Private Capacity and Secret-Key Distillation

Ordinary channel coding asks one question: can Bob recover Alice's message? The private capacity asks a sharper one: can Bob recover it while the rest of the universe stays ignorant? Every noisy quantum channel $\mathcal{N}_{A\to B}$ is secretly a two-output device. Its Stinespring dilation attaches an environment $E$ , and whatever information does not reach Bob has to go somewhere — it flows into $E$ , where a maximally capable eavesdropper is assumed to be waiting. Reliability and secrecy therefore pull against each other along the same isometry: the more structure Alice pours into the signal to help Bob, the more of it also spills to Eve. The private capacity $P(\mathcal{N})$ is the largest rate at which both demands can be met at once — vanishing decoding error at Bob and vanishing leakage to $E$ — in the asymptotic limit of many channel uses. The organizing result is Devetak's 2005 theorem: $P(\mathcal{N})$ is the regularized private information, the difference of two mutual informations $I(X;B)-I(X;E)$ maximized over input ensembles. That difference is the quantum descendant of Wyner's classical wiretap secrecy capacity — reliability to Bob minus leakage to Eve — and it links secrecy to coherent information, because the decoupling of Eve that certifies privacy is the very same decoupling that, made coherent, transmits qubits. Three consequences shape the article. First, a private code and a secret-key distillation protocol are the same object viewed twice, so $P(\mathcal{N})=K(\mathcal{N})$ and the private capacity is the operational heart of quantum key distribution. Second, the capacities nest, $Q(\mathcal{N})\le P(\mathcal{N})\le C(\mathcal{N})$ . Third — and this is where quantum secrecy stops resembling anything classical — the private information is non-additive and can even be superactivated, so for a general channel only a regularized limit is correct, and the degradable channels are the rare island where everything collapses to a single letter.

Key takeaways

The private capacity $P(\mathcal{N})$ is the maximum rate of classical bits Alice can send to Bob so that the channel's environment (the eavesdropper $E$ fixed by the Stinespring dilation) learns a vanishing amount about the message.
Devetak's theorem gives a regularized coherent-information-like formula, $P(\mathcal{N})=\lim_{n\to\infty}\tfrac1n P^{(1)}(\mathcal{N}^{\otimes n})$ , with single-letter private information $P^{(1)}=\max_{\{p_x,\rho_x\}}[I(X;B)-I(X;E)]$ .
Private communication and secret-key distillation are interconvertible without rate loss, so $P(\mathcal{N})=K(\mathcal{N})$ — this is the operational meaning of QKD key rates.
The capacities nest: $Q(\mathcal{N})\le P(\mathcal{N})\le C(\mathcal{N})$ ; entanglement transmitted secretly is at least a private bit, but privacy is cheaper than coherence.
For degradable channels the private information single-letterizes and equals the quantum capacity, $P=Q=Q^{(1)}=P^{(1)}$ (dephasing, amplitude damping with $\gamma<½$ , pure-loss bosonic with $\eta>½$ ); in general $P$ is non-additive and can be superactivated.
The qubit dephasing channel is the clean solved case: $P=1-H_2(p)$ , giving $P=0.531$ bits at $p=0.1$ and $P=0$ at full dephasing $p=½$ .
Key idea: treat the channel through its Stinespring dilation $\mathcal{N}(\rho)=\mathrm{Tr}_E[V\rho V^\dagger]$ so every use makes a tripartite correlation among message $X$ , Bob $B$ , and environment $E$ . Privacy is reliability to Bob ( $I(X;B)$ large) minus leakage to Eve ( $I(X;E)$ small); the private capacity is the regularized maximum of $I(X;B)-I(X;E)$ , and a private code is simultaneously a secret-key distillation protocol.

The core insight

Treat the channel through its Stinespring dilation $\mathcal{N}(\rho)=\mathrm{Tr}_E[V\rho V^\dagger]$ so that every transmission produces a tripartite correlation among the message $X$ , Bob $B$ , and the environment/eavesdropper $E$ . Privacy equals reliability to Bob ( $I(X;B)$ large) minus leakage to Eve ( $I(X;E)$ small); the private capacity is the regularized maximum of $I(X;B)-I(X;E)$ , and a private code is simultaneously a secret-key distillation protocol.

Where this lives today

The private capacity is the operational spine of quantum key distribution. The rate a real QKD system reports after error correction and privacy amplification is the Devetak–Winter rate $r=I(X;B)-I(X;E)$ : Bob's reconciliation term minus Eve's information, the finite-block realization of the private information. The pure-loss threshold and the PLOB repeaterless bound $-\log_2(1-\eta)$ are quoted directly in link budgets, and beating them at distance is a headline goal — twin-field QKD, demonstrated over fibre links exceeding 500 km, restores the $\sqrt{\eta}$ scaling that a naive point-to-point channel forbids, precisely by turning a two-segment link into an effective channel whose private capacity does not decay as fast. Satellite QKD (the Micius spacecraft distributing entanglement and keys over thousand-kilometre free-space channels) is an engineering answer to the same antidegradability wall, moving the loss budget above the atmosphere. Measurement-device-independent and device-independent protocols push the private-capacity idea further, certifying secrecy against a hidden $E$ without trusting the hardware, using the same $I(X;B)-I(X;E)$ ledger. And on the theory frontier, the non-additivity and superactivation of $P$ drive the hunt for additive upper bounds — the relative entropy of entanglement and squashed-entanglement bounds that sandwich the secret-key capacity of a channel from above, since the exact private capacity of a generic channel remains, like most quantum capacities, an open problem.

The physical picture

Think of the channel as a beamsplitter. Alice's signal partly reaches Bob and partly leaks to the environment, and the same isometry $V$ decides both shares at once — Eve does not choose what she gets, the dilation hands it to her. If Bob's share carries more distinguishing information about the message than Eve's share, Alice has room to manoeuvre: she hashes her true message into a slightly shorter one, padding it with genuine randomness so that Bob, who resolves the whole codeword, still recovers the message, while Eve, who only resolves it up to her poorer information, is left with a state almost independent of what was sent. The surplus she can bank as secrecy is exactly $I(X;B)-I(X;E)$ , and the first figure fixes this tripartite geometry.

Figure

Alice's signal enters the Stinespring isometry V and splits into Bob's output B and the environment E, which the eavesdropper holds. Reliability is measured by I(X;B), leakage by I(X;E), and the deliverable secret rate is their difference R = I(X;B) − I(X;E), maximized over input ensembles and regularized over many uses

The same isometry that certifies privacy also generates entanglement. Making Eve's information vanish is decoupling her from the message, and Devetak's insight was that this classical decoupling is the shadow of the coherent decoupling used to send quantum information — which is why private codes and quantum codes are two faces of one construction, and why $Q\le P$ . Secret key and private bits are then interchangeable currency: a private bit that Bob decodes is a shared random bit unknown to Eve, i.e. a key bit, and a key bit one-time-pads a message bit. "Private capacity" and "secret-key distillation rate of the channel" name the same number seen as a communication task versus a resource-generation task. Where the story turns sharply non-classical is additivity. Privacy is fragile under tensoring: two channels each with zero private information can combine to a positive private capacity, because a joint input can confuse Eve more than it confuses Bob even when neither channel does so alone. That is why no finite single-letter formula is known in general, and why the tractable examples all live in the degradable class. The second figure is the cleanest of those examples — the private capacity of the qubit dephasing channel, a channel Alice can actually compute and a curve a QKD engineer can read off.

Figure

Private capacity of the qubit dephasing channel, P = 1 − H₂(p), falling from 1 secret bit per use at p = 0 to zero at full dephasing p = ½. The marked point is p = 0.1, where H₂(0.1) = 0.4690 and P = 0.531 bits. Because the dephasing channel is degradable, this single-letter value is the true capacity — no regularization needed

The core equations

The subject is built from one optimization and the dilation that defines its ingredients. We take $\log\equiv\log_2$ throughout, and all rates are secret bits per channel use. The starting object is the single-letter private information: reliability to Bob minus leakage to Eve, maximized over how Alice encodes her classical symbols.

P^{(1)}(\mathcal{N})=\max_{\{p_x,\rho_x\}}\Big[I(X;B)_\sigma-I(X;E)_\sigma\Big] \qquad (1)

where: $\{p_x,\rho_x\}$ — input ensemble, symbol $x$ sent with probability $p_x$ encoded into state $\rho_x$ on input $A$ ; $\sigma_{XBE}=\sum_x p_x\,|x\rangle\langle x|_X\otimes(V\rho_x V^\dagger)_{BE}$ — the classical–quantum state built from the dilation; $I(X;B)$ — Holevo information delivered to Bob (the reliability term); $I(X;E)$ — information leaked to the environment (the security penalty). Reading it: the best net secrecy from a single channel use is how much more Bob learns than Eve does, optimized over the code alphabet. Because that single-letter quantity is non-additive, the operationally correct capacity is its regularization over blocks — the honest definition, and the reason the theory is hard.

P(\mathcal{N})=\lim_{n\to\infty}\frac{1}{n}\,P^{(1)}(\mathcal{N}^{\otimes n}) \qquad (2)

where: $P(\mathcal{N})$ — private capacity, the largest secret classical rate with simultaneously vanishing decoding error and leakage; $\mathcal{N}^{\otimes n}$ — $n$ parallel uses treated as one channel, over which entangled encodings may be optimized. Reading it: only in the many-use limit is the rate exact, and the limit can strictly exceed $P^{(1)}(\mathcal{N})$ . Every term in $(1)$ is fixed by the dilation. The channel and its complement are the two marginals of one isometry, and the complement is precisely what the eavesdropper receives.

\mathcal{N}(\rho)=\mathrm{Tr}_E[V\rho V^\dagger],\qquad \mathcal{N}^c(\rho)=\mathrm{Tr}_B[V\rho V^\dagger],\qquad V^\dagger V=\mathbb{1}_A \qquad (3)

where: $V:\mathcal{H}_A\to\mathcal{H}_B\otimes\mathcal{H}_E$ — the Stinespring isometry, unique up to an isometry on $E$ ; $\mathcal{N}^c$ — complementary channel delivering Eve's state, so $I(X;E)$ is determined by $\mathcal{N}^c$ , not chosen by an adversary. Reading it: Eve is not a free parameter — she is the environment the physics already supplies. The private information decomposes into a Bob-minus-Eve entropy difference, exposing its kinship with coherent information.

I(X;B)-I(X;E)=\big[H(B)-H(E)\big]-\big[H(B|X)-H(E|X)\big] \qquad (4)

where: $H(B|X)=\sum_x p_x\,H(\mathcal{N}(\rho_x))$ — Bob's entropy conditioned on the message; $H(B)-H(E)$ — the unconditioned output entropy difference; the bracketed conditional terms cancel for pure-state inputs. Reading it: strip away the conditional part and the private information is the coherent information $H(B)-H(E)$ . That coherent information is the quantum-capacity functional and the lower bound on privacy: any code that transmits qubits secretly transmits private bits, so the capacities nest.

I_c(\rho,\mathcal{N})=H(\mathcal{N}(\rho))-H(\mathcal{N}^c(\rho)),\qquad Q^{(1)}(\mathcal{N})=\max_\rho I_c(\rho,\mathcal{N}),\qquad Q(\mathcal{N})\le P(\mathcal{N})\le C(\mathcal{N}) \qquad (5)

where: $I_c$ — coherent information; $Q^{(1)}$ — one-shot quantum capacity; $C$ — classical capacity, no secrecy constraint. Reading it: secrecy sits between coherence and raw classical throughput — a private bit is weaker than a qubit but stronger than an unprotected classical bit. Security itself is a decoupling statement, and the equivalence with key distillation closes the circle.

\tfrac{1}{2}\big\|\rho_{XE}-\rho_X\otimes\rho_E\big\|_1\le\varepsilon \;\;\Longleftrightarrow\;\; \text{Eve is }\varepsilon\text{-decoupled},\qquad P(\mathcal{N})=K(\mathcal{N}) \qquad (6)

where: $\rho_{XE}$ — joint message–environment state after coding; $\rho_X\otimes\rho_E$ — the ideal product state Eve holds no information about $X$ ; $\|\cdot\|_1$ — trace norm; $K(\mathcal{N})$ — secret-key distillation rate. Reading it: privacy is the trace-norm closeness of Eve's state to a message-independent state, and achieving it is distilling a secret key.

Derivation AAchievability of the private rate by random coding and privacy amplification

The goal is to prove the direct part of Devetak's theorem: any rate $R<I(X;B)-I(X;E)$ is achievable both reliably and privately. The construction is a double-indexed random codebook — one index for the true message, one for genuine randomness that Alice sacrifices to blind the eavesdropper. Bob decodes the whole codeword and reads off the message; Eve, seeing only her weaker output, finds the randomness index enough to wash out any dependence on the message. Fix an ensemble $\{p_x,\rho_x\}$ , use the channel $n$ times, and track the two rate constraints that the two receivers impose.

Step 1. Draw $2^{n(R+R')}$ codewords independently from $\prod_i p_{x_i}$ and partition them into $2^{nR}$ bins, each bin a distinct message and each holding $2^{nR'}$ codewords. To send message $m$ , Alice picks a codeword uniformly at random from bin $m$ and transmits it. Why: the extra $R'$ randomness is the raw material of secrecy — it is what Alice pays so that no single message maps to a fixed signal Eve could latch onto.

Step 2. Bob must resolve the entire codeword, not just the bin, so his constraint is the total rate: by the HSW packing lemma, holding $B^n$ he decodes with error $\to 0$ provided $R+R'<I(X;B)$ . Why: reliability is a statement about Bob alone, and Holevo–Schumacher–Westmoreland gives him exactly $I(X;B)$ bits of resolving power per use.

Step 3. Eve must be unable to resolve within a bin. If $R'>I(X;E)$ , the covering (privacy-amplification) lemma guarantees that the $2^{nR'}$ codewords of any fixed bin flood Eve's output so that her averaged state $\bar\rho_E$ is essentially the same for every message, giving $I(M;E^n)\to 0$ . Why: secrecy is a statement about Eve alone — enough decoy codewords per message make her marginal message-independent, which is precisely $\varepsilon$ -decoupling.

Step 4. Combine the two constraints. The deliverable message rate is the total minus the sacrificed randomness, $R=(R+R')-R'<I(X;B)-I(X;E)$ . Maximizing over the ensemble gives $P^{(1)}$ , and regularizing over $n$ gives $P(\mathcal{N})$ . Why: subtracting the security overhead from the reliability budget is the whole content of the private rate, and it collapses to Wyner's classical wiretap formula when $B$ and $E$ are classical.

Go deeper · Derivation B · 1 minDegradable channels single-letterize the private capacity

Derivation BDegradable channels single-letterize the private capacity

The goal is to show that for degradable channels the regularization is unnecessary and $P=Q=Q^{(1)}=P^{(1)}=\max_\rho I_c(\rho,\mathcal{N})$ , so a single, computable optimization gives the exact secret rate. Degradability means Bob can simulate Eve: there is a CPTP map $\mathcal{D}$ with $\mathcal{N}^c=\mathcal{D}\circ\mathcal{N}$ . This one structural hypothesis forces the private information to be concave, additive, and equal to the coherent information — turning an infinite-dimensional limit into a one-line answer, which is why every solvable example lives here.

Step 1. Restrict to pure-state ensembles. For a pure input $\rho_x$ the global output $V\rho_x V^\dagger$ is pure, so $B$ and $E$ have equal spectra, $H(B|X)=H(E|X)$ , and by equation $(4)$ the private information reduces to $H(B)-H(E)=I_c$ . Hence $P^{(1)}\ge\max_\rho I_c$ . Why: pure inputs kill the conditional terms exactly, exposing the coherent information as an achievable private rate.

Step 2. Bound from the other side. Degradability gives $I(X;E)=I(X;\mathcal{D}(B))$ , so by the data-processing inequality Eve's information is a processed copy of Bob's; the conditional difference obeys $H(B|X)-H(E|X)\ge 0$ and can only reduce $I(X;B)-I(X;E)$ below $H(B)-H(E)$ . Thus $P^{(1)}\le\max_\rho I_c$ . Why: when Bob dominates Eve, mixing the encoding never helps, so the optimum sits at the coherent information from above and below at once.

Step 3. Use concavity for additivity. For degradable channels $I_c(\rho,\mathcal{N})$ is concave in $\rho$ , and concavity makes the coherent information additive: $Q^{(1)}(\mathcal{N}^{\otimes n})=n\,Q^{(1)}(\mathcal{N})$ , and the same for $P^{(1)}$ . Why: additivity is precisely the property that lets the regularized limit collapse to its single-use value.

Step 4. Collapse the tower. Combining, $P=P^{(1)}=Q^{(1)}=Q=\max_\rho\big[H(\mathcal{N}(\rho))-H(\mathcal{N}^c(\rho))\big]$ , with no regularization. Concrete instances: the dephasing channel ( $P=1-H_2(p)$ ), amplitude damping with $\gamma<½$ , and the pure-loss bosonic channel with transmissivity $\eta>½$ . Why: this is the payoff — for the physically central channels, secrecy is exactly computable, and it coincides with the quantum capacity.

Go deeper · Derivation C · 1 minPrivate capacity equals the secret-key rate

Derivation CPrivate capacity equals the secret-key rate

The goal is to prove $P(\mathcal{N})=K(\mathcal{N})$ , that a private classical code and a secret-key distillation protocol convert into each other with no loss of rate. This is what gives the private capacity its cryptographic teeth: it certifies that the number governing a communication task is literally the maximal rate of unconditionally secure shared randomness a channel can produce. The argument is two inclusions plus a rate match, each direction using nothing more than the definitions of privacy and of a secret key.

Step 1. Private implies key. Run any private code on a uniformly random message $M$ . Bob decodes $\hat M=M$ with high probability, and privacy gives $\tfrac12\|\rho_{ME}-\rho_M\otimes\rho_E\|_1\le\varepsilon$ . The string $M$ is now shared, uniform, and almost independent of Eve — the definition of an $\varepsilon$ -secure key of the same rate. Why: a private message that happens to be random is already a key; nothing extra is needed.

Step 2. Key implies private. Given a distilled key $M$ , Alice one-time-pads any chosen message $W$ as $C=W\oplus M$ and sends $C$ over a public classical use. Eve's information about $W$ equals her information about $M$ , which is $\le\varepsilon$ , so $W$ travels privately at the key rate. Why: a secret key is a reusable secrecy resource — the one-time pad turns it back into private communication with no overhead.

Step 3. Match the rates. Both conversions preserve rate up to $o(1)$ per use, so the optimal achievable rates coincide and $P(\mathcal{N})=K(\mathcal{N})$ . Why: because neither direction leaks rate, the two operational quantities are not merely comparable but equal, which is why QKD security proofs quote a private capacity as a key rate without apology.

Limiting cases

How the private capacity specializes across channel classes:

Case	Result	Meaning
Degradable channel	$P=P^{(1)}=Q=\max_\rho I_c(\rho,\mathcal{N})$	Bob can simulate Eve; the private information is additive and equals the coherent information / quantum capacity — the computable regime.
Antidegradable channel	$P=0$	Eve can simulate Bob, so $I(X;E)\ge I(X;B)$ for every ensemble by data processing; no private rate exists (e.g. pure-loss bosonic with $\eta<½$ ).
Noiseless channel	$P(\mathrm{id}_d)=\log d$	The environment is decoupled, $I(X;E)=0$ , so every classical bit is already private; $P$ equals the classical capacity $\log d$ .
Classical degraded wiretap (Wyner)	$P=\max_{p(x)}[I(X;B)-I(X;E)]$	Recovers Wyner's 1975 secrecy capacity; single-letter here because the classical degraded order plays the role of degradability.

Common trapAssuming the private information is additive or that Eve is a free adversary

Two errors recur. The first is to treat $P^{(1)}$ as the answer. It is only a lower bound on $P$ in general: the private information is non-additive, can be superadditive, and the private capacity can even be superactivated — two channels each with $P=0$ whose tensor product has $P>0$ . Quoting $P^{(1)}(\mathcal{N})=0$ as "this channel is useless for secrecy" is unjustified without a degradability or antidegradability argument. The second error is to imagine Eve as an arbitrary attacker whose power you get to model. She is not: $E$ is the specific environment fixed up to isometry by the Stinespring dilation, and $I(X;E)$ is computed from the complementary channel $\mathcal{N}^c$ . This is a feature, not a limitation — bounding the information of the purifying environment bounds every possible eavesdropper at once, which is what makes the security information-theoretic rather than computational. Do not confuse the dilation's $E$ with a weaker, guessable adversary; the strongest Eve already holds all the leakage.

Worked examples

1 · The qubit dephasing channel (fully worked)

The qubit dephasing channel is $\mathcal{N}(\rho)=(1-p)\rho+p\,Z\rho Z$ . It is degradable, so its private capacity is the single-letter $P=1-H_2(p)$ . Evaluate $P$ at $p=0.1$ and at full dephasing $p=½$ , and say what each means for key distribution.

Step 1. Because the channel is degradable, Derivation B applies and no regularization is needed: $P=Q=Q^{(1)}=\max_\rho I_c(\rho,\mathcal{N})$ , and for dephasing this maximum evaluates to $P=1-H_2(p)$ with $H_2(p)=-p\log_2 p-(1-p)\log_2(1-p)$ .

Step 2. At $p=0.1$ : compute the binary entropy, $H_2(0.1)=-0.1\log_2 0.1-0.9\log_2 0.9=0.33219+0.13680=\mathbf{0.4690}$ bits. Then $P=1-0.4690=\mathbf{0.531}$ secret bits per use. A little over half a secret bit survives each channel use, and — degradability again — this is the true capacity, not merely an achievable rate.

Step 3. At $p=½$ : $H_2(0.5)=1$ , so $P=1-1=\mathbf{0}$ . Full dephasing turns the channel into a measurement in the $Z$ basis; Bob and the environment learn the same diagonal, nothing coherent remains, and no secrecy can be extracted. Summary: $P=0.531$ bits at $p=0.1$ , dropping smoothly to $P=0$ at $p=½$ — the whole curve of the second figure, computed exactly because the channel is degradable.

2 · The pure-loss bosonic channel and the repeaterless limit (numeric)

An optical fibre or free-space link is modelled as a pure-loss bosonic channel of transmissivity $\eta$ (the fraction of photons reaching Bob). Locate the private-capacity threshold, and quote the repeaterless secret-key benchmark at $\eta=0.9$ and $\eta=0.99$ .

Step 1. Split the beam at a virtual beamsplitter: Bob gets fraction $\eta$ , the environment gets $1-\eta$ . For $\eta>½$ Bob receives more than Eve and the channel is degradable, so a positive one-way private capacity exists. For $\eta<½$ the channel is antidegradable — Eve holds a copy at least as good as Bob's — and $P=0$ exactly. The knife-edge is $\eta=½$ .

Step 2. With two-way classical communication one does better than the one-way $P$ , and the exact repeaterless secret-key capacity is the PLOB bound $K=-\log_2(1-\eta)$ secret bits per use. At $\eta=0.9$ : $K=-\log_2 0.1=\mathbf{3.32}$ bits per use. At $\eta=0.99$ : $K=-\log_2 0.01=\mathbf{6.64}$ bits per use.

Step 3. Read the consequence. Since $K\ge P$ and $K$ scales only as $-\log_2(1-\eta)\approx 1.44\,\eta_{\text{loss}}^{-1}$ decibels' worth of rate, the secret-key rate of any point-to-point optical link falls linearly with transmissivity and vanishes as $\eta\to 0$ : no repeaterless protocol can beat it. This is why long-distance QKD needs repeaters or twin-field schemes — the $\eta<½$ antidegradable wall kills one-way privacy, and even the two-way PLOB rate $-\log_2(1-\eta)$ decays with distance, capping unrepeated links.

3 · Why an antidegradable channel has zero private capacity (conceptual)

A channel is antidegradable: there is a CPTP map $\mathcal{A}$ with $\mathcal{N}=\mathcal{A}\circ\mathcal{N}^c$ , so Eve can reconstruct Bob's output from her own. Show that $P=0$ without computing any entropy.

Step 1. For any input ensemble, apply $\mathcal{A}$ to Eve's system to manufacture a copy of Bob's. By the data-processing inequality, processing cannot increase information, so Eve's original information already satisfies $I(X;E)\ge I(X;B)$ for every ensemble.

Step 2. Then $I(X;B)-I(X;E)\le 0$ for all $\{p_x,\rho_x\}$ , so $P^{(1)}\le 0$ , and since a private rate cannot be negative, $P^{(1)}=0$ . Regularization of a quantity that is $\le 0$ for every tensor power stays $0$ . Anything Bob can learn, Eve already knows — antidegradability is a hard, coding-independent zero, the exact complement of the degradable single-letter regime.

Physics of the portrait

The "portrait" here is not a person but a quantity: the private capacity itself, a number assembled over thirty years from Shannon-style secrecy, quantum dilations, and the coding theorems that fused them.

:::physicist[private capacity|the secret-classical rate P(N) = limₙ (1/n) max[I(X;B) − I(X;E)]|quantum Shannon theory of secret communication] The private capacity is the meeting point of two lineages. The classical one begins with Claude Shannon's 1949 information-theoretic framing of secrecy and crystallizes in Aaron Wyner's 1975 wiretap channel, the first model in which reliability to a legitimate receiver and ignorance of an eavesdropper are treated as one coding problem — Wyner's secrecy capacity is exactly $\max[I(X;B)-I(X;E)]$ over a degraded broadcast channel. Imre Csiszár and János Körner generalized it in 1978 to the broadcast channel with confidential messages, removing the degradedness assumption, and in 1993 Ueli Maurer, together with Rudolf Ahlswede and Csiszár, recast secrecy as secret-key agreement by public discussion, the conceptual bridge to distillation. The quantum lineage begins with Bennett and Brassard's 1984 BB84 protocol, which showed that the no-cloning structure of quantum states lets two parties detect eavesdropping and distil a key — but a general capacity theorem waited two decades. Ning Cai, Andreas Winter, and Raymond Yeung defined the quantum wiretap channel in 2004, and Igor Devetak's 2005 paper proved the decisive result: the private capacity of a quantum channel is the regularized private information $\lim_n\frac1n\max[I(X;B)-I(X;E)]$ , with the eavesdropper identified as the Stinespring environment. Devetak's proof simultaneously nailed the quantum capacity, because the decoupling that hides a message from the environment is the same decoupling that transmits a qubit — a unification of secrecy and coherence that turned a family of cryptographic protocols into a single capacity, non-additive and, for most channels, still uncomputed.

Origins · 1 minhow this was discovered

History

1975

— Wyner introduces the wiretap channel and its secrecy capacity max[I(X;B) − I(X;E)]

1978

— Csiszár and Körner generalize secrecy to the broadcast channel with confidential messages

1993

— Maurer, and Ahlswede and Csiszár, formalize secret-key agreement by public discussion

2004

— Cai, Winter and Yeung define the quantum wiretap channel and its private information

2005

— Devetak proves the private capacity equals the regularized private information

Going further

Texts. Wilde, Quantum Information Theory, 2nd ed., Ch. 23 (Private Classical Communication) and Ch. 24 (degradable channels) · Nielsen & Chuang, Quantum Computation and Quantum Information, Ch. 12 · Watrous, The Theory of Quantum Information, Ch. 8 · Preskill, Lecture Notes on Quantum Computation, Ch. 10 · Hayashi, Quantum Information Theory: Mathematical Foundation, Ch. 9.

Key papers. I. Devetak, IEEE Trans. Inf. Theory 51, 44 (2005), private and quantum capacity · A. Wyner, Bell Syst. Tech. J. 54, 1355 (1975), the wiretap channel · N. Cai, A. Winter & R. Yeung, Probl. Inf. Transm. 40, 318 (2004), quantum wiretap channel · I. Devetak & A. Winter, Proc. R. Soc. A 461, 207 (2005), distillation of secret key and entanglement · S. Pirandola, R. Laurenza, C. Ottaviani & L. Banchi, Nat. Commun. 8, 15043 (2017), fundamental repeaterless (PLOB) bounds.

Provenance. A verifier should reproduce: (1) Devetak's theorem $P=\lim_n\frac1n\max_{\{p_x,\rho_x\}}[I(X;B)-I(X;E)]$ (Devetak 2005; Wilde Ch. 23); (2) achievability via HSW packing plus covering/privacy-amplification, giving $R<I(X;B)-I(X;E)$ ; (3) the degradable collapse $P=Q=Q^{(1)}=\max_\rho I_c$ with $I_c=H(\mathcal{N}(\rho))-H(\mathcal{N}^c(\rho))$ (Devetak–Shor; Wilde Ch. 24); (4) the dephasing value $P=1-H_2(p)$ with $H_2(0.1)=0.4690$ so $P(0.1)=0.531$ and $P(½)=0$ ; (5) the $\eta=½$ antidegradable threshold for the pure-loss bosonic channel and the PLOB secret-key capacity $-\log_2(1-\eta)$ giving $3.32$ at $\eta=0.9$ and $6.64$ at $\eta=0.99$ ; (6) the task equivalence $P=K$ and the ordering $Q\le P\le C$ . All quantities are textbook-standard with $\log\equiv\log_2$ ; no nonstandard constants are introduced.

Prerequisites. Quantum Channels and CPTP Maps · Stinespring Dilation Theorem · Complementary Channels and Degradability · Quantum Conditional Entropy and Mutual Information · Holevo Bound · Data-Processing Inequality. Leads to. Complementary Channels and Degradability · Quantum Relative Entropy · Strong Subadditivity of Quantum Entropy.

Ask the tutor: Ask me to work the dephasing or amplitude-damping private capacity end to end, or to walk through why decoupling Eve is the same move that transmits a qubit.

What is the difference between the private capacity and the ordinary classical capacity?

The classical capacity $C(\mathcal{N})$ asks only that Bob recover the message; it places no constraint on who else learns it. The private capacity $P(\mathcal{N})$ adds a secrecy demand — the environment $E$ of the channel's dilation must end up almost independent of the message — so it is a strictly harder task and $P\le C$ . The gap between them is the price of secrecy: a noiseless channel decouples the environment automatically, so there $P=C=\log d$ , but any channel that leaks distinguishable information to $E$ forces Alice to spend part of her rate on privacy amplification, and $P$ falls below $C$ . The two coincide only when the leakage $I(X;E)$ can be driven to zero for the capacity-achieving ensemble.

Why is the eavesdropper modelled as the channel's environment rather than as a specific attacker?

Because the environment is the worst-case eavesdropper, and modelling it makes the security unconditional. The Stinespring dilation attaches a system $E$ that purifies the channel, and any information that fails to reach Bob is, by construction, present in $E$ . An adversary who holds $E$ therefore holds everything that leaked — no physically realizable attacker can do better, because there is nothing left over to hold. So bounding $I(X;E)$ bounds the information of every possible eavesdropper simultaneously, giving information-theoretic security that does not rest on any assumption about the attacker's technology or computational power. This is exactly why $E$ is fixed by the physics and not chosen by Eve.

How can private communication and secret-key distillation be "the same" task?

They are interconvertible without rate loss, which is the strongest sense in which two tasks can coincide. If Alice runs a private code on a uniformly random message, Bob recovers a shared random string about which Eve is nearly ignorant — that is precisely a secret key, so private communication yields key at its own rate. Conversely, given a secret key, Alice one-time-pads any message and sends the ciphertext publicly; Eve's information about the message equals her information about the key, which is negligible, so key yields private communication at its rate. Because neither conversion wastes rate, the optimal rates are equal, $P(\mathcal{N})=K(\mathcal{N})$ , and one may freely speak of the channel's private capacity or its secret-key rate.

Why does the private capacity need a regularized limit when the classical Shannon capacity does not?

The single-letter private information $P^{(1)}$ is non-additive. Feeding an entangled input across several channel uses can produce correlations that raise $I(X;B)-I(X;E)$ above what any product input achieves — the difference is superadditive, and in extreme cases two channels with $P^{(1)}=0$ can be superactivated to a joint $P>0$ . So the honest capacity is $P=\lim_n\frac1n P^{(1)}(\mathcal{N}^{\otimes n})$ , which can strictly exceed $P^{(1)}(\mathcal{N})$ . Classically this never happens: Shannon's mutual information is additive, i.i.d. inputs are optimal, and the single-letter formula is exact. The extra structure that quantum mechanics permits — entanglement spread across uses — is exactly what breaks additivity and forces the limit.

Which channels actually have a computable private capacity?

The degradable channels — those where Bob can post-process his output to reproduce Eve's, $\mathcal{N}^c=\mathcal{D}\circ\mathcal{N}$ . For them the private information is concave and additive, the regularization collapses, and $P=Q=Q^{(1)}=\max_\rho I_c(\rho,\mathcal{N})$ , a finite optimization you can solve. This class includes several of the most important channels: the dephasing channel ( $P=1-H_2(p)$ ), amplitude damping with damping $\gamma<½$ , and the pure-loss bosonic channel with transmissivity $\eta>½$ . Their antidegradable partners have $P=0$ exactly. Generic channels — the depolarizing channel above its threshold is the standard example — are neither, and their exact private capacity remains unknown, bounded but not determined, which is why the theory invests heavily in additive upper bounds.

Is the Devetak–Winter rate the same thing as the private capacity?

Almost — it is its per-signal, protocol-level face. The Devetak–Winter rate $r=I(X;B)-I(X;E)$ is the secret-key rate extractable from a fixed measured ensemble after one-way error correction (which costs $I(X;B)$ -worth of reconciliation) and privacy amplification (which subtracts Eve's $I(X;E)$ ). It is exactly the single-letter private information for that ensemble, so a QKD protocol's asymptotic key rate is a private information, and the channel's private capacity is the supremum of such rates over encodings and blocks. The distinction is that "private capacity" is the optimized, regularized channel quantity, while "Devetak–Winter rate" usually names the achievable rate of a specific protocol and measurement — the same ledger, evaluated at a chosen operating point rather than maximized.