# The Transient Outgassed Atmosphere of 55 Cancri e

Kevin Heng11affiliation: Faculty of Physics, Ludwig Maximilian University,
Scheinerstrasse 1, D-81679, Munich, Bavaria, Germany. Email:
<EMAIL_ADDRESS>22affiliation: ARTORG Center for Biomedical
Engineering Research, University of Bern, Murtenstrasse 50, CH-3008, Bern,
Switzerland 33affiliation: Astronomy & Astrophysics Group, Department of
Physics, University of Warwick, Coventry CV4 7AL, United Kingdom

###### Abstract

The enigmatic nature of 55 Cancri e has defied theoretical explanation. Any
explanation needs to account for the observed variability of its secondary
eclipse depth, which is at times consistent with zero in the visible/optical
range of wavelengths—a phenomenon that does not occur with its also variable
infrared eclipses. Yet, despite this variability its transit depth remains
somewhat constant in time and is inconsistent with opaque material filling its
Hill sphere. The current study explores the possibility of a thin, transient,
secondary atmosphere on 55 Cancri e that is sourced by geochemical outgassing.
Its transient nature derives from the inability of outgassing to be balanced
by atmospheric escape. As the outgassed atmosphere escapes and is replenished,
it rapidly adjusts to radiative equilibrium and the temperature fluctuations
cause the infrared eclipse depths to vary. Atmospheres of pure carbon dioxide
or carbon monoxide produce sufficient Rayleigh scattering to explain the
observed optical/visible eclipse depths, which vanish in the absence of an
atmosphere and the presence of a dark rocky surface. Atmospheres of pure
methane are ruled out because they produce insufficient Rayleigh scattering.
Upcoming observations by the James Webb Space Telescope will potentially allow
the atmospheric temperature and surface pressure, as well as the surface
temperature, to be measured.

planets and satellites: atmospheres

##  1 Introduction

Since the discovery of its transits in 2011 (Demory et al., 2011), the super
Earth 55 Cancri e is one of the most enigmatic objects in the study of
exoplanetary atmospheres. Searches for hydrogen (Ehrenreich et al., 2012) and
helium (Zhang et al., 2021) in its atmosphere have been unsuccessful, which is
not inconsistent with its bulk mass density of $6.4^{+0.8}_{-0.7}$ g cm-3
(Demory et al., 2016b). Models of its interior structure suggest the
possibility of volatiles being present (Dorn et al., 2017; Crida et al.,
2018), but to date an unambiguous detection of gaseous species in its
atmosphere remains elusive (Jindal et al., 2020) including a search for metals
using high-resolution spectroscopy from the ground (Keles et al., 2023). A
detection of hydrogen cyanide (HCN) was previously claimed (Tsiaras et al.,
2016), but from a chemical perspective it remains difficult to reconcile with
the non-detection of hydrogen (Ehrenreich et al., 2012).

A Spitzer Space Telescope phase curve of 55 Cancri reveals a strong dayside
($\approx 2700$ K) to nightside ($\approx 1400$ K) brightness temperature
contrast at 4.5 $\mu$m and a $41\pm 12$ degree offset in the peak of its phase
curve (Demory et al., 2016b). (See also Mercier et al. 2022.) This Spitzer
phase curve has inspired several theoretical studies that have attempted to
explain and/or predict its atmospheric composition (Angelo & Hu, 2017; Hammond
& Pierrehumbert, 2017; Mahapatra et al., 2017; Miguel, 2019), although none of
the predicted atmospheric chemistries have been definitively corroborated by
the observations.

Figure 1: Schematic of multi-wavelength model that includes a hot rocky
surface (heated by starlight) and a thin, transient atmosphere sourced by
geochemical outgassing. The left and right panels show the model in its “bare
rock” and thin-atmosphere phases, respectively. The atmosphere is transient
because outgassing and atmospheric escape fail to balance out each other and
the timescale for adjustment to radiative equilibrium is likely to be shorter
than an orbital period (see text for discussion).

A key hint to understanding the nature of 55 Cancri e lies in the variability
of its secondary eclipses, both in the optical/visible (Meier Valdés et al.,
2022, 2023; Demory et al., 2023) and infrared (Demory et al., 2016a; Tamburo
et al., 2018) range of wavelengths. At times, the optical/visible secondary
eclipses become consistent with zero (Demory et al., 2023; Meier Valdés et
al., 2023), but this phenomenon does not occur with the infrared secondary
eclipses (Demory et al., 2016a; Tamburo et al., 2018). Yet, its primary
transit depths remain somewhat constant (Tamburo et al., 2018; Meier Valdés et
al., 2023). Star-exoplanet interactions have been ruled out (Morris et al.,
2021). By analogy with the torus around Io (a moon of Jupiter), it has been
suggested that a torus of spectroscopically active gas and dust could account
for the observed variability of the secondary eclipses of 55 Cancri e (Meier
Valdés et al., 2023).

In addition to the generally short sublimation timescales of dust (Meier
Valdés et al., 2023), a key puzzle of this interpretation is how the presence
of a torus could be simultaneously consistent with the somewhat constant
transit depths and variable eclipse depths. Using the exoplanetary properties
from Demory et al. (2016b) and the stellar properties from Crida et al.
(2018), the Hill radius of 55 Cancri e is estimated to be about
$7.4R_{\oplus}$ or about $3.9R$ where $R=1.91R_{\oplus}$ is the Spitzer
$4.5~{}\mu$m radius of the exoplanet (Demory et al., 2016b). This radius
corresponds to a transit depth of about 334 parts per million (ppm), which is
consistent with the 29 transit depths measured by the CHEOPS space telescope
(Meier Valdés et al., 2023). By contrast, the presence of a torus around 55
Cancri e, which would fill its Hill sphere, would result in a transit depth of
about 4995 ppm, which is firmly ruled out by the CHEOPS observations. It is
worth noting that the Hill radius of Io is about 6 times its radius and its
torus has been observed to fill and even overflow its Hill sphere (e.g.,
Schneider & Trauger 1995; Steffl et al. 2004).

One way out of this conundrum is to assume that spectroscopically active
material is present only near secondary eclipse (where the dayside of the
exoplanet is in full view), but somehow vanishes at primary transit (which
probes its nightside and teminators). Yet another way out is to assume that
the material is spectroscopically active only at secondary eclipse, but
becomes inert or transparent at primary transit. From the perspective of
Occam’s Razor, it is challenging to explain how this may occur over the 29
contemporaneous transits and eclipses of 55 Cancri e observed by CHEOPS (Meier
Valdés et al., 2023).

These recently reported observations by the CHEOPS space telescope (Meier
Valdés et al., 2022, 2023; Demory et al., 2023), as well as upcoming eclipse
observations by the James Webb Space Telescope (JWST)111JWST Cycle 1 Proposals
#1952 and #2084., motivate a qualitatively different approach of interpreting
the data of 55 Cancri e. In the current study, it is suggested that the
reported observations collectively describe a thin, transient, outgassed
atmosphere that does not survive over long timescales because atmospheric
escape dominates the outgassing flux.

##  2 Toy Model of Transient Secondary Atmosphere

###  2.1 Theory

Figure 2: Scattering photospheric pressures (top left panel), single-
scattering albedos (top right panel), absorption cross sections (bottom left
panel) and absorption photospheric pressures (bottom right panel) associated
with pure carbon dioxide (CO2), carbon monoxide (CO) and methane (CH4)
atmospheres. For the absorption cross sections, a temperature of 2700 K and a
pressure of 0.1 bar are assumed.

As a proof of concept, I will construct the simplest possible model that
includes the salient features needed to explain multi-wavelength observations
(Figure 1). The simplicity of the model is also motivated by the complexity of
the processes that one needs to model. The starting point is a secondary
atmosphere sourced by geochemical outgassing (e.g., Tian & Heng 2023). While
the outgassing chemistry may be solved by considering the thermodynamics of
mixed phases and non-ideal gases (French, 1966; Gaillard & Scaillet, 2014;
Tian & Heng, 2023), predicting the outgassing flux is challenging as it
requires an understanding of the interior geodynamics of the exoplanet
including its tectonic regime (Stamenković & Seager, 2016). The outgassing is
balanced by a process that is notoriously difficult to model even for the
planets of the Solar System: atmospheric escape (Shizgal & Arkos, 1996). It is
the balance between the outgassing and escape fluxes that allows one to
calculate the atmospheric surface pressure (e.g., Liggins et al. 2020).
Instead of introducing several free parameters into the problem, I choose to
encode our incomplete knowledge of these processes into a single free
parameter: the atmospheric surface pressure $P$.

Furthermore, it is assumed that the atmospheric escape flux exceeds the
outgassing flux such that an equilibrium between the two processes is never
reached. Such an assumption is consistent with the erratic temporal
variability of the observed secondary eclipses, which is not observed to
correlate with any exoplanetary property (Meier Valdés et al., 2023). Using
dimensional analysis, the energy-limited mass flux222Technically, this is the
“mass luminosity”. of atmospheric escape is

$\dot{M}\sim\frac{\pi
R^{2}F_{X}}{E_{g}}=\frac{L_{X}R^{3}}{4GMR^{2}_{\star}}\sim 10^{10}\mbox{ g
s}^{-1},$ (1)

where $F_{X}$ is the X-ray flux of the star, $L_{X}=4\times 10^{26}$ erg s-1
is its X-ray luminosity (Ehrenreich et al., 2012), $E_{g}=GM/R$ is the
specific gravitational potential energy, $G$ is the universal gravitational
constant, $M=8.08~{}M_{\oplus}$ is the mass of 55 Cancri e (Demory et al.,
2016b) and $R_{\star}=0.958~{}R_{\odot}$ is the stellar radius (Crida et al.,
2018). This escape flux is $\sim 1000$ times higher than the CO2 outgassing
flux of modern Earth (Plank & Manning, 2019). While a predictive theory for
estimating the outgassing flux on 55 Cancri e remains elusive (Meier et al.,
2023), it seems implausible that such a high outgassing flux could be
attained. To balance atmospheric escape, the mass of atmosphere outgassed in
an orbital period ($t_{\rm orbit}=0.74$ day) is $\dot{M}t_{\rm period}\approx
8\times 10^{14}$ g. This implies an atmospheric pressure of $\dot{M}t_{\rm
period}g/4\pi R^{2}\approx 0.1~{}\mu$bar, which is orders of magnitude lower
than the surface pressures assumed in this study. The only general conclusion
one can draw from the non-balancing of the two processes is that it produces
stochasticity in the outgassing and atmospheric escape fluxes, which plausibly
lead to temperature fluctuations.

The transient, outgassed atmosphere sits above a rocky surface, which is
heated by starlight from 55 Cancri. The equilibrium temperature of the
exoplanet is about 1965 K. In the absence of an atmosphere, the rocky surface
attains a temperature of $T_{s}=1965$ K—at least, on the dayside of 55 Cancri
e. The thermal conduction timescale333While the thermal diffusivity of rock
(which has the physical units of a diffusion coefficient) is well-documented,
one needs to specify a characteristic length scale to convert it into a
timescale. It is unclear what the characteristic length scale is for a rocky
surface. associated with the rocky surface is assumed to be much longer than
the survival time of the atmosphere, such that it does not have enough time to
adjust to the atmospheric temperature. The surface is assumed to radiate like
a blackbody.

The outgassed atmosphere originates from a magma chamber beneath the surface
that is associated with its own temperature $T_{\rm magma}$. Under Earth-like
conditions, $T_{\rm magma}=1600$ K; see Tian & Heng (2023) for a discussion of
the appropriate values to assume for $T_{\rm magma}$. Initially, the outgassed
atmosphere has $T\approx T_{\rm magma}$. Given enough time, the atmosphere
adjusts its temperature to a value that is consistent with the greenhouse
warming effect of the outgassed species. This radiative adjustment time is
(Showman & Guillot, 2002)

$t_{\rm rad}\sim\frac{c_{P}P}{\sigma_{\rm SB}gT^{3}}\approx 2\times
10^{3}\mbox{ s}~{}\left(\frac{P}{0.1\mbox{
bar}}\right)~{}\left(\frac{T}{1600\mbox{ K}}\right)^{-3},$ (2)

where $c_{P}\sim 10^{7}$ erg g-1 K-1 is the specific heat capacity at constant
pressure and $\sigma_{\rm SB}$ is the Stefan-Boltzmann constant. The preceding
estimate was made for CO2 molecules and is a factor $\sim 2$–3 higher for CO
and CH4; the composition dependence enters through the specific heat capacity.
If the atmospheric surface pressure is $\sim 0.1$ bar, then $t_{\rm rad}$ is a
fraction of the $0.74\mbox{ day}\approx 6\times 10^{4}$ s orbital period of 55
Cancri e. It implies that, as soon as the atmosphere is outgassed, the
adjustment of the atmospheric temperature to radiative equilibrium occurs well
within an orbital period.

The key parameter controlling the chemistry of the outgassed atmosphere is the
pressure associated with the magma $P_{\rm magma}$. If the magma chamber is
located close to the surface, then one may assume $P_{\rm magma}\approx P$
(Gaillard & Scaillet, 2014). If it is located deep beneath the surface such
that $P_{\rm magma}\gg P$, then the system inherits an additional free
parameter. An additional unknown, which is difficult to calculate from first
principles, is the oxidation state of the mantle. It is parametrised by the
oxygen fugacity $f_{\rm O_{2}}$ (e.g., Tian & Heng 2023). In the conceivable
parameter space of $P_{\rm magma}$, $T_{\rm magma}$ and $f_{\rm O_{2}}$, the
plausible carbon- and oxygen-bearing species are carbon dioxide (CO2), carbon
monoxide (CO), methane (CH4) and water (H2O) (e.g., Gaillard & Scaillet 2014;
Tian & Heng 2023). In particular, a methane-dominated atmosphere is only
produced for reduced (poorly oxidized) mantles, reduced magma temperatures
(compared to that of Earth) and $P_{\rm magma}\gtrsim 10$ bar (Tian & Heng,
2023). Water is not considered further, because it is neither detected by the
Wide Field Camera 3 of the Hubble Space Telescope (Tsiaras et al., 2016) nor
from the ground using high-resolution spectroscopy (Jindal et al., 2020).

Let the flux from the dayside of 55 Cancri e and the star be $F$ and
$F_{\star}$, respectively. The orbital semi-major axis of 55 Cancri e is
$a=0.01544$ AU and the ratio of its radius to the stellar radius is
$R/R_{\star}=0.0187$ (Demory et al., 2016b). It follows that the monochromatic
secondary eclipse depth is

$\frac{F}{F_{\star}}=\left(\frac{R}{R_{\star}}\right)^{2}\frac{B_{\lambda}\left(T_{s}\right){\cal
T}+\left(1-{\cal
T}\right)B_{\lambda}\left(T\right)}{B_{\lambda}\left(T_{\star}\right)}+\left(\frac{a}{R}\right)^{2}A_{g},$
(3)

where $B_{\lambda}$ is the Planck function, $A_{g}$ is the geometric albedo
and

${\cal T}=e^{-\tau}$ (4)

is the transmission function. The effective temperature of the star is
$T_{\star}=5174$ K (Crida et al., 2018).

In equation (3), the first term accounts for thermal emission from the rocky
surface, which is attenuated by the transient outgassed atmosphere, as well as
from the atmosphere itself. The term associated with $B_{\lambda}(T)$ is a
well-known expression used to estimate the brightness temperature (e.g., Cowan
& Agol 2011; Tamburo et al. 2018). In the limit of an opaque atmosphere
(${\cal T}=0$), the thermal emission is purely blackbody in nature (with no
spectral features). The second term in equation (3) accounts for reflected
light from the outgassed atmosphere. The optical depth associated with the
attenuation is

$\tau=\frac{\kappa P}{g},$ (5)

where $g=10^{3.33}\approx 2138$ cm s-2 is the surface gravity of 55 Cancri e
(Demory et al., 2016b). The absorption opacity $\kappa$ is trivially converted
to a cross section $\sigma$ via $\kappa=\sigma/m$, where $m$ is the mass of
the molecular species considered.

For Rayleigh scattering by molecules, the geometric albedo is given by (Heng
et al., 2021)

$A_{g}=\frac{\omega}{16}+\frac{\epsilon}{2}+\frac{\epsilon^{2}}{6}+\frac{\epsilon^{3}}{24},$
(6)

where $\epsilon=(1-\gamma)/(1+\gamma)$ is the bihemispherical reflectance
(Hapke, 1981) and $\gamma=\sqrt{1-\omega}$. The single-scattering albedo
$\omega$ is constructed from the absorption ($\sigma$) and scattering
($\sigma_{\rm scat}$) cross sections,

$\omega=\frac{\sigma_{\rm scat}}{\sigma+\sigma_{\rm scat}}.$ (7)

If only single scattering is considered (i.e., multiple scattering is
ignored), then the geometric albedo is instead given by (Heng et al., 2021)

$A_{g}=\frac{3\omega}{16}.$ (8)

A more accurate approach is to derive an analytical expression for the
geometric albedo that is a function of the scattering optical depth, which
would allow an entire continuum of surface pressures to be rigorously
considered. The geometric albedo should naturally vanish as the scattering
optical depth becomes zero. While this development is necessary for future
work, it is beyond the scope of the current study.

In summary, the toy model described here has only three free parameters: the
surface temperature $T_{s}$, the atmospheric temperature $T$ and the
atmospheric surface pressure $P$. Each of the aforementioned chemical species
will be considered in turn. By fitting this model to data using Bayesian
inference methods, one may derive posterior distributions of these three
parameters. This is beyond the scope of the current study. Instead, the
intention is to elucidate the influence of each parameter in an intuitive way.

###  2.2 Cross sections

Indispensable ingredients for even a toy model are the cross sections
associated with the absorption and scattering of radiation. The Rayleigh
scattering cross sections for CO, CO2 and CH4 are taken from Sneep & Ubachs
(2005) and Thalman et al. (2014). Unfortunately, a literature search for the
Rayleigh scattering of sulfur dioxide (SO2) was in vain. The spectroscopic
line lists and partition functions are taken from the following references: Li
et al. (2015) for CO; Yurchenko et al. (2020) for CO2; Yurchenko & Tennyson
(2014) and Yurchenko et al. (2017) for CH4. These quantities were converted
into opacities (cross sections per unit mass) using the HELIOS-K opacity
calculator (Grimm & Heng, 2015) and made publicly available via the DACE
database (Grimm et al., 2021).444https://dace.unige.ch/

##  3 Results

In a self-consistent radiative transfer model, equation (3) is iterated with
the first law of thermodynamics (energy conservation) such that radiative
equilibrium is attained. The outcome of such an approach is a temperature-
pressure profile that is consistent with the assumed chemical abundances and
emergent spectrum. In atmospheric retrieval models of exoplanets, this
approach is not typically implemented, i.e., the chemical abundances and
temperature-pressure profile are not self-consistent. This is the
phenomenological approach that we will adopt when computing our toy model. As
already explained, the intention is to demonstrate the influence of each
parameter rather than fit for its values from matching data. As an
illustration, the atmospheric temperature is assumed to be $T=2700$ K, which
is inspired by the Spitzer 4.5 $\mu$m brightness temperature reported by
Demory et al. (2016b). The elucidated concepts are qualitatively independent
of this assumption.

###  3.1 Scattering and absorption photospheres

The expression for the geometric albedo stated in equation (6) assumes a so-
called “semi-infinite atmosphere”, where the scattering optical depth spans
the range from zero to infinity (Chandrasekhar, 1960; Hapke, 1981).
Physically, this corresponds to a scattering atmosphere that transitions from
being transparent to opaque, rather than the spatial distance going to
infinity in one direction. To check this assumption, I examine the scattering
photospheric pressure,

$P_{\rm scat}\sim\frac{g}{\kappa_{\rm scat}},$ (9)

where $\kappa_{\rm scat}$ is the scattering opacity. The top left panel of
Figure 2 shows calculations of $P_{\rm scat}$ for various assumed atmospheric
compositions. At wavelengths relevant to the spectral energy distribution of
55 Cancri ($\gtrsim 0.55~{}\mu$m), the scattering optical depth becomes unity
at $\sim 0.1$ bar. This suggests that as long as atmospheric surface pressures
$\gtrsim 0.1$ bar are considered then the use of equation (6) is not
unreasonable. Otherwise, one ignores multiple scattering as an approximation
and uses equation (8) instead.

The top right panel of Figure 2 shows the single-scattering albedos. The
absorption cross sections are shown in the bottom left panel of Figure 2. The
(absorption) photospheric pressure,

$P_{\rm photosphere}\sim\frac{g}{\kappa},$ (10)

is shown in the bottom right panel of Figure 2. The comparatively transparent
spectral windows in between the absorption bands of CO means that the single-
scattering albedo easily reaches unity within these windows. It also means
that $P_{\rm photosphere}\gg 1$ bar within the same spectral windows, implying
that starlight may easily reach the surface of an exoplanet with a $\sim 0.1$
bar CO atmosphere.

By contrast, methane is a good absorber in the infrared range of wavelengths
and does not have deep spectral windows in between its absorption bands. An
atmosphere with even $\sim 1$ mbar of methane may easily absorb infrared
radiation from the surface of 55 Cancri e.

Figure 3: Emission spectra (wavelength-dependent secondary eclipse depths) for
$P=0.1$ bar, $T=2700$ K and $T_{s}=1965$ K. The gray dotted curves represent
“bare rock” models with various assumed values for the geometric albedo of the
rocky surface ($A_{g,s}$). The $A_{g,s}=0$ curve essentially corresponds to a
1965 K blackbody. For Rayleigh scattering, $A_{g}=0.77$ when $\omega=1$. The
black dashed curve corresponds to a 2700 K blackbody. Figure 4: Same as Figure
3, but for $P=1$ mbar. Since this atmosphere is optically thin to Rayleigh
scattering, the treatment of multiple scattering is ignored; see equation (8).

###  3.2 Emission spectra

Figure 3 shows examples of emission spectra from 0.4 to 28 $\mu$m, which cover
the range of wavelengths probed by CHEOPS, TESS, Spitzer and JWST. For
illustration, these models assume an atmospheric surface pressure of $P=0.1$
bar, an atmospheric temperature of $T=2700$ K and a surface temperature of
$T_{s}=1965$ K. To guide our intuition, I first compute “bare rock” emission
spectra where the rocky surface is assumed to have a constant geometric albedo
$A_{g,s}$. Even with $A_{g,s}=1$, the secondary eclipse depth is only 28 ppm,
although this depends on the assumed value of $T_{s}$. The $A_{g,s}=0$ curve
essentially corresponds to a blackbody curve with a temperature of 1965 K.

All of the computed emission spectra have spectral features that are bracketed
by the 1965 K and 2700 K blackbody curves. At wavelengths that are opaque to
radiation, only the $T=2700$ K atmosphere is visible to the observer. At
wavelengths that are transparent to radiation, the observer sees the
$T_{s}=1965$ K rocky surface. These qualitative insights remain even when
other values are assumed for $T$ and $T_{s}$.

As already anticipated, methane absorbs more strongly in the infrared range of
wavelengths compared to CO and CO2. Its emission spectrum is featureless
because it probes the thin but opaque atmosphere. Methane scatters weakly in
the optical/visible range of wavelengths with the total eclipse depth (which
includes thermal emission) being less than 5 ppm for wavelengths shorter than
0.8 $\mu$m.

With its transparent spectral windows, carbon monoxide produces an emission
spectrum rich with features that rise above the continuum by as much as 60
ppm. In the optical/visible range of wavelengths (0.4–0.8 $\mu$m), it produces
a maximum eclipse depth of 22 ppm.

Carbon dioxide is intermediate between CO and CH4, producing an emission
spectrum that has a few spectral features and a maximum eclipse depth of 21
ppm from 0.4–0.8 $\mu$m. It is noted that these optical/visible eclipse depth
estimates depend on the value of $T$ assumed as hotter atmospheres contribute
more thermal emission at these wavelengths and thus produce larger eclipse
depths.

###  3.3 Eclipse depths

Table 1: Bandpass-integrated eclipse depths (ppm)

Bandpass | Pure CO2 | Pure CO | Pure CH4
---|---|---|---
CHEOPS (blackbody) | 14.8 | 21.4 | 4.0
CHEOPS (SED) | 14.8 | 21.5 | 4.1
TESS (blackbody) | 11.0 | 21.3 | 7.8
TESS (SED) | 11.2 | 21.4 | 7.9
Spitzer 4.5 $\mu$m (blackbody) | 101.5 | 88.6 | 101.4
Spitzer 4.5 $\mu$m (SED) | 107.0 | 93.4 | 107.0

Note: All of these estimates assume a surface pressure of $P=0.1$ bar. “SED”
means a PHOENIX spectrum of 55 Cancri was used to compute the eclipse depth.

To facilitate comparison to observations, the bandpass-integrated eclipse
depth $D$ needs to be computed for each model emission spectrum. Some
attention to detail is needed when integrating equation (3) over wavelength as
one needs to include the filter response function $f_{\lambda}$ of the various
space telescopes555http://svo2.cab.inta-csic.es/theory/fps/. The thermal
emission component of the eclipse depth is

$D_{\rm
th}=\left(\frac{R}{R_{\star}}\right)^{2}\frac{\int\left[B_{\lambda}\left(T_{s}\right){\cal
T}+\left(1-{\cal
T}\right)B_{\lambda}\left(T\right)\right]S_{\lambda}~{}d\lambda}{\int
B_{\lambda}\left(T_{\star}\right)S_{\lambda}~{}d\lambda},$ (11)

where $S_{\lambda}=\lambda f_{\lambda}$ for photon counters (CHEOPS) and
$S_{\lambda}=f_{\lambda}$ for energy counters (TESS and Spitzer). The
reflected light component of the eclipse depth requires even more attention to
detail, because a bandpass-integrated geometric albedo is similar666Geometric
and spherical albedos are wavelength-dependent quantities that are intrinsic
to the scattering surface or atmosphere. They do not depend on the stellar
properties. By contrast, the Bond albedo depends on both the intrinsic
scattering properties and the spectral energy distribution of the star. In
other words, the exact same exoplanet orbiting stars of different spectral
types will have different values of the Bond albedo. to a Bond albedo (e.g.,
Heng et al. 2021) and requires an extra weighting factor of the stellar
spectral energy distribution,

$D_{\rm r}=\left(\frac{a}{R}\right)^{2}\frac{\int
A_{g}B_{\lambda}\left(T_{\star}\right)S_{\lambda}~{}d\lambda}{\int
B_{\lambda}\left(T_{\star}\right)S_{\lambda}~{}d\lambda}.$ (12)

The bandpass-integrated eclipse depth is $D=D_{\rm th}+D_{\rm r}$.

There is a rich debate on how the treatment of the spectral energy
distribution of the 55 Cancri star affects the interpretation of the secondary
eclipses of 55 Cancri e (Crossfield, 2012). To check the sensitivity of the
computed eclipse depths to this issue, the PHOENIX model spectrum of 55 Cancri
used by Demory et al. (2023) and Meier Valdés et al. (2023) is used. The
preceding expressions for $D_{\rm th}$ and $D_{\rm r}$ are generalised by
substituting $B_{\lambda}(T_{\star})$ with $F_{\star}/\pi$, where $F_{\star}$
is the PHOENIX model spectrum (in flux, rather than intensity, units).

Table 1 states the computed eclipse depths in the CHEOPS, TESS and Spitzer 4.5
$\mu$m bandpasses. Only the Spitzer eclipse depths are sensitive to whether a
blackbody or PHOENIX model is used for the spectral energy distribution of the
star. The computed TESS eclipse depths are consistent with the $15\pm 4$ ppm
and $8\pm 5$ ppm measurements reported by Meier Valdés et al. (2022). To
within two standard deviations, the computed Spitzer eclipse depths are
consistent with the $154\pm 23$ ppm measurement of Demory et al. (2016b) and
the non-zero values reported in Table 4 of Tamburo et al. (2018). Also to
within two standard deviations, the computed CHEOPS eclipse depths for pure CO
or CO2 atmospheres are consistent with almost all of the non-zero values shown
in Figure 3 of Meier Valdés et al. (2023). A more definitive comparison
requires JWST spectra to break the degeneracy in assumed composition that
Spitzer data alone cannot provide.

###  3.4 Change in infrared transit depth

The pressure corresponding to the wavelength-dependent transit chord is (Heng
& Kitzmann, 2017)

$\begin{split}P_{\rm transit}&\sim P_{\rm photosphere}\sqrt{\frac{H}{R}}\\\
&\approx 0.055P_{\rm photosphere}\left(\frac{T}{2700\mbox{
K}}\right)^{1/2}\left(\frac{m}{28\mbox{ amu}}\right)^{-1/2},\end{split}$ (13)

where $H$ is the (isothermal) pressure scale height and the gravity and
exoplanetary radius are taken from Demory et al. (2016b). The preceding
estimate focuses on CO, because it has a larger pressure scale height compared
to that of CO2 and the photospheric pressure is as low as $P_{\rm
photosphere}\sim 0.1~{}\mu$bar (bottom right panel of Figure 2). The pressure
associated with the transit chord thus reaches as high in altitude as $\sim 1$
nbar. For a $P=0.1$ bar atmosphere, the difference between the transit radius
and the surface of the exoplanet is about $\delta\approx 18H$. This
corresponds to a maximum change in transit depth of
$2R\delta/R^{2}_{\star}\approx 38$ ppm, which is not inconsistent with the
variation in the Spitzer 4.5 $\mu$m transit depths reported by Demory et al.
(2016a) and Tamburo et al. (2018).

##  4 Discussion

I now suggest an alternative interpretation of the observations reported by
Demory et al. (2016a, b, 2023), Tamburo et al. (2018) and Meier Valdés et al.
(2023). When the optical/visible secondary eclipse depths are consistent with
being zero, this is interpreted as the observations probing mainly the bare
rocky surface of the dayside of 55 Cancri e. To be consistent with zero
optical/visible eclipse depth, the geometric albedo of the surface must be
close to zero.

Stochasticity in the outgassing and atmospheric escape fluxes plausibly lead
to fluctuations in the global spatial distribution of the atmosphere (which I
have not modelled) and the atmospheric temperature. As the outgassed
atmosphere starts to accumulate on the dayside, this increases the
optical/visible eclipse depth because of Rayleigh scattering of starlight and
atmospheric thermal emission. In this scenario, pure CH4 atmospheres are ruled
out because they produce insufficient Rayleigh scattering, although such
atmospheres would easily produce a featureless blackbody spectrum in the
infrared. CO and CO2 atmospheres are also opaque at 4.5 $\mu$m and the
emission spectrum at this wavelength probes the $T=2700$ K blackbody curve.

The fluctuating temperatures shift the upper envelope of the infrared emission
spectrum, shown in Figure 3, up and down. This produces variable infrared
eclipse depths that are consistent with those reported by Demory et al.
(2016a) and Tamburo et al. (2018). It is plausible that the changing
atmosphere also causes erratic fluctuations in the optical/visible phase
curves, which have been observed by CHEOPS (Meier Valdés et al., 2023). The
infrared eclipse depth never becomes zero in this scenario, because even in
the absence of an atmosphere it probes the rocky surface.

Upcoming JWST observations will potentially be able to distinguish between
different atmospheric chemistries. If the atmospheric surface pressure is less
than 0.1 bar (see Figure 4 for computed emission spectra corresponding to
$P=1$ mbar), then the spectral features will become more distinct. However,
the spectral features may easily be muted by the presence of clouds, hazes or
condensates. Nevertheless, fitting even a featureless spectrum to a blackbody
curve will allow one to infer the atmospheric temperature, independent of the
surface pressure. If spectral features are observed, then fitting a blackbody
curve to the lowest fluxes will allow one to infer the surface temperature. A
model fit should be performed within a Bayesian retrieval framework with the
fitting parameters being the atmospheric temperature ($T$), surface pressure
($P$) and surface temperature ($T_{s}$).

The current model makes falsifiable predictions that may be tested by
simultaneous optical/visible and JWST observations. It is crucial that these
observations are taken at the same time, because the atmospheric escape and
radiative adjustment timescales are expected to be shorter than the orbital
period. When 55 Cancri e is in its “bare rock” phase, the optical/visible
eclipse depth should be close to zero while the infrared emission spectrum
should probe the temperature of the rocky surface. When an outgassed
atmosphere is present on the dayside, the optical/visible eclipse depth probes
Rayleigh scattering by the atmosphere while the infrared emission spectrum
should probe the atmospheric temperature and composition. In between these two
phases, the infrared and optical/visible eclipse depths are expected to
fluctuate as the atmospheric temperature adjusts to radiative equilibrium
(from its original outgassed value).

It is conceivable that the molecules of the outgassed atmosphere will
eventually be broken up into their constituent atoms and ions (e.g., carbon
and oxygen), which may be observable as exospheric species via ultraviolet
spectroscopy.

I am grateful to Alexis Brandeker, Brice-Olivier Demory and Meng Tian for
useful discussions and to Erik Meier Valdés for providing the PHOENIX stellar
spectrum of 55 Cancri. I acknowledge funding by the Ludwig Maximilian
University and the Swiss National Science Foundation. This research was
stimulated by spirited discussions at the inaugural Exoplanets by the Lake
summer school, held from 31st July to 4th August 2023 in Starnberg, following
a talk by Jayshil Patel.

## References

  * Angelo & Hu (2017) Angelo, I., & Hu, R. 2017, AJ, 154, 232
  * Chandrasekhar (1960) Chandrasekhar, S. 1960, Radiative Transfer (New York: Dover)
  * Cowan & Agol (2011) Cowan, N.B., & Agol, E. 2011, ApJ, 726, 82
  * Crida et al. (2018) Crida, A., Ligi, R., Dorn, C., & Lebreton, Y. 2018, ApJ, 860, 122
  * Crossfield (2012) Crossfield, I.J.M. 2012, A&A, 545, A97
  * Demory et al. (2011) Demory, B.-O., Gillion, M., Deming, D., et al. 2011, A&A, 533, A114
  * Demory et al. (2016a) Demory, B.-O., Gillon, M., Madhusudhan, N., & Queloz, D. 2016a, MNRAS, 455, 2018
  * Demory et al. (2016b) Demory, B.-O., Gillon, M., de Wit, J., et al. 2016, Nature, 532, 207
  * Demory et al. (2023) Demory, B.-O., Sulis, S., Meier Valdés, E., et al. 2023, A&A, 669, A64
  * Dorn et al. (2017) Dorn, C., Hinkel, N.R., & Venturini, J. 2017, A&A, 597, A38
  * Ehrenreich et al. (2012) Ehrenreich, D., Bourrier, V., Bonfils, X., et al. 2012, A&A, 547, A18
  * French (1966) French, B.M. 1966, Reviews of Geophysics, 4, 223
  * Gaillard & Scaillet (2014) Gaillard, F., & Scaillet, B. 2014, Earth & Planetary Science Letters, 403, 307
  * Grimm & Heng (2015) Grimm, S.L., & Heng, K. 2015, ApJ, 808, 182
  * Grimm et al. (2021) Grimm, S.L., Malik, M., Kitzmann, D., et al. 2021, ApJS, 253, 30
  * Hammond & Pierrehumbert (2017) Hammond, M., & Pierrehumbert, R.T. 2017, ApJ, 849, 152
  * Hapke (1981) Hapke, B. 1981, J. Geophys. Res., 86, 3039
  * Heng & Kitzmann (2017) Heng, K., & Kitzmann, D. 2017, MNRAS, 470, 2972
  * Heng et al. (2021) Heng, K., Morris, B.M., & Kitzmann, D. 2021, Nature Astronomy, 5, 1001
  * Jindal et al. (2020) Jindal, A., de Mooij, E.J.W., Jayawardhana, R., et al. 2020, AJ, 160, 101
  * Keles et al. (2023) Keles, E., Mallonn, M., Kitzmann, D., et al. 2023, MNRAS, 513, 1544
  * Li et al. (2015) Li, G., Gordon, I.E., Rothman, L.S., et al. 2015, ApJS, 216, 15
  * Liggins et al. (2020) Liggins, P., Shorttle, O., & Rimmer, P.B. 2020, Earth & Planetary Science Letters, 550, 116546
  * Mahapatra et al. (2017) Mahapatra, G., Helling, Ch., & Miguel, Y. 2017, MNRAS, 472, 447
  * Meier et al. (2023) Meier, T.G., Bower, D.J., Lichtenberg, T., Hammond, M., & Tackley, P.J. 2023, arXiv:2308.00592
  * Meier Valdés et al. (2022) Meier Valdés, E.A., Morris, B.M., Wells, R.D., Schanche, N., & Demory, B.-O. 2022, A&A, 663, A95
  * Meier Valdés et al. (2023) Meier Valdés, E.A., Morris, B.M., Demory, B.-O., et al. 2023, arXiv:2307.06085v2
  * Mercier et al. (2022) Mercier, S.J., Dang, L., Gass, A., Cowan, N.B., & Bell, T.J. 2022, AJ, 164, 204
  * Miguel (2019) Miguel, Y. 2019, MNRAS, 482, 2893
  * Morris et al. (2021) Morris, B.M., Delrez, L., Brandeker, A., et al. 2021, A&A, 653, A173
  * Plank & Manning (2019) Plank, T., & Manning, C.E. 2019, Nature, 574, 343
  * Schneider & Trauger (1995) Schneider, N.M., & Trauger, J.T. 1995, ApJ, 450, 450
  * Shizgal & Arkos (1996) Shizgal, B.D., & Arkos, G.G. 1996, Reviews of Geophysics, 34, 483
  * Showman & Guillot (2002) Showman, A.P., & Guillot, T. 2002, A&A, 385, 166
  * Sneep & Ubachs (2005) Sneeps, M., & Ubachs, W. 2005, Journal of Quantitative Spectroscopy and Radiative Transfer, 92, 293
  * Stamenković & Seager (2016) Stamenković, V., & Seager, S. 2016, ApJ, 825, 78
  * Steffl et al. (2004) Steffl, A.J., Stewart, A.I.F., & Bagenal, F. 2004, Icarus, 172, 78
  * Tamburo et al. (2018) Tamburo, P., Mandell, A., Deming, D., & Garhart, E. 2018, AJ, 155, 221
  * Thalman et al. (2014) Thalman, R., Zarzana, K.J., Tolbert, M.A., & Volkamer, R. 2014, Journal of Quantitative Spectroscopy and Radiative Transfer, 147, 171
  * Tian & Heng (2023) Tian, M., & Heng, K. 2023, arXiv:2301.10217
  * Tsiaras et al. (2016) Tsiaras, A., Rocchetto, M., Waldmann, I.P., et al. 2016, ApJ, 820, 99
  * Yurchenko & Tennyson (2014) Yurchenko, S.N., & Tennyson, J. 2014, MNRAS, 440, 1649
  * Yurchenko et al. (2017) Yurchenko, S.N., Amundsen, D.S., Tennyson, J., & Waldmann, I.P. 2017, A&A, 605, A95
  * Yurchenko et al. (2020) Yurchenko, S.N., Mellor, T.M., Freedman, R.S., & Tennyson, J. 2020, MNRAS, 496, 5282
  * Zhang et al. (2021) Zhang, M., Knutson, H.A., Wang, L., et al. 2021, AJ, 161, 181


Also at ]State Key Laboratory of Integrated Service Networks, Xidian
University, Xi’an 710071, China

# Post-processing of the oblivious key in quantum private queries

Fei Gao  [<EMAIL_ADDRESS>Bin Liu<EMAIL_ADDRESS>Wei Huang
Qiao-Yan Wen  State Key Laboratory of Networking and Switching Technology,
Beijing University of Posts and Telecommunications, Beijing, 100876, China

###### Abstract

Quantum private query (QPQ) is a kind of quantum protocols to protect both
users’ privacy in their communication. There is an interesting example, that
is, Alice wants to buy one item from Bob’s database, which is composed of a
quantity of valuable messages. QPQ protocol is the communication procedure
ensuring that Alice can get only one item from Bob, and at the same time, Bob
cannot know which one was taken by Alice. Owing to its practicability,
quantum-key-distribution-based QPQ has draw much attention in recent years.
However, the post-processing of the key in such protocols, called oblivious
key, remains far from being satisfactorily known. Especially, the error
correction method for such special key is still missing. Here we focus on the
post-processing of the oblivious key, including both dilution and error
correction. On the one hand, we demonstrate that the previous dilution method,
which greatly reduces the communication complexity, will bring Alice the
chance to illegally obtain much additional information about Bob’s database.
Simulations show that by very limited queries Alice can obtain the whole
database. On the other hand, we present an effective error-correction method
for the oblivious key, which completes its post-processing and makes such QPQ
more practical.

###### pacs:

03.67.Dd, 03.67.Hk

††preprint: APS/123-QED

##  I Introduction

In some cryptographic communications, we need not only protect the security of
the transmitted message against eavesdropping from an outside adversary, but
also the communicators’ individual privacy against each other. An interesting
example is the problem of private user queries to a database, where Alice
bought an item in Bob’s database, which is composed of a quantity of valuable
messages, and wants to get it from Bob (given that Alice knows the address of
this item in the database). Here Bob will worry about that Alice can obtain
more items from his database when she gets the bought one, and Alice might not
want Bob know which item she is querying. Symmetrically private information
retrieval (SPIR) SPIR  protocols are designed for such circumstance. It
ensures the privacies of both Alice and Bob. That is, after the communication,
Alice can correctly obtain at most one item (i.e. the one who bought) from
Bob’s database and simultaneously, Bob does not know the address Alice has
retrieved.

As we know, the security of most classical cryptosystems is based on the
assumptions of computational complexity, and they might be broken by the
strong ability of some advanced algorithms like quantum computation Shor ;
Grover . Fortunately, this difficulty can be overcome by quantum cryptography
BB84 ; GRTZ02 , where the security is assured by physical principles. Owing to
its higher security, quantum cryptography has attracted a great deal of
attention now.

Quantum Private Queries (QPQ) is the quantum scheme for SPIR problem. In fact,
as a kind of protocols for two party quantum secure computations, the task of
SPIR cannot be achieved ideally even in its quantum version Lo1997 . More
practically, the requirements are generally relaxed into that Alice can elicit
sufficiently little content of the database, and Bob’s attack will be
discovered, with a certain probability, by Alice if he tries to obtain the
address Alice is retrieving.

In 2008 V. Giovannetti et al proposed the first QPQ protocol QPQ08 ; QPQproof
; QPQexp , where the database is represented by a unitary operation (i.e.
oracle operation) and it is performed on the two coming query states. In 2011
L. Olejnik presented an improved protocol where only one query state is
necessary QPIR11 . Compared with the previous (classical) SPIR schemes, the
above two protocols display an exponential reduction in both communication
complexity and running-time computational complexity.

Though the above two protocols exhibit significant advantages in theory, they
are difficult to implement because when large database is concerned the
dimension of the oracle operation will be very high. To solve this problem, M.
Jakobi et al gave a new QPQ protocol (J-protocol) based on quantum key
distribution (QKD) QPQ11 . In this protocol SARG04 QKD scheme SARG04  is
utilized to distribute an oblivious key between Alice and Bob, which satisfies
the following three requirements.

  * R1.

Bob knows every bit in the key.

  * R2.

Alice knows every key bit with a certain probability (e.g. 0.25 for an honest
Alice in J-protocol).

  * R3.

Bob does not know which key bits are known by Alice.

Then the post-processing of the key is needed, which changes the oblivious key
so that it satisfies the above requirements (R1), (R3), and a modified (R2),
that is,

  * R2’.

Alice knows only several bits in the key (note that the ideal case is Alice
knows just one bit, but to increase the success probability of the
communication the bits obtained by Alice are generally little more than one,
e.g. 2-7 on average).

Here we call the key before and after post-processing the Raw Oblivious Key
(ROK) and the Final Oblivious key (FOK), respectively. Obviously it is a
“dilution process” from ROK to FOK. Afterwards, if Alice knows the $j$-th bit
in the FOK and wants to retrieve the $i$-th item in Bob’s database, she
declares a shift value $s=j-i$ so that Bob can shift his FOK by $s$. At last
Bob encrypts his database by the shifted FOK (for simplicity, it is generally
assumed that the content of each item in the database is just a bit, and one
key bit can encrypt one item by ont-time pad), and sends the whole encrypted
database to Alice. Thus Alice can correctly decrypt the item she wanted by her
known key bit. More importantly, both users’ privacy are successfully
protected.

Compared with previous QPQ protocols, J-protocol is based on QKD, the most
practical application of quantum information technology, and consequently it
is easy to be realized. More concretely, it can be easily generalized to large
database, and it is loss tolerant. Therefore, as a practical model of QPQ,
QKD-based QPQ is very attractive and has become a studying point. Different
manners to distribute the ROK were given by some of us in Refs. OE12 ; PRA13 ,
and different methods for post-processing were presented in Refs. PJ13 ; SZM12
.

Here we focus on the post-processing of the oblivious key in QPQ. In Ref.
QPQ11  M. Jakobi et al gave a $kN-N$ method, that is, it transforms a ROK with
length $kN$ into a $N$-bit FOK (here $N$ is the total number of items in the
database and $k$ is a parameter which is an integer greater than 1).
Afterwards M. V. Panduranga Rao et al proposed two improved methods in Ref.
PJ13 . One is $N-N$, and the other is $rM-N$, where $r,M$ are integers
satisfying $rM\ll N$. Obviously these two methods would greatly reduce the
communication complexity.

However, in our opinion, two important problems about the post-processing of
the oblivious key need be further studied.

(1) As pointed by the authors of Ref. PJ13 , the reduction in communication
complexity in their methods comes at the cost that parity information about
some key bits in FOK is easier to obtain for Alice. So, the question is, what
kind of influence this fact (that is, the parity information were illegally
leaked to Alice) brings on the database security?

(2) In a practical realization, noise exists in the channel and there are
always errors in the shared key between Alice and Bob. An error bit in Alice’s
FOK implies that Alice would pay her money and get back a wrong content from
Bob, which is obviously unfair for Alice. Moreover, when she finds the bought
content is error, Alice believes Bob is cheating, and consequently Bob’s
reputation will become very bad. Therefore, just like in QKD, error correction
is necessary in the post-processing. In fact, dilution and error correction
compose the whole post-processing of oblivious key in QPQ (note that privacy
amplification, another important part of post-processing in QKD, is
unnecessary here because its function will be achieved by the dilution
procedure). But performing error correction on oblivious key is difficult.
This is because, to correct errors, Bob has to declare additional information
about the key to Alice, which would bring the chance for Alice to illegally
get much more key bits than expected. M. Jakobi et al listed error correction
as an open question in QPQ QPQ11 , and till now all previous post-processing
methods just pay attention to “dilution”, while error correction is still
awaited.

In this paper we demonstrate that M. V. Panduranga Rao et al’s dilution
methods would result in insecurity for Bob’s database. Simulations show that
Alice can obtain much more items (even the whole database) than expected if
she execute multiple but limited (averagely 53.4 for $N=10^{4}$) queries. In
other words, buying about 53 items means obtaining the whole database with
$10^{4}$ items in total! Furthermore, we propose an effective error-correction
method for the oblivious key, which completes its post-processing and makes
such QPQ protocol more practical for a real noisy channel.

The rest of this paper is organized as follows. In Sec. II we give a brief
review of previous three dilution methods, and analysis the insecurity brought
by the $N-N$ method and the $rM-N$ one in Sec. III. The scheme of post-
processing with error-correction is presented In Sec. IV and Sec.V is our
conclusion.

##  II Previous dilution methods

In this section we will give brief sketches of previous dilution methods,
including the $kN-N$ one given by M. Jakobi et al QPQ11 , and the improved
ones, i.e. $N-N$ and $rM-N$ ones, given by M. V. Panduranga Rao et al PJ13 .
In all these methods it is assumed that Alice and Bob have shared a ROK
$O^{R}$ satisfying the above requirements R1-R3. The aim is to dilute $O^{R}$
into the FOK $O^{F}$ satisfying R1,R2’, and R3.

###  II.1 The $kN-N$ method

For simplicity, the $kN$-bit ROK $O^{R}$ can be denoted as
${O^{R}_{1}O^{R}_{2}...O^{R}_{kN}}$, and the $N$-bit FOK $O^{F}$ as
${O^{F}_{1}O^{F}_{2}...O^{F}_{N}}$. Here every $O^{R}_{i}(1\leq i\leq kN)$ or
$O^{F}_{i}(1\leq i\leq N)$ represents a key bit. In this method the relation
between $O^{R}$ and $O^{F}$ is

$\displaystyle O^{F}_{i}=\bigoplus_{j=0}^{k-1}O^{R}_{i+jN},1\leq i\leq N,$ (1)

where $\bigoplus$ denotes the addition modulo 2.

For example, $N=12$, $k=2$, and the ROK is

$\displaystyle 0~{}1~{}1~{}0,~{}0~{}1~{}0~{}0,~{}0~{}1~{}1~{}1$ $\displaystyle
0~{}0~{}1~{}1,~{}0~{}1~{}0~{}1,~{}1~{}0~{}0~{}1$ (2)

for Bob, while

$\displaystyle?~{}1~{}?~{}?,~{}0~{}?~{}?~{}?,~{}?~{}1~{}?~{}?$ $\displaystyle
0~{}?~{}?~{}?,~{}?~{}1~{}?~{}?,~{}?~{}0~{}?~{}?$ (3)

for Alice (that is, Alice only knows the 2nd, 5th, 10th, 13rd, 18th, 22nd bits
in this ROK). Then after the dilution, the FOK is

$\displaystyle 0~{}1~{}0~{}1,~{}0~{}0~{}0~{}1,~{}1~{}1~{}1~{}0$ (4)

for Bob, while

$\displaystyle?~{}?~{}?~{}?,~{}?~{}?~{}?~{}?,~{}?~{}1~{}?~{}?$ (5)

for Alice. It’s easy to see that the quantity of the known bits for Alice is
reduced from 6 to 1.

###  II.2 The $N-N$ method

Similarly, the $N$-bit ROK $O^{R}$ can be denoted as
${O^{R}_{1}O^{R}_{2}...O^{R}_{N}}$, and the $N$-bit FOK $O^{F}$ as
${O^{F}_{1}O^{F}_{2}...O^{F}_{N}}$. In this $N-N$ method the relation between
$O^{R}$ and $O^{F}$ is

$\displaystyle O^{F}_{i}=\bigoplus_{j=i}^{i+k-1\mod N}O^{R}_{j},1\leq i\leq
N.$ (6)

For example, $N=12$, $k=2$, and the ROK is

$\displaystyle 0~{}1~{}1~{}0,~{}0~{}1~{}0~{}0,~{}0~{}1~{}1~{}1$ (7)

for Bob, while

$\displaystyle?~{}?~{}?~{}0,~{}0~{}?~{}0~{}?,~{}?~{}?~{}?~{}?$ (8)

for Alice. Then after the dilution, the FOK is

$\displaystyle 1~{}0~{}1~{}0,~{}1~{}1~{}0~{}0,~{}1~{}0~{}0~{}1$ (9)

for Bob, while

$\displaystyle?~{}?~{}?~{}0,~{}?~{}?~{}?~{}?,~{}?~{}?~{}?~{}?$ (10)

for Alice. It’s easy to see that the quantity of the known bits for Alice is
reduced from 3 to 1.

###  II.3 The $rM-N$ method

In this method, the $rM$-bit ROK $O^{R}$ is divided into $r$ sub-keys with the
same length $M$, i.e. $O^{R_{1}},O^{R_{2}},...,O^{R_{r}}$. Then the following
two steps are executed.

(1) Sub-key extension. For every sub-key $O^{R_{i}}(1\leq i\leq r)$, the
parities (i.e. the sum modulo 2) of all possible combinations of $k$ out of
these $M$ bits, listed by a certain order, compose a new key
$\widetilde{O}^{R_{i}}$. In fact, there are $(^{M}_{k})$ combinations of $k$
out of $M$, so the length of each new key $\widetilde{O}^{R_{i}}$ is
$(^{M}_{k})$, which is generally supposed to be equal to the database’s
capacity $N$.

(2) Shift-addition. To obtain the FOK $O^{F}$, the above $r$ keys
$\widetilde{O}^{R_{i}}$ are combined bitwise with relative shifts $s_{i}$
Alice can freely choose, that is

$\displaystyle
O^{F}_{j}=\bigoplus_{i=1}^{r}\widetilde{O}^{R_{i}}_{j+s_{i}},1\leq j\leq N,$
(11)

where $O^{F}_{j}$ represents the $j$-th bit in $O^{F}$ and
$\widetilde{O}^{R_{i}}_{j+s_{i}}$ is the $(j+s_{i})$-th bit in
$\widetilde{O}^{R_{i}}$.

The first step tries to reuse every bit in ROK to the most degree so that $M$,
i.e. the communication complexity for each sub-key $O^{R_{i}}$, reaches the
lowest value. But obviously it will result in the amount of the bits Alice
knows in $\widetilde{O}^{R_{i}}$ is more than expected. Therefore, the second
step is utilized to reduce Alice’s knowledge in the final key. Because Alice
can choose a shift for each $\widetilde{O}^{R_{i}}$, she will know at least 1
bit in the final key $O^{F}$ given that she knows at least 1 bit in each
$\widetilde{O}^{R_{i}}$. The feature of shift-addition is that it can reduce
Alice’s known bits in the final key, while, at the same time, dose not
increase the failure probability (that is, Alice knows no bit in the final
key). Please sea Ref. PJ13  for details (the technique of shift-addition was
also discussed in Ref. QPQ11 ) .

##  III Security analysis on the improved dilution methods

In all the three dilution methods the parity of $k$ ROK bits means a FOK bit.
It is not difficult to see that in the improved dilution methods, i.e. $N-N$
and $rM-N$ ones, the bits in ROK are reused frequently so that the
communication complexity is greatly reduced. More specifically, ROK with
length $N$ or even $rM$, instead of the original $kN$, is enough for $N$-bit
FOK. However, as pointed by the authors of Ref. PJ13 , the reduction in
communication complexity in their methods comes at the cost that parity
information about some key bits in FOK is easier to obtain for Alice. Taking
the $N-N$ mothod as our example, though Alice does not know their particular
values, Alice does know the parity of two adjacent FOK bits $O^{F}_{i}$ and
$O^{F}_{i+1}$ if Alice knows two ROK bits $O^{R}_{i}$ and $O^{R}_{i+k}$
(obviously $O^{F}_{i}\oplus O^{F}_{i+1}=O^{R}_{i}\oplus O^{R}_{i+k}$).
Similarly, if Alice also knows $O^{R}_{i+1}$ and $O^{R}_{i+k+1}$ she knows the
parity of $O^{F}_{i+1}$ and $O^{F}_{i+2}$, and consequently knows all parities
of any two bits in the adjacent-bit set
$\\{O^{F}_{i},O^{F}_{i+1},O^{F}_{i+2}\\}$. Here we say such sets, like the
above $\\{O^{F}_{i},O^{F}_{i+1}\\}$ and
$\\{O^{F}_{i},O^{F}_{i+1},O^{F}_{i+2}\\}$, are almost known (for Alice)
because in each of them Alice would know all of the bits if she gets any one
in it.

Now, the question is, what kind of influence this fact (that is, the parity
information were illegally leaked to Alice) brings on the database’s security?
Remember that, in the database, every item, i.e. one-bit secret message
$m_{i}$, will be encrypted through $O^{F}_{i}$, getting the ciphertext
$c_{i}=m_{i}\oplus O^{F}_{i}$, and then all the ciphertext bits will be
transmitted to Alice. Therefore, the message sets such as
$\\{m_{i},m_{i+1}\\}$ and $\\{m_{i},m_{i+1},m_{i+2}\\}$, which correspond to
the above almost-known-final-key sets, are also almost known for Alice. It
implies Alice can illegally obtain much more information about the secret
messages in database than expected. If only one query is considered such
information leakage seems trivial because Alice does not know more explicit
messages than expected. However, if Alice (or equivalent, Alice and some other
users who collude with her) executes multiple queries to Bob’s database by
buying multiple messages from him, the influence of this kind of information
leakage will become serious.

In fact, in each query, apart from obtaining 1 or little more bits in FOK
(equivalently, 1 or little more items in the database), Alice would also get
additional information, that is, identifying some Almost Known Sets (AKS) in
the database. With the increasing amount of the queries, such AKSs will become
more and more, and then some of them might be combined together generating a
larger set (for example, a previous AKS $\\{m_{i},m_{i+1}\\}$ and a new AKS
$\\{m_{i+1},m_{i+2}\\}$ will be combined together into a larger one
$\\{m_{i},m_{i+1},m_{i+2}\\}$, and previous two AKSs $\\{m_{i},m_{i+1}\\}$ and
$\\{m_{i+2},m_{i+3},m_{i+4}\\}$ will be linked together by a new AKS
$\\{m_{i+1},m_{i+2}\\}$, becoming a larger one
$\\{m_{i},m_{i+1},m_{i+2},m_{i+3},m_{i+4}\\}$). If Alice legally obtains a bit
in an AKS in one of the queries, all the items in this set will be lighted,
that is, all of them are explicitly known for Alice. It is not difficult to
imagine that after a certain number of queries Alice will obtain all the
database completely. That is to say, Alice might steal the whole database,
which is full of valuable secret messages, by just buying limited items in it.
Furthermore, Alice can choose an optimal shift, i.e. the shift on the FOK
before encrypting the database, in each query so that she can obtain the whole
database with less queries.

Indeed, Alice can obtain the whole database by enough queries (at most $N$)
even though she does not utilize the information brought by those AKS. The key
point is, would Alice, with the help of the illegal information, achieve her
goal greatly more quickly than expected? The answer is yes. It means the
leaked parity information about some key bits in FOK results in serious
insecurity for Bob’s database.

###  III.1 Analysis on the $N-N$ method

As described in Sec. I, Alice will know every ROK bit with probability $p=1/4$
if she is honest in the J-protocol. While if she prepares a quantum memory and
executes individual unambiguous state discrimination (USD) measurement to
attack, Alice can increase this probability to $p=1-\frac{1}{\sqrt{2}}\approx
0.29$ QPQ11 . Then the probability of identifying a two-bit AKS such as
$\\{m_{i},m_{i+1}\\}$ is 1/16 and $3/2-\sqrt{2}$ in the above two conditions
respectively. Now we do simulations for different parameters to see how much
information Alice will illegally obtain from the leaked parity information,
especially how many queries are needed on average for Alice to obtain the
whole database.

In our simulation, the approach Alice chooses to attack by multiple queries is
as follows.

(S1) Define the parameters $N,k$, and $p$. Here $N$ is the total number of
items in Bob’s database, the integer $k$ is a security parameter which is
chosen so that the quantity of Alice’s known bits in FOK $c=\frac{N}{4^{k}}$
is little more than 1 and the failure (that is, no bit is obtained by Alice)
probability is small enough PJ13 , and $p$ equals to 0.25 or 0.29 for
different attacks.

(S2) Simulate the first query. (I) Key generation. A ROK with respect to $N$
and $p$ is generated. More concretely, there are $N$ bits in this key and
Alice knows every key bit with probability $p$. (II) Dilution. FOK is obtained
from the above ROK according to the $N-N$ method. The state of every FOK bit,
i.e. known, unknown, or almost known (equivalently, belonging to an almost
known set), is determined after this step. (III) Record maintenance. Alice
announces a shift $s$ $(0\leq s\leq N-1)$, which can be selected at random
here, so that Bob encrypts the database via the shifted FOK and sends the
whole ciphertext to her. Then Alice records the state of every item
accordingly. Obviously, the items encrypted via known (unknown) key bits are
still know (unknown), and the ones encrypted via an almost known key set still
compose an AKS.

(S3) Simulate another query. The first two steps (I) and (II) are the same as
that in (S2). (III) Record maintenance. Alice announce an optimal shift $s$
$(0\leq s\leq N-1)$ so that Bob encrypts the database via the shifted FOK and
sends the whole ciphertext to her. Here by optimal we mean that when the shift
is chosen the unknown information about the database $H=n_{u}+n_{aks}$ is the
lowest, where $n_{u}$ is the total number of unknown items, and $n_{aks}$ is
the total number of AKS after Alice received the ciphertext encrypted via this
FOK. Afterwards, Alice updates the state of every item accordingly.

(S4) Repeat (S3) until all the items in Bob’s database are explicitly known
for Alice.

Table 1: The DQA for different $N$. Here $\overline{n}$ represents the expected amount of items Alice will get via one query. $N$ | $225$ | $1024$ | $10^{4}$
---|---|---|---
$k$ | 3 | 4 | 6
$\overline{n}=Np^{k}$ $(p=0.25)$ | 3.52 | 4.00 | 2.44
$\overline{q}_{d}$ $(p=0.25)$ | 18.6 | 30.4 | 53.4
$\overline{n}=Np^{k}$ $(p=0.29)$ | 5.49 | 7.24 | 5.95
$\overline{q}_{d}$ $(p=0.29)$ | 15.4 | 23.3 | 40.0

We perform simulations for three values of $N$, that is, 225, 1024, and
$10^{4}$, and both $p=0.25$ and $p=0.29$ are executed for different $N$. For
each situation the simulation is done over 10 runs and the average amount of
queries (i.e. $\overline{q}_{d}$), which is needed for Alice to steal the
whole database, is obtained and shown in Table 1. Here we call
$\overline{q}_{d}$ the Death Query Amount (DQA). It can be seen that the
leakage of parity information in $N-N$ method seriously damages the security
of Bob’s database. For example, when $N=10^{4}$ a dishonest Alice can steal
the whole database after only 53.4 (for $p=0.25$) queries on average. While,
as is shown, the expected amount of items Alice will get via one query is
2.44, and consequently the DQA should have been at least $10^{4}/2.44=4098.4$.
Note that in this attack what Alice needs to do is only legally performing
multiple queries (or equivalently, collecting data from other users who
collude with her), and this insecurity comes from the leakage of parity
information completely. If Alice executes a more complex attack, e.g. using
individual USD measurement so that she can get any ROK bit with probability
0.29 instead of 0.25, the DQA would be further decreased to 40.0.

More concretely, three typical simulation instances for $N=10^{4}$, 1024, and
225 are shown in Figs. 1, 3, and 4, respectively. From these figures we can
see how the amount of known or almost known items changes with respect to the
query count $n_{q}$. Fig. 2 demonstrates how the theoretical amount of unknown
information about the database changes in the instance $N=10^{4}$. Besides,
one may also be interested in how many items Alice can explicitly obtain after
each query. To show that we also depict the relation between the amount of
explicitly known items and $n_{q}$. Obviously less queries (than DQA) might be
enough if Alice wants to know only part of the database instead of the whole.

(a) $n_{q}$=1 (b) $n_{q}$=7 (c) $n_{q}$=14

(d) $n_{q}$=21 (e) $n_{q}$=28 (f) $n_{q}$=35

(g) $n_{q}$=42 (h) $n_{q}$=49 (i) $n_{q}$=53

Figure 1: A simulation instance for $N=10^{4}$, $k=6$, and $p=0.25$, which is
directly adapted from Ref. PJ13 . To identify all the database items clearly,
we draw a picture of the database, where any item is represented by a square,
and dye the known items dark red, the unknown ones grey, and the AKS other
different light colors. Here $n_{q}$ is the present count of queries and each
sub-figure denotes the state of the whole database. In this instance the DQA
is 53.  Figure 2: The amount of unknown information about the database,
denoted by $H$, and that of explicitly known items, denoted by $N_{E}$, after
each query for $N=10^{4}$ and $k=6$. The red lines represent the result for an
instance with $p=0.25$, i.e. the one shown in Fig. 1, and the blue lines
denote the result for an instance with $p=0.29$. To obtain the whole database,
in the above two instances, Alice needs only 53 and 40 queries, respectively.

(a) $n_{q}$=1 (b) $n_{q}$=7 (c) $n_{q}$=13

(d) $n_{q}$=19 (e) $n_{q}$=25 (f) $n_{q}$=30

Figure 3: A simulation instance for $N=1024$, $k=4$, and $p=0.25$. In this
instance the DQA is 30.

(a) $n_{q}$=1 (b) $n_{q}$=5 (c) $n_{q}$=9

(d) $n_{q}$=13 (e) $n_{q}$=17 (f) $n_{q}$=19

Figure 4: A simulation instance for $N=225$, $k=3$, and $p=0.25$. In this
instance the DQA is 19.

###  III.2 Analysis on the $rM-N$ method

In the $rM-N$ dilution method, Alice and Bob generate an $N$-bit FOK by $rM$
ROK bits. This method greatly reduces the communication complexity compared
with the $kN-N$ method (generally $rM\ll N$). However, the information entropy
of such an $N$-bit FOK is $rM$ at maximum, which means this FOK is not
strictly secure in theory. Through analysis, we get the following theorem.

Theorem 1. In a QPQ protocol which employs the $rM-N$ dilution method, the
user Alice can get the total database by at most $rM$ queries.

###### Proof.

We start with the analysis on the structures of the FOK $O^{F}$ generated by
$rM-N$ dilution method. If the sub-key $O^{R_{i}}$ (with length $M$), the
extended sub-key $\widetilde{O}^{R_{i}}$ (with length $N$), and the FOK
$O^{F}$ are seen as column vectors, we can write the dilution method as

$O^{F}=\bigoplus\limits_{i=1}^{r}\widetilde{O}^{R_{i}}(s_{i})=\bigoplus\limits_{i=1}^{r}G(s_{i})O^{R_{i}},$
(12)

where $\widetilde{O}^{R_{i}}(s_{i})$ represents the new key generated by
performing a relative shift $s_{i}$ on $\widetilde{O}^{R_{i}}$, and $G(s_{i})$
is an $N\times M$ matrix. Obviously here $G(s_{i})$ includes both the sub-key-
extension operation and the key-shift operation. According to the processes
described in subsection II.3, we can get that the row vectors of $G(s_{i})$
are $N$ different $M$-dimensional binary vectors, each contains $k$ 1s and
$M-k$ 0s. Furthermore, different key-shift operations (that is, different
$s_{i}$) just implies different orders of the row vectors in $G(s_{i})$ fn .

To give further analysis on the structures of $O^{F}$, we consider the
equation

$\displaystyle\begin{bmatrix}\widetilde{O}^{R_{1}}(s_{1})&\widetilde{O}^{R_{2}}(s_{2})&\cdots&\widetilde{O}^{R_{r}}(s_{r})\end{bmatrix}$
(13) $\displaystyle=$
$\displaystyle\begin{bmatrix}G(s_{1})&G(s_{2})&\cdots&G(s_{r})\end{bmatrix}\begin{bmatrix}O^{R_{1}}&&&\\\
&O^{R_{2}}&&\\\ &&\ddots&\\\ &&&O^{R_{r}}\end{bmatrix}.$

For simplicity, here we denote the above three matrices as
$\widetilde{O}_{s}$, $G_{s}$, and $O^{R}_{I}$ respectively, and Eq. (13) can
be written in the form of $\widetilde{O}_{s}=G_{s}O^{R}_{I}$. By rewriting the
first two matrices in the form of row vectors, Eq. (13) can be expressed as

$\displaystyle\begin{bmatrix}o^{1}\\\ o^{2}\\\ \vdots\\\
o^{N}\end{bmatrix}=\begin{bmatrix}g^{1}\\\ g^{2}\\\ \vdots\\\
g^{N}\end{bmatrix}O^{R}_{I}=\begin{bmatrix}g^{1}O^{R}_{I}\\\ g^{2}O^{R}_{I}\\\
\vdots\\\ g^{N}O^{R}_{I}\end{bmatrix},$ (14)

where $o^{j}$ and $g^{j}$ ($j\in[1,N]$) are row vectors. Suppose the rank of
$G_{s}$ is $T$, then $T\leq rM$ since $G_{s}$ is an $N\times rM$ matrix.
Suppose $\\{g^{\gamma_{1}},g^{\gamma_{2}},\ldots,g^{\gamma_{T}}\\}$ is a
maximally linearly independent set of the row vectors of $G_{s}$, which means
any row vector of $G_{s}$ can be expressed by these $T$ vectors, that is

$\displaystyle g^{j}=\bigoplus_{t=1}^{T}\lambda_{j,t}g^{\gamma_{t}},\forall
j\in[1,N],$ (15)

where $\lambda_{j,t}=0,1$. Then for any $j\in[1,N]$ we have

$\displaystyle
o^{j}=g^{j}O^{R}_{I}=(\bigoplus_{t=1}^{T}\lambda_{j,t}g^{\gamma_{t}})O^{R}_{I}=\bigoplus_{t=1}^{T}\lambda_{j,t}o^{\gamma_{t}},$
(16)

and consequently we arrive at

$\displaystyle
O^{F}_{j}=\bigoplus\limits_{i=1}^{r}o^{j}_{i}=\bigoplus\limits_{i=1}^{r}\bigoplus_{t=1}^{T}\lambda_{j,t}o^{\gamma_{t}}_{i}=\bigoplus_{t=1}^{T}\lambda_{j,t}O^{F}_{\gamma_{t}}.$
(17)

Eqs. (16) and (17) imply that the $T$ vectors $\\{o^{\gamma_{t}}|t\in[1,T]\\}$
can linearly express all the row vectors in $\widetilde{O}_{s}$, and $O^{F}$
is totally determined by the $T$ bits $\\{O^{F}_{\gamma_{t}}|t\in[1,T]\\}$.
Therefore, once Alice gets these $T$ bits, she can figure out the whole
$O^{F}$, and consequently obtain the whole database by decrypting the
ciphertext of the database encrypted by the key $O^{F}$. Here we call such a
set of $T$ $O^{F}$ bits, which can determine the whole $O^{F}$, a basis of
$O^{F}$. For example, the above $\\{O^{F}_{\gamma_{t}}|t\in[1,T]\\}$ is a
basis of $O^{F}$.

Now we introduce Alice’s attack strategy where she can get the total database
by at most $rM$ queries. Suppose Bob’s database is bit string
$D=D_{1}D_{2}\ldots D_{N}$, where each bit $D_{j}$ $(j\in[1,N])$ represents an
item. The processes of the attack is as follows.

  * 1

Alice honestly executes the first query to Bob’s database. Suppose the
$N\times rM$ matrix, i.e. the second one in Eq. (13), is $G_{s}^{1}$, the
shifted FOK is $O^{F_{1}}(s^{\prime}_{1})$, where $s^{\prime}_{1}$ is the
shift value Alice chose to the FOK $O^{F_{1}}$, and one of Alice’s known bits
in $O^{F_{1}}(s^{\prime}_{1})$ is $O^{F_{1}}_{\gamma_{1}}(s^{\prime}_{1})$
(i.e. the $\gamma_{1}$-th bit in it). In this query, Alice will receive a
ciphertext of the database $C^{1}$, in which the $j$-th ($j\in[1,N]$) bit is
$C^{1}_{j}=D_{j}\oplus O^{F_{1}}_{j}(s^{\prime}_{1})$.

Afterwards, according to $G_{s}^{1}$ and $s^{\prime}_{1}$, Alice calculates a
basis of $O^{F_{1}}(s^{\prime}_{1})$ which contains
$O^{F_{1}}_{\gamma_{1}}(s^{\prime}_{1})$, denoted as
$\\{O^{F_{1}}_{\gamma_{t}}(s^{\prime}_{1})|t\in[1,T]\\}$.

  * $t$

($t=2,3,\ldots,T$) Alice executes the $t$-th query to Bob’s database. Suppose
the FOK in this round is $O^{F_{t}}$ and one of the bits known to Alice is the
$\nu_{t}$-th one. Then she declares a shift value $\gamma_{t}-\nu_{t}$, thus
she knows the $\gamma_{t}$-th bit in the shifted FOK
$O^{F_{t}}(\gamma_{t}-\nu_{t})$. Consequently, she can calculate
$O^{F_{1}}_{\gamma_{t}}(s^{\prime}_{1})$ when she receives the ciphertext of
the database $C^{t}$.The reason is as follows. The $\gamma_{t}$-th bit in the
two ciphertexts $C^{1}$ and $C^{t}$ are

$\displaystyle C^{t}_{\gamma_{t}}$ $\displaystyle=$ $\displaystyle
D_{\gamma_{t}}\oplus O^{F_{t}}_{\gamma_{t}}(\gamma_{t}-\nu_{t}),$
$\displaystyle C^{1}_{\gamma_{t}}$ $\displaystyle=$ $\displaystyle
D_{\gamma_{t}}\oplus O^{F_{1}}_{\gamma_{t}}(s^{\prime}_{1}),$ (18)

so,

$\displaystyle O^{F_{1}}_{\gamma_{t}}(s^{\prime}_{1})=C^{t}_{\gamma_{t}}\oplus
C^{1}_{\gamma_{t}}\oplus O^{F_{t}}_{\gamma_{t}}(\gamma_{t}-\nu_{t}).$ (19)

  * $T$+1

According to the $T$ known bits
$\\{O^{F_{1}}_{\gamma_{t}}(s^{\prime}_{1})|t\in[1,T]\\}$ and the linear
relationships determined by $G_{s}^{1}$ and $s^{\prime}_{1}$, Alice calculates
all the other bits in $O^{F_{1}}(s^{\prime}_{1})$ and then the whole database
$D=C^{1}\oplus O^{F_{1}}(s^{\prime}_{1})$.

In the above attack strategy, Alice gets the whole database by only $T$
queries, where $T\leq rM$. Actually, Alice always needs less than $T$ queries.
On the one hand, Alice may know more than one FOK bit in each query. On the
other hand, there are many different bases of $O^{F_{1}}(s^{\prime}_{1})$, and
she can choose the basis which contains more known bits to reduce the total
number of queries. ∎

##  IV Post-processing of the oblivious key with error correction

As we know, the major advantage of QKD-based QPQ protocols is its
practicability. In a practical realization, however, noise exists in the
channel and there are always errors in the shared (raw) key between Alice and
Bob. Therefore, error correction is necessary for such protocols. In fact,
potential errors will seriously damage the function of QPQ. An error bit in
Alice’s FOK implies that Alice would pay her money and get back a wrong
message from Bob, which is obviously unfair for Alice. Moreover, Alice would
think Bob is dishonest if she got a wrong item, and Bob might cover his attack
by channel noise (not that Bob’s attack will inevitably result in giving a
wrong message to Alice with a certain probability QPQ11 , and he can excuse
that it is a result of channel noise when such error happens). But till now,
as an open question in QPQ listed by M. Jakobi et al QPQ11 , the method of
error correction in QKD-based QPQ protocols is still missing, which greatly
limits the practicability of them.

Actually, performing error correction on oblivious key is difficult. On the
one hand, Alice only knows part of the oblivious key, which is quite different
from that of general communication or QKD. On the other hand, to correct
errors, additional two-way communication is generally needed, which might
affect the privacy of both users. Furthermore, this kind of influence is
difficult to analyze QPQ11 . Here, enlightened by the idea of one-way error
correction in QKD proof , we present an error correction manner for the
oblivious key. Together with previous $kN-N$ dilution and the technique of
shift-addition, we actually give a complete post-procession algorithm for the
oblivious key in QPQ, including both dilution and error correction.
Furthermore, the influence of error correction on the user’s privacy is
analyzed.

As analyzed above, the improved dilution method, i.e. $N-N$ and $rM-N$ ones,
will result in the insecurity of Bob’s database. So, let us go back to the
original $kN-N$ method QPQ11  to reduce Alice’s known bits, and take the
scenario where $N=10^{5}$, $k=7$, $p=0.25$, $\overline{n}=6.10$ and the
failure probability $P_{0}=(1-p^{k})^{N}=0.002$ as our example, which is
directly adapted from Ref. QPQ11 . In this condition Alice and Bob share a ROK
$O^{R}=O^{R}_{1}O^{R}_{2}...O^{R}_{kN}$, with length $kN$, in the sense that
Bob knows all the key while Alice knows every bit with probability $p=0.25$.
After the dilution, a FOK $O^{F}=O^{F}_{1}O^{F}_{2}...O^{F}_{N}$, with length
$N$, can be obtained according to Eq.(1).

Consider one FOK bit $O^{F}_{i}$, which equals to the parity of 7 ROK bits
$\\{O^{R}_{i+jN}(j=0,1,...,6)\\}$. Suppose the error rate of Alice’s ROK is
$e$, that is, owing to the noise in quantum channel, Alice’s every known bit
in ROK differs from Bob’s with probability $e$ (it is reasonable to assume
that the error probabilities of $\\{O^{R}_{i+jN}\\}$ are independent because
they come from different photons which are distant from each other). Similar
to that in QKD, Alice and Bob can estimate this error rate by publicly
comparing their key bits. For example, Bob announces part of his ROK bits,
Alice compares them with the corresponding known ones in her ROK, and then
declares the error rate.

Then, if there is no manner to correct errors, the error probability of the
FOK bit $O^{F}_{i}$ is

$\displaystyle p_{e}=\sum_{t=1,3,5,7}(^{7}_{t})e^{t}(1-e)^{7-t},$ (20)

that is, the probability that odd errors happen in $\\{O^{R}_{i+jN}\\}$.

In fact, the users can correct errors in ROK and obtain FOK by the following
steps. Note that here, for simplicity, we still take the above example to
describe our method. That is, we only discuss how to correct errors and get a
FOK bit from 7 ROK bits $\\{O^{R}_{i+jN}\\}$. Other ROK bits can be managed by
the same manner.

(C1) Bob generates a message $V$ containing 4 random bits, i.e.
$V=V_{1}V_{2}V_{3}V_{4}$, and encodes it into a 7-bit codeword $CW$ via a
[7,4,3] linear error-correction code. For example, the code has a generator
matrix

$\displaystyle G=\left[\begin{array}[]{c c c c c c c}1&0&0&0&1&0&1\\\
0&1&0&0&1&1&1\\\ 0&0&1&0&1&1&0\\\ 0&0&0&1&0&1&1\end{array}\right],$ (25)

and it encodes 0000, 0001, 0010, …, 1111 into

$\displaystyle 0000000,\quad 0001011,\quad 0010110,\quad 0011101$
$\displaystyle 0100111,\quad 0101100,\quad 0110001,\quad 0111010$
$\displaystyle 1000101,\quad 1001110,\quad 1010011,\quad 1011000$
$\displaystyle 1100010,\quad 1101001,\quad 1110100,\quad 1111111$ (26)

respectively. This code has a minimum distance $d=3$ and can correct 1 error
among the 7 bits.

(C2) Bob encrypts the above 7-bit codeword $CW$, using $\\{O^{R}_{i+jN}\\}$ as
the key, via one-time pad, and sends the ciphertext $c$ to Alice.

(C3) This step can be divided into the following two different conditions.

Condt.1 Alice knows all the 7 ROK bits $\\{O^{R}_{i+jN}\\}$. In this
condition, (I) Alice decrypts $c$, getting a 7-bit codeword $CW^{\prime}$.
(II) Alice corrects the possible error in $CW^{\prime}$, obtaining $CW$.
Obviously, if there are no more than 1 bit error in $\\{O^{R}_{i+jN}\\}$ Alice
will obtain $CW$ correctly. (III) Alice takes the parity of 7 bits in $CW$ as
the FOK bit $O^{F}_{i}$.

Condt.2 Alice does not know all the 7 ROK bits $\\{O^{R}_{i+jN}\\}$. In this
condition, Alice labels this FOK bit unknown, i.e. $O^{F}_{i}=?$.

(C4) Bob also calculates the parity of 7 bits in $CW$ to obtain his
corresponding FOK bit $O^{F}_{i}$.

By the above manner, Alice and Bob will finish their dilution and error
correction of the ROK after the management of all the $7N$ ROK bits, obtaining
$N$-bit FOK $O^{F}$. It is not difficult to see that, by introducing the error
correction method, the error rate in FOK now becomes

$\displaystyle p^{\prime}_{e}=\sum_{t=3,5,7}(^{7}_{t})e^{t}(1-e)^{7-t},$ (27)

that is, the probability that 3, 5, or 7 errors happen in
$\\{O^{R}_{i+jN}\\}$. Obviously this error rate is greatly lower than the one
without error correction, i.e. $p_{e}$, when $e$ is small. And the failure
probability, which implies Alice does not obtain any FOK bit, remains
unchanged, that is

$\displaystyle P^{\prime}_{0}=P_{0}=(1-p^{k})^{N}=0.002.$ (28)

Now we analyze the influence on users’ privacy the above error correction
brings.

Bob’s privacy. In the above example, to achieve the function of error
correction (i.e. to reduce the error rate of the FOK bit $O^{F}_{i}$), Alice
has to know all 7 ROK bits $\\{O^{R}_{i+jN}\\}$, which happens with
probability $p_{1}=p^{7}$. Owing to the utilization of the above [7,4,3] code,
however, Alice can deduce $CW$ and then get $O^{F}_{i}$ as long as she knows
no less than 4 bits among the 7 correctly. Therefore, if Alice is dishonest
and gives up the function of error correction she will know every FOK bit with
probability

$\displaystyle p_{2}=\sum_{t=4,5,6,7}(^{7}_{t})p^{t}(1-p)^{7-t}.$ (29)

Obviously, there is a huge gap between $p_{1}$ and $p_{2}$, which greatly
influences the database security. More concretely, considering $N=10^{5}$ and
$p=0.25$, the expected amount of FOK bits known by an honest Alice equals
$\overline{n}_{1}=Np_{1}=6.10$, while that by a dishonest Alice is
$\overline{n}_{2}=Np_{2}=7055.66$. That is to say, if a dishonest Alice gives
up the function of error correction, where the error rate of her known FOK
bits will be relatively higher, she will obtain much more items in the
database than expected. An intuitionistic way to strengthen Bob’s privacy is
choosing a greater $k$ ($k=7$ in the above example) to reduce the value of
$\overline{n}_{2}$. But it is useless because it will greatly increase the
failure probability $P_{0}$ (i.e. that of $\overline{n}_{1}=0$) for an honest
Alice.

Now we must resolve this problem, that is, how to eliminate the gap between
$p_{1}$ and $p_{2}$, though it is quite troublesome. Otherwise our above
method for dilution and error correction will be useless. Fortunately, there
is a manner, i.e. the technique of shift-addition (see subsection II.3), to
overcome this difficulty. Recall that shift-addition has a good feature, that
is, it can reduce Alice’s known bits in the final key, while, at the same
time, dose not increase the failure probability. Therefore, we can adapt this
technique to deal with the oblivious key further. In detail,

(D1) Alice and Bob share $g$ ROK with length $7N$ via QKD protocol such as
SARG04. Here $g$ is a parameter and its value will be discussed later.

(D2) Alice and Bob perform dilution and error correction on every ROK
respectively, obtaining $g$ $N$-length middle oblivious key (MOK)
$O^{M_{i}}\\{i=1,2,...,g\\}$ as they get FOK in steps (C1-C4).

(D3) To obtain the FOK $O^{F}$, the above $g$ MOKs are combined bitwise with
relative shifts $s_{i}$ Alice can freely choose, that is

$\displaystyle O^{F}_{j}=\bigoplus_{i=1}^{g}O^{M_{i}}_{j+s_{i}},1\leq j\leq
N,$ (30)

where $O^{F}_{j}$ represents the $j$-th bit in $O^{F}$, and
$O^{M_{i}}_{j+s_{i}}$ is the $(j+s_{i})$-th bit in $O^{M_{i}}$.

Actually, the technique of shift-addition decreases the amount of FOK bits
obtained by a dishonest Alice through distributing multiple oblivious keys. It
really can resolve the above involved problem and render our error correct
method to take effect though the communication efficiency becomes lower.

Obviously, our post-processing is a $gkN-N$ method with error correction.
After this procedure, the final error rate in FOK $O^{F}$ is

$\displaystyle p^{\prime\prime}_{e}=\sum_{t=1,3,5...,t\leq
g}(^{g}_{t})(p^{\prime}_{e})^{t}(1-p^{\prime}_{e})^{g-t},$ (31)

that is, the probability that odd errors happen in the $g$ MOK bits (which
will be combined into one FOK bit). And the final failure probability is

$\displaystyle P^{\prime\prime}_{0}=1-(1-P^{\prime}_{0})^{g},$ (32)

which means that at least one MOK is totally unknown for Alice.

Table 2: Simulation result for determining $g$ ($N=10^{5}$, $k=7$, $p=0.25$). Here $n_{A}$ represents the amount of FOK bits known by a dishonest Alice. Because $n_{A}$ remains unchanged from $g$=12 to $g$=20, we do not continue the simulation for $g>20$. In this simulation, with the value of $g$ increasing, $n_{A}$ would decrease rapidly to around 5 though the dishonest Alice has chosen an optimal shift $s_{i}$ for every MOK to make more bits survived. $g$ | 1 | 2 | 3 | 4 | 5 | 6~7 | 8~11 | 12~20
---|---|---|---|---|---|---|---|---
$n_{A}$ | 7066 | 578 | 65 | 18 | 7 | 5 | 4 | 3

Now we discuss how to choose the value of $g$. In fact we can perform
simulations to determine $g$ and the amount of FOK bits known to a dishonest
Alice, $n_{A}$. For the example here, i.e. $N=10^{5}$, our simulation result
is given in Tab.2. It can be seen that $g=6$ is reasonable. In this condition
$n_{A}=5$, which is already less than the expected amount of known FOK bits
for a honest Alice in the original $kN-N$ method, i.e. $\bar{n}=6.10$. It
should be emphasized that greater $g$ will bring less $n_{A}$, which implies
higher database security, but it also results in lower communication
efficiency.

Fig. 5 depicts the comparison between the error rates of FOK in the original
$kN-N$ method and in our $gkN-N$ one. It can be seen that when $e<30\%$ the
error rate of FOK in our $gkN-N$ method is visibly lower than that in the
original $kN-N$ one, which implies the function of error correct takes effect
in our method. For example, suppose $e=3\%$. An overall comparison between the
original $kN-N$ method and our $gkN-N$ one is given in Tab. 3. Obviously, by a
tolerable sacrifice on the failure probability (and communication efficiency),
our method can significantly decrease the error rate of the final oblivious
key.

Figure 5: The error rate of FOK. Here the line labeled by $p_{e}$ is the error rate in $kN-N$ method, and the other line $p^{\prime\prime}_{e}$ is that in our $gkN-N$ method. Table 3: An overall comparison between the $kN-N$ dilution method and our $gkN-N$ post-processing for the example where $N=10^{5}$, $k=7$, $p=0.25$, $g=6$, and $e=3\%$. Here the 2nd column represents the expected amount of FOK bits which can be obtained by an honest Alice, and the 3rd one is that for a dishonest Alice (note that by “dishonest” we mean Alice tries to obtain more key bits by just giving up the function of error correction). The 4th column denotes the error rate in the final oblivious key, and the 5th one is the failure probability. |  $\bar{n}$-hon. |  $\bar{n}$-dishon. | error rate | failure prob.
---|---|---|---|---
$kN-N$ | 6.10 | - | 0.1758 | 0.002
$gkN-N$ | 1 | 5 | 0.0008 | 0.013

Alice’s privacy. We believe that Alice’s privacy in our $gkN-N$ method is the
same as the $kN-N$ one. The reasons are as follows. (1) Alice’s privacy in MOK
in our method is the same as that in FOK in $kN-N$ one because there is no
difference for Bob to gather information on a bit’s conclusiveness in the
above two keys (note that our error correction is executed in a one-way-
communication style). That is, knowing a conclusive bit in Alice’s MOK implies
no information on this bit’s value for Bob QPQ11 . (2) Suppose finally Alice
knows the $i$th bit in FOK in our method. Because FOK is the combination of
shifted MOKs, to know Alice’s privacy, i.e. the index $i$, Bob has to know a
conclusive bit in at least one of the MOKs. But if he obtains that Bob will
totally loss the knowledge of this bit’s value, and consequently not know the
value of the $i$th bit in FOK. This security for Alice’s privacy is just the
same as that in $kN-N$ method.

Finally we emphasize the following two points about our post-processing,
especially the error correction in it.

(1) Note that here, for simplicity, we use the parity of codeword as the FOK
bit. To ensure the randomness of FOK, the code must has balanced parity, that
is, half codewords have odd parity and the other half have even one. Of course
we can also choose a code which has not balanced parity. In this condition,
the parity of message (that is, the four-bit one corresponding to every
codeword in our above example, e.g. 0000, 00001, 0010, …, 1111) instead of
codeword can be used as the FOK bit. Obviously the parity of message is
naturally random.

(2) In the description of our post-processing, a [7,4,3] linear error-
correction code is taken as our example. Of course we can also choose other
code according to the requirement of error correction. For example, a code
with a minimum distance d=5 is needed if we want correct any 1-bit and 2-bit
error in the $k$ ROK bits whose parity will be a FOK bit. In our example, $k$
happens to be 7, and so the [7,4,3] code, in which the length of codewords is
7, is suitable. One may argue that our error correction may not work regularly
if we want to use [7,4,3] code in some scenario where $k$ is not 7 (for
example, as shown in Ref. QPQ11 , when $N=10^{4}$ a reasonable value of $k$ is
6). In fact it is unnecessary to worry about it. According to the manner given
in Ref. OE12 , any expected value of $k$ can be achieved for different $N$ by
adjusting the parameter $\theta$. Therefore, when we choose the code we only
need to consider our requirement of error correction, and our post-processing
method is universal for different scenarios. Of course, for the scenarios
other than our above example (i.e. $N=10^{5}$, $k=7$ and $p=0.25$), the
performances of our post-processing, including the error rates before and
after the procedure, the user’s privacy, the failure probability, and the
value of $g$, should be re-analyzed by similar manners.

##  V Conclusions

From the proposing of BB84 QKD protocol BB84 , quantum cryptography has drawn
much attention of the scholars in the world. Because of its success in the
high security in key distribution, people hope the security of various kinds
of protocols in classical cryptography can be overall upgraded by quantum
manners. To this aim, different kinds of quantum protocols have been proposed,
including quantum secret sharing, quantum secure direct communication, quantum
digital signature, quantum coin flipping, quantum bit commitment, and so on.
However, it seems that QKD is the most practical one till now. Other quantum
protocols tend to have different shortages, e.g., failure in pursuing perfect
security, excessive complexity, fragility against channel noise, or difficulty
in realization. Therefore, in our opinion, it is valuable to study what kind
of cryptographic aims can be achieved via QKD. It helps us to understand what
kind of innovation quantum mechanics can bring to cryptography on earth. QKD-
based QPQ is a good example for that, and it may push this study forward.

Though different protocols have been given, the post-processing of QKD-based
QPQ is still unclear, which greatly limits the practicability of those
protocols. Here we study the post-processing of the oblivious key in QKD-based
QPQ, including both parts in it, i.e. dilution and error correction.

On the one hand, we demonstrate that, though they can significantly reduce
communication complexity, the previous $N-N$ and $rM-N$ dilution methods PJ13
will result in insecurity in the sense that by multiple queries Alice can
obtain much more items (even the whole database) than expected. For the $N-N$
method our simulation shows that when $N=10^{4}$ the dishonest Alice can steal
the whole database after only 53.4 (for $p=0.25$) queries on average. While
this number, called the Death Query Amount (DQA), should have been at least
$N/\bar{n}=10^{4}/2.44=4098.4$. If Alice executes a more complex attack, e.g.
using individual USD measurement, the DQA would be further decreased to 40.0.
For the $rM-N$ method we prove that Alice can get the total database by at
most $rM$ queries.

On the other hand, we propose an effective error-correction scheme for the
oblivious key. Combined with the previous $kN-N$ dilution method, our error
correction scheme completes the post-processing of oblivious key in this kind
of QPQ protocols and makes them more practical for a real noisy channel. By
our post-processing the error rate in the final oblivious key will be
significantly decreased by the sacrifice on communication efficiency. For
example, in the scenario where $N=10^{5}$, $k=7$, $p=0.25$, $e=3\%$, the error
rate after our post-processing is 0.0008 instead of 0.1758 in the original
$kN-N$ method without error correction. And at the same time, the user’s
privacy is still properly protected.

Note. When this work was finished we found that another error correction
scheme for QPQ had been proposed by P. Chan et al in Ref. otherEC .

## Acknowledgements

This work is supported by NSFC (Grant Nos. 61300181, 61272057, 61202434,
61170270, 61100203, 61121061), Beijing Natural Science Foundation (Grant No.
4122054), Beijing Higher Education Young Elite Teacher Project (Grant Nos.
YETP0475, YETP0477).

## References

  * (1) Y. Gertner, Y. Ishai, E. Kushilevitz, and T. Malkin, J. Comput. Syst. Sci. 60, 592 (2000).
  * (2) P. W. Shor, in _Proc. 35th Annual Symposium on the Foundations of Computer Science_ , Santa Fe, New Mexico, 1994, p.124.
  * (3) L. K. Grover, in _Proc. 28th Annual ACM Symposium on Theory of Computing_ , New York, 1996, p.212.
  * (4) C. H. Bennett and G. Brassard, in _Proc. IEEE International Conference on Computers, Systems and Signal_ , Bangalore, India, 1984, p.175.
  * (5) N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev. Mod. Phys. 74, 145 (2002).
  * (6) H.-K. Lo, Phys. Rev. A 56, 1154 (1997).
  * (7) V. Giovannetti, S. Lloyd, and L. Maccone, Phys. Rev. Lett. 100, 230502 (2008).
  * (8) V. Giovannetti, S. Lloyd, and L. Maccone, IEEE T. Inform. Theory 56, 3465 (2010).
  * (9) F. D. Martini, et al., Phys. Rev. A 80, 010302 (2009).
  * (10) L. Olejnik, Phys. Rev. A 84, 022313 (2011).
  * (11) M. Jakobi, et al., Phys. Rev. A 83, 022301 (2011).
  * (12) V. Scarani, A. Acín, G. Ribordy, and N. Gisin, Phys. Rev. Lett. 92, 057901 (2004).
  * (13) F. Gao, et al., Opt. Express 20, 17411 (2012).
  * (14) J. Zhang, et al., Phys. Rev. A 88, 022334 (2013).
  * (15) M. V. Panduranga Rao and M. Jakobi, Phys. Rev. A 87, 012331 (2013).
  * (16) D. S. Shen, et al., J. Optoelectron. ADV. M. 14, 504 (2012).
  * (17) In fact, different sub-key-extension operation (that is, different listing order when the users list the parities of any $k$ sub-key bits to obtain the extended sub-key) also just implies different orders of the row vectors in $G(s_{i})$. So, our proof also works for the condition where different listing order is adapted.
  * (18) P. W. Shor and J. Preskill, Phys. Rev. Lett. 85, 441 (2000).
  * (19) P. Chan, et al., arXiv:1303.0865v2 (2013).