probabilities of the adversary’s knowledge classes 𝐾 (𝑡) are obtained, enabling explicit evaluation of the expected Holevo Information and the corresponding state reconstruction fidelity.
A.
Independent Exponential Leakage Model
We consider a leakage scenario in which the two classical Pauli correction bits (𝑚 1, 𝑚 2 ) are compromised independently over time. This model captures memoryless side-channel leakage through exponential waiting-time distributions. The input qubit to be teleported by Alice is in the unknown state, |𝛼 | 2 + |𝛽 | 2 = 1.
|𝜓 ⟩ = 𝛼 |0⟩ + 𝛽 |1⟩ ,
(54)
As described earlier, Bob’s half of the shared Bell pair undergoes amplitude damping with parameter 𝛾 ∈ [0, 1]. Conditioned on Alice’s Bell measurement outcome (𝑚 1, 𝑚 2 ) ∈ {0, 1}2 , Bob’s normalized post-measurement state is given by, 𝜌𝑚1𝑚2 = 𝑋 𝑚1 𝑍 𝑚2 𝜌 00 𝑍 𝑚2 𝑋 𝑚1 , FIG. 7: Holevo Information 𝜒 (|𝛼 | 2, 𝛾) as a function of the input amplitude |𝛼 | 2 for several fixed values of the amplitude damping parameter 𝛾, assuming equiprobable Bell outcomes 𝑝𝑚1𝑚2 = 1/4.
In Fig. 7, we plot 𝜒 (|𝛼 | 2, 𝛾) as a function of the input amplitude |𝛼 | 2 for several fixed values of 𝛾. For each fixed 𝛾, the Holevo Information increases monotonically with |𝛼 | 2 . As |𝛼 | 2 → 1, the input approaches the ground state |0⟩, which is invariant under amplitude damping, and the conditional states remain pure, yielding 𝜒 → 1. Conversely, for smaller |𝛼 | 2 , the input has a larger excited-state component, which is more strongly affected by amplitude damping, producing more mixed conditional states and a smaller Holevo Information.
where the reference state corresponding to (𝑚 1, 𝑚 2 ) = (0, 0) is 𝑎 𝑐 𝜌 00 = ∗ , (56) 𝑐 𝑏 with 𝑎 = |𝛼 | 2 + 𝛾 |𝛽 | 2,
(57)
2
(58)
𝑏 = (1 − 𝛾)|𝛽 | , √︁ 𝑐 = 𝛼𝛽 ∗ 1 − 𝛾 .
STOCHASTIC MODELS FOR CLASSICAL INFORMATION LEAKAGE
(59)
We introduce the following auxiliary quantities to simplify our calculations (See Appendices G and H for details), 𝑟 := ℜ(𝑐),
(60) 2
VII.
(55)
𝐷 := 𝑎𝑏 − |𝑐 | , √ 𝛿 := 1 − 4𝐷 .
(61) (62)
The eigenvalues of 𝜌 00 are, In quantum teleportation, the Pauli correction bits (𝑚 1, 𝑚 2 ) are transmitted over a classical channel. In realistic settings, this channel may be subject to partial interception, delayed compromise, or correlated exposure of the two bits. We model such leakage by introducing a stochastic process 𝐾 (𝑡) ⊆ {1, 2} that specifies which subset of correction bits has become available to an adversary by time 𝑡. The resulting knowledge state 𝐾 (𝑡) determines the ensemble of quantum states on Bob’s system from the adversary’s perspective, which in turn determines both the residual hidden information and the adversary’s optimal reconstruction performance. We consider four stochastic leakage models: independent exponential leakage, sequential leakage, burst leakage, and correlated leakage. These models provide phenomenological descriptions of partial and time delayed disclosure of the classical correction bits during quantum teleportation [76– 79]. For each model, closed form expressions for the time
1 𝜆± = (1 ± 𝛿), 2
(63)
and since all states 𝜌𝑚1𝑚2 are related to 𝜌 00 by Pauli conjugation, they share the same spectrum. Consequently, the von Neumann entropy of every conditional state is, 𝑆 (𝜌𝑚1𝑚2 ) = ℎ(𝛿),
(64)
where ℎ(·) denotes the binary entropy function. Classical leakage is modeled by assigning independent exponential waiting times to the correction bits. Let 𝑇1 ∼ Exp(𝑘 1 ),
𝑇2 ∼ Exp(𝑘 2 ),
(65)
be the leakage times of 𝑚 1 and 𝑚 2 , respectively. At time 𝑡, the adversary’s knowledge set is, 𝐾 (𝑡) = { 𝑖 ∈ {1, 2} : 𝑇𝑖 ≤ 𝑡 }.
(66)
16 The probabilities of the four knowledge classes are, 𝑃∅ (𝑡) = Pr(𝐾 (𝑡) = ∅) = 𝑒 − (𝑘1 +𝑘2 )𝑡 ,
(67)
𝑃 {1} (𝑡) = Pr(𝐾 (𝑡) = {1}) = (1 − 𝑒 −𝑘1𝑡 ) 𝑒 −𝑘2𝑡 ,
(68)
𝑃 {2} (𝑡) = Pr(𝐾 (𝑡) = {2}) = 𝑒 −𝑘1𝑡 (1 − 𝑒 −𝑘2𝑡 ),
(69)
𝑃 {1,2} (𝑡) = (1 − 𝑒 −𝑘1𝑡 ) (1 − 𝑒 −𝑘2𝑡 ).
(70)
For each knowledge class, Eve observes an ensemble obtained by averaging over the unknown correction bits. The corresponding Holevo quantities are (See Appendix G for details), 𝜒∅ = 1 − ℎ(𝛿), 𝜒 {1} = ℎ(|1 − 2𝑎|) − ℎ(𝛿), 𝜒 {2} = ℎ(2|𝑟 |) − ℎ(𝛿), 𝜒 {1,2} = 0.
(71) (72) (73) (74)
In this formulation, the Holevo Information measures the residual information about the teleported state that remains concealed from Eve because of uncertainty in the unrevealed correction bits. The expected Holevo information at time 𝑡 is therefore, E[𝜒 (𝑡)] = 𝑃 ∅ (𝑡) 𝜒∅ + 𝑃 {1} (𝑡) 𝜒 {1} + 𝑃 {2} (𝑡) 𝜒 {2} .
(75)
We also consider Eve’s achievable reconstruction fidelity given partial knowledge of the correction bits together with access to Bob’s quantum system (See Appendix H ), 1 𝐹∅ = , 2 1 𝐹 {1} = 1 + |1 − 2𝑎| , 2 1 𝐹 {2} = + |𝑟 |, 2 1 𝐹 {1,2} = (1 + 𝛿). 2
(76) B.
Sequential Leakage Model
(77) (78) (79)
Averaging over the leakage process yields, 𝐹 (𝑡) = 𝑃∅ (𝑡) 𝐹 ∅ + 𝑃 {1} (𝑡) 𝐹 {1} + 𝑃 {2} (𝑡) 𝐹 {2} + 𝑃 {1,2} (𝑡) 𝐹 {1,2} .
FIG. 8: Expected Holevo Information E[𝜒 (𝑡)] and Eve’s reconstruction fidelity 𝐹 (𝑡) under the independent exponential √ leakage model with symmetric leakage rates 𝑘 1 = 𝑘 2 = 1, 𝛼 = 0.6 √ and 𝛽 = 0.4. As the correction bits are progressively leaked, the residual hidden information decreases with time, while Eve’s achievable reconstruction fidelity increases. Different curves correspond to different amplitude damping parameters 𝛾.
(80)
Fig. 8 shows that, under independent exponential leakage, the residual hidden information decreases monotonically over time as Eve gains access to more correction data, while her reconstruction fidelity correspondingly increases. Larger values of the amplitude damping parameter 𝛾 degrade the Bob’s state and lower the maximum fidelity achievable by Eve. At any time 𝑡, the subset 𝐾 (𝑡) ⊆ {1, 2} of leaked keys determines the ensemble of quantum states accessible to Eve and, consequently, the residual information about the teleported state that remains hidden from her. Because the two leakage processes are independent, partial disclosure events occur without temporal correlation. This model captures side channel scenarios in which the two classical correction bits are compromised at unrelated times.
In the sequential leakage model, the second correction bit 𝑚 2 can be exposed only after the first correction bit 𝑚 1 has leaked. This captures scenarios in which the disclosure of classical information follows a fixed order, for example due to protocol structure or layered side-channel vulnerabilities. Let 𝑇1 ∼ Exp(𝑘 1 ) denote the random time at which 𝑚 1 leaks, and let 𝑇2 ∼ Exp(𝑘 2 ) denote the additional waiting time required for 𝑚 2 to leak after 𝑚 1 has become known. The total time to learn both keys is therefore 𝑇1 + 𝑇2 , where 𝑇1 and 𝑇2 are independent random variables. At time 𝑡, the probabilities of the possible knowledge classes are: 𝑃 ∅ (𝑡) = Pr(𝑇1 > 𝑡) = 𝑒 −𝑘1𝑡 , 𝑃 {1} (𝑡) = Pr(𝑇1 ≤ 𝑡 < 𝑇1 + 𝑇2 ) 𝑘1 𝑒 −𝑘1𝑡 − 𝑒 −𝑘2𝑡 , 𝑘 1 ≠ 𝑘 2, = 𝑘2 − 𝑘1 𝑘𝑡 𝑒 −𝑘𝑡 , 𝑘 1 = 𝑘 2 = 𝑘, 𝑃 {1,2} (𝑡) = 1 − 𝑃∅ (𝑡) − 𝑃 {1} (𝑡).
(81)
(82)
(83)
Because 𝑚 2 cannot leak before 𝑚 1 , the knowledge class {2} never occurs in this model. The set of possible knowledge
17
FIG. 9: Expected Holevo information (top) and Eve’s optimal fidelity (bottom) as functions√of time in the√sequential leakage model with 𝑘 1 = 𝑘 2 = 1, 𝛼 = 0.6 and 𝛽 = 0.4. Curves correspond to different amplitude-damping strengths 𝛾.
states is therefore {∅, {1}, {1, 2}}. The Holevo quantities and fidelities associated with each class coincide with those derived previously, except that the contributions 𝜒 {2} and 𝐹 {2} are absent. The expected Holevo Information at time 𝑡 is therefore, E[𝜒 (𝑡)] = 𝑃 ∅ (𝑡) 𝜒∅ + 𝑃 {1} (𝑡) 𝜒 {1} ,
(84)
There is no 𝑃 {1,2} (𝑡) 𝜒 {1,2} term because 𝜒 {1,2} = 0 (See Appendix G). while the corresponding expected fidelity of Eve’s optimal reconstruction is, 𝐹 (𝑡) = 𝑃∅ (𝑡) 𝐹 ∅ + 𝑃 {1} (𝑡) 𝐹 {1} + 𝑃 {1,2} (𝑡) 𝐹 {1,2} .
information improves Eve’s reconstruction, and the fidelity increases monotonically. At long times, when both correction keys have leaked with high probability, the fidelity approaches the asymptotic value (1 + 𝛿)/2. We make two observations from Fig. 9. First, the expected Holevo information decreases monotonically with time as more correction information becomes available to Eve. For the chosen input state, increasing 𝛾 decreases the Holevo contribution from each relevant knowledge class, so the ordering of the curves is preserved and no crossing occurs. Second, the fidelity curves exhibit a crossing behavior. In this model, the expected fidelity is determined by a weighted combination of the class-dependent fidelities 𝐹 {1} and 𝐹 {1,2} , which depend differently on 𝛾. Over the plotted range, the partial-leakage fidelity 𝐹 {1} increases with 𝛾, whereas the fullinformation fidelity 𝐹 {1,2} decreases. At early times, the {1} knowledge class carries a larger probability weight, while at later times the {1, 2} class becomes dominant. The crossing therefore reflects the shift in probability weight from partial leakage to full leakage as time increases. A similar crossing can also occur in the independent leakage model shown in Fig. 8. However, in that case Eve’s expected fidelity receives contributions from all four knowledge classes, including the additional {2} class, whereas in the sequential leakage model the evolution is restricted to the ordered sequence ∅ → {1} → {1, 2}. Thus, although both models can exhibit fidelity crossings, the behavior in the sequential leakage model is shaped by the enforced order of key disclosure.
C.
Burst Leakage Model
In the burst leakage model, both Pauli correction bits are compromised simultaneously at a single random time. This scenario captures sudden side-channel failures or catastrophic disclosure events in which all classical correction information becomes available at once. Let 𝑇 ∼ Exp(𝑘) denote the random leakage time at which both bits (𝑚 1, 𝑚 2 ) are revealed. Prior to this event, Eve has no classical information, while after 𝑇 she possesses complete knowledge of the correction keys. The resulting knowledge class probabilities are,
(85)
Fig. 9 top subplot shows the expected Holevo information E[𝜒 (𝑡)] in the sequential leakage model. At 𝑡 = 0, Eve has no access to either correction bit, so the Holevo information starts at its maximum value 𝜒 ∅ = 1 − ℎ(𝛿). As time increases, leakage of the first key 𝑚 1 reduces Eve’s uncertainty, causing E[𝜒 (𝑡)] to decrease. Because the second key cannot leak before the first, the decay is constrained by the ordered sequence ∅ → {1} → {1, 2}, in contrast to the independent leakage model. Larger values of the damping parameter 𝛾 reduce the initial value of the Holevo information, reflecting the fact that stronger amplitude damping already degrades Bob’s state before any classical leakage occurs. The Fig. 9 bottom subplot shows Eve’s optimal fidelity 𝐹 (𝑡). Initially, Eve’s best strategy is random guessing, yielding 𝐹 (0) = 1/2. As the first correction key leaks, partial classical
𝑃∅ (𝑡) = Pr(𝑇 > 𝑡) = 𝑒 −𝑘𝑡 , 𝑃 {1,2} (𝑡) = Pr(𝑇 ≤ 𝑡) = 1 − 𝑒
(86) −𝑘𝑡
.
(87)
Since no intermediate leakage of a single key is possible, the expected Holevo information simplifies to, E[𝜒 (𝑡)] = 𝑃 ∅ (𝑡) 𝜒∅ = 𝑒 −𝑘𝑡 𝜒∅,
(88)
where 𝜒 ∅ = 1 − ℎ(𝛿) denotes the Holevo information when no correction bits are known. Similarly, Eve’s optimal fidelity evolves as, 𝐹 (𝑡) = 𝑃∅ (𝑡)𝐹 ∅ + 𝑃 {1,2} (𝑡)𝐹 {1,2} = 𝑒 −𝑘𝑡 𝐹 ∅ + 1 − 𝑒 −𝑘𝑡 𝐹 {1,2} ,
(89)
18 D.
Correlated Leakage Model
In the correlated leakage model, disclosure of the two Pauli correction bits is neither fully independent nor perfectly simultaneous. Instead, the leakage dynamics consist of a shared component that can reveal both bits at once, together with independent components that can reveal each bit separately. This construction continuously interpolates between the independent leakage and burst leakage limits. We assume identical marginal leakage rates for the two correction bits, 𝑘 1 = 𝑘 2 = 𝑘, and introduce a correlation parameter 𝜇 ∈ [0, 1]. Let 𝑇sh ∼ Exp(𝜇𝑘), 𝑇1ind ∼ Exp((1 − 𝜇)𝑘), 𝑇2ind ∼ Exp((1 − 𝜇)𝑘)
(90)
be three independent exponential random variables. Here, 𝑇sh represents a shared leakage mechanism that reveals both correction bits simultaneously, while 𝑇𝑖ind represents independent leakage of the individual bit 𝑚𝑖 . The effective leakage time of bit 𝑚𝑖 is defined by 𝑇𝑖 = min 𝑇sh, 𝑇𝑖ind , 𝑖 ∈ {1, 2}. (91) FIG. 10: Time evolution of Eve’s expected Holevo information (top) and optimal fidelity (bottom) √ leakage model with √ in the burst leakage rate 𝑘 = 1.0, 𝛼 = 0.6 and 𝛽 = 0.4. Each curve corresponds to a fixed amplitude damping parameter 𝛾. In this model, both Pauli correction bits are revealed simultaneously at a single random time, producing a direct transition from no knowledge to full classical disclosure.
interpolating between random guessing, 𝐹 ∅ = 21 , and the maximum achievable fidelity 𝐹 {1,2} = 1+𝛿 2 once both correction keys are disclosed. Figure 10 illustrates the temporal behavior of Eve’s expected Holevo information and reconstruction capability in the burst leakage model. Since both correction bits leak simultaneously at a single exponentially distributed time, there is no intermediate regime corresponding to partial key knowledge. The top panel shows the expected Holevo information E[𝜒 (𝑡)] = 𝑒 −𝑘𝑡 𝜒 ∅ , which decays exponentially from its initial value 𝜒∅ = 1 − ℎ(𝛿) toward zero. Larger values of the amplitude damping parameter 𝛾 reduce the initial Holevo information, while the decay rate is determined solely by the leakage rate 𝑘. The bottom panel shows Eve’s optimal fidelity, which rises monotonically from the random guessing value 𝐹 ∅ = 12 toward the saturation value 𝐹 {1,2} = 1+𝛿 2 . Unlike the independent or sequential leakage models, the burst model has no intermediate partial-leakage phase. Together, these curves highlight the defining feature of burst leakage: a direct transition from complete concealment of the correction data to full disclosure, together with the corresponding increase in Eve’s reconstruction fidelity.
Thus, each correction bit may leak either through the shared channel or through its own independent channel, whichever occurs first. By construction, each effective leakage time 𝑇𝑖 has marginal distribution Exp(𝑘), while the dependence between 𝑇1 and 𝑇2 is controlled by the shared component 𝑇sh . When 𝜇 = 0, the shared leakage channel is absent and the two bits leak independently at rate 𝑘, recovering the independent leakage model. When 𝜇 = 1, only the shared leakage channel remains, so both bits are revealed simultaneously at rate 𝑘, recovering the burst leakage model. At time 𝑡, the probability that no correction bit has leaked is the probability that none of the three underlying leakage processes has occurred: 𝑃∅ (𝑡) = Pr(𝑇sh > 𝑡) Pr(𝑇1ind > 𝑡) Pr(𝑇2ind > 𝑡) = 𝑒 −𝜇𝑘𝑡 𝑒 − (1−𝜇 )𝑘𝑡 𝑒 − (1−𝜇 )𝑘𝑡 = 𝑒 − (2−𝜇 )𝑘𝑡 .
(92)
The probability that only the 𝑋 -correction bit 𝑚 1 has leaked is obtained by requiring that the shared leakage has not occurred, that 𝑚 1 has leaked through its independent channel, and that 𝑚 2 has not leaked: 𝑃 {1} (𝑡) = Pr(𝑇sh > 𝑡) Pr(𝑇1ind ≤ 𝑡) Pr(𝑇2ind > 𝑡) = 𝑒 −𝜇𝑘𝑡 1 − 𝑒 − (1−𝜇 )𝑘𝑡 𝑒 − (1−𝜇 )𝑘𝑡 .
(93)
By symmetry, the probability that only the 𝑍 -correction bit 𝑚 2 has leaked is 𝑃 {2} (𝑡) = Pr(𝑇sh > 𝑡) Pr(𝑇1ind > 𝑡) Pr(𝑇2ind ≤ 𝑡) = 𝑒 −𝜇𝑘𝑡 𝑒 − (1−𝜇 )𝑘𝑡 1 − 𝑒 − (1−𝜇 )𝑘𝑡 .
(94)
Finally, the probability that both correction bits have leaked is obtained by normalization: 𝑃 {1,2} (𝑡) = 1 − 𝑃∅ (𝑡) − 𝑃 {1} (𝑡) − 𝑃 {2} (𝑡).
(95)
19 This event includes contributions both from the shared leakage channel and from the case in which the two independent leakage channels have both occurred by time 𝑡. The expected Holevo information and Eve’s optimal reconstruction fidelity are obtained by weighting the class dependent quantities 𝜒𝐾 and 𝐹𝐾 by the corresponding knowledge class probabilities: ∑︁ E[𝜒 (𝑡)] = 𝑃𝐾 (𝑡) 𝜒𝐾 , (96) 𝐾 ⊆ {1,2}
𝐹 (𝑡) =
∑︁
𝑃𝐾 (𝑡) 𝐹𝐾 .
(97)
𝐾 ⊆ {1,2}
The correlated leakage model therefore interpolates between the independent and burst leakage limits, allowing the effect of partial correlation in classical side-channel leakage to be quantified in a controlled manner.
FIG. 11: Time evolution of the expected Holevo information E[𝜒 (𝑡)] (top) and Eve’s optimal fidelity 𝐹 (𝑡) (bottom) under the correlated leakage model parameter 𝛾 = 0.5, √ √ for fixed damping leakage rate 𝑘 = 1, 𝛼 = 0.6, and 𝛽 = 0.4. The curves correspond to different values of the correlation parameter 𝜇.
Fig. 11 illustrates the effect of correlation in classical key leakage on Eve’s expected Holevo information and optimal fidelity. The top subplot shows E[𝜒 (𝑡)], which decreases monotonically with time for all values of 𝜇. The curves remain close, but larger values of 𝜇 produce a slightly faster decay. The bottom panel shows Eve’s optimal fidelity 𝐹 (𝑡), which increases monotonically with time for all values of 𝜇. In this case, larger values of 𝜇 lead to a slightly slower increase at
early and intermediate times, while all curves approach nearly the same asymptotic value at long times.
VIII.
CONCLUSION AND FUTURE WORK
In this work, we introduced and analyzed the QuantumResistant Quantum Teleportation (QRQT) framework, in which the classical correction channel of quantum teleportation is protected using lattice based post quantum cryptographic primitives. We investigated the security of teleportation in the presence of time dependent leakage of the classical correction information and studied how delayed or partial exposure of the correction bits affects both the information available to an adversary and the quality of the reconstructed state. To capture imperfections in the quantum channel, we also incorporated decoherence in the shared entangled resource by modeling an amplitude damping channel acting on Bob’s half of the Bell pair. To study the effect of classical leakage, we introduced four stochastic leakage models: independent exponential leakage, sequential leakage, burst leakage, and correlated leakage. For each model, we derived explicit time dependent expressions for the adversary’s knowledge classes and used them to evaluate the expected Holevo information and Eve’s reconstruction fidelity. These results show that the temporal structure of leakage plays a central role in determining both the secrecy of the correction data and the adversary’s ability to reconstruct the teleported state. A central conclusion of our analysis is that quantum memory coherence acts as the hidden bottleneck coupling physical and computational security. It simultaneously limits the achievable communication distance, constrains the tolerable post quantum cryptographic overhead, and bounds the adversary’s useful attack window. Under realistic parameters, including a 1 ms coherence time and fiber optic propagation, the maximum secure teleportation distance ranges from approximately 191 km for FrodoKEM-1344 to approximately 199 km for Kyber512. We also found that the joint classical and quantum attack probability, 𝑃joint (𝑡), exhibits a characteristic bell shaped profile arising from the competing time dependence of classical cryptanalysis and quantum decoherence, thereby establishing a bounded optimal attack window beyond which adversarial success decays exponentially. While the present analysis provides useful insights, it also relies on some modeling assumptions that should be considered. First, the quantum noise model is restricted to amplitude damping on one qubit of the Bell pair, although the appropriate noise model may vary depending on the qubit platform and its interaction with the surrounding environment, and the quantum memory decoherence model adopts a single exponential decay, 𝐹 (𝑡) = 𝐹 0𝑒 −𝑡 /𝑇coh , which is appropriate for Markovian noise but may not adequately capture systems with non Markovian memory effects, multi exponential relaxation, or additional device level imperfections. Second, the stochastic leakage models considered here are phenomenological and are intended to capture representative patterns of classical compromise rather than all implementation spe-
20 cific attack mechanisms. Third, our analysis assumes a strong threat model in which the adversary can gain access to Bob’s quantum system in addition to leaked classical information, and the SWAP attack model further assumes an idealized adversary capable of performing a perfect unitary swap without introducing detectable disturbance. In practice, entanglement verification, timing analysis, and decoy state style countermeasures may constrain such attacks. Finally, the cryptographic protection in QRQT relies on the conjectured hardness of lattice problems such as LWE and SIS rather than on information theoretic security, so future advances in lattice algorithms or quantum computing could alter the long term security landscape.
cryptographic overhead may accumulate across intermediate nodes. Experimental validation of QRQT on photonic or trapped ion platforms, even over short distances, would provide useful benchmarks for the latency and coherence tradeoffs predicted here. It is also worth exploring hybrid approaches that combine QKD derived symmetric keys for initial authentication with post quantum cryptography for long term classical channel protection. More broadly, as NIST standardized post quantum schemes mature and quantum memory technologies continue to improve, revisiting the security and distance tradeoff with updated parameters will be essential for assessing the practical deployment of QRQT in future quantum networks.
Several directions remain for future work. A natural extension is to study more general and realistic quantum noise models, including depolarizing noise, dephasing noise, qubit correlated noise, and non-Markovian memory dynamics, as well as more realistic multi-mode quantum memory architectures [83]. It would also be valuable to investigate implementation driven leakage models grounded in specific hardware platforms, communication stacks, and side channel assumptions. Another important direction is to extend QRQT to multi-hop teleportation, repeater based quantum networks, and distributed quantum computing architectures, where leakage timing, memory coherence, and cryptographic latency may interact in more complex ways and where post quantum
Acknowledgements.— JL is supported in part by the University of Pittsburgh, School of Computing and Information, Department of Computer Science, Pitt Cyber, Pitt Momentum fund, PQI Community Collaboration Awards, John C. Mascaro Faculty Scholar in Sustainability, NSF award 2535915, Thinking Machines Lab and Cisco Research. This research used resources of the Oak Ridge Leadership Computing Facility, which is a DOE Office of Science User Facility supported under Contract DE-AC05-00OR22725 KPS thanks the U.S. Department of Energy, Office of Science, Advanced Scientific Computing Research (ASCR) program, for support under Award Number DE-SC0026264, Cisco Systems, and PQI Community Collaboration Awards.
[1] A. Dahlberg, M. Skrzypczyk, T. Coopmans, L. Wubben, F. Rozpdek, M. Pompili, A. Stolk, P. Paweczak, R. Knegjens, J. de Oliveira Filho, R. Hanson, and S. Wehner, A link layer protocol for quantum networks, in Proceedings of the ACM Special Interest Group on Data Communication, SIGCOMM -?9 (ACM, 2019) pp. 159–?73. [2] R. Valivarthi, S. I. Davis, C. Pea, S. Xie, N. Lauk, L. Narvez, J. P. Allmaras, A. D. Beyer, Y. Gim, M. Hussein, G. Iskander, H. L. Kim, B. Korzh, A. Mueller, M. Rominsky, M. Shaw, D. Tang, E. E. Wollman, C. Simon, P. Spentzouris, D. Oblak, N. Sinclair, and M. Spiropulu, Teleportation systems toward a quantum internet, PRX Quantum 1, 10.1103/prxquantum.1.020317 (2020). [3] C. H. Bennett, G. Brassard, C. Crpeau, R. Jozsa, A. Peres, and W. K. Wootters, Teleporting an unknown quantum state via dual classical and einstein-podolsky-rosen channels, Physical Review Letters 70, 1895 (1993). [4] H. J. Kimble, The quantum internet, Nature 453, 1023 (2008). [5] S. Wehner, D. Elkouss, and R. Hanson, Quantum internet: A vision for the road ahead, Science 362, 10.1126/science.aam9288 (2018). [6] N. Sangouard, C. Simon, H. de Riedmatten, and N. Gisin, Quantum repeaters based on atomic ensembles and linear optics, Rev. Mod. Phys. 83, 33 (2011). [7] J. I. Cirac, A. K. Ekert, S. F. Huelga, and C. Macchiavello, Distributed quantum computation over noisy channels, Phys. Rev. A 59, 4249 (1999). [8] R. Van Meter, Quantum Networking (Wiley, 2014). [9] S. L. N. Hermans, M. Pompili, H. K. C. Beukers, S. Baier, J. Borregaard, and R. Hanson, Qubit teleportation between nonneighbouring nodes in a quantum network, Nature 605, 663
(2022). [10] S. Gangopadhyay, T. Wang, A. Mashatan, and S. Ghose, Controlled quantum teleportation in the presence of an adversary, Physical Review A 106, 10.1103/physreva.106.052433 (2022). [11] S. Tserkis, N. Hosseinidehaj, N. Walk, and T. C. Ralph, Teleportation-based collective attacks in gaussian quantum key distribution, Physical Review Research 2, 10.1103/physrevresearch.2.013208 (2020). [12] W. K. Yam, M. Renger, S. Gandorfer, R. Gross, and K. G. Fedorov, Practical quantum teleportation with finite-energy codebooks (2025), arXiv:2512.23388 [quant-ph]. [13] N. K. Chandra, S. Guha, and K. P. Seshadreesan, Multiplexed bilayered realization of fault-tolerant quantum computation over optically networked trapped-ion modules, IEEE Transactions on Quantum Engineering 7, 1 (2026). [14] M. A. Nielsen and I. L. Chuang, Quantum Computation and Quantum Information: 10th Anniversary Edition (Cambridge University Press, 2012). [15] A. Parakh, Quantum teleportation with one classical bit, Scientific Reports 12, 10.1038/s41598-022-06853-w (2022). [16] X.-S. Ma, T. Herbst, T. Scheidl, D. Wang, S. Kropatschek, W. Naylor, B. Wittmann, A. Mech, J. Kofler, E. Anisimova, V. Makarov, T. Jennewein, R. Ursin, and A. Zeilinger, Quantum teleportation over 143 kilometres using active feed-forward, Nature 489, 269 (2012). [17] R. Cane, W. Xie, and S. X. Ng, Turbo-oded secure and reliable quantum teleportation, IET Quantum Communication 1, 16 (2020). [18] Z. Liu and R. Zhou, Asymmetric cyclic controlled quantum teleportation in noisy environment, in Proceedings of the 2024
21 3rd International Conference on Cryptography, Network Security and Communication Technology, CNSCT 2024 (ACM, 2024) pp. 504–?10. [19] R. Renner and R. Wolf, Quantum advantage in cryptography, AIAA Journal 61, 1895 (2023). [20] R. L. Rivest, A. Shamir, and L. Adleman, A method for obtaining digital signatures and public-key cryptosystems, Commun. ACM 21, 120 (1978). [21] National Institute of Standards and Technology, Digital signature standard (DSS) (1994). [22] P. W. Shor, Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer, SIAM Review 41, 303 (1999). [23] X. Jin, N. K. Chandra, M. Azari, K. P. Seshadreesan, and J. Liu, Quantum-resistant networks using post-quantum cryptography (2025), arXiv:2510.24534 [quant-ph]. [24] M. N. Wegman and J. Carter, New hash functions and their use in authentication and set equality, Journal of Computer and System Sciences 22, 265 (1981). [25] C. H. Bennett and G. Brassard, Quantum cryptography: Public key distribution and coin tossing, Theoretical Computer Science 560, 7 (2014). [26] V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M. Duek, N. Lütkenhaus, and M. Peev, The security of practical quantum key distribution, Reviews of Modern Physics 81, 1301 (2009). [27] C. Portmann and R. Renner, Security in quantum cryptography, Reviews of Modern Physics 94, 10.1103/revmodphys.94.025008 (2022). [28] R. Amiri, P. Wallden, A. Kent, and E. Andersson, Secure quantum signatures using insecure quantum channels, Physical Review A 93, 10.1103/physreva.93.032325 (2016). [29] N. Aquina, B. Cimoli, S. Das, K. Hövelmanns, F. J. Weber, C. Okonkwo, S. Rommel, B. kori, I. Tafur Monroy, and S. Verschoor, A critical analysis of deployed use cases for quantum key distribution and comparison with post-quantum cryptography, EPJ Quantum Technology 12, 10.1140/epjqt/s40507-025-00350-5 (2025). [30] Y. Baseri, V. Chouhan, A. Ghorbani, and A. Chow, Evaluation framework for quantum security risk assessment: A comprehensive strategy for quantum-safe transition, Computers & Security 150, 104272 (2025). [31] L. Chen, S. Jordan, Y.-K. Liu, D. Moody, R. Peralta, R. Perlner, and D. Smith-Tone, Report on Post-Quantum Cryptography (2016). [32] J. Bos, L. Ducas, E. Kiltz, T. Lepoint, V. Lyubashevsky, J. M. Schanck, P. Schwabe, G. Seiler, and D. Stehle, Crystals - kyber: A cca-secure module-lattice-based kem, in 2018 IEEE European Symposium on Security and Privacy (EuroS&P) (IEEE, 2018) pp. 353–?67. [33] L. Ducas, E. Kiltz, T. Lepoint, V. Lyubashevsky, P. Schwabe, G. Seiler, and D. Stehl, Crystals-dilithium: A lattice-based digital signature scheme, IACR Transactions on Cryptographic Hardware and Embedded Systems , 238 (2018). [34] D. J. Bernstein, A. Hülsing, S. Kölbl, R. Niederhagen, J. Rijneveld, and P. Schwabe, The sphincs + signature framework, in Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, CCS -?9 (ACM, 2019) pp. 2129–?146. [35] D. Moody, G. Alagic, D. C. Apon, D. A. Cooper, Q. H. Dang, J. M. Kelsey, Y.-K. Liu, C. A. Miller, R. C. Peralta, R. A. Perlner, A. Y. Robinson, D. C. Smith-Tone, and J. Alperin-Sheriff, Status report on the second round of the NIST post-quantum cryptography standardization process (2020). [36] L.-J. Wang, K.-Y. Zhang, J.-Y. Wang, J. Cheng, Y.-H. Yang, S.B. Tang, D. Yan, Y.-L. Tang, Z. Liu, Y. Yu, Q. Zhang, and J.-W. Pan, Experimental authentication of quantum key distribution
with post-quantum cryptography, npj Quantum Information 7, 10.1038/s41534-021-00400-7 (2021). [37] N. Bar-Gill, L. Pham, A. Jarmola, D. Budker, and R. Walsworth, Solid-state electronic spin coherence time approaching one second, Nature Communications 4, 10.1038/ncomms2771 (2013). [38] M. Zhong, M. P. Hedges, R. L. Ahlefeldt, J. G. Bartholomew, S. E. Beavan, S. M. Wittig, J. J. Longdell, and M. J. Sellars, Optically addressable nuclear spins in a solid with a six-hour coherence time, Nature 517, 177 (2015). [39] K. Heshami, D. G. England, P. C. Humphreys, P. J. Bustard, V. M. Acosta, J. Nunn, and B. J. Sussman, Quantum memories: emerging applications and recent advances, Journal of Modern Optics 63, 2005 (2016). [40] D. Hucul, I. V. Inlek, G. Vittorini, C. Crocker, S. Debnath, S. M. Clark, and C. Monroe, Modular entanglement of atomic qubits using photons and phonons, Nature Physics 11, 37 (2014). [41] M. Genovese, Proposal of an experimental scheme for realizing a translucent eavesdropping on a quantum cryptographic channel, Physical Review A 63, 10.1103/physreva.63.044303 (2001). [42] M. Lederman and U. Pereg, Secure communication with unreliable entanglement assistance, in 2024 IEEE International Symposium on Information Theory (ISIT) (IEEE, 2024) pp. 1017–?022. [43] M. Shaban and M. Ismail, Secured quantum identity authentication protocol for quantum networks, in 2024 IEEE 100th Vehicular Technology Conference (VTC2024-Fall) (IEEE, 2024) pp. 1–? [44] P.-a. Klimov, J. Kelly, Z. Chen, M. Neeley, A. Megrant, B. Burkett, R. Barends, K. Arya, B. Chiaro, Y. Chen, A. Dunsworth, A. Fowler, B. Foxen, C. Gidney, M. Giustina, R. Graff, T. Huang, E. Jeffrey, E. Lucero, J.-. Mutus, O. Naaman, C. Neill, C. Quintana, P. Roushan, D. Sank, A. Vainsencher, J. Wenner, T.-. White, S. Boixo, R. Babbush, V.-. Smelyanskiy, H. Neven, and J.-. Martinis, Fluctuations of energy-relaxation times in superconducting qubits, Physical Review Letters 121, 10.1103/physrevlett.121.090502 (2018). [45] S. Khatri, K. Sharma, and M. M. Wilde, Information-theoretic aspects of the generalized amplitude-damping channel, Physical Review A 102, 10.1103/physreva.102.012401 (2020). [46] P. O. Boykin and V. Roychowdhury, Optimal encryption of quantum bits, Physical Review A 67, 10.1103/physreva.67.042317 (2003). [47] O. Regev, On lattices, learning with errors, random linear codes, and cryptography, Journal of the ACM 56, 1 (2009). [48] Y. Chen and P. Q. Nguyen, Bkz 2.0: Better lattice security estimates, in Advances in Cryptology -?ASIACRYPT 2011 (Springer Berlin Heidelberg, 2011) pp. 1–?0. [49] M. R. Albrecht, R. Player, and S. Scott, On the concrete hardness of learning with errors, Journal of Mathematical Cryptology 9, 169 (2015). [50] C. P. Schnorr and M. Euchner, Lattice basis reduction: Improved practical algorithms and solving subset sum problems, Mathematical Programming 66, 181 (1994). [51] R. Lindner and C. Peikert, Better key sizes (and attacks) for lwe-based encryption, in Topics in Cryptology -?CT-RSA 2011 (Springer Berlin Heidelberg, 2011) pp. 319–?39. [52] TOP500.org, Green500 list - november 2024, https://top500. org/lists/green500/2024/11/ (2024), accessed: 2025-0810. [53] P. G. Kwiat, K. Mattle, H. Weinfurter, A. Zeilinger, A. V. Sergienko, and Y. Shih, New high-intensity source of polarization-entangled photon pairs, Physical Review Letters 75, 4337 (1995). [54] D. C. Burnham and D. L. Weinberg, Observation of simultaneity in parametric production of optical photon pairs, Physical
22 Review Letters 25, 84 (1970). [55] M. P. Hedges, J. J. Longdell, Y. Li, and M. J. Sellars, Efficient quantum memory for light, Nature 465, 1052 (2010). [56] C. D. Bruzewicz, J. Chiaverini, R. McConnell, and J. M. Sage, Trapped-ion quantum computing: Progress and challenges, Applied Physics Reviews 6, 10.1063/1.5088164 (2019). [57] X. Liu, J. Hu, Z.-F. Li, X. Li, P.-Y. Li, P.-J. Liang, Z.-Q. Zhou, C.-F. Li, and G.-C. Guo, Heralded entanglement distribution between two absorptive quantum memories, Nature 594, 41 (2021). [58] H. Barnum, C. Crepeau, D. Gottesman, A. Smith, and A. Tapp, Authentication of quantum messages, in The 43rd Annual IEEE Symposium on Foundations of Computer Science, 2002. Proceedings., SFCS-02 (IEEE Comput. Soc, 2002) pp. 449–?58. [59] J. Yin, Y.-H. Li, S.-K. Liao, M. Yang, Y. Cao, L. Zhang, J.-G. Ren, W.-Q. Cai, W.-Y. Liu, S.-L. Li, R. Shu, Y.-M. Huang, L. Deng, L. Li, Q. Zhang, N.-L. Liu, Y.-A. Chen, C.-Y. Lu, X.-B. Wang, F. Xu, J.-Y. Wang, C.-Z. Peng, A. K. Ekert, and J.-W. Pan, Entanglementbased secure quantum cryptography over 1, 120 kilometres, Nature 582, 501 (2020). [60] M. Caleffi, Optimal routing for quantum networks, IEEE Access 5, 22299 (2017). [61] S. Pirandola, J. Eisert, C. Weedbrook, A. Furusawa, and S. L. Braunstein, Advances in quantum teleportation, Nature Photonics 9, 641 (2015). [62] A. Holevo, The capacity of the quantum channel with general signal states, IEEE Transactions on Information Theory 44, 269 (1998). [63] M. M. Wilde, Quantum Information Theory (Cambridge University Press, 2013). [64] M. Horodecki, P. Horodecki, and R. Horodecki, General teleportation channel, singlet fraction, and quasidistillation, Physical Review A 60, 1888 (1999). [65] M. Curty, M. Lewenstein, and N. Lütkenhaus, Entanglement as a precondition for secure quantum key distribution, Physical Review Letters 92, 10.1103/physrevlett.92.217903 (2004). [66] J. J. Pantoja, V. A. Bucheli, and R. Donaldson, Electromagnetic side-channel attack risk assessment on a practical quantumkey-distribution receiver based on multi-class classification, EPJ Quantum Technology 11, 10.1140/epjqt/s40507-024-002906 (2024). [67] B. Qi, C.-H. F. Fung, H.-K. Lo, and F.-X. Ma, Time-shift attack in practical quantum cryptosystems, Quantum Information and Computation 7, 73 (2007). [68] N. Gisin, S. Fasel, B. Kraus, H. Zbinden, and G. Ribordy, Trojanhorse attacks on quantum-key-distribution systems, Physical Review A 73, 10.1103/physreva.73.022320 (2006). [69] N. Brunner, D. Cavalcanti, S. Pironio, V. Scarani, and S. Wehner, Bell nonlocality, Reviews of Modern Physics 86, 419 (2014). [70] H.-K. Lo, X. Ma, and K. Chen, Decoy state quantum key distribution, Physical Review Letters 94, 10.1103/physrevlett.94.230504 (2005). [71] S. Winitzki, A handy approximation for the error function and its inverse, A lecture note obtained through private communication (2008). [72] A. S. Holevo, Bounds for the quantity of information transmitted by a quantum communication channel, Problems of Information Transmission 9, 177 (1973). [73] F. Koeune and F.-X. Standaert, A tutorial on physical security and side-channel attacks, in Foundations of Security Analysis and Design III (Springer Berlin Heidelberg, 2005) pp. 78–?08. [74] M. Lucamarini, I. Choi, M.-. Ward, J.-. Dynes, Z.-. Yuan, and A.. Shields, Practical security bounds against the trojan-horse attack in quantum key distribution, Physical Review X 5, 10.1103/physrevx.5.031030 (2015).
[75] S. Ghosh, S. Upadhyay, and A. Ash Saki, A primer on security of quantum computing hardware, Proceedings of the IEEE 113, 640 (2025). [76] E. Ruijters, D. Reijsbergen, P.-T. de Boer, and M. Stoelinga, Rare event simulation for dynamic fault trees, Reliability Engineering & System Safety 186, 220 (2019). [77] Z. Zeng, A. Barros, and D. Coit, Dependent failure behavior modeling for risk and reliability: A systematic and critical literature review, Reliability Engineering & System Safety 239, 109515 (2023). [78] A. F. Karr, Stochastic processes (sheldon m. ross), SIAM Review 26, 448 (1984). [79] Stochastic Models in Reliability and Maintenance (Springer Berlin Heidelberg, 2002). [80] S. Oh, S. Lee, and H.-w. Lee, Fidelity of quantum teleportation through noisy channels, Physical Review A 66, 10.1103/physreva.66.022316 (2002). [81] D.-G. Im, C.-H. Lee, Y. Kim, H. Nha, M. S. Kim, S.-W. Lee, and Y.-H. Kim, Optimal teleportation via noisy quantum channels without additional qubit resources, npj Quantum Information 7, 10.1038/s41534-021-00426-x (2021). [82] Throughout this paper, 𝑚 1 ≡ 𝑀1 and 𝑚 2 ≡ 𝑀2 . These symbols denote the same classical bits and are used interchangeably in some sections for notational convenience and clarity. [83] C. Casey, A. Williams, C. McCaffrey, E. Rotherham, and N. Darby, Multi-mode quantum memories for high-throughput satellite entanglement distribution (2025). [84] P. Lodahl, Quantum-dot based photonic quantum networks, Quantum Science and Technology 3, 013001 (2017). [85] P. Krantz, M. Kjaergaard, F. Yan, T. P. Orlando, S. Gustavsson, and W. D. Oliver, A quantum engineer- guide to superconducting qubits, Applied Physics Reviews 6, 10.1063/1.5089550 (2019). [86] W. Gao, P. Fallahi, E. Togan, A. Delteil, Y. Chin, J. MiguelSanchez, and A. Imamoglu, Quantum teleportation from a propagating photon to a solid-state spin qubit, Nature Communications 4, 10.1038/ncomms3744 (2013). [87] H. Weinfurter, Experimental bell-state analysis, Europhysics Letters 25, 559 (1994). [88] R. Barends, J. Kelly, A. Megrant, A. Veitia, D. Sank, E. Jeffrey, T. C. White, J. Mutus, A. G. Fowler, B. Campbell, Y. Chen, Z. Chen, B. Chiaro, A. Dunsworth, C. Neill, P. Roushan, A. Vainsencher, J. Wenner, A. N. Korotkov, A. N. Cleland, and J. M. Martinis, Superconducting quantum circuits at the surface code threshold for fault tolerance, Nature 508, 500 (2014). [89] J. L. O-rien, Optical quantum computing, Science 318, 1567 (2007). [90] P. Wang, C.-Y. Luan, M. Qiao, M. Um, J. Zhang, Y. Wang, X. Yuan, M. Gu, J. Zhang, and K. Kim, Single ion qubit with estimated coherence time exceeding one hour, Nature Communications 12, 10.1038/s41467-020-20330-w (2021). [91] A. Somoroff, Q. Ficheux, R. A. Mencia, H. Xiong, R. Kuzmin, and V. E. Manucharyan, Millisecond coherence in a superconducting qubit, Physical Review Letters 130, 10.1103/physrevlett.130.267001 (2023). [92] O. Milul, B. Guttel, U. Goldblatt, S. Hazanov, L. M. Joshi, D. Chausovsky, N. Kahn, E. undefinediftyürek, F. Lafont, and S. Rosenblum, Superconducting cavity qubit with tens of milliseconds single-photon coherence time, PRX Quantum 4, 10.1103/prxquantum.4.030336 (2023). [93] D. Ghinea, F. Kaczmarczyck, J. Pullman, J. Cretin, S. Kölbl, R. Misoczki, J.-M. Picod, L. Invernizzi, and E. Bursztein, Hybrid post-quantum signatures in hardware security keys, in Applied Cryptography and Network Security Workshops (Springer Nature Switzerland, 2023) pp. 480–?99.
23 [94] L. Babai, On lovsz-?lattice reduction and the nearest lattice point problem, Combinatorica 6, 1 (1986). [95] O. Regev, Lattice-based cryptography, in Advances in Cryptology - CRYPTO 2006 (Springer Berlin Heidelberg, 2006) pp. 131–?41.
24 Appendix A: Table of Notation
TABLE II: Summary of principal symbols and notation used throughout this paper. Symbol
Description
Defined in
Quantum states and operators |𝜑 ⟩ = 𝛼 |0⟩ + 𝛽 |1⟩ |Φ+ ⟩ , |𝛽 00 ⟩ (𝑀1 , 𝑀2 ) 𝑈 SWAP 𝐸0, 𝐸1 𝜌𝑚1𝑚2 , 𝜌 avg
Alice’s input qubit; 𝛼, 𝛽 are the √ amplitudes ( |𝛼 | 2 + |𝛽 | 2 = 1) Shared Bell pair ( |00⟩ + |11⟩ )/ 2 Alice’s Bell-measurement outcomes (two classical bits) SWAP unitary applied by Eve in the quantum-channel attack Kraus operators of the amplitude-damping channel Bob’s conditional state for outcome (𝑚 1 , 𝑚 2 ) ; ensemble-averaged state
Sec. III Sec. III Sec. III Sec. IV A App. G Sec. V
QRQT protocol maps and timing TQRQT PBell , UBell , MAlice , EPQC , R Bob 𝑇PBell , 𝑇UBell , 𝑇MAlice , 𝑇EPQC , 𝑇RBob 𝑇comm 𝜏𝑚 𝑇coh 𝑇fixed 𝑑 , 𝑑 max 𝑣fiber
End-to-end QRQT teleportation map Protocol substep operators (preparation, transformation, measurement, PQC, correction) Latency of each protocol substep Classical communication delay (= 𝑑/𝑣fiber ) Minimum quantum memory lifetime required for QRQT Quantum memory coherence time Distance-independent protocol delay Communication distance; maximum feasible distance Speed of light in optical fiber (≈ 2 × 105 km/s)
Sec. III Sec. III Sec. III, App. B 1 Sec. III Sec. III Sec. III Eq. (14), App. B 3 Sec. III, Eq. (14) Sec. III
SWAP attack and quantum-side security 𝐹 (𝑡 ) , 𝐹 0 Time-dependent fidelity of Eve’s recovered state; initial fidelity 𝑃SWAP (𝑡 ) SWAP attack success probability (= 𝐹 0 𝑒 −𝑡 /𝑇coh )
Sec. IV A Eq. (18)
Classical-side attack (LWE / BKZ) 𝐴 sk, e, p 𝑛, 𝑚, 𝑞 𝑠 𝜎𝑒 𝛿 root 𝑏˜𝑖 , ∥𝑏˜ 1 ∥ 𝑑𝑖 𝑎, 𝑏 𝑇BKZ 𝑃LWE 𝜁 𝑤 , 𝑊𝑖
Public matrix ∈ Z𝑞𝑛×𝑚 Secret key vector, Gaussian error vector, public key / noisy samples LWE secret dimension, number of samples / lattice dimension, modulus Standard deviation of the Gaussian noise LWE noise width parameter (e ∈ DZ,𝜎𝑒 𝑞 ) Root-Hermite factor of BKZ-reduced basis 𝑖 -th Gram–Schmidt vector of the reduced basis; length of the first Integer search radius at NearestPlanes level 𝑖 BKZ runtime scaling coefficients characterizing adversarial computational capability BKZ lattice-reduction runtime LWE attack success probability −2 ) GSA decay ratio (≈ 𝛿 root Padé constant (≈ 0.140012); scaled argument in log-prob. formula
Sec. IV B Sec. IV B Sec. IV B Sec. IV B Sec. IV B Sec. IV B Sec. IV B Sec. IV B Eq. (10), App. E 8 Eq. (10) Eq. (19) App. E 7 a Eq. (F4)
Joint attack model 𝑃joint (𝑡 ) 𝑡∗ 𝜖
Joint classical–quantum attack success probability Optimal attack time arg max𝑡 𝑃 joint (𝑡 ) Security threshold parameter
Sec. IV C Sec. IV C Sec. IV C
Information-theoretic security (Holevo analysis) 𝑆 (𝜌 ) Von Neumann entropy of density matrix 𝜌 𝜒 Holevo quantity (upper bound on extractable information) 𝛾 Amplitude-damping √︁ parameter 𝛿 Eigenvalue gap 1 − 4𝛾 (1−𝛾 ) (1− |𝛼 | 2 ) 2 ℎ (·) Binary entropy function 𝐷 Determinant of conditional state 𝑅 ; 𝐷 = 𝛾 (1−𝛾 ) |𝛽 | 4 𝐽,𝐾 Population bias and residual √︁ coherence of 𝜌 avg Δ Eigenvalue gap of 𝜌 avg ; (1−2𝐽 ) 2 + 4|𝐾 | 2 √ 𝑢, 𝑟 Effective population |𝛼 | 2 +𝛾 |𝛽 | 2 ; residual coherence ℜ(𝛼𝛽 ∗ 1−𝛾 ) 𝐾 (𝑡 ) Subset of leaked correction-bit indices at time 𝑡 𝜒𝐾 , 𝐹 𝐾 Holevo quantity and fidelity for knowledge class 𝐾 𝑘 , 𝑘1 , 𝑘2 Exponential leakage rates 𝜇 Correlation parameter in correlated leakage model
Sec. V Eq. (6) Sec. VI Sec. (36) Sec. VI App. G App. G App. G Sec. VII Sec. VII Eq. VII Sec. VII Sec. VII
PQC protocol and computation EncPQC (·) , EncAES (·) 𝐶1 , 𝐶2 𝐾 (session key) 𝑝𝑘 Bob 𝑁 ops , 𝑅max
App. D App. D App. D App. D App. C
PQC and AES encryption operations PQC-encrypted session key; AES-encrypted correction bits Random session key for hybrid encryption Bob’s PQC public key Number of integer operations for PQC; peak throughput (PFlop/s)
25 Appendix B: Latency Data for Memory Lifetime Constraint Estimation 1.
TABLE III: Latency estimates for each step in quantum teleportation.
Step
Overview of Protocol Timing Components
The total memory lifetime 𝜏𝑚 (Eq. (13)) comprises several physical substeps whose symbols are defined in Table II. Representative latencies for each substep are provided in Sec. B 2:
Latency
Distance Dep.
State Preparation (|𝜑⟩) ∼ 10−500 ns Bell-Pair Generation ∼ 100 ps – 10 ns Bell Measurement ∼ 10−100 ns Classical Communication ∼ 5 𝜇s/km Local Pauli Corrections ∼ 1−10 ns
No No No Yes No
• 𝑇 PBell : Bell-pair preparation and distribution; • 𝑇UBell , 𝑇MAlice : Bell-basis transformation and measurement;
TABLE IV: Baseline computation time (in ns) for representative PQC schemes.
• 𝑇 EPQC : PQC encryption and decryption (estimated separately in App. C); • 𝑇comm : Classical communication over optical fiber; • 𝑇RBob : Local Pauli corrections on Bob’s qubit.
2.
Level 3
Level 5
Kyber (NIST KEM) BIKE (Code-based) FrodoKEM (LWE)
412 2002 3421
432 3932 5260
449 7885 7955
Definition of Fixed Delay Term 𝑇fixed
The total memory lifetime requirement in the QRQT protocol can be expressed as
a. State preparation. Encoding a quantum state |𝜑⟩ into a photon or superconducting qubit requires ∼ 10–500 ns depending on the platform: single-photon sources typically operate at ∼ 500 ns [84], while superconducting circuits achieve ∼ 10 ns [85]. This step is local and distance-independent. b. Bell-pair generation. Entangled photon pairs are produced via spontaneous parametric down-conversion (SPDC, ∼ 1–10 ns[53, 54]) or quantum dot emitters (∼ 100 ps [86]). The generation itself is local, but distributing one photon to a distant node adds a distance-dependent propagation delay. c. Bell measurement. Alice’s Bell-basis measurement involves linear optics and photon detection (∼ 10–100 ns [87]) together with basis-changing gates (∼ 1–10 ns [88]). This step is performed locally. d. Classical communication. The two-bit measurement result must be transmitted to Bob over optical fiber. The delay scales linearly with distance: 𝑑 ,
Level 1
3.
Physical Latency Estimates
𝑇comm =
Scheme Family
(B1)
𝜏𝑚 = 𝑇 PBell + 𝑇UBell + 𝑇 EPQC + 𝑇MAlice + 𝑇comm + 𝑇RBob ,
The term𝑇fixed used in Eq. (14) isolates all local and protocoldependent delays that do not scale with communication distance: 𝑇fixed = 𝑇 PBell + 𝑇UBell + 𝑇 EPQC + 𝑇MAlice + 𝑇RBob .
Table III summarizes the above estimates. The dominant latency arises from classical communication, which scales linearly with distance; all other steps operate within nanosecond time scales.
(B3)
This separation allows the communication delay to be modeled as 𝑇comm = 𝑑/𝑣 fiber , leading to the distance–lifetime tradeoff 𝑑 max = (𝑇coh − 𝑇fixed ) · 𝑣 fiber used in the main text.
4.
Simulation of Memory Lifetime Constraints for PQC-Protected Teleportation
To quantitatively illustrate the relationship between communication distance and the minimum quantum-memory coherence time required for successful teleportation under post-quantum cryptographic (PQC) latency, we numerically evaluated the total delay
𝑣 fiber where 𝑣 fiber ≈ 2 × 105 km/s, giving approximately 500 𝜇s at 100 km, 5 ms at 1000 km, and 25 ms at 5000 km. This is the dominant contribution to 𝜏𝑚 . e. Local Pauli corrections. Upon receiving the classical bits, Bob applies 𝑋 and/or 𝑍 gates (∼ 1–10 ns in superconducting qubits [88]; ∼ 1 ns in photonic implementations [89]). These operations are local and distance-independent.
(B2)
𝜏𝑚 = 𝑇fixed + 𝑇comm (𝑑),
(B4)
where 𝑇fixed represents distance-independent operations including Bell-pair preparation, measurement, PQC encryption/decryption, and Pauli corrections, and 𝑇comm (𝑑) ≈
𝑑 , 𝑣 fiber
𝑣 fiber ≃ 2 × 105 km/s (≈ 5 𝜇s/km).
(B5) Teleportation remains feasible only if the quantum-memory coherence time 𝑇coh exceeds the total latency 𝜏𝑚 . To produce Fig. 3, benchmark encryption and decryption latencies (in nanoseconds) for representative NIST-standardized PQC algorithms were used as the baseline offset 𝑇fixed :
26 Note: Each security level corresponds to the standard NIST parameter sets used in post-quantum KEMs. Specifically, Level 1, Level 3, and Level 5 refer respectively to parameter configurations such as Kyber512, Kyber768, and Kyber1024 in lattice-based schemes, or BIKE-L1/L3/L5 and FrodoKEM640/976/1344 for code-based and LWE-based constructions. These mappings reflect equivalent target security levels of approximately 128-bit, 192-bit, and 256-bit classical strength. Each curve represents the minimum memory lifetime requirement 𝜏𝑚 (𝑑) = 𝑇fixed + 5𝑑 (ns), where the slope of 5 ns/m corresponds to a propagation delay of 5 𝜇s/km in optical fiber. TABLE V: Reported quantum memory coherence times for representative physical platforms. System
Reported 𝑇coh
Reference
∼1 s (109 ns)
[37] [90] [91] [92]
NV-center Trapped ion ∼1 h (3.6 × 1012 ns) Fluxonium qubit ∼1.4 ms (1.4 × 106 ns) Superconducting cavity ∼34 ms (3.4 × 107 ns)
Appendix C: Estimation of PQC Execution Time
To estimate the classical processing delay introduced by post-quantum cryptography (PQC) in the QRQT protocol, we approximate the encryption and decapsulation runtimes using the number of integer operations required by each PQC primitive and the peak floating-point throughput (𝑅max ) of a modern supercomputer. Since cryptographic primitives are dominated by integer arithmetic (modular multiplication, polynomial operations) rather than floating-point operations, and no standardized integer-throughput benchmark exists for HPC systems, we adopt 𝑅max as a proxy; this yields an optimistic (i.e., lower-bound) estimate of the actual latency. The estimation is based on the high-performance computing system JEDI BullSequana XH3000, equipped with NVIDIA GH200 Grace Hopper Superchips and Quad-Rail InfiniBand interconnects, ranked #222 on the November 2024 TOP500 list [52]. The system delivers a sustained performance of 𝑅max = 4.50 PFlop/s with 19,584 cores and an energy efficiency of 72.7 GFlops/W. The decapsulation time is then approximated as: 𝑁 ops 𝑇decap/encap ≈ , (C1) 𝑅max where 𝑁 ops denotes the total number of integer operations required by the PQC and AES128 algorithms. This estimate assumes ideal parallel execution across all available compute units. In practice, the actual runtime may be longer due to sequential dependencies and synchronization overheads, as certain operations must wait for prior computation events (e.g., key encapsulation preceding decapsulation). Hence, the value obtained from Eq. (C1) provides a theoretical lower bound on PQC computation latency.
Appendix D: PQC-Protected Quantum Teleportation Protocol
Alice and Bob first share a√maximally entangled Bell state such as |Φ+ ⟩ = (|00⟩ + |11⟩)/ 2, which serves as the quantum resource for teleportation. Alice performs a Bell-state measurement on her input qubit |𝜓 ⟩ = 𝛼 |0⟩ + 𝛽 |1⟩ together with her half of the Bell pair, projecting the joint system onto one of four Bell-basis states. This measurement yields two classical bits (𝑀1, 𝑀2 ) ∈ {0, 1}2 , which encode the Pauli corrections required for Bob to recover the original state. To secure these correction bits against quantum-capable adversaries, Alice employs a hybrid post-quantum cryptographic (PQC) scheme [93]. A random session key 𝐾 is first encapsulated with a lattice-based key-encapsulation mechanism such as CRYSTALS–Kyber, producing 𝐶 1 = EncPQC (𝑝𝑘 Bob, 𝐾). The measurement results are then symmetrically encrypted with 𝐾 using AES, yielding 𝐶 2 = EncAES (𝐾, (𝑀1, 𝑀2 )). Alice transmits the ciphertext pair (𝐶 1, 𝐶 2 ) through the PQC-secured classical channel. Upon reception, Bob decapsulates 𝐶 1 to recover 𝐾, decrypts 𝐶 2 to obtain (𝑀1, 𝑀2 ), and applies the corresponding Pauli corrections 𝑍 𝑀2 𝑋 𝑀1 to his entangled qubit, thereby reconstructing the quantum state |𝜓 ⟩. The correctness and fidelity of the teleportation process require that all classical operations, including PQC encryption, communication, and decryption, complete within the quantum memory lifetime 𝜏𝑚 . In our estimation of the hybrid cryptographic latency, AES128 is adopted as the symmetric primitive accompanying the post-quantum scheme. However, since the overall classical attack complexity is overwhelmingly dominated by the hardness of the underlying post-quantum cryptographic primitive, the contribution of symmetric encryption is negligible in comparison. Consequently, throughout our security analysis we treat a successful classical-side compromise as equivalent to successfully breaking the PQC scheme, and we focus exclusively on attacks against the post-quantum cryptographic layer.
Appendix E: LWE Attack Model and Analysis 1.
LWE problem instance
An LWE instance is given by p = 𝐴⊤ sk + e
(mod 𝑞),
(E1)
𝑛 where 𝐴 ∈ Z𝑞𝑛×𝑚 is public, p ∈ Z𝑚 𝑞 is the public key, sk ∈ Z𝑞 𝑚 is the secret key, and e ∈ Z𝑞 is an error vector sampled from a discrete Gaussian noise distribution 𝐷 Z,𝜎𝑒 𝑞 . Standard
assumptions are: • sk is uniformly random over Z𝑞𝑛 . • 𝐴 is uniformly random over Z𝑞𝑛×𝑚 . • e ← 𝐷 Z,𝜎𝑒 𝑞 , a discrete Gaussian centered at 0 with width 𝜎𝑒 𝑞. Recovering sk from (𝐴, p) is conjectured to be hard and forms the basis of lattice-based post-quantum cryptography [47].
27 2.
Attack strategy: BKZ + NearestPlanes
The main practical attack on LWE reduces to two stages [48, 51]: 1. Apply the BKZ block lattice reduction algorithm to the lattice basis derived from (𝐴, p), obtaining a shorter and more orthogonal basis. 2. Use Babai’s NearestPlanes algorithm [94] (or enumeration refinements) in the reduced basis to recover the secret vector sk. The subtlety is that BKZ and NearestPlanes operate in the Euclidean space R𝑚 , while the LWE problem is defined modulo 𝑞. The attack effectively embeds the finite problem into R and searches for close lattice points in the Euclidean metric.
4.
NearestPlanes Algorithm and Its Role in LWE Decoding
The NearestPlanes algorithm, introduced by Gama and Nguyen and used extensively in lattice-based cryptanalysis, provides an efficient recursive strategy for finding lattice vectors close to a given target point. In the context of LearningWith-Errors (LWE) attacks, it forms the core enumeration subroutine following BKZ reduction: after obtaining a nearly orthogonal basis 𝐵, the algorithm enumerates lattice points in a narrow parallelepiped centered around the target 𝑝 = 𝐴𝑠 + 𝑒 (mod 𝑞) in R𝑚 . The goal is to recover the lattice vector 𝑣 = 𝐴𝑠 whose displacement 𝑒 = 𝑝 − 𝑣 is the error term. a. Input and output definition. The algorithm takes as input: • A lattice basis 𝐵 = {𝑏 1, 𝑏 2, . . . , 𝑏𝑘 } ⊆ R𝑚 ,
3.
Parameter Interpretation and Communication Security Assumption
a. LWE parameters and key structure. In the standard LWE formulation, the matrix 𝐴 ∈ Z𝑚×𝑛 consists of 𝑚 public 𝑞 sample rows, each corresponding to a noisy linear equation 𝑝𝑖 = ⟨a𝑖 , sk⟩ + 𝑒𝑖 (mod 𝑞). Here 𝑛 denotes the dimension of the secret vector sk ∈ Z𝑞𝑛 , which determines the lattice dimension and hence the dominant source of computational hardness. The parameter 𝑚 represents the number of publicly observable LWE samples available to an adversary. In standard hardness analyses 𝑚 ≥ 𝑛 is often assumed, modeling a sample-rich setting. Accordingly, the LWE-based public and secret keys are defined as public key: (𝐴, 𝑝 = 𝐴⊤ sk + e mod 𝑞),
obtained, for instance, from a BKZ-reduced basis of the LWE lattice; • A vector of integer search widths d = (𝑑 1, 𝑑 2, . . . , 𝑑𝑘 ) ∈ (Z>0 )𝑘 , where each 𝑑𝑖 specifies the number of nearest integer planes considered at depth 𝑖; • A target vector 𝑝 ∈ R𝑚 , typically corresponding to the noisy sample to be decoded. Î Output: A set of 𝑘𝑖=1 𝑑𝑖 candidate lattice vectors of the form
secret key: sk.
The public key thus exposes a set of noisy linear equations parameterized by the secret sk, while the noise vector e ensures computational hardness. b. Communication-security assumption. In our system model, quantum teleportation and the exchange of classical control information occur at high speed, whereas solving the underlying LWE instance via lattice reduction (e.g., BKZ–Nearest-Planes) requires substantially longer time. We therefore adopt a conservative, long-lived-key assumption: the same LWE keying material remains in use across many rapid transmissions, allowing an adversary to accumulate multiple public LWE samples over time (effectively a large 𝑚). Once the LWE secret is eventually recovered, the adversary can decrypt all subsequent classical control bits as well as any previously intercepted and stored ciphertexts that used the same key. However, recovering quantum states transmitted before the LWE compromise would additionally require that these states, or equivalent quantum side information have been preserved until the key recovery moment. Such a condition imposes significant quantum-memory requirements, which are beyond the scope of this study. Our focus is therefore on post-compromise exposure of classical control information, rather than on retroactive recovery of past quantum states.
𝑣=
𝑘 ∑︁
𝑐 𝑗𝑏 𝑗 ,
𝑐 𝑗 ∈ Z,
𝑗=1
which represent points in the lattice L (𝐵) lying within a bounded distance from the projection of 𝑝 onto span(𝐵). Among these, the closest candidate (in Euclidean distance) is the final decoding output. b. Recursive formulation. The recursive NearestPlanes procedure can be expressed as follows: • If 𝑘 = 0, return the zero vector. • Let 𝑣 be the orthogonal projection of 𝑝 onto span(𝐵), where span(𝐵) = {𝛼 1𝑏 1 + · · · + 𝛼𝑘 𝑏𝑘 | 𝛼𝑖 ∈ R}. • Compute the 𝑑𝑘 integers closest to the normalized inner product ⟨𝑏˜𝑘 , 𝑣⟩ , ⟨𝑏˜𝑘 , 𝑏˜𝑘 ⟩ where 𝑏˜𝑘 is the 𝑘-th Gram–Schmidt vector. • For each such integer 𝑐𝑖 , recursively call 𝑁 𝑒𝑎𝑟𝑒𝑠𝑡𝑃𝑙𝑎𝑛𝑒𝑠 ({𝑏 1, . . . , 𝑏𝑘 −1 }, (𝑑 1, . . . , 𝑑𝑘 −1 ), 𝑣 − 𝑐𝑖 𝑏𝑘 ), and add 𝑐𝑖 𝑏𝑘 to the returned partial lattice vector.
28 The complete output is the union of all recursive branches: Ø S𝑘 = 𝑐𝑖 𝑏𝑘 + NearestPlanes({𝑏 𝑗 } 𝑗 <𝑘 , d<𝑘 , 𝑣 − 𝑐𝑖 𝑏𝑘 ) 𝑖 ∈ [𝑑𝑘 ]
(E2) c. Interpretation. Intuitively, the algorithm performs a depth-first enumeration across hyperplanes orthogonal to 𝑏˜𝑘 , choosing the nearest integer projections at each level. Each recursion step refines the residual target by subtracting the best multiple of 𝑏𝑘 , so that the final set of candidate vectors covers all points in a parallelepiped centered around the projected target. The correct lattice point 𝑣 (and hence the true secret 𝑠) appears among the outputs if the cumulative rounding error across all levels remains smaller than the Gaussian noise norm. Under the Geometric Series Assumption (GSA), the lengths ∥𝑏˜𝑖 ∥ decay geometrically with 𝑖, which renders the coordinate errors approximately independent.
5.
7.
BKZ Runtime and LWE Attack Probability Derivation
Building on the security condition introduced in Eq. (20), we now derive the quantitative relationship between the attack runtime 𝑇BKZ and the success probability 𝑃LWE . This formulation connects the computational hardness of lattice reduction with the physical coherence constraints discussed in the main text, thereby defining a unified, time-dependent metric for adversarial feasibility. The derivation follows the modeling framework of Lindner and Peikert [51], with parameters calibrated according to the empirical runtime relations summarized in Appendix E 8.
a.
The GSA states that in a BKZ-reduced basis 𝐵 = {𝑏 1, 𝑏 2, . . . , 𝑏𝑚 }, the lengths of the Gram–Schmidt vectors 𝑏˜𝑖 decay geometrically with 𝑖 (as stated in Sec. E 6 above): [51] ∥𝑏˜𝑖 ∥ = ∥𝑏˜1 ∥ · 𝜁 𝑖 −1,
Success attack probability of BKZ-NearestPlanes
Suppose 𝑝 = 𝑣 + 𝑒 for some 𝑣 ∈ L (𝐵) and 𝑒 drawn from a spherical Gaussian of parameter 𝑠. Then the probability that 𝑣 is contained in the NearestPlanes output satisfies [51]: ! 𝑚 Ö ˜𝑖 ∥ √𝜋 𝑑 ∥ 𝑏 𝑖 𝑃𝑟 [𝑒 ∈ P 1 (𝐵˜ · 𝑑𝑖𝑎𝑔(𝑑))] = erf (E3) 2 2𝑠 𝑖=1 When 𝑒 is drawn from a sufficiently wide discrete Gaussian (width parameter ≥ 6), this product-form expression provides an extremely accurate approximation to the true successÎprobability. The NearestPlanes enumeration operates in 𝑂 ( 𝑖 𝑑𝑖 ) time and is typically used in conjunction with BKZ-reduced bases. Under the Geometric Series Assumption (GSA), the Gram–Schmidt norms ∥𝑏˜𝑖 ∥ decay geometrically, which makes the error contributions approximately independent. This independence justifies the product-form success probability in Eq. (E3), which is the standard analytical model for estimating LWE decoding success [48, 51].
6.
BKZ reduction and GSA
BKZ is the standard block reduction algorithm for lattice cryptanalysis. Its effectiveness is characterized by the rootHermite factor 𝛿 root , which controls the geometric decay of Gram–Schmidt lengths. Under the Geometric Series Assumption (GSA) [48]: ∥𝑏˜𝑖 ∥ ≈ ∥𝑏 1 ∥ · (𝛿 root )
−2(𝑖 −1)
.
Geometric Series Assumption (GSA)
(E4)
Attack cost is parameterized by the BKZ block size (or equivalently 𝛿 root ). A common runtime model is 𝑎 log2 𝑇BKZ ≈ − 𝑏, (E5) log2 𝛿 root where 𝑎, 𝑏 are calibrated to estimator data [49]. Larger block sizes yield smaller 𝛿 root but exponentially higher cost.
(E6)
where 𝜁 < 1 is the decay ratio. Following Lindner and Peikert [51], the determinant of the Î ˜ lattice satisfies det(Λ) = 𝑚 𝑖=1 ∥𝑏𝑖 ∥. Substituting Eq. (E6) and 1/𝑚 gives the Hermite factor definition ∥𝑏 1 ∥ = 𝛿 𝑚 root det(Λ) 𝑚 Ö
𝑚 (𝑚−1)/2 ∥𝑏˜𝑖 ∥ = ∥𝑏 1 ∥𝑚 𝜁 𝑚 (𝑚−1)/2 = 𝛿 𝑚 . (E7) root det(Λ) 𝜁 2
𝑖=1
Equating this with det(Λ) and cancelling yields −2𝑚/(𝑚−1) −2 𝜁 = 𝛿 root ≈ 𝛿 root .
(E8)
This approximation (valid for large 𝑚) bridges the decay factor 𝜁 and the root-Hermite factor 𝛿 root , forming the foundation for the GSA-based norm distribution model in BKZ-reduced lattices. Consequently, each level of the basis satisfies −2(𝑖 −1) 𝜁 𝑖 −1 ≈ 𝛿 root .
(E9)
a. Empirical BKZ runtime fit. The empirical relation between the achieved root-Hermite factor and the BKZ runtime (rearranging Eq. (10) from the main text) [49, 51] is modeled as 𝑎 log2 𝛿 root = , (E10) log2 𝑇BKZ + 𝑏 where the coefficients 𝑎 and 𝑏 depend on computational power (see Appendix E 8). This can be rewritten as 𝑎
𝛿 root = 2 log2 𝑇BKZ +𝑏 ,
(E11)
and thus 𝜁 𝑖 −1 = 2
b.
−2(𝑖 −1) log 𝑇𝑎
2 BKZ +𝑏
.
(E12)
NearestPlanes Success Probability under GSA
The NearestPlanes algorithm enumerates lattice candidates in the neighborhood of a target vector 𝑝 = 𝑣 + 𝑒, where
29 𝑣 ∈ L (𝐵) and 𝑒 follows a Gaussian noise distribution with standard deviation 𝑠. The success probability that the correct lattice vector 𝑣 is found in the enumeration output is given by the product-form approximation: √ ! 𝑚 Ö 𝑑𝑖 ∥𝑏˜𝑖 ∥ 𝜋 ˜ , (E13) 𝑃LWE ({𝑏𝑖 }, d, 𝑠) = erf 2𝑠 𝑖=1 where d = (𝑑 1, . . . , 𝑑𝑚 ) denotes the integer search widths (number of nearest integer planes per level). Substituting Eqs. (E6)–(E12) into the product-form probability gives ! √ 𝑚 Ö 𝑑𝑖 ∥𝑏˜1 ∥ 𝜋 −2(𝑖 −1) log 𝑇𝑎 +𝑏 2 BKZ 𝑃LWE = erf ·2 , (E14) 2𝑠 𝑖=1 which explicitly links the attack success probability to the BKZ runtime and thereby to computational capability. a. Practical interpretation. Equation (E14) shows that the success probability increases as the achievable reduction quality (i.e., smaller 𝛿 root ) improves, or equivalently, as the runtime 𝑇BKZ and computing power increase. In most practical lattice attacks, the search widths are chosen as 𝑑𝑖 = 1 for nearly all dimensions, representing enumeration along a single nearest plane per level. Only in high-dimensional or low-noise regimes are a few deeper layers extended to 𝑑𝑖 ∈ {2, 3, 4} to improve coverage, since the total enumeration cost scales as Î 𝑖 𝑑𝑖 . This tradeoff defines the practical boundary between feasible and infeasible LWE instance attacks under realistic hardware constraints.
computational capability of the attacker: smaller 𝑎 indicates steeper efficiency scaling (stronger algorithmic or hardware performance), while larger 𝑏 implies higher baseline throughput. Hence, 𝑎 and 𝑏 together form an abstract metric of attack power. For reference, the 2.3 GHz baseline platform corresponds to (𝑎, 𝑏) = (1.8, 110), which we adopt as the conservative default in our simulations. Stronger adversaries can be modeled by decreasing 𝑎 or increasing 𝑏. Representative settings are summarized in Table VI. TABLE VI: Representative calibration of BKZ parameters (𝑎, 𝑏) under different hardware assumptions. Hardware
CPU (2.3 GHz) 1.8 110 Ref. fit [51] GPU cluster 1.6 115 Moderate parallelism HPC / quantum 1.4 120 Aggressive assumption
This calibration enables a quantitative mapping from BKZ runtime to physical computational resources, forming the bridge between classical cryptanalytic effort and the coherence-time-limited quantum teleportation window in our joint threat model.
Appendix F: Complete Derivation: Relationship Between 𝑛, ∥𝑏 1 ∥, and 𝑚 1.
8.
Empirical BKZ Runtime Fit from Lindner and Peikert (2010)
This appendix details the empirical calibration of the BKZ runtime model adopted in Eq. (10). Lindner and Peikert [51] performed systematic BKZ lattice-reduction experiments on random √︁ 𝑞-ary lattices with parameters 𝑛 = 72, 𝑞 = 1021, and 𝑚 = 𝑛 log(𝑞)/log(𝛿 root ). Their experiments were executed on a 2.3 GHz AMD Opteron processor (comparable in performance to an Intel Xeon server core) and measured the runtime (in seconds) required to obtain a target root-Hermite factor 𝛿 root . A least-squares regression yielded the empirical relation [51]: 1.806 log2 𝑇BKZ (𝛿 root ) = − 91, log2 (𝛿 root ) and a conservative lower-bound estimate [51]: 1.8 log2 𝑇BKZ (𝛿 root ) = − 110. log2 (𝛿 root ) These values correspond to measurements on commodity Intel-class hardware and have since become the de facto reference for estimating the cost of BKZ-based lattice reduction. In summary, the BKZ runtime model takes the form 𝑎 log2 𝑇BKZ = − 𝑏, log2 𝛿 root where 𝛿 root denotes the achieved root-Hermite factor after reduction. The coefficients 𝑎 and 𝑏 jointly capture the effective
𝑏 Description
𝑎
Foundation from Paper
We use the following established relationships from the paper: ∥𝑏˜𝑖 ∥ = ∥𝑏 1 ∥ · 𝜁 𝑖 −1 𝜁 =𝛿
−2𝑚/(𝑚−1)
(GSA, Eq. E6) ≈𝛿
∥𝑏 1 ∥ = 𝛿 𝑚 · det(Λ) 1/𝑚 det(Λ) = 𝑞𝑛 √︄ 𝑛 lg(𝑞) 𝑚= lg(𝛿)
−2
(Eq. E8, large 𝑚) (Hermite factor [50]) (𝑞-ary lattice [95])
(F1) (F2)
(Optimal subdim. [51]) (F3)
Equation (F2) is derived from standard q-ary LWE embedding construct. The Hermite factor 𝛿 in Eq. (F1) characterizes the quality of the reduced basis [47, 51]. Equation (F3) represents the optimal embedding dimension, achieving a balance between basis reduction and the cost of bounded-distance decoding [47, 51]. Inverting this equation 2 yields 𝛿 ≈ 𝑞𝑛/𝑚 ; given 𝑛, 𝑞, 𝑚, the corresponding Hermite factor is automatically determined.
2.
Step-by-Step Derivation
Step 1: Express ∥𝑏˜𝑚 ∥ using GSA ∥𝑏˜𝑚 ∥ = ∥𝑏 1 ∥ · 𝜁 𝑚−1
30 Step 2: Substitute 𝜁 ≈ 𝛿 −2
4.
∥𝑏˜𝑚 ∥ = ∥𝑏 1 ∥ · (𝛿 −2 )𝑚−1 = ∥𝑏 1 ∥ · 𝛿 −2(𝑚−1) Step 3: Substitute Hermite factor definition ∥𝑏 1 ∥ = 𝛿 𝑚 · (𝑞𝑛 ) 1/𝑚 = 𝛿 𝑚 · 𝑞𝑛/𝑚 ∥𝑏˜𝑚 ∥ = 𝛿 𝑚 · 𝑞𝑛/𝑚 · 𝛿 −2(𝑚−1) = 𝛿 𝑚−2(𝑚−1) · 𝑞𝑛/𝑚 = 𝛿 −𝑚+2 · 𝑞𝑛/𝑚 Step 4: Use √︃ optimal dimension relationship to eliminate 𝛿
From 𝑚 =
𝑛 lg(𝑞) lg(𝛿 ) :
𝑛 lg(𝑞) lg(𝛿) 𝑛 lg(𝑞) lg(𝛿) = 𝑚2 𝑛/𝑚 2 𝛿 =𝑞 𝑚2 =
𝑚·lg ∥𝑏 ∥
The relationship ∥𝑏 1 ∥ = 𝑞 2𝑛/𝑚 and its inverse 𝑛 = 2 lg 𝑞 1 are exact consequences of the GSA and optimal embedding dimension assumptions. In practice, BKZ with finite block size 𝛽 achieves a root-Hermite factor 𝛿 ach > 𝛿 opt , which invalidates 2 the substitution 𝛿 = 𝑞𝑛/𝑚 used in Step 4. As a result, the actual first basis vector satisfies ∥𝑏 1 ∥ ach = 𝛿 𝑚 · 𝑞𝑛/𝑚 > 𝑞 2𝑛/𝑚 , and ach the simple closed-form relation between 𝑛 and ∥𝑏 1 ∥ no longer holds exactly. The expressions derived above should therefore be understood as idealized analytical relationships illustrating how lattice parameters scale with one another, rather than as operational formulas for concrete security estimation. For the latter purpose, dedicated tools such as the LWE Estimator [49] and the BKZ simulator of Chen and Nguyen [48] should be used, as they incorporate empirical corrections for finite block sizes and non-asymptotic effects.
5.
Step 5: Substitute back into ∥𝑏˜𝑚 ∥ ∥𝑏˜𝑚 ∥ = (𝑞𝑛/𝑚 ) −𝑚+2 · 𝑞𝑛/𝑚
Practical Considerations
Padé Approximation for the Error Function
2
=𝑞
−𝑛 (𝑚−2)/𝑚 2
=𝑞 =𝑞 =𝑞
𝑛
𝑚−2 1 𝑚 − 𝑚2
·𝑞
𝑛/𝑚
𝑛 𝑚− (𝑚−2) 2 𝑚
2𝑛/𝑚 2
Step 6: Express ∥𝑏 1 ∥ in terms of 𝑛 and 𝑚 ∥𝑏 1 ∥ = 𝛿 𝑚 · 𝑞𝑛/𝑚 2
= (𝑞𝑛/𝑚 )𝑚 · 𝑞𝑛/𝑚 = 𝑞𝑛/𝑚 · 𝑞𝑛/𝑚 = 𝑞 2𝑛/𝑚 The above equations demonstrate relationships between variables under our assumptions; note that ∥𝑏 1 ∥ is not an independent free parameter but is determined by 𝑛, 𝑚, and 𝑞.
3.
To accelerate the computation of Eq. (19), we use Winitzki’s Padé-type rational approximation [71], which provides a globally accurate closed-form for the error function: √︄ 2 𝑧 (4/𝜋 + 𝑤𝑧 2 ) erf (𝑧) ≈ 1 − exp − , 1 + 𝑤𝑧 2
Final Results
Primary relationship:
where 𝑤 ≈ 0.140012. This approximation achieves a maximum absolute error of less than 3.5×10−4 for all real 𝑧, and has been widely adopted in analytic approximations for Gaussian cumulative functions. Substituting this form into Eq. (19) and taking the base-2 logarithm yields the closed-form log-probability: !! 𝑚 ∑︁ 𝑊𝑖2 𝜋4 + 𝑤𝑊𝑖2 1 , (F4) log2 𝑃LWE ≈ log2 1 − exp − 2 1 + 𝑤𝑊𝑖2 𝑖=1 where √ ∥𝑏˜1 ∥ 𝜋 −2(𝑖 −1) log 𝑇𝑎 +𝑏 2 BKZ 𝑊𝑖 = 𝑑𝑖 2 . 2𝑠 This formulation enables efficient evaluation of 𝑃LWE with negligible numerical loss while maintaining analytic differentiability with respect to lattice and attack parameters (𝑎, 𝑏, 𝑠, 𝑑𝑖 ).
∥𝑏 1 ∥ = 𝑞 2𝑛/𝑚 a.
Solving for 𝑛: 𝑛=
𝑚 · lg(∥𝑏 1 ∥) 2 · lg(𝑞)
Last Gram-Schmidt vector: ∥𝑏˜𝑚 ∥ = 𝑞 2𝑛/𝑚
2
Padé Approximation Validation
To validate the efficiency of our Padé approximation of log2 𝑃LWE , we compare it with exact values across a range of lattice dimensions. Figure 13 shows attack success probability versus available BKZ time for different PQC parameter sets.
31 0.0 (a)
uncertainty in the unrevealed correction bits. We assume that Eve has access to Bob’s quantum system and attempts to infer the teleported state using the leaked classical information. Throughout this appendix, Bob’s conditional pre-correction state corresponding to the Bell measurement outcome (𝑚 1, 𝑚 2 ) is denoted by 𝜌𝑚1𝑚2 . All four conditional states are related by Pauli conjugation of a reference state 𝜌 00 . Since Pauli conjugation is unitary, it preserves the spectrum of the state, and hence all four conditional states have the same von Neumann entropy. The four cases below correspond to Eve learning none of the correction bits, only 𝑚 1 , only 𝑚 2 , or both bits.
log 2 Pr (×10 −8 )
0.2 0.4 0.6 0.8 1.0
Exact Padé approx
Relative error
1.2
(b)
10 1 10 2
Case A: No Keys Leaked (𝐾 = ∅)
10 3
10
20
30
40
m
50
60
FIG. 12: Comparison of exact and Padé-approximated log2 𝑃LWE versus lattice dimension 𝑚. The approximation achieves < 10−4 relative error while reducing computation time by orders of magnitude. Parameters: 𝑎 = 1.8, 𝑏 = 2.7, 𝑇 = 230 s, ∥𝑏 1 ∥ = 10, 𝑑𝑖 = 2, 𝑠 = 2.
-4,000 (a)
If neither correction bit is leaked, Eve must average uniformly over all four conditional states. The ensembleaveraged state is, 1 ∑︁ 𝐼 𝜌 avg|∅ = 𝜌𝑚1𝑚2 = . (G1) 4 𝑚 ,𝑚 2 1
The entropy of the averaged state is therefore 𝑆 (𝜌 avg|∅ ) = 1. Since each conditional state 𝜌𝑚1𝑚2 has entropy ℎ(𝛿), the Holevo quantity in this case is 𝜒∅ = 1 − ℎ(𝛿).
-6,000
Here ℎ(𝑥) denotes the binary entropy associated with eigenvalues 12 (1 ± 𝑥), namely
-8,000
log 2 Pr
2
-10,000
ℎ(𝑥) = −
-12,000
1+𝑥 1+𝑥 1−𝑥 1−𝑥 log2 − log2 . 2 2 2 2
-14,000 -16,000
Exact Padé approx
Relative error
-18,000 10 4
(b)
10 5 10 6 20
30
40
50
60
log 2 TBKZ
70
80
90
FIG. 13: Attack success probability versus BKZ computation time for various PQC algorithms. Quantum memory constraints limit attack time, directly impacting achievable security levels. Parameters: 𝑎 = 0.3, 𝑏 = 2.7, 𝑚 = 30, ∥𝑏 1 ∥ = 10, 𝑑𝑖 = 1, 𝑠 = 2.
Appendix G: Holevo Information with an Amplitude-Damped Bell Pair
Case B: 𝑋 Key Leaked Only (𝐾 = {1})
If Eve learns the 𝑋 -correction bit 𝑚 1 but not the 𝑍 correction bit 𝑚 2 , she averages over the two states that differ by a 𝑍 conjugation. Writing 𝑎 𝑐 𝑎 −𝑐 𝜌 00 = ∗ , 𝜌 01 = , 𝑐 𝑏 −𝑐 ∗ 𝑏 the averaged state for fixed 𝑚 1 = 0 is 1 𝜌 avg|𝑚1 =0 = (𝜌 00 + 𝜌 01 ) = diag(𝑎, 𝑏). 2 Similarly, for 𝑚 1 = 1, averaging over 𝜌 10 and 𝜌 11 yields diag(𝑏, 𝑎). In both cases, the eigenvalue gap of the averaged state is |1 − 2𝑎|, and its entropy is therefore ℎ(|1 − 2𝑎|). Subtracting the entropy ℎ(𝛿) of the individual conditional states gives 𝜒 {1} = ℎ(|1 − 2𝑎|) − ℎ(𝛿).
We analyze the the ensemble induced by the adversary’s (Eve’s) partial knowledge who learns a subset 𝐾 ⊆ {1, 2} of the classical teleportation correction bits (𝑚 1, 𝑚 2 ) ∈ {0, 1}2 . For each leakage pattern, we compute the corresponding Holevo quantity 𝜒𝐾 , which measures the residual information about the teleported state that remains hidden from Eve because of
Case C: 𝑍 Key Leaked Only (𝐾 = {2})
If Eve learns the 𝑍 -correction bit 𝑚 2 but not 𝑚 1 , she averages over states that differ by an 𝑋 conjugation. For fixed
32 𝑚 2 = 0,
with auxiliary parameters 𝜌 00 =
𝑎 𝑐 , 𝑐∗ 𝑏
𝑏 𝑐∗ 𝜌 10 = , 𝑐 𝑎
(H2)
The parameter 𝛿 determines the eigenvalue spectrum of 𝜌 00 , whose eigenvalues are 21 (1 ± 𝛿). For a given knowledge class 𝐾, Eve observes an ensemble {𝑝𝑖 , 𝜌𝑖 } of possible quantum states and selects a pure state |𝜎⟩ that maximizes the average overlap with the ensemble. Her optimal single-shot fidelity is therefore given by ∑︁ 𝐹𝐾 = max 𝑝𝑖 ⟨𝜎 | 𝜌𝑖 |𝜎⟩ , (H3)
and the averaged state is 𝑎+𝑏 1 ℜ(𝑐) 2 . 𝜌 avg|𝑚2 =0 = (𝜌 00 + 𝜌 10 ) = ℜ(𝑐) 𝑎+𝑏 2 2 Since 𝑎 + 𝑏 = 1, this state has eigenvalue gap Δ2 = 2|ℜ(𝑐)|.
|𝜎 ⟩ 𝑖
The same spectrum is obtained for 𝑚 2 = 1. The entropy of the averaged state is therefore ℎ(2|ℜ(𝑐)|), and the corresponding Holevo quantity is 𝜒 {2} = ℎ(2|ℜ(𝑐)|) − ℎ(𝛿).
Case D: Both Keys Leaked (𝐾 = {1, 2})
If both correction bits are leaked, the ensemble collapses to a single known conditional state 𝜌𝑚1𝑚2 . No uncertainty associated with the correction-bit ensemble remains, and therefore
which is achieved by projecting onto the eigenvector corresponding to the largest eigenvalue of the effective averaged state available to her. Table VII summarizes the effective states observed by Eve, their eigenvalue spectra, and the resulting optimal fidelities for each knowledge class. Key Set 𝐾
Effective State 𝜌 avg|𝐾
Eigenvalues
Fidelity 𝐹𝐾
∅
1 2𝐼 !
1 1 2, 2
1 2
𝑎, 𝑏
1 2 (1 + |1 − 2𝑎|)
1 2 ±𝑟
1 2 + |𝑟 |
1 2 (1 ± 𝛿)
1 2 (1 + 𝛿)
{1}
𝜒 {1,2} = 0.
{1, 2}
Summarizing the above results, the Holevo quantities associated with the four leakage patterns are
(G2)
Appendix H: Derivation of Eve’s Optimal Fidelity
In this appendix, we derive Eve’s optimal average fidelity for each possible subset 𝐾 ⊆ {1, 2} of leaked Pauli correction keys in the teleportation protocol. Eve’s task is to infer Bob’s post-measurement quantum state based on partial or complete knowledge of the classical correction bits. Let Bob’s conditional pre-correction state be 𝑎 𝑐 𝜌 00 = ∗ , (H1) 𝑐 𝑏
𝑎 0 0 𝑏
{2}
𝜒∅ = 1 − ℎ(𝛿), 𝜒 {1} = ℎ(|1 − 2𝑎|) − ℎ(𝛿), 𝜒 {2} = ℎ(2|ℜ(𝑐)|) − ℎ(𝛿), 𝜒 {1,2} = 0.
√︁ 𝛿 := 1 − 4(𝑎𝑏 − |𝑐 | 2 ).
𝑟 := ℜ(𝑐),
1 2
𝑟
𝑟
1 2
!
𝜌𝑚1𝑚2
TABLE VII: Eve’s optimal fidelity for each subset 𝐾 of known Pauli correction keys.
When no correction keys are known (𝐾 = ∅), Eve observes the maximally mixed state, yielding a fidelity of 1/2, equivalent to random guessing. Knowledge of only the 𝑋 -correction key removes phase coherence and produces a diagonal effective state, while knowledge of only the 𝑍 -correction key preserves coherence but symmetrizes the population distribution. In both cases, Eve’s optimal fidelity is determined by the largest eigenvalue of the corresponding averaged state. When both correction keys are known, Eve can identify the exact conditional state, and her fidelity is limited only by the intrinsic mixedness induced by noise, as quantified by 𝛿. This analysis provides a direct operational characterization of partial classical key leakage, complementing the Holevo information results by quantifying Eve’s best achievable state reconstruction performance.