the first quantum key distribution ( qkd ) protocols were proposed independently by bennett and brassard  in 1984 inspired by early work on quantum money by wiesner  and by ekert  in 1991 .the original papers discussed security in the presence of an eavesdropper that could perform only limited operations on the quantum channel . the first security proofs that considered an unbounded adversary were given more than a decade later  .another decade after the first such proof , knig et al . showed that the security criterion used was insufficient : even though it guarantees that an eavesdropper can not guess the key , this only holds if the key is never used .if part of the key is revealed to the eavesdropper for example , by using it to encrypt a message known to her the rest becomes insecure .a new security criterion for qkd was introduced , along with a new proof of security for bb84  .it was argued that , the joint state of the final key ( ) and quantum information gathered by an eavesdropper ( ) , must be close to an ideal key , , that is perfectly uniform and independent from the adversary s information : where is the probability that the protocol aborts , , with , instead of explicitly writing the factor .the two formulations are however mathematically equivalent . ] is the trace distance and  ] , where is the probability of aborting and and are alice and bob s keys conditioned on not aborting . ] the secrecy of a qkd protocol measures how close the final key is to a distribution that is uniform and independent of the adversary s system . let be the probability that the protocol aborts , and be the resulting state of the subsystems conditioned on not aborting .a protocol is _ /secret _ if for all adversarial strategies , where the distance is the trace distance and is the fully mixed state .[ thm : qkd ] if a qkd protocol is /correct and /secret , then is satisfied for .let us define to be a state obtained from ( ) by throwing away the system and replacing it with a copy of , i.e. , from the triangle inequality we get   since in the states and the system is a copy of the system , it does not modify the distance .furthermore , {\gamma_{abe } } = \trace[b]{\rho^{\top}_{abe}} ] .we will however not use this fact here .consider now a real system that outputs values given by and an ideal system that outputs values according to . tells us that there exists a coupling of these distributions such that the probability of the real system producing a different value from the ideal system is bounded by the total variation distance between and .thus , the real system behaves ideally except with probability .we first prove this theorem , then in here below we apply it to quantum systems .let be the real function on defined by & \text{if } \\ 0 & \text{otherwise}\end{cases }   \end{aligned}\ ] ] ( for all ) .furthermore , let and be the real functions on defined by we then define by   we now show that satisfies the conditions of the theorem .for this , we note that for any  \geq 0 \   ,   \end{aligned}\ ] ] i.e. , , and , likewise , , are nonnegative .since is by definition also nonnegative , we have that is nonnegative , too . from or , which we will prove below, it follows that is also normalized .hence , is a valid probability distribution .  to show we use again the non / negativity of and , which implies = 1- d(p_z , p_{\tilde{z } } ) \ ,  \end{aligned}\ ] ] where in the last equality we used the alternative formulation of the total variation distance from .to prove , we first note that = d(p_z ,  p_{\tilde{z } } ) \ .\end{aligned}\ ] ] using this we find that for any  by symmetry , this also proves .  in the case of quantum states , can be used to couple the outcomes of any observable applied to the quantum systems .[ cor : difference ] for any states and with trace distance , and any measurement given by its povm operators with outcome probabilities and , there exists a coupling of and such that \leq d(\rho,\sigma ) \ .\ ] ]  immediate by combining and .tells us that if two systems produce states and , then for any observations made on those systems there exists a coupling for which the values of each measurement will differ with probability at most .it is instructive to remember that this operational meaning is not essential to the security notion or part of the framework in any way .it is an intuitive way of understanding the trace distance , so as to better choose a suitable value .it allows this distance to be thought of as a maximum failure probability , and the value for to be chosen accordingly .non / composable security models often use measures of uncertainty to quantify how much information an adversary might have about a secret , e.g. , entropy as used by shannon to prove the security of the one - time pad  .these measures are often weaker than what one obtains using a global distinguisher , and in general do not provide good security definitions .they are however quite intuitive and in order to further illustrate the quantitative value of the distinguishing advantage , we derive bounds on two of these measures of uncertainty in terms of the trace distance , namely on the probability of guessing the secret key in and on the von neumann entropy of the secret key in .let be the joint state of a secret key in the subsystem and eve s information in the subsystem . to guess the value of the key, eve can pick a povm , measure her system , and output the result of the measurement .given that the key is , her probability of having guessed correctly is .the average probability of guessing correctly for this measurement is then given by the sum over all , weighted by their respective probabilities . and eve s probability of correctly guessing the key is defined by taking the maximum over all measurements , {k|e } \coloneqq  \max_{\{\gamma_k\ } } \sum_{k \in \ck } p_k \trace{\gamma_k \rho^k_e } \  .\ ] ]  [ lem : pguess ] for any bipartite state with classical , {k|e } \leq \frac{1}{|\ck| } + d\left ( \rho_{ke},\tau_k \tensor \rho_e\right ) \ , \ ] ] where is the fully mixed state .note that for , where maximizes , the guessing probability can equivalently be written {k|e } =  \trace{m \rho_{ke } } \ .\ ] ] furthermore , in we proved that for any operator , setting and in the above inequality , we finish the proof : {k|e } & \leq \frac{1}{|\ck| } + d\left ( \rho_{ke},\tau_k   \tensor \rho_e\right ) \ . \qedhere\end{aligned}\ ] ]   let be the joint state of a secret key in the subsystem and eve s information in the subsystem .we wish to bound the von neumann entropy of given  , where  in terms of the trace distance .we first derive a lower bound on the von neumann entropy , using the following theorem from alicki and fannes  .[ thm : af04 ] for any bipartite states and with trace distance and , we have where is the binary entropy .  [ cor : af04 ] for any state with , where is the fully mixed state , we have   immediate by plugging and in.  given the von neumann entropy of conditioned on , , one can also upper bound the trace distance of from by relating to the relative entropy of to  the relative entropy of to is defined as .[ lem : entropybound ] for any quantum state ,   from the definitions of the relative and von neumann entropies we have where is the identity matrix .we then use the following bound on the relative entropy ( * ? ? ?* theorem 1.15 ) to conclude the proof :   and can be written together in one equation , upper and lower bounding the conditional von neumann entropy : .in we derived two conditions secrecy and correctness that together imply that a real qkd system is indistinguishable from the ideal one . an alternative definition for _/secrecy _ was proposed in the literature  :   this alternative notion is equivalent to the standard definition of secrecy ( ) up to a factor , as can be seen by the following calculation .let be the state for which the minimum in is achieved .then , we thus have this means that any qkd scheme proven secure with one definition is still secure according to the other , with a minor adjustment of the failure parameter .however , we do not know how to derive this alternative notion from a composable framework .in particular , it is not clear if the failure from is additive under parallel composition .for example , the concatenation of two keys that each , individually , satisfy , could possibly have distance from uniform greater than .for this reason , the arxiv version of was updated to use instead .a distinguisher has been introduced as a single entity that has to guess which of two systems it is holding .mathematically , it is more convenient to model a distinguisher as a set .each element is a system with interfaces . of them connect to the interfaces of a resource or and the last interface outputs a bit , as illustrated in on .thus , for any and any compatible system , is a binary random variable .the distinguishing advantage can be rewritten as - \pr[d(\as)=1 ] \ .\ ] ]  for a set to be a valid distinguisher , it has to be closed under composition with all resources and converters . for a converter and a resource , define a distinguisher closed under composition with a set of converters and a set of resources , and a set of resources to be valid , they also have to be closed under composition , i.e. , for all and all , ] if for all , all and all , for example , the set of all possible distinguishers is closed under composition with the sets of all possible converters and resources , and is used for information / theoretic security .the set of all efficient distinguishers is closed under composition with the sets of all efficient converters and resources , and is used for computational security . the fact that the distinguishing advantage is non / increasing under composition ( see on ) follows directly from the closure of the distinguisher , .   in this sectionwe briefly sketch why the security criteria of guarantee that the composition of two secure protocols is also secure .we write up the argument in the case where an adversary is present ( from ) .the case with no adversary follows similarly with the simulator removed and a filter connected to eve s interface of every resource .proofs of this can be found in .let protocols and construct from and from within and , respectively , i.e. , it then follows from the triangle inequality of the distinguishing metric that constructs from within ,   to see why this holds when an adversary is present , note that since can not be distinguished from with advantage greater than , by a distinguisher running in particular can not distinguish them . hence likewise , a distinguisher running does not know if it is interacting with or , i.e. , combining the two equations above , we get   so there exists a simulator , namely , such that the real and ideal systems can not be distinguished with advantage greater than .the argument for parallel composition is similar to that of sequential composition .let and construct and from and within and , respectively , i.e. , if these resources and protocols are composed in parallel , we find that constructs from within , where is the filtered resource consisting of the parallel composition of the resources and filters from and .  for the casewhere an adversary is present , this can be proven as follows . from the definition of parallel composition of converters in wehave since for some , can not be distinguished from with advantage greater than , by running in parallel can not help the distinguisher , hence for the same reason we also have combining the equations above and one more use of , we obtain   thus , there exists a simulator , namely , such that the real and ideal systems can not be distinguished with advantage greater than .in this section we model recursive composition of an authentication protocol and qkd . starting with a short ( uniform ) key, we construct an authentic channel , which is then used in a qkd protocol to obtain a long key . part of this new key is then consumed in another round of authentication , which is used by qkd , resulting in more shared secret key .this can be repeated indefinitely . from the composability of the security definitions we immediately have that the total failure is bounded by the sum of the individual failures of ( each run of ) each protocol .the goal of this section is to write this out explicitly : we show that where and are registers containing all shared , unused secret keys generated in rounds of authentication and qkd , contains the adversary s information , and are the states obtained by a distinguisher interacting with the real and ideal systems , by conditioning on obtaining a key and writing it as , because the repetitions of the protocol lead to events : it never aborted , aborted after one round , two rounds , etc . ] and and are the ( probabilities of ) failure of the authentication and qkd protocols in each round . is half of that in round , and the sum is bounded for all . ]  for this recursive construction it is not necessary to use the ( interactive ) authentication protocol of renner and wolf  which only requires a password .instead we use the simpler universal hashing of wegman and carter  , which appends a tag to the message that is sent , but requires an ( almost ) uniform key .a more detailed analysis of this authentication method , including key recycling and a proof that strong universal hashing meets the corresponding security definition can be found in .  inwe sketch how to construct an authentic channel from a shared secret key and insecure channel resource , and provide a generic simulator . in we compose multiple authentication protocols in parallel so that we may have multiple use authentic channels in qkd . inwe compose such a construction with qkd , obtaining a key expansion protocol . andfinally in we iteratively compose a key expansion protocol with itself , resulting in a continuous stream of secret key bits .the qkd and one - time pad protocols discussed in this work make use of authentic channels as depicted in , which always deliver the correct message to the receiver .this is however impossible to construct from an insecure channel , since eve can always cut the communication between alice and bob , and prevent any message from being transmitted .what can be constructed , is a channel which guarantees that bob does not receive a corrupted message .he either receives the correct message sent by alice , or an error , which symbolizes an attempt by eve to change the message .this can be modeled by giving eve s idealized interface two controls : the first provides her with alice s message , the second allows her to input one bit that prevents alice s message from being delivered to bob and produces an error instead .we illustrate this in .[ .5][l ]  ( keybox ) at ( 0,0 ) ; ( alice ) at ( -2.6,0 ) alice ; ( bob ) at ( 2.6,0 ) bob ; ( eve ) at ( 0,-1.7 ) eve ; ( ajunc ) at ( eve.north |- alice ) ;  ( alice ) to node[pos=.06,auto ] node[pos=.94,auto ] ( bob ) ; ( ajunc.center ) to node[pos=.85,auto ] ( eve ) ;  [ .5][r ]  ( keybox ) at ( 0,0 ) ; ( alice ) at ( -2.6,0 ) alice ; ( bob ) at ( 2.6,0 ) bob ; ( eve ) at ( 0,-1.7 ) eve ; ( ajunc ) at ( eve.north west |- alice ) ;  ( alice ) to node[pos=.12,auto ] ( 0,0 ) to node[pos=.5 ] ( ejunc ) + ( 160:-.8 ) ; ( ajunc.center ) to node[pos=.85,auto , swap ] ( eve.north west ) ; ( .8,0 ) to node[pos=.9,auto ] ( bob ) ; ( ejunc.center |- eve.north ) to node[pos=.15,auto , swap ] ( ejunc.center ) ;  a construction of this authentic channel resource from an insecure channel and a shared secret key resource is typically accomplished by computing the hash of the message , and sending the string to bob , where is the shared secret key and a family of hash functions  .alice s part of the authentication protocol thus gets a key from an ideal key resource , a message from alice , and sends down the insecure channel .when bob receives a string , he needs to check whether .his part of the protocol gets a key from an ideal key resource , a message from the channel , and outputs if , otherwise an error .if the ideal key resource used by both players produces an error instead of a key , alice and bob abort , and the protocol is trivially secure .so for simplicity we omit this possibility in the following , and assume that they always get a shared secret key .this is depicted in .2.89 .75  ( a1 ) at ( - , ) ; ( a2 ) at ( -,0 ) ; ( a3 ) at ( -,- ) ; ( a ) at ( -,0 ) + ; at ( a.north west ) ; ( alice ) at ( -,0 ) ;  ( b1 ) at ( , ) ; ( b2 ) at ( , 0 ) ; ( b3 ) at ( , - ) ; ( b ) at ( , 0 ) + ; at ( b.north west ) ; ( bob ) at ( , 0 ) ;  ( keybox ) at ( 0 , ) ; ( key ) at ( 0 , ) key ; at ( keybox.north west ) secret key ; ( channel ) at ( 0,- ) ; at ( channel.north west ) insecure channel ; ( eveleft ) at ( -.4,-1.75 ) ; ( everight ) at ( .4,-1.75 ) ; ( ajunc ) at ( eveleft |- a3 ) ; ( bjunc ) at ( everight |- b3 ) ;  ( key ) to node[auto , swap , pos=.3 ] ( a1 ) ; ( key ) to node[auto , pos=.3 ] ( b1 ) ;  ( alice.center ) to node[auto , pos=.4 ] ( a2 ) ; ( b2 ) to node[auto , pos=.75 ] ( bob.center ) ;  ( a3 ) to ( ajunc.center ) to node[pos=.8,auto , swap ] ( eveleft.center ) ; ( everight.center ) to node[pos=.2,auto , swap ] ( bjunc.center ) to ( b3 ) ;  in the case where no adversary is present and filters cover eve s interfaces of figures [ fig : auth.resource.switch ] and [ fig : auth.real ] , the real and ideal systems are indistinguishable as they are both identity channels which faithfully transmit from alice to bob .so in the following we only consider the case where an adversary is present , condition  in .  in the ideal setting, the authentic channel ( ) has the same interface on alice s and bob s sides as the real setting ( ): alice can input a message , and bob receives either a message or an error .however , eve s interface looks quite different : in the real setting she can modify the transmission on the insecure channel , whereas in the ideal setting the adversarial interface provides only controls to read the message and interrupt the transmission . fromwe have that an authentication protocol constructs the authentic channel if there exists a simulator that can recreate the real interface while accessing just the idealized one . an obvious choice for the simulator is to first generate its own key and output .then upon receiving , it checks if and cuts the transmission on the authentic channel if this does not hold .we illustrate this in .-1.1 .75 ( channel ) at ( 0 , ) ; at ( channel.north west ) authentic channel ; ( alice ) at ( - , ) ; ( bob ) at ( , ) ;  ( sim ) at ( 0 , ) ; at ( sim.north west ) ; ( sleft ) at ( -.809 , ) ; ( sright ) at ( .809 , ) ; ( sim.north ) to ( sim.south ) ;  ( ajunc ) at ( sleft |- alice ) ; ( bjunc ) at ( sright |- bob ) ;  ( alice.center ) to node[pos=.15,auto ] ( .4 , ) to node[pos=.54 ] ( ejunc ) + ( 160:-.8 ) ; ( ajunc.center ) to node[pos=.63,auto , swap ] ( sleft ) ; ( 1.2 , ) to node[pos=.75,auto ] ( bob.center ) ; ( sright ) to node[pos=.4,auto , swap ] ( ejunc.center ) ;  ( sltext ) at ( -.809 , ) ; ( srtext ) at ( .809 , ) + ;  ( eveleft ) at ( sleft |- 0 , ) ; ( everight ) at ( sright |- 0 , ) ; ( sleft ) to node[pos=.75,auto , swap ] ( eveleft.center ) ; ( everight.center ) to node[pos=.25,auto , swap ] ( sright ) ;  ( key ) at ( .15,+.8 ) key ; ( key ) to ( sleft ) ;  an authentication protocol is then /secure if figures [ fig : auth.real ] and [ fig : auth.ideal ] are /close , i.e. , portmann  showed that is satisfied if the hash functions used are /almost strongly universal . if any two different messages are almost uniformly mapped to all pairs of tags . ]in we modeled one run of an authentication protocol , that constructs a one - time use authentic channel .in general , qkd protocols require multiple rounds of authenticated communication .this is achieved by running the same protocol in parallel multiple times with new keys .it is straightforward from , , and that parallel repetitions of the authentication protocol are /close to ideal authentic channels and simulators in parallel ,   in the following , when we speak of the authentication used in qkd we always refer to parallel repetitions of the protocol that construct multiple use authenticated channels . for simplicity, we use the same notation for multiple authentic channels as we have for single channels we denote the resulting multiple use authentic channel by , as well as for the multiple use insecure channel , for a key sufficiently long for authenticating every message and for the accumulated failure of all parallel repetitions in one round of qkd .let be an authentication protocol which constructs with failure a ( multiple use ) authentic channel from a short secret key of length , , and an insecure classical channel , let be a qkd protocol which constructs with failure a long secret key of length , , from an authentic channel and an insecure quantum channel , by sequentially composing the two protocols , we immediately have that constructs a long secret key from a short secret key and insecure channels and , with failure , the generic argument for sequential composition is given in . herewe illustrate it in the special case of authentication and qkd , and draw it in .  2.25 .75  ( a1 ) at ( - , ) ; ( a2 ) at ( -,0 ) ; ( a3 ) at ( -,- ) ; ( a ) at ( -,0 ) ; at ( a.north west ) ; ( alice ) at ( -,- ) ;  ( b1 ) at ( , ) ; ( b2 ) at ( , 0 ) ; ( b3 ) at ( , - ) ; ( b ) at ( , 0 ) ; at ( b.north west ) ; ( bob ) at ( , - ) ;  ( keybox ) at ( 0 , ) ; ( key ) at ( 0 , ) ; at ( keybox.north west ) secret key ;  ( f1 ) at ( -,0 ) ; ( f2 ) at ( -,- ) ; ( f3 ) at ( -,-2 * ) ; ( f ) at ( -,- ) ; at ( f.north west ) ;  ( g1 ) at ( , 0 ) ; ( g2 ) at ( , - ) ; ( g3 ) at ( , -2 * ) ; ( g ) at ( , - ) ; at ( g.north west ) ;  ( eveq1 ) at ( -2 * , ) ; ( juncq1 ) at ( eveq1 |- f3 ) ; ( eveq2 ) at ( - , ) ; ( juncq2 ) at ( eveq2 |- f3 ) ; ( evec1 ) at ( 0 , ) ; ( juncc1 ) at ( evec1 |- a3 ) ; ( evec2 ) at ( , ) ; ( juncc2 ) at ( evec2 |- a3 ) ;  ( key ) to ( a1 ) ; ( key ) to ( b1 ) ;  ( a2 ) to node[auto , pos=.5,swap ] ( f1 ) ; ( b2 ) to node[auto , pos=.5 ] ( g1 ) ;  ( a3 ) to ( juncc1.center ) to node[pos=.85,auto , swap ] ( evec1.center ) ; ( evec2.center ) to node[pos=.19,auto ] ( juncc2.center ) to ( b3 ) ;  ( f3 ) to ( juncq1.center ) to node[pos=.7,auto , swap ] ( eveq1.center ) ; ( eveq2.center ) to node[pos=.34,auto ] ( juncq2.center ) to ( g3 ) ;  ( f2 ) to node[auto , pos=.8,swap ] ( alice.center ) ; ( g2 ) to node[auto , pos=.8 ] ( bob.center ) ;  -1.85 0  ( channel ) at ( 0 , ) ; ( c0 ) at ( 0 , ) ; at ( channel.north west ) authentic channel ; ( alice ) at ( - , ) ; ( bob ) at ( , ) ;  \(f ) at ( - , ) ; ( f1 ) at ( - , ) ; ( f2 ) at ( - , ) ; ( f3 ) at ( - , ) ; at ( f.north west ) ;  \(g ) at ( , ) ; ( g1 ) at ( , ) ; ( g2 ) at ( , ) ; ( g3 ) at ( , ) ; at ( g.north west ) ;  ( sim ) at ( 0 , ) ; at ( sim.north east ) ; ( sleft ) at ( -.809 , ) ; ( sright ) at ( .809 , ) ; ( srright ) at ( , ) ; ( scenter ) at ( 0 , ) ; ( c1 ) at ( sleft |- f1 ) ; ( c2 ) at ( sright |- g1 ) ;  ( c0 ) to node[pos=.5,auto , swap ] ( f1 ) ; ( c0 ) to node[pos=.5,auto ] ( g1 ) ; ( c1 ) to node[pos=.5,auto , swap ] ( sleft ) ; ( sright ) to node[pos=.5,auto , swap ] ( c2 ) ;  ( eveq1 ) at ( -2 * , ) ; ( juncq1 ) at ( eveq1 |- f3 ) ; ( eveq2 ) at ( - , ) ; ( juncq2 ) at ( eveq2 |- f3 ) ; ( evec1 ) at ( 0 , ) ; ( evec2 ) at ( , ) ;  ( scenter ) to node[pos=.8,auto , swap ] ( evec1.center ) ; ( srright ) to node[pos=.78,auto , swap ] ( evec2.center ) ;  ( f2 ) to node[auto , pos=.8,swap ] ( alice.center ) ; ( g2 ) to node[auto , pos=.8 ] ( bob.center ) ; ( f3 ) to ( juncq1.center ) to node[pos=.7,auto , swap ] ( eveq1.center ) ; ( eveq2.center ) to node[pos=.34,auto ] ( juncq2.center ) to ( g3 ) ;  -1.3  ( channel ) at ( 0,0 ) ; ( c0 ) at ( 0,0 ) ; at ( channel.north west ) secret key ; ( alice ) at ( -,0 ) ; ( bob ) at ( , 0 ) ;  ( simqkd ) at ( - , ) ; at ( simqkd.west ) ; ( pleft ) at ( -2 * , ) ; ( pcenter ) at ( - , ) ; ( pright ) at ( 0 , ) ;  ( simauth ) at ( , ) ; at ( simauth.east ) ; ( qleft ) at ( 0 , ) ; ( qcenter ) at ( , ) ; ( qright ) at ( 2 * , ) ;  ( ajunc ) at ( pcenter |- alice ) ; ( bjunc ) at ( qcenter |- bob ) ; ( c0 ) to node[pos=.8,auto , swap ] ( alice ) ; ( c0 ) to node[pos=.8,auto ] ( bob ) ; ( pcenter ) to node[pos=.45,auto , swap ] ( ajunc ) ; ( qcenter ) to node[pos=.48,auto , swap ] ( bjunc ) ;  ( peve1 ) at ( -2 * , ) ; ( peve2 ) at ( - , ) ; ( qeve1 ) at ( , ) ; ( qeve2 ) at ( 2 * , ) ;  ( pleft ) to node[pos=.84,auto , swap ] ( peve1 ) ; ( peve2 ) to node[pos=.18,auto ] ( pcenter ) ; ( pright ) to node[pos=.5,auto ] ( qleft ) ; ( qcenter ) to node[pos=.6,auto , swap ] ( qeve1 ) ; ( qright ) to node[pos=.55,auto , swap ] ( qeve2 ) ;  depicts the real world : the two protocols are composed in sequence and run using the short key and insecure channel resources . inwe have a system consisting of the real qkd protocol and the ideal authentic channel and simulator .we know that the black parts of figures [ fig : ex.auth.real ] and [ fig : ex.auth.hybrid ] are /close , so adding the qkd protocol in gray can only reduce the distance .depicts the ideal secret key resource and simulators . by removing the dashed simulator from figures [ fig : ex.auth.hybrid ] and [ fig : ex.auth.ideal ] , we recover the real and ideal qkd systems from figures [ fig : qkd.real.adv ] and [ fig : qkd.ideal ] with an extra switch on the authentic channel in the real system and on the secret key resource in the ideal system . since these are /close , so are figures [ fig : ex.auth.hybrid ] and [ fig : ex.auth.ideal ] . putting the two statements together with the triangle inequalityfinishes the argument .this reasoning is summed up in the following equation , which can be directly derived from , and :   let be the state gathered by a distinguisher interacting with the real system from and be the state gathered by the distinguisher interacting with the ideal system from . by the argument above we have    in we show that the composition of qkd and authentication i.e. , key expansion constructs a long key from a short key and insecure channels . to show that this can be done recursively , we need to argue that part of the long keycan be kept for the next round of key expansion .so far the secret keys have been treated as blocks , entirely consumed by a protocol , which is not convenient for the analysis of a protocol that uses only part of a key .instead , we should think of these key resources e.g. , and in figures [ fig : ex.auth.real ] and [ fig : ex.auth.ideal ] as a parallel composition of resources that produce a single bit of key , i.e. , , where is the instance of a resource that produces one bit of key ( or an error message ) at alice and bob s interfaces , and has a switch at eve s interface that decides if it produces the key or error .  then , a proof that is immediately also a proof that for any . iterating the protocol timeswe get where and are instances of the resources and in parallel , and is times the sequential composition of . follows immediately from this .we are greatly indebted to the following people for having proofread an initial draft and provided us with invaluable feedback and comments : rotem arnon friedman , normand beaudry , vedran dunjko , felipe lacerda , charles ci wen lim , christoph pacher , joseph renes , marco tomamichel , and nino walenta .this work has been funded by the swiss national science foundation ( via grant no .200020 - 135048 and the national centre of competence in research ` quantum science and technology ' ) , the european research council erc ( grant no .258932 ) and by the vienna science and technology fund ( wwtf ) through project ict10 - 067 ( hipanq ) .charles h. bennett and gilles brassard .quantum cryptography : public key distribution and coin tossing . in _ proceedings of ieee international conference on computers , systems , andsignal processing _ , pages 175179 , 1984 .eli biham , michel boyer , p. oscar boykin , tal mor , and vwani roychowdhury .a proof of the security of quantum key distribution ( extended abstract ) . in _ proceedings of the 32nd symposium on theory of computing , stoc 00 _ , pages 715724 .acm , 2000 . .michael ben - or , michael horodecki , debbie leung , dominic mayers , and jonathan oppenheim . the universal composable security of quantum key distribution .in _ theory of cryptography , proceedings of tcc 2005 _ , volume 3378 of _ lecture notes in computer science _ , pages 386406 .springer , 2005 . .michael backes , birgit pfitzmann , and michael waidner . a general composition theorem for secure reactive systems . in _ theory of cryptography ,proceedings of tcc 2004 _ , volume 2951 of _ lecture notes in computer science _ , pages 336354 .springer , 2004 ..   ran canetti .universally composable security : a new paradigm for cryptographic protocols . in_ proceedings of the 42nd symposium on foundations of computer science , focs 01 _ , pages 136145 .ieee , 2001 ..   ran canetti , yevgeniy dodis , rafael pass , and shabsi walfish .universally composable security with global setup . in _ theory of cryptography , proceedings of tcc 2007_ , volume 4392 of _ lecture notes in computer science _ , pages 6185 .springer , 2007 . .. constructive cryptography a new paradigm for security definitions and proofs . in _ proceedings of theory of security and applications , tosca 2011 _ , volume 6993 of _ lecture notes in computer science _ , pages 3356 .springer , 2012 . .dominic mayers .quantum key distribution and string oblivious transfer in noisy channels . in _ advances in cryptology crypto 96 _ , volume 1109 of _ lecture notes in computer science _ , pages 343357 .springer , 1996 . .birgit pfitzmann and michael waidner .composition and integrity preservation of secure reactive systems . in _ proceedings of the 7th acm conference on computer and communications security , css 00_ , pages 245254 .acm , 2000 . .birgit pfitzmann and michael waidner . a model for asynchronous reactive systems and its application to secure message transmission .ieee symposium on security and privacy _ , pages 184200 .ieee , 2001 . .renato renner and robert knig .universally composable privacy amplification against quantum adversaries . in joekilian , editor , _ theory of cryptography , proceedings of tcc 2005 _ , volume 3378 of _ lecture notes in computer science _ , pages 407425 .springer , 2005 . .renato renner and stefan wolf .unconditional authenticity and privacy from an arbitrarily weak secret . in_ advances in cryptology crypto 2003 _ , volume 2729 of _ lecture notes in computer science _ , pages 7895 .springer , 2003 . .valerio scarani , helle bechmann - pasquinucci , nicolas j. cerf , miloslav du ek , norbert ltkenhaus , and momtchil peev .the security of practical quantum key distribution ., 81:13011350 , september 2009 . .marco tomamichel , christian schaffner , adam smith , and renato renner .leftover hashing against quantum side information . in_ proceedings of 2010 international symposium on information theory , isit _ , pages 27032707 .ieee , 2010 . .dominique unruh .universally composable quantum multi - party computation . in _ advances in cryptology eurocrypt 2010 _ , volume 6110 of _ lecture notes in computer science _ , pages 486505 .springer , 2010 . .

Abstract: this work is intended as an introduction to cryptographic security and a motivation for the widely used quantum key distribution ( qkd ) security definition . we review the notion of security necessary for a protocol to be usable in a larger cryptographic context , i.e. , for it to remain secure when composed with other secure protocols . we then derive the corresponding security criterion for qkd . we provide several examples of qkd composed in sequence and parallel with different cryptographic schemes to illustrate how the error of a composed protocol is the sum of the errors of the individual protocols . we also discuss the operational interpretations of the distance metric used to quantify these errors .


the concept of photometric redshift estimation is over four decades old . since methodology has changed only incrementally but its role in astronomy has completely spun around .the astronomy community originally received the idea with serious skepticism , which , over time , thanks to a series of breakthroughs in the field ( e.g. , * ? ? ?* ; * ? ? ?* ) , slowly faded . todaythe next generation telescopes plan to perform photometric observations only , and completely rely on these kind of estimation techniques for most of their key science projects including cosmology and large - scale structure .while getting ready for extracting most of our new scientific knowledge from photometric measurements , we have to examine the current limitations of the various techniques and understand the underlying assumptions .essentially all currently existing implementation can be categorized into two classes of methods : empirical estimators and template fitting .reviewing the history of the research area is outside the scope this study ; see for a rich cross section of the field instead ; now we look at the basic concepts and the differences in the traditional methodologies .empirical methods map the relation of the observed and desired properties using a training set ; e.g. , piecewise linear or polynomial fitting , or via other regression methods like artificial neural nets , support vector machines , etc .template - fitting techniques rely on prior knowledge encoded in the model s spectral energy distributions ( seds ) that can be matched to observations .why are the current implementations of these two so different ?there is no fundamental reason , e.g. , one could generate training sets from model templates .why do only template - fitting algorithms use photometric uncertainties and not the empirical ones ? why do people estimate the redshifts independently from other physical properties , e.g. , often use empirical redshift estimates and then template spectra for type determination ? we knowthese quantities are correlated and should be dealt with in a consistent way . the answers to these questionsare usually direct consequences of limitations in the models and the measurements .if the model seds matched all the observations , we would know everything about all the objects in the universe .the uncertainties would be used more often if they provided reliable extra information .the `` photo - z '' label currently associated with the above methods , should gain a new meaning .we should expect more from the codes than a single estimate per object . the implementations need to provide the full joint probability density functions of all desired physical parameters ,so we can develop new statistical tools that utilize all the information available .  in this paper, we are not concerned with what observables are the best to use or which filter set is optimal for special cases of the generalized photometric inversion problem , which depend on the specific science cases , instead we derive a probabilistic formalism to address the common issues . in section [sec : method ] , we introduce the methodology and derive the formulas for determining the photometric constraints on physical properties . section [ sec : models ] , describes the traditional empirical and template - fitting algorithms as special cases of the proposed framework , and the advanced techniques that go beyond their limits . in section [ sec : disc ] , we illustrate the concepts and detail the practical aspects . section [ sec : sum ] concludes our study .  throughout the paper ,we use the capital letter for probabilities and the lower - case letter for probability density functions , or pdfs for short .we start by formulating the problem as general as possible .the challenge is to constrain physical properties of sources with some observables in a data set denoted by , hereafter the query set .since model spectra would never be perfectly suitable for all desired parameters , one will need a training set , .in fact there is no reason to demand that these data sets have the same observables .the mapping is provided by some model , .for example , magnitudes of different photometric systems can be mapped on to one another , say , observations to  by empirical formulas . in general , let be a set of observables in the training set that also contains extra information about the physical properties , and let denote the observables of the query set .our model is parameterized by a vector ; the model can predict the observables and for a given parameter via the density and has a prior on its parameters .for example , one can build models based on the or templates that can be used to calculate the colors of sources at a given redshift in any particular photometric system .however , the modeling goes beyond just estimating the values for a given parameter , because the observational uncertainties also enter the formula .later on , we will discuss in details how to establish various models ; for now , the above functions are assumed to be known .furthermore , let us assume that the training set samples the entire space of the observables , and discuss the selection effects later .our goal is to derive the probability density function ( pdf ) of the physical properties for a given query point with observations using our model .this function , , is the solution of the generalized photometric inversion problem and the subject of this section .the next two paragraphs discuss probabilistic concepts analogous to elements of template fitting and empirical estimation , respectively , in the context of our probabilistic formalism .next we address the burning issues of selection effects and feasibility .the first step is to make the connection between the observables .it can be done formally by calculating the probability density of for the query point .we do this via the equality of where the right - hand side contains integrals of known functions over the model s parameter domain and over for the marginalization we see how this is superior to the techniques analogous to the traditional way .the usual solution involves fitting for the best - match model parameter using , for example , maximum likelihood estimation ( mle ) , and accepting that parameter at face value to derive the estimates . here, we consider all possible model parameters and add up their contributions .we note that the above general mapping formula is valid in case of improper priors , too , in the sense that the posterior is always properly normalized to unity . if one has no prior knowledge about the model parameters , and wishes to use a noninformative prior , e.g. , flat , formally he / she is allowed to do so ; see more on the priors later on .next we establish the relation between the observable and the desired physical parameters .the traditional way is to assume the properties of interest to be a function of the observables .some of the existing methods utilize explicit functions such as a polynomial or piecewise linear , while others use more obscure mappings such as a decision tree or an artificial neural net .conceptually , they are just assuming a fitting function which is tuned to reproduce the elements of the training set as best as possible .the problem with this assumption is that there is no guarantee that the same observables always correspond to the same properties .in fact , we know that degeneracies are present in most data sets . clearly , the above assumption is an unnecessary restriction over the general relation of and denoted by . in other words, the traditional model is using dirac s symbol .a better way is not to restrict the distribution arbitrarily to an unknown surface but to leave the formula general .we can establish the proper relation by observing the fact that the right - hand side is a ratio of two densities that ( both ) can be estimated from the training set , e.g. , using voronoi tessellation or kernel density estimation ( kde ) .  having derived the above relation, one can compute the final pdf of interest as the integral over the possible observables in the training set when it is possible to accurately characterize this distribution by a gaussian function or some mixture model , one can compress the numerical results into a few parameters . when the pdf is unimodal , which is often not the case , the expectation value should suffice for an estimate the above equation is similar to kernel regression in case of using kde , except it is a generalization to incorporate the uncertainties in the data sets .photometric redshifts and other such properties are often used in statistical studies for their availability for a large number of sources , even though they provide relatively loose constraints on individual objects .the full pdfs of the sources are best suited to derive the ensemble properties of entire catalogs or even specific subsamples .the distribution of the properties over a set of measurements is given by the average hence there is no need for an extra deconvolution step to recover the underlying distribution of the objects in a sample , because their average pdf is exactly that .a common example is the estimation of the redshift distribution for various subsamples , say , at different distances .when selection bias is not an issue for the scientific analysis , e.g. , lensing studies , one can even choose the subsets to optimize the contrast of the averaged pdfs .the inherent limitations of a finite training set pose a serious problem for any estimator , which is often neglected .our formalism introduced earlier is no exception , hence we now turn to examine the effects .the selection function is the probability of a source , with observables making it into the training set , .the region that the training set can sample is the window function , which takes the value of 1 where the selection function is nonzero , and 0 otherwise .for example , for a survey that has a magnitude limit of 22 in a band .the selection function is expected to enter our method at two separate places : the marginalization over and via the density estimates used for the relation .the former appears to be inevitable but causes problems only at the boundaries of the selection criteria .if the integrand in equation ( [ eq : pz ] ) vanishes within the integration domain of the window function , the results are valid .otherwise the estimated pdf is biased in an unknown way .the probability of being inside the window function is the right indicator of the problem occurring when this probability is close to 1 , the training set provides good support for the photometric inversion problem , but when the value is low , the query point is known to be outside the regime of the training set .the relation between the desired properties and the observables is the other issue as it is only probed on the training set .the relation as seen on the training set depends on the true relation and the selection function via the equation if the selection function strictly depends only on , we have and find that the empirical relation is identical to the true one on the selection domain . if the sampling frequency is low , the measured relation is noisier and less robust numerically .this is a critical point , which is worth emphasizing once again : the equality holds only if does not influence the selection in any way , not even indirectly via some hidden parameter .a counter example is the common case of cutting on morphological parameters in the selection function , while only considering the fluxes for .another interesting consequence is that one can not use only the colors to estimate , say , photometric redshifts , if a magnitude cut was involved in the selection of the training set .yet another issue is cosmic variance , which might cause the relation to depend on the position in the sky .the solution in all cases is to revise the selection of the training set , if possible , or to add the hidden observables into , and extend the model to include them .previously we have hinted at how models can be constructed but , until now , they have just been assumed to be known . a model is a combination of the limitations in our observations , both in the training and query sets , and the parameterization of the observables . from discussing the topic in the most general way, we now turn to the practicalities of real - life astronomical observations.  today the errors of extracted fluxes of photometric measurements are independent estimates of the uncertainties in the separate passbands .typically , gaussian errors are assumed , and the catalogs would quote 1 values for every source . analyzing the repeated observations in the sloan digital sky survey ( sdss ;* ) , have shown that this simple picture is wrong , and the off - diagonal elements of the covariance matrix are significant .this is not surprising .one of the major components in the photometric uncertainty is the error in the determination of the aperture . if the multicolor measurements share a common aperture , e.g. , sdss model magnitudes that are best suited for colors , the flux measurements will be inevitably correlated .thus an improved error model of the photometric observations is described by a multivariate normal distribution , , with a mean of and covariance matrix .the next generation survey telescopes that plan to visit the sources on multiple occasions will be able to better determine the full covariance matrices from actual observations to improve our understanding of the errors .hence , for now it is general enough to consider error estimates that are fully described by the covariances .  in this reasonable approximation ,the mapping is also a normal distribution with a full covariance matrix that includes cross - catalog terms , if necessary , that go beyond the calibration work on the individual catalogs .if the apertures are locked together for better color determination , one has to obtain the dependencies via a data set that contains sources with all and measurements .however , when the processing pipelines are independent , one can assume that the uncertainties in and are also independent , and write a realistic as the product of the two gaussians : the dependences in the means and are straightforward to model and , even in the most complicated case , are similar , in spirit , to the traditional template - fitting procedures . for example , when considering a synthetic model of galaxies , one has to vary the redshift , age , optical depth , and so on , to derive high - resolution model spectra for different parameters , and then convolve them with the broadband filters to get the fluxes .clearly modeling the covariance matrices is more complicated and would require many more parameters to model accurately. if is a minimal set of parameters that is enough to describe and , there are some other hidden parameters or hyperparameters that are also needed for the covariances .the fully bayesian way is to establish the relation of the covariance matrix and the hyperparameters along with a hyperprior ( the prior on the hyperparameters ) , and to marginalize over the extra dependence . even though , this relation between the elements of the covariance matrix and the observables could , in principle , be modeled based on the catalogs , it may prove impractical .the empirical bayes approach , admittedly more optimistic but easily quantifiable , is to find the most likely hyperparameter and substitute it into the dependence . in practice ,for every parameter , one can find the values of and and the closest measurement points , whose covariance matrices are good estimates .if the covariance matrix changes slowly with compared to its widths , one can safely calculate the values at the catalog points by using the corresponding error matrices , the only concern with this approximation is the noise on the elements of the covariance .if needed , one could improve on the stability by smoothing or fitting locally over the catalog entries .the consequences of the model approximation in equation ( [ eq : normal ] ) are most intriguing from the implementation aspect of the methodology . as long as we only evaluate the pdfs at the observed locations , the calculations are more straightforward and computationally less expensive .the field of numerical evaluation of complicated multidimensional integrals that usually emerge in bayesian analysis such as ours is well studied .the solution typically involves some randomized algorithms that range from simple direct sampling from the prior to adaptive strategies often based on markov chain monte carlo ( mcmc ) methods , e.g. , gibbs sampling .although this topic is beyond the scope of the present discussion , we briefly touch on the basic idea to illustrate the concepts and provide some insight on how to derive the final results numerically , namely the value of and the function .the clever construction of the chain in the mcmc algorithm yields model parameters that can be considered independent random realization drawn from the posterior distribution , in our case . with the chain in hand , one can readily approximate the integral by the average over the mcmc samples .the mapping of the observables then becomes where is the index of the training point closest to .when the query point is well within the regime of the training set , this approximation is valid .what happens otherwise ? often the uncertainties are larger outside the selection criteria , e.g. , the photometric errors beyond the flux limit . by using the covariance matrix of the closest training point ,one actually artificially decreases the contribution to the integral making tighter .while the accuracy of the calculation is affected , the change is such that it reduces the value of the integral in , which is the measure of reliability .hence , if we measure a large value , we can be confident of the result .having said that we note that in practice the covariances probably do not change fast enough to pose a significant problem in this calculation for the objects along the edge of the selection function , and farther away the probabilities are very small anyway .once we know that the estimation is in the safe regime , we can compute the integral ignoring the window function completely by summing up at preset points in our region of interest , e.g. , a fine redshift grid , as where the densities and the matrix are obtained from the numerical density estimates once for the training set ; see equation ( [ eq : zx ] ) . here , we made use of the fact that the points are ( naturally ) drawn from the distribution .  in order to perform these summations efficiently for many query points , one has to utilize fast searching mechanisms in the space of the observables .the situation is complicated by the strong correlation in the observables and the varying mahalanobis metric , yet , a significant speedup can be achieved by adequate multidimensional indexing of the color space as described in .   in classical sed - fitting approaches, one does not technically have a training set .although , formally it can be generated from a grid of model parameters as , where is often simply a subset of , e.g. , the redshift is just one of the parameters in the models of seds .traditionally , this artificial training set has no errors associated with the reference points , hence we have and , assuming has an inverse , the analytical calculation yields an intuitive result , where the grid points are weighted by their likelihood multiplied by the corresponding prior in the limit of a flat prior , this is the classic mle case , which is equivalent to the minimization techniques used in most sed - fitting implementations today , where the measurements are compared to the simulated observations at the grid points to select the optimum .one obvious exception is the algorithm of , which actually applies an explicit empirical redshift prior in this equation , hence it is often referred to as `` bayesian . ''the selection of a set of templates is another simple prior but on the spectral type , even if well hidden , implicit , and not often admitted .researchers routinely seek for templates that provide the best redshift estimates . strictly speaking ,this is cheating .the selection should be based on how well the templates represent the data in the space of the observables , and not based on their performance in the estimation .naturally , there is a connection , but not in that direction .the templates that follow the data will likely provide better estimates ; however , templates that yield good estimates are not guaranteed to match the data .the development of a class of methods by and can be considered early attempts to achieve a better sed prior . here , the templates are statistically modified to represent the observations more accurately , while not optimized for redshift estimation whatsoever .clearly , these are just the first steps in this direction . instead of just assigning 1 and 0 weights to the templates by either including them or not ( respectively ) as typically done today, one can explicitly formalize more realistic priors over a broader range of seds that are driven by scientific knowledge and/or ensemble statistics .an obvious but rather important improvement in the new framework is the ability to naturally introduce and utilize the uncertainties of the template spectra .we know that the models are not perfect , and this can be easily characterized . as an example, one can use the same prescription for the spectral synthesis , but build on a various stellar libraries to analyze the differences . when using empirical templates , the implementation is even more evident .we fold in the uncertainties by abandoning the simplified relation in equation ( [ eq : diracx ] ) and creating a more realistic model with the estimated finite errors .   the new methodology in the limit of the classic empirical algorithms goes well beyond the usual techniques , which consist of simply establishing the fitting function in equation ( [ eq : fit ] ) .we can utilize those fits ( or preferably estimate the densities numerically to map the full relation ) , but we can also properly consider the uncertainties .the parameterization of a minimalist model is done by a position in the space of the observables , i.e. , is the same type of quantity as and , e.g. , fluxes .namely , we choose and .even though the observables in and are the same quantities , the mapping is still required to fold in the photometric errors . with an improper flat prior , the mapping of the observables is integrated analytically while this model is clearly very simple , it is quite powerful and conceptually more sound than a number of traditional methods .we will use it for illustrations in the upcoming discussions .other simple forms of priors can also be handled analytically , e.g. , linear and gaussian , that may be reasonable approximations at least locally .otherwise we resort to the numerical evaluation .the problem with the classic empirical methods is the requirement of having the same set of observables for both the training and the query sets .the limitations of the sed - fitting techniques come from the fact that the models can not perfectly describe the relation of observables and the physical properties .  in the realm of our unified framework , we can have more advanced methods that combine these two previously separate classes of techniques .we can introduce new algorithms to take advantage of the training points even if their photometric observables differ from those in the query set .the idea is the following : true to the spirit of empirical methods , we utilize the training set to provide the relation between the physical properties we wish to constrain and some observables ; see equation ( [ eq : zx ] ) .in addition to this empirical relation , we apply a mapping from the observables of the query set to that of the training set based on sed modeling , like in the template fitting procedures .for example , if the training set contains magnitudes , one can map them to using equation ( [ eq : xy ] ) .the intriguing observation to make here is that one does not even need realistic physical models to start with , because the physics is in the training set and not the model .let us consider a model , which is a complete basis on the observed wavelength range , e.g. , legendre polynomials or fourier series with the parameterization by their coefficients .the manifold of the physical spectra is naturally contained within . in practice , this model needs to be only sufficiently complete and band - limited so that real seds can be well described ; this is a weak prior that we can set up based on all the spectra we observed and simulated before .a model spectrum corresponding to a certain parameter value in can be convolved with the appropriate transmission curves to yield the observables and , even if they are unphysical . hence, formally we have the basis of our mapping , .as long as the data provide good enough constraints on the model parameters , the mapping is valid and the algorithm follows the routine .when the observations barely constrain the model parameters and large volumes of unphysical seds have significant likelihood , the mapping will be wrong .the solution is to apply a prior to consider only the physical seds .using the entire catalog , one can derive an empirical physical prior statistically , which we will discuss in the next section .these new advanced methods overcome the usual difficulties in photometric redshift estimation , and offer a way out of the half - century - old dilemma .they are a natural extension of everything that has worked before in the field : a straightforward combination of the two previously separate methodologies .next we demonstrate the new framework in action by applying a simple model to real - life data , which is followed by discussions of the qualities of training sets and the prior .   to illustrate the concepts introduced earlier , we apply the aforementioned minimalist empirical model to a sample of galaxies .we choose sdss sources for their well - studied photometric uncertainties .following , we estimate the full covariance matrix for all objects , and utilize them in the subsequent analysis .we randomly select a quarter of the entire main galaxy sample ( mgs ; * ? ? ?* ) of dr6 to be the training set , roughly 100 thousand objects .our query set is a smaller disjoint random subset for illustration purposes .first , we map the observables ( magnitudes to magnitudes ) analytically using our simple model in equation ( [ eq : emp_map ] ) .the calculation is done inside the dr6 database by sql user - defined functions .next , we compute the conditional pdfs by a dual - tree kde implementation at preset locations defined by the training and query sets in magnitude space and a uniform high - resolution redshift grid . the practical complication with any density estimation is the fact that it is scale - dependent and changes with the metric .we are further limited in our applications to fix bandwidths for the conditional density estimation in the current implementation of the estimator .we adopt a bandwidth of in a metric that scales the magnitudes to the redshift . in other words , the resolution in redshift space is set by , the full width half maximum of the normal distributions , and we re - scale the magnitudes by a factor of to reasonably match the density of the sources in the separate subspaces .this simple technique is expected perform reasonably well within the regime where the sources are suitably dense but not in the outskirts where a larger variable bandwidth is needed in magnitude space .the theory of more sophisticated conditional density estimation is well - studied ( e.g. , * ? ? ?* ) , and advanced adaptive implementations are in the works to help out ( lee & gray , 2008 ; private communication ) .  figure [ fig : pdf ] illustrates the nature of the relation , in this case the multicolor measurements and redshift , as well as the final redshift distribution , , incorporating the photometric uncertainties in our model .we see that the redshift is really not a simple function of the magnitudes but rather a more general relation .this is even more so for observables that constrain the physical properties less than the measurements .the relation itself ( shown as a dotted line ) might provide an overly optimistic view of the uncertainties at times and usually much noisier than the final pdf ( shown in solid ) that sums up these relations with appropriate weights .the top panels show intrinsically red galaxies at three different redshifts , which were selected based on the mixing angle of the first two principal components , also known as the ` eclass ` in the sdss terminology .the bottom panels show the more problematic blue galaxies at similar redshifts .note the consistent performance of the estimator on the red sources as a function redshift in comparison to the blue galaxies that have broader pdfs at higher redshifts and are noisier , especially at the largest distances .  in the bottom rightmost panel ,the distribution is not even centered around the spectroscopic redshift , but skewed toward lower values .this object is very close to the edge of the training set , and the result would be considered unreliable due to the lack of calibrators at higher redshift that would still be within the sources photometric uncertainties .a very attractive feature of the new pdf estimator derived earlier in equation ( [ eq : res ] ) is its conceptual independence from the sampling of the calibrators .many statistical tools rely heavily on having a representative training set and only provide unbiased results in that limit . in our case , the training points simply provide locations where the evaluation is feasible and their density is essentially just a resolution factor .the sampling frequency of the training set only affects the accuracy of the numerical integral in equation ( [ eq : num_res ] ) but not in a systematic way as long as the query point is well within the boundaries of the window function .a denser training set will provide higher resolution in the summation , but there is a practical limit beyond which one expects no improvement .the reason is that the new calibrator sources are essentially identical to the ones already in the training set .the number of spectroscopic measurements to be carried out for calibration purposes is limited by finite resources .it is vital to acquire reliable training sets for the new generation photometric studies .a good training set has a well - defined selection function , using criteria based on only the observables one plans to model for the estimation , and , within that , a smart adaptive sampling strategy to optimize the coverage in observable space .clearly , the densest regions can be subsampled , but one needs all training points in the outskirts of the manifold for broad support .for this reason , the simplest random subsampling of the underlying population will not suffice .instead , a stratified sampling strategy is to be pursued .  to demonstrate that the methodology is robust to this kind of systematic changes in the training set, we create a stratified subset and perform the previous analysis the same way .the sampling is done by including sources randomly based on their local density in magnitude space .a galaxy is included in the training set only if the ratio of some constant and the local density is larger than a randomly generated real number , , uniform between 0 and 1 , i.e. , .we set the value of to yield a subsample that is half the size of the original data set .figure [ fig : strat ] shows the results for the previously selected sources based on the smaller stratified subset .the basic shape of the curves is practically the same in most cases , only somewhat noisier but without systematics .one exception is the blue galaxy at around , where the subsampling somewhat amplifies the effect of the large wall in sdss at .the blue galaxy at the highest redshift is essentially unchanged ( except for the part at the lowest redshift where the density in magnitude space is larger to start with ) because the stratified sampling ( by construction ) has no effect on its already very sparse neighborhood .optimal sampling is difficult to achieve . in fact , it is difficult even to define .in addition to the photometric uncertainties , the desired resolution of the physical quantities also sets limits on the sampling frequency . this is prominent in the case of degenerate regions where an extended part of the physical parameter space is cramped into a small volume of observables .simulations built on realistic sed models can help cross - check these factors , and evaluate the performance of the estimator ahead of time . in the ideal case, one would create stratified training sets in the space of the physical parameters instead of the observables , which should be more feasible in the near future with improved spectral modeling ( e.g. , * ? ? ?.   the distribution of sources in a training set may be artificial and , as we just argued , should be optimized for coverage with a practical upper bound on the density tuned to the photometric inaccuracies and source diversity .however , the distribution in the query set is often physical and can be used to derive an empirical prior for our model .the basic observation is that the density of sources in the query set , , should match the predicted density of the model , .the latter is calculated for any prior as the convolution , if we substitute measured from the sources on the left - hand side of the equation , the only unknown is the prior , which we can solve for using the elegant deconvolution technique of and .  to see whya physically sensible prior is important , let us consider the density of sources in the training set within the window function . since the density is proportional to the product of the underlying density and the selection function , a significant volume of the window function is not sampled by the training set , where is zero . without a reasonableprior , the mapping could yield wrong weights for unphysical observables in the summation of equation ( [ eq : pz ] ) .hence , any model needs some physical information . even if one is hesitant to take the empirical prior at face value , the domain of the model parameters should be carefully considered . in case of template fitting, this happens implicitly , even if not optimally , via the selection of the set or manifold of template spectra , but can be also done for even the empirical algorithms .starting from first principles of bayesian probability theory , we built a description and obtained the solution of the generic photometric inversion problem , where the physical properties of sources are constrained based on observational measurements .the new approach yields a formalism that encapsulates the field of photometric redshift estimation , and contains the traditional methods as special cases . in our systematic analysis of the mathematical problem , we put previous techniques in context and pointed out the directions for improvement in each .the proposed extensions to the current methods represent significant progress in more respects .we avoid the common assumption of the physical properties being a single - valued function of the observables by treating their relation in a more general way .thus the formalism is not prone to fail in regions , where the data sets are degenerate .we showed how to estimate the corresponding probability density of this relation .in addition , the uncertainties of the observables are propagated all the way to the results via explicit modeling of the accuracies .we discussed various aspects of the modeling from the simplest empirical case to the application of seds .this general framework allows for the construction of novel , more advanced methods that combine the attractive qualities of empirical and template - fitting algorithms .one can build empirical estimators based on training sets that have different observables from the query set , e.g. , photometry to , via sed modeling .we can improve the methods by creating more and more realistic models that include , for example , the strengths of the emission lines in galaxies ( following * ? ? ?* ) and their inclination angles ( based on * ? ? ?* ) among the model parameters to properly marginalize over the nuance parameters for a more reliable mapping of the observables .the current limitations come from the lack of good understanding of the photometric uncertainties . from previous studies , we know that the flux measurements in various passbands are correlated , yet , most catalogs only quote errors on the individual fluxes . for more precise scientific measurements via tighter photometric constraints , we need better photometric error models in the future .upcoming survey telescopes will observe all sources multiple times , hence will be able to get a better handle on the errors and their covariances .understadning these systematics is probably one of the highest priority tasks in the preparation for the upcoming era of photometric science .the proper solution of the generalized photometric inversion problem may be straightforward on paper , but efficient implementations of realistic models with appropriate priors involve many advanced concepts in statistics , and can only be built on the most recent and on - going developments in computer science , e.g. , multi - dimensional indexing in databases .even then the computations are not trivial to carry out , and have significantly higher demand for compute power than previous methods .the immediate future work is to have such a unified framework developed and ready for the next generation imaging surveys .the author is grateful to alexander s. szalay , istvn csabai and andrew j. connolly for originally introducing the problem , and for the countless inspiring discussions on various aspects of the topic over the course of many years ever since .the presented work has grown out of their collaboration on hubble space telescope and sloan digital sky survey data .also the author thanks dongryeol lee and alexander g. gray of the fastlab team at the georgia institute of technology for making their dual - tree kde implementation available for this work , and for their continuing support to the astronomy community .this study was supported by the gordon and betty moore foundation via gbmf 554 .budavri , t. , szalay , a.s ., connolly , a.j . ,csabai , i. & dickinson , m.e . , 1999 , in asp conf .proc . , 191 , photometric redshifts and high redshift galaxies , ed . r. j. weymann , l. j. storrie lombardi , m. sawicki , & r. brunner , ( san francisco , ca : asp ) , 19        connolly , a.j ., budavri , t. , szalay , a.s . , csabai , i. , & brunner , r.j . , 1999 , in _ photometric redshifts and high redshift galaxies , _ eds .r.j.weymann , l.j .storrie lombardi , m. sawicki , & r. brunner , ( san francisco : asp ) , 13

Abstract: we present a rigorous mathematical solution to photometric redshift estimation and the more general inversion problem . the challenge we address is to meaningfully constrain unknown properties of astronomical sources based on given observables , usually multicolor photometry , with the help of a training set that provides an empirical relation between the measurements and the desired quantities . we establish a formalism that blurs the boundary between the traditional empirical and template - fitting algorithms , as both are just special cases that are discussed in detail to put them in context . the new approach enables the development of more sophisticated methods that go beyond the classic techniques to combine their advantages . we look at the directions for further improvement in the methodology , and examine the technical aspects of practical implementations . we show how training sets are to be constructed and used consistently for reliable estimation .