Entanglement-Anchored Key Agreement

The honest claim

The marketing temptation around quantum entanglement in a messenger is to imply two endpoints share an entangled pair and derive a key from it. That is false for any device a user holds, and this paper refuses the claim. The claim made — and made demonstrable — is narrower and true:

Every online session key can be anchored to a real quantum measurement — ideally a published loophole-free Bell-test outcome — mixed in as a public, auditable co-factor under a post-quantum secret, such that anyone can verify after the fact that this specific session consumed that specific certified pulse, and such that the key is never weaker than the hybrid PQ floor even if the quantum source is absent, stale, or actively spoofed.

This is not QKD. Not quantum networking. Not quantum teleportation. We do not violate the no-communication theorem. We bind a key-derivation function to a verifiable physical measurement no classical adversary can fabricate in advance.

The value is not confidentiality from physics. It is anti-backdoor-RNG freshness — a subverted local CSPRNG loses purchase when the keying material also absorbs randomness whose provenance is a publicly published, independently verifiable measurement record — plus public auditability, session by session.

Background

Bell (1964) showed no local-hidden-variable theory reproduces all quantum correlations. CHSH (1969) turned that into a testable inequality:

S = E(a₀,b₀) + E(a₀,b₁) + E(a₁,b₀) − E(a₁,b₁)
|S| ≤ 2        for every classical (LHV) model
|S| ≤ 2√2 ≈ 2.828   quantum ceiling (Tsirelson, 1980)

A measured S above 2 certifies non-classicality — but only when the detection and locality loopholes are closed. Three groups closed both simultaneously in 2015; a public randomness beacon has published certified randomness extracted from a running loophole-free Bell test, hash-chained and precommitted, since 2025. That beacon class is the canonical external source this construction binds. The word "loophole-free" is reserved for it and appears nowhere else in this system's claims.

Construction

A pulse is produced by ingesting a beacon round or by an operator-run round that:

1. runs four CHSH circuits and computes S with its standard error — on co-located hardware this is a device-behaviour check under trusted-device assumptions, recorded only when S − 3σ > 2.0 so the flag cannot flip on shot noise;
2. estimates the generation bits' min-entropy conservatively — a tested subset of NIST SP 800-90B, self-labelled as such in the record and not CMVP/ESV-validated;
3. distills the raw bits through a Toeplitz strong extractor with output length m = ⌊H∞⌋ − 128, giving statistical distance ≤ 2⁻⁶⁴ from uniform when the min-entropy bound holds;
4. signs the canonical record with ML-DSA-87 and links it to the prior round by hash chain.

Verification is fail-closed and anchors trust to a caller-pinned public key, never a key carried inside the pulse. The verified output W then enters the existing QSEED aggregation path:

IKM  = DH || SS || W          // both secrets first, public co-factor last
key  = HKDF-Expand(HKDF-Extract(transcript_salt, IKM),
                   info = "QERYX-Q-ENTANGLE-WITNESS-v0.1" || ctx, L)

If W is empty (beacon unreachable) or rejected (verification failed), the binding degrades to the local OS/QRNG floor. The key is full-strength in every branch. Both endpoints pull the same pulse by index and bind the identical W; a spoofed pulse on one side surfaces as a handshake key mismatch and aborts the session — the co-witness is self-enforcing through the existing AEAD confirmation, with no new secret channel.

Security properties

Breaking a session remains exactly what it was: breaking both X25519 and ML-KEM-1024.

Honest limits

Stated plainly, because the credibility of the artifact depends on them:

• Attested, not endpoint-measured. The randomness is produced by a beacon or an operator's quantum processor — not by the two phones. The endpoints verify a published measurement; they do not perform one. This is fundamentally weaker than DIQKD and is not called DIQKD.
• An own-device CHSH run is a device-behaviour check. Co-located, circuit-model runs leave the detection and locality loopholes open; S > 2 there indicates quantum-consistent behaviour under trusted-device assumptions and is never used as a min-entropy bound.
• No phone-to-phone entanglement. No shared Bell pair, no entanglement distribution, no quantum channel. Any phrase implying "your phones are entangled" is banned in source, UI, and docs.
• Min-entropy estimation is a subset of SP 800-90B and not CMVP/ESV-validated; the record self-labels this.
• Beacon-operator trust reduces to a pinned key plus the beacon's own transparency guarantees; the verifier does not re-derive the physics. P1 ensures even a fully dishonest beacon cannot weaken the key.

Composition sketch

Model HKDF as a PRF/random oracle F keyed on the secret prefix. For any quantum-polynomial-time adversary, the advantage against key = F(salt, k_s || w) with public w is bounded by the advantage against the underlying key exchange plus the PRF term — adding a public input cannot help the adversary (the P1 upper bound). Against an adversary whose advantage came from predicting subverted local randomness, a genuine pre-committed pulse strictly reduces that advantage — a conditional benefit, never a load-bearing secrecy assumption. A full UC/game-based proof with the beacon precommitment modelled explicitly is future work, and is named as such.

Implementation status

Every claim in this paper is scoped to what the reference implementation in tools/quantum-beacon/ actually does.

References

1. J. S. Bell, "On the Einstein Podolsky Rosen Paradox," Physics 1(3), 195–200 (1964).
2. J. F. Clauser, M. A. Horne, A. Shimony, R. A. Holt, Phys. Rev. Lett. 23, 880 (1969).
3. B. S. Tsirelson, "Quantum Generalizations of Bell's Inequality," Lett. Math. Phys. 4, 93–100 (1980).
4. B. Hensen et al., Nature 526, 682–686 (2015); L. K. Shalm et al., Phys. Rev. Lett. 115, 250402 (2015); M. Giustina et al., Phys. Rev. Lett. 115, 250401 (2015) — the loophole-free Bell tests.
5. NIST and University of Colorado Boulder, CURBy: certified public randomness from a running loophole-free Bell test (public beacon, 2025).
6. NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), SP 800-90B.
7. Impagliazzo, Levin, Luby — the Leftover Hash Lemma, STOC 1989.
8. H. Krawczyk, "Cryptographic Extraction and Key Derivation: The HKDF Scheme," CRYPTO 2010.
9. Source artifact — docs/papers/Q-ENTANGLE-WITNESS-ANCHORED-KEY-AGREEMENT.md; reference implementation tools/quantum-beacon/.
10. Verify a Bell Binding — the third-party verification recipe as a guide.