Device-Independent Conference Keys from Parity-Extended Games

AI summary

Overview

Research area: Quantum cryptography — specifically device-independent conference key agreement (DI-CKA), non-local games, and Bell-inequality-based security proofs. arXiv:2610.01025v1 [quant-ph], 01 Oct 2026, by Suvradip Chakraborty (Visa Research), Ronak Ramachandran (UT Austin, work done while at Visa) and Aniruddha Sen (UT Austin, work done while at Visa). Licensed CC BY 4.0.

Technical level: Advanced. The paper assumes familiarity with non-local games, von Neumann and min-entropy, the NPA hierarchy and semi-definite programming. The introductory and overview sections, however, are written so that the core construction can be followed without the full formalism.

Scope (one sentence): The paper introduces "Parity-G games," a generic way to lift any two-player non-local game with a Pauli strategy to an N-player game, and uses the resulting Parity Magic Square Game to build and prove secure the first DI-CKA protocol based on a pseudo-telepathy game.

What This Paper Is About

Device-independent conference key agreement lets N parties agree on a shared secret key while treating their quantum hardware as untrusted black boxes, with security certified purely by how well the devices win a non-local game. Every existing DI-CKA protocol is built around one Bell inequality — typically a multiparty variant of CHSH, such as the Parity-CHSH game of Ribeiro, Murta and Wehner — whereas two-party DI-QKD has been built on a much richer set of games, including the Mermin–Peres magic square game.

The paper asks whether that richer landscape can be carried over to the conference setting, and in particular whether a pseudo-telepathy game (one quantum players win with certainty but classical players cannot) could yield a better DI-CKA protocol. The stated obstacle is security analysis: the known techniques require semi-definite programs via the NPA hierarchy that become infeasible for N even slightly larger than 2, which is why Holz, Kampermann and Bruß could not prove guarantees for more than 4 parties on their N-party game.

Key Contributions

1. Parity-G games. For every two-player game G that admits an optimal strategy in which one player measures Pauli observables on shared EPR pairs (a "Pauli strategy," Definition 4.2), the authors define an N-player game 𝗉G_N, the parity extension of G (Definition 4.5). For every N ≥ 2, 𝗉G_N has the same quantum and classical values as G (Theorem 4.11), and its optimal value can be attained given copies of the N-party GHZ state (Proposition 4.10). The construction recovers the Parity-CHSH game of Ribeiro, Murta and Wehner as a special case (Example 4.18).

2. The Parity Magic Square Game and the first pseudo-telepathy-based DI-CKA protocol. Instantiating the framework with the Mermin–Peres magic square game yields 𝗉MSG_N (Definition 4.13), a new N-player pseudo-telepathy game with quantum value 1 and classical value 8/9 for every N (Propositions 4.15 and 4.16). From it the authors construct the first DI-CKA protocol based on a pseudo-telepathy game, producing up to two key bits per round, and prove it secure against coherent attacks (Sections 5 and 6).

3. Security reduces to the two-player game. Lemma 6.6 shows that every convex lower bound on the entropy of Alice's key output that holds for G also holds for 𝗉G_N, for every N. The security analysis therefore does not grow harder with the number of parties, in contrast to NPA-based analyses that blow up beyond N slightly larger than 2 and give no asymptotic guarantees.

4. Key-rate comparison and a matching attack. Under global depolarizing noise, the 𝗉MSG_N-based protocol achieves a higher asymptotic key rate than the Parity-CHSH-based protocol in the low-noise regime. To show tightness, the authors adapt an attack from prior work under which the adversary learns Alice's entire key while the devices still win 𝗉MSG_N with probability up to 5/9 + 4/9 cos²(π/8) ≈ 0.935, which combined with the cited bound yields a key-rate upper bound (Appendix C).

Main Findings

• Values are preserved by the extension. For every N ≥ 2, the parity extension 𝗉G_N of a Pauli game G has exactly the same classical and quantum values as G (Theorem 4.11), so the two-player analysis transfers intact.
• A new pseudo-telepathy game. 𝗉MSG_N has quantum value 1 and classical value 8/9 for every N, meaning ideal devices win every round while classical devices cannot.
• How the N-party game works. All but two players measure their qubit of a shared N-party GHZ state in the X basis; Alice and Bob then share 1/√2(|00⟩ + (−1)^p|11⟩), where p ∈ {0,1} is the parity of the other N−2 measurement outcomes. The referee XORs correction bits (the "swap mask," Figure 2) into Alice's three outputs before checking the magic square winning condition.
• Fewer non-signaling constraints are needed. Players other than Alice and Bob receive no input, so Parity-G games require non-signaling only between N−1 pairs (Alice and everyone else) rather than all N² pairs — quadratically easier to enforce.
• The games are not self-testing for GHZ. The N-party game can be won by having Alice and Bob play the two-player game on shared EPR pairs while the others output 0. Consistent with Wooltorton et al., the game therefore does not require genuine multipartite entanglement to achieve DI-CKA; the shared key instead comes from the tension between passing test rounds and passing error correction.
• Protocol structure. The protocol runs m rounds, each designated a test round with probability γ and a key round with probability 1−γ. In key rounds all players measure in the Z basis; in test rounds B₂,…,B_{N−1} measure in the X basis while Alice and Bob follow the optimal MSG strategy. Parameter estimation computes the average winning probability ω; the protocol aborts if ω falls below a threshold ω_tol, then performs error correction and privacy amplification.
• Threshold constraints. The threshold must satisfy ω_tol > 8/9 for any non-zero key, since classical devices win deterministically with probability 8/9; the improved quantum strategy forces ω_tol ≳ 0.935.
• Per-round entropy range. The quantity being bounded is H(A|E), with 0 ≤ H(A|E) ≤ 2, consistent with up to two key bits per round.
• Key-rate results. The 𝗉MSG_N-based protocol has the higher key rate when global depolarizing noise q is below ≈ 5%, and also when local depolarizing noise is below ≈ 1.5% at N = 3. It has a lower key rate when q ≳ 10%, and both protocols exhibit zero key rate when q ≳ 14%. Both lower and upper bounds on key rates are computed for both protocols to expose the tightness gap.
• Coherent-attack security. Security across all n rounds and all N parties against coherent attacks is established via the Generalized Entropy Accumulation Theorem.

Methodology in Plain English

The starting observation is a quirk of entanglement. If Alice and Bob share the singlet |Φ⁻⟩ instead of |Φ⁺⟩, that is the same as secretly applying a Z gate to Alice's qubit. Because Pauli measurements either commute or anticommute with Z, this hidden difference only flips some of Alice's output bits — a predictable, correctable effect. The authors call a two-player game a "Pauli game" when it has an optimal strategy using EPR pairs in which one player measures only Paulis, and note that almost every known two-player game qualifies.

The lift to N players uses GHZ states. If N−2 players each measure their piece in the X basis, the remaining two are left sharing |Φ⁺⟩ or |Φ⁻⟩ depending on the parity of those N−2 outcomes. Alice and Bob can therefore play the original two-player game, provided the referee knows the parity and flips Alice's reported bits accordingly (the swap-mask table). This turns a two-player game into an N-player game without changing what the game is testing.

The protocol then alternates between checking and using the devices: most rounds are key rounds where everyone measures in the Z basis to produce raw key, a fraction γ are test rounds where the group plays the N-party game. Since the devices cannot tell a key round from a test round in which Alice's input is the first row — both ask for Z⊗I and I⊗Z — honesty forced in test rounds carries over to key rounds. Devices that try to win test rounds with EPR pairs shared only between Alice and Bob are caught in error correction, because the other players end up with different bits.

For the quantitative security bound, the authors would normally need to solve large semi-definite programs via the NPA hierarchy to lower-bound H(A|E) for the N-party game. Instead they show this N-party entropy bound is a convex combination of bounds for the two-player magic square game over relabelings of inputs, so only the two-player problem, which is tractable, must be solved numerically. The Generalized Entropy Accumulation Theorem then extends the per-round bound to the full protocol against coherent attacks.

Why This Matters

Impact on research. The paper removes a structural bottleneck in DI-CKA: previously each protocol was tied to one Bell inequality, usually a CHSH variant, and security proofs failed to scale past a handful of parties. The Parity-G framework is a general recipe that converts essentially any two-player Pauli game into a conference protocol whose security proof is inherited rather than re-derived, and it provides the first DI-CKA construction grounded in pseudo-telepathy — a class of games that seems attractive precisely because ideal devices cannot afford to lose a single round.

Potential applications (none of which the paper implements or evaluates; it reports theory and asymptotic key rates only):

• Secure group conferencing, where several sites need one common key rather than pairwise keys.
• Group messaging and multicast encryption, where a single shared conference key reduces rekeying overhead compared with N−1 pairwise QKD runs.
• Multi-node quantum networks, including architectures where a multipartite entangled state gives higher key rates than running N−1 two-party protocols.
• Deployments where hardware cannot be trusted or is supplied by an adversary, since the security claim rests only on observed input-output statistics.

Industry relevance. The authors are affiliated with Visa Research and UT Austin, signalling interest from the payments and financial sector in cryptographic key establishment that does not depend on trusting the underlying quantum hardware. Because the security analysis does not become harder as N grows, the construction is more plausible to certify for realistic group sizes than NPA-based alternatives.

Future Directions

• Beyond Pauli measurements. The authors note that the restriction to Paulis is for simplicity and that the results hold more generally, for instance for any basis on the equator of the Bloch sphere. Extending Parity-G rigorously to that broader class is a natural next step.
• Tighter rate bounds. The attack in Appendix C caps the winning probability at 5/9 + 4/9 cos²(π/8) ≈ 0.935, and the paper computes both lower and upper key-rate bounds to expose the gap. Closing that gap, and improving the upper bound obtained by combining the attack with the cited prior work, would sharpen the comparison against Parity-CHSH.
• Other base games. The framework applies to any game with a Pauli strategy. Candidates mentioned but not developed include the N-player GHZ game and parallel two-player magic square games, the latter discussed in the context of running pairwise DI-QKD protocols in parallel (Section 7.1); other two-party games are said to extend as well.
• Finite-key and implementation questions. The key-rate evaluation is asymptotic, taking the test probability γ → 0 as the number of rounds grows. Finite-key behaviour, noise models beyond the global and local depolarizing models considered, and any experimental realisation of 𝗉MSG_N remain open; the paper reports no implementation or measured data.
• Structural consequences of non-self-testing. Since the game does not self-test an N-qubit GHZ state and does not require genuine multipartite entanglement, understanding exactly which device behaviours still permit key generation — and whether the reduced non-signaling requirement between only N−1 pairs can be exploited further — is an open design question.

Target Audience

Quantum information researchers working on device-independent cryptography, non-local games, and multiparty key agreement will get the most from this paper, particularly those interested in entropy bounds and the NPA hierarchy. It is also relevant to cryptographic engineers and security architects in finance and telecommunications who need to understand what device independence costs and delivers at the group level, and to graduate students looking for a worked example of reducing an N-party security proof to a two-party one. Readers without a background in quantum entropies and semi-definite programming will find the contributions and the rate comparison accessible, but the proofs in Sections 4 and 6 require the full formalism.

Authors’ abstract

Device-independent conference key agreement (DI-CKA) lets a group of parties establish a shared secret key from untrusted quantum devices, with security certified by non-locality. Existing DI-CKA protocols are each built around a single Bell inequality, typically a multiparty variant of the CHSH game. DI-QKD protocols, in contrast, have been built from a much richer landscape of non-local games, and it has remained unclear how to carry this landscape over to the conference setting. We introduce $\textit{Parity-$G$ games}$, which extend any two-player game $G$ to $N$ players, for every $N$, provided $G$ has an optimal strategy in which one player measures Pauli observables. The extension preserves the quantum and classical values of $G$, and the security of the resulting $N$-party protocol follows from an analysis of the two-player game alone. Our framework recovers the Parity-CHSH game of Ribeiro, Murta and Wehner (Phys. Rev. A, 2018) as a special case. Applied to the Mermin--Peres Magic Square Game, it yields a new $N$-player pseudo-telepathy game, the $\textit{Parity Magic Square Game}$, which ideal devices win in every round. We use it to construct the $\textit{first}$ DI-CKA protocol based on a pseudo-telepathy game. We prove the protocol secure against coherent attacks. It produces up to two key bits per round, and at low noise its key rate exceeds that of the DI-CKA protocol based on the Parity-CHSH game.