One Key Good, L Keys Better: List Decoding Meets Quantum Privacy Amplification

We introduce list privacy amplification (LPA), a relaxation of the final step of quantum key distribution (QKD) in which Alice and Bob extract a list of L candidate keys from a raw string correlated with an eavesdropper Eve, with the guarantee that at least one key is perfectly secret while Eve cannot identify which. This parallels list decoding in error-correcting codes: relaxing unique decoding to list decoding increases the decoding radius; analogously, list extraction increases achievable key length beyond the standard quantum leftover hash lemma (QLHL). Within the abstract cryptography framework, we formalise LPA and prove the Quantum List Leftover Hash Lemma (QLLHL): an L-list of ell-bit keys can be extracted from an n-bit source with smooth min-entropy k iff \[ \ell \le k + \log L - 2\log(1/ε) - 3, \] yielding a tight additive log L gain over QLHL. This gain arises because the index of the secure key is chosen after hashing and hidden from Eve, effectively contributing log L bits of entropy. Applying QLLHL to BB84-type QKD, a list size L = 2^αn' increases the tolerable phase-error threshold from h^-1\(1 - h(e_b\)) to h^-1\(1 - h(e_b\) + α), exceeding the standard approx 11\% bound for any α> 0. We prove tightness via a matching intercept-resend attack, establish composability with Wegman--Carter authentication, and present two constructions: a polynomial inner-product hash over mathbb{F}_2^m and a Toeplitz-based variant, running in O(nL) and O\(nL log n\) time.