Cryptography Reference
In-Depth Information
Last but not least, it remains to be seen how A and B can decide whether
their resulting bitstrings are identical (indicating with high probability that no
eavesdropping has occured on the quantum channel) or different (indicating that the
quantum channel has been subject to eavesdropping). A simple and straightforward
solution is for A and B to publicly compare some of the bits on which they think they
should agree. The position of these bits must be chosen randomly after the quantum
transmission has been completed. Obviously, this process sacrifices the secrecy of
these bits. Because the bit positions used in this comparison are only a random subset
of the correctly received bits, eavesdropping on more than a few photons is likely
to be detected. If all comparisons agree, A and B can conclude that the quantum
channel has been free of significant eavesdropping. Therefore, most of the remaining
bits can safely be used as a one-time pad for subsequent communication over the
public channel. When this one-time pad is used up, the protocol can be repeated
arbitrarily often.
Table 16.1 illustrates an exemplary execution of the quantum key exchange
protocol. Lines 1 and 2 illustrate the bits and the polarization bases that are randomly
chosen by A (+ refers to a rectilinear basis and x refers to a diagonal basis). Line 3
illustrates the polarization of the photons that are actually sent from A to B. Again,
the polarization can be 0 (i.e.,
−→
), 45 (i.e.,
), 90 (i.e.,
↑
), or 135 (i.e.,
)deg.IfA
has chosen a rectilinear basis, a zero is encoded as
−→
and a one is encoded as
↑
. If,
however, A has chosen a diagonal basis, a zero is encoded as
and a one is encoded
as
. The photons as polarized in line 3 are sent from A to B and are expected to
reach B. Line 4 illustrates the polarization bases that are randomly chosen by B, and
line 5 illustrates the binary values that are measured and decoded by B. Note that
not all of these values must be correct (only the ones that are measured with the
correct polarization basis). In line 5, the values that are not necessarily correct are
written in italics. Also, B may miss the reception of specific photons. In line 5, for
example, B has missed measuring the polarization of the second photon. Anyway,
the bitstring that is received by B is 010000110, and A and B must now find out
which bits they can use. In line 6, B publicly announces the bases in which he or
she measured the received photons, and in line 7 A says which bases were correctly
guessed. In the example, five bases were correctly guessed by B. This information
is presumably shared. Line 8 illustrates the corresponding bitstring (i.e., 01001). In
line 9, B reveals some bits chosen at random, and in line 10, A confirms these bits (if
they are correct). In line 11, the remaining bits are illustrated; they may now serve
as shared secret bits.
The eavesdropping-detection subprotocol as described earlier is rather waste-
ful because a significant proportion of the bits (2
/
5 in the example given here) are
sacrificed to obtain a good probability that eavesdropping is detected even if at-
tempted on only a few photons. Moreover, the probability that the resulting strings
