  Key establishment is a crucial primitive for building secure channels: in a
multi-party setting, it allows two parties using only public authenticated
communication to establish a secret session key which can be used to encrypt
messages. But if the session key is compromised, the confidentiality of
encrypted messages is typically compromised as well. Without quantum mechanics,
key establishment can only be done under the assumption that some computational
problem is hard. Since digital communication can be easily eavesdropped and
recorded, it is important to consider the secrecy of information anticipating
future algorithmic and computational discoveries which could break the secrecy
of past keys, violating the secrecy of the confidential channel.
  Quantum key distribution (QKD) can be used generate secret keys that are
secure against any future algorithmic or computational improvements. QKD
protocols still require authentication of classical communication, however,
which is most easily achieved using computationally secure digital signature
schemes. It is generally considered folklore that QKD when used with
computationally secure authentication is still secure against an unbounded
adversary, provided the adversary did not break the authentication during the
run of the protocol.
  We describe a security model for quantum key distribution based on
traditional classical authenticated key exchange (AKE) security models. Using
our model, we characterize the long-term security of the BB84 QKD protocol with
computationally secure authentication against an eventually unbounded
adversary. By basing our model on traditional AKE models, we can more readily
compare the relative merits of various forms of QKD and existing classical AKE
protocols. This comparison illustrates in which types of adversarial
environments different quantum and classical key agreement protocols can be
secure.
