Cryptography Reference
In-Depth Information
circumstances have been studied extensively [3-6]. Our analysis of the secrecy
of a practical implementation of the BB84 protocol simultaneously takes into
account and presents the
full
set of analytical expressions for effects due to
the presence of pulses containing multiple photons in the attenuated output
of the laser, the finite length of individual blocks of key material, losses due
to error correction, privacy amplification, and authentication, errors in polar-
ization detection, the efficiency of the detectors, and attenuation processes in
the transmission medium [7,13].
We consider particular attacks made on individual photons, as opposed to
collective attacks on the full quantum state of the photon pulses. The extension
to other protocols, such as B92 [8] is straightforward, but is not discussed here
because of limitations of space. We analyze important subtleties that arise in
the
practical
implementation of privacy amplification in which the distinction
between averaging over hash functions, on the one hand, and making use of
a particular hash funtion, on the other, yield different bounds on the mutual
information available to an enemy eavesdropper. We pay special attention to
the consequences of this distinction on the resulting throughput of secret bits,
which is a crucial figure-of-merit in assessing the viability of a practical key
distribution system.
7.2 Presentation of the Effective
Secrecy Capacity
The protocol begins when Alice selects a random string of
m
bits from which
Bob and she will distill a shorter key of
L
bits which they both share and about
which Eve has exponentially small information. We define the secrecy capac-
ity
S
as the ratio of the length of the final key to the length of the original string
L
m
.
S
=
(7.1)
This quantity is useful for two reasons. First, it can be used in proving the
secrecy of specific practical quantum cryptographic protocols by establishing
that
S >
0 (7.2)
holds for the protocol. Second, it can be used to establish the rate of generation
of key material according to
R
=
S
τ
,
(7.3)
where
is the pulse period of the initial sequence of photon transmissions.
Several scenarios in which useful key generation rates can be obtained are
described in Ref. [7].
The length of the final key is given by
L
τ
(7.4)
The first term
n
, is the length of the sifted string. This is the string that remains
after Alice has sent her qubits to Bob, and Bob has informed Alice of which
=
n
−
(
e
T
+
q
+
t
+
ν)
−
(
a
+
g
pa
).
