Cryptography Reference
In-Depth Information
states and vice versa. If, for each incoming particle, the receiver performing the
measurement is not told in advance which type of spin (
x
or
y
) was prepared
by the sender, then the receiver is completely lost and unable to determine
the spin value. This can be used for the key distribution.
Alice and Bob agree on the bit encoding, e.g.,
| ↑ =
0
= |→
,
| ↓ =
1
=
|←
, and Alice repeatedly prepares one of the four quantum states, choos-
ing randomly out of
. She then sends it to Bob, who
randomly chooses to measure either the
x
or the
y
spin component. After com-
pleting all the measurements, Alice and Bob discuss their data in public so
that anybody can listen, including their adversary Eve. Bob tells Alice which
spin component he measured for each incoming particle and she tells him
“what should have been measured.” Alice does not disclose which particular
state she prepared, and Bob does not reveal the outcome of the measurement,
so the actual values of bits are still secret. Alice and Bob then discard those
results in which Bob failed to detect a particle and those for which he made
measurements of the wrong type. They then compare a large subset of the re-
maining data. Provided no eavesdropping has taken place, the result should
be a shared secret that can be interpreted by both Alice and Bob as a binary
key.
| ↑
,
| ↓
,
|→
, and
|←
But let us suppose there is an eavesdropper, Eve. Eve does not know
in advance which state will be chosen by Alice to encode a given bit. If she
measures this bit and resends it to Bob, this may create errors in Bob's readings.
Therefore in order to complete the key distribution Alice and Bob have to test
their data for discrepancies. They compare in public some randomly selected
readings and estimate the error rate; if they find many discrepancies, they have
reason to suspect eavesdropping and should start the whole key distribution
from scratch. If the error rate is negligibly small, they know that the data not
disclosed in the public comparison form a secret key. No matter how complex
and subtle is the advanced technology and computing power available to the
eavesdropper, the “quantum noise” caused inevitably by each act of tapping
will expose each attempt to gain even partial information about the key.
1.8 Security Proofs
Admittedly the key distribution procedures described above are somewhat
idealized. The problem is that there is in principle no way of distinguishing
noise due to an eavesdropper from innocent noise due to spurious interac-
tions with the environment, some of which are presumably always present.
All good quantum key distribution protocols must be operable in the pres-
ence of noise that may or may not result from eavesdropping. The protocols
must specify for which values of measurable parameters Alice and Bob can
establish a secret key and provide a physically implementable procedure that
generates such a key. The design of the procedure must take into account that
an eavesdropper may have access to unlimited quantum computing power.
The best way to analyze eavesdropping in the system is to adopt the
entanglement-based protocol and the scenario that is most favorable for
