Table Of ContentImproved Asymptotic Key Rate of the B92 Protocol
Ryutaroh Matsumoto
∗
Department of Communications and Integrated Systems, Tokyo Institute of Technology, 152-8550 Japan
∗
Abstract—We analyze the asymptotic key rate of the single On the other hand, we can express a qubit channel as
photonB92protocolbyusingRenner’ssecurityanalysisgivenin follows. Define the three Pauli matrices σ , σ , and σ as
x y z
2005. ThenewanalysisshowsthattheB92protocolcansecurely
usual. Then a qubit density matrix ρ can be expressed as [5]
generate key at 6.5% depolarizing rate, while the previous
3 analyses cannot guarantee the secure key generation at 4.2% 1
1 depolarizing rate. ρ= 2(cid:16)I+xσx+yσy+zσz(cid:17),
0
2 I. Introduction where x,y,z R and x2 + y2 + z2 1. The vector (x,y,z)
n The B92 quantum-key-distribution(QKD) protocol [2] has is called a Blo∈ch vector. The qubit ch≤annel B from Alice to
E
a remained less popular than the famous BB84 protocol [1], Bob can be expressed as a map between Bloch vectors by
J
while both protocols provide the unconditional security. One z z
2
] 2 ptwoliattuhhsetihbeclehsartaennansdeoalnrndfoooirsneteh-tewhauaynnpitnohfpeourlBmarBaitt8yi4oi.nsSrtehpcaeotcnitfihcicelaiBallt9yio,2ntihsceawnBegaBke8ne4r- yx 7→R yx +~t, (2)
h where
erate secure key overthe depolarizingchannelat depolarizing
p rate 16.5%, while the previous security analyses of the B92 Rzz Rzx Rzy tz
ant- c3a.5n%not[8g]u,a3ra.7n%tee[4th]eosre4cu.2r%ek[e7y].generationatdepolarizingrate R= RRyxzz RRyxxx RRyxyy , ~t= ttyx . (3)
u The conventional security analyses of the B92 [4], [7], Define
0 ϕ + 1 ϕ
q [8] involved many inequalities, and the tightness of those Ψ = | iA| 0iB | iA| 1iB.
[ inequalities was not explicitly discussed. We cannot exclude | i √2
1 the possibility that the B92 protocol can securely generate As in [8], we also define the four POVM
v key at depolarizing rates over 4.2%. On the other hand, the
3 asymptotic secure key rate in [7], [6] is expressed as the F0 = |ϕ¯1ihϕ¯1|/2, (4)
8 minimum of conditional quantum entropy over a certain set F1 = ϕ¯0 ϕ¯0/2, (5)
0 | ih |
5 of bipartite quantum states. By using the convexoptimization F0¯ = |ϕ1ihϕ1|/2, (6)
1. tmecahnnyiqinueeq,uwaelitcieasn,cwohmicphletceoluyldremunodveerecsatriemfuatlemthaneipseuclautrieonkeoyf F1¯ = |ϕ0ihϕ0|/2. (7)
0
3 rate. In this paper we reformulate the asymptotic secure key After passing the quantum channel B from Alice to Bob,
E
1 rate formula as a convex optimization problem, and compute Ψ Ψ becomes
| ih |
: the rate without any manipulation of inequalities directly by
v ρ =(I )Ψ Ψ. (8)
i a numerical optimization procedure. As a result, we show 1,AB ⊗EB | ih |
X
that the B92 protocol[2] without noisy preprocessing [7] can In a quantum key distribution protocol, the state change
B
r securely generate key at 6.5% depolarizing rate. is caused by Eve’s cloning of the transmitted qubits to hEer
a
quantum memory. The content of Eve’s quantum memory is
II. NewSecurityAnalysisoftheB92Protocol
mathematicallydescribedbythepurification Φ ofρ .
1,ABE 1,AB
Inthissection,wepresentanewformulafortheasymptotic Let ρ = Φ Φ . | i
1,ABE 1,ABE 1,ABE
key rate of the B92 protocol, based on Renner’s security In addition| to Evei’hs quant|um memory, she also knows the
argument [6]. Firstly, we fix notations. Let 0 , 1 be some content of public communication over the classical public
{| i | i}
fixed orthonormal basis of a qubit. In the B92 protocol [2], channel between Alice and Bob. For each transmitted qubit
Alice sends the quantum state fromAlicetoBob,thepubliccommunicationconsistsof1-bit
ϕ =β0 +( 1)jα1 , (1) informationindicatingwhetherBobdiscardshisreceivedqubit
j
| i | i − | i ornot.Wealsohavetotakeitintoaccount.Weshallrepresent
for j = 0,1, where β = √1 α2, and 0 < α < 1/√2. For the public communication by a classical random variable P
−
convenience of presentation, we also define that becomes1 if Bob discards his qubit and 0 otherwise. So,
P = 0 when Bob’s measurement outcome is F or F , and
ϕ¯ =α0 ( 1)jβ1 . 0 1
| ji | i− − | i P=1 when Bob’s measurement outcome is F0¯ or F1¯.
We can see that ϕ , ϕ¯ forms an orthonormal basis of a On the other hand, in the B92 protocol, Bob performs the
j j
{| i | i}
qubit. measurement specified by Eqs. (4)–(7). Alice and Bob keep
their a qubit if and only if its measurement outcome is F or The probability of the measurement outcome being F or F
0 0 1
F . Otherwise it is discarded and is not used for generation is
1
of secret key. This is mathematically equivalentto set Alice’s Tr[ρ (I (F +F ))].
1,AB A 0 1
⊗
bit to 0 if the measurement outcomes is F or F . Therefore,
0¯ 1¯
So we can see that Eve’s ambiguity per single transmitted
from Eve’s perspective on Alice’s classical bit, the joint state
qubitthat is neitherannouncedforthe channelestimation nor
between Alice and Bob after the selection by measurement
discarded is
outcomes is equivalent to
S(XEP)
| .
ρ2,ABEP = (IA⊗ pF0⊗IEρ1,ABEIA⊗ pF0⊗IE Tr[ρ1,AB(I⊗(F0+F1))]
+I F I ρ I F I ) 0 0 By [7], [6] the asymptotic key rate is
A⊗ p 1⊗ E 1,ABE A⊗ p 1⊗ E ⊗| iPh |P
++|p0iFA1h¯0⊗|AI⊗ET(rpA[Fρ0¯1,⊗ABIEE]TprFA[1¯ρ⊗1,AIBEE)]⊗p|F1i0¯P⊗h1I|EP. Tr[ρ1,ABS(I(X⊗|E(FP0)+F1))] −H(X′|Y′). (11)
Note that the above formula assumes that Alice and Bob
Observethatthestatechangefromρ toρ isatrace-
1,ABE 2,ABEP
knows the channel between them. In the BB92 protocol, we
preserving completely positive map.
cannot estimate all the parameters of the channel. We can
Remark 1: Alternatively,byusingthemoreusualapproach
only estimate part of them. In Eq. (11) we can asymptotically
tomodelaquantumstateafterselectivemeasurement,onecan
determine the true values of Tr[ρ (I (F + F ))] and
alsoregardthequantumstateafterhavingBob’smeasurement 1,AB ⊗ 0 1
H(X Y ).Ontheotherhandwecannotknowthetruevalueof
outcome F0 or F1 as S(X′E| P′).Therefore,we need to calculate the minimum value
1 (i.e.|the worst-case)of S(XEP)overall thepossiblequantum
(F +F )Tr [ρ ](IA⊗ pF0⊗IEρ1,ABEIA⊗ pF0⊗IE channel between them.|
0 1 A 1,AB B
E
+I F I ρ I F I ) 0 0 . OnecancomputetheminimumofS(XEP)asfollows.Ob-
A⊗ p 1⊗ E 1,ABE A⊗ p 1⊗ E ⊗| iPh |P servefirstthatS(XEP)isafunctionofthe| channelparameters
|
Themotivationbehindusingouralternativeformulation(9) is Eq. (3) of . By the almost same argument as [9, Remark
B
E
toprovelatertheconvexityofthequantumconditionalentropy 11]oneseesthatS(XEP)isa convexfunctionofthe channel
|
(9) intermsoftheparametersgiveninEq.(3), so thatwe can parameters Eq. (3). Moreover, we see that the minimum of
use the convex optimization technique to find the minimum S(XEP) is attained when R = R = R = R = t = 0
xy yx yz zy y
|
value of Eq. (9). bythealmostsame argumentas[9,Proposition1].Therefore,
Inordertocalculatethekeyrate,weneedtoconsiderEve’s one can compute the minimization of S(XEP) by the convex
|
ambiguity on Alice’s classical bit [7], [6] defined as follows. optimization [3].
Let
III. NumericalResult
ρ2,XEP = X |jiAhj|A⊗IEPTrB[ρ2,ABEP]|jiAhj|A⊗IEP. We consider the depolarizing channel q with depolarizing
j=0,1 E
rate q. The definition of q follows [8]. For a qubit density
Eve’sambiguityonAlice’s classicalbitS(XEP)isdefinedas matrix ρ, we have (ρ) = (1 q)ρ+(q/2)I . With such a
q 2 2
| channel , R and~tEin Eq. (2)−are given by ×
q
S(XEP)=S(ρ ) S(ρ ), (9) E
2,XEP 2,EP
| −
1 4q/3 0 0
ewnhtIrenorepoyrρ.d2e,ErPto=cTarlAc[uρl2a,tXeEPth],eaanmdoSu(n·)tdoefnpoutebslitchecovmonmNuneuicmatainonn R= −00 1−04q/3 1−4q/3 , ~t=~0.
Define
required for information reconciliation, we define the joint
ρ =(I )Ψ Ψ.
random variables (X ,Y ) as 1,AB,q q
′ ′ ⊗E | ih |
Over with infinitely many qubits, the asymptotic key rate
X = j if the transmitted qubit is ϕ , q
′ j E
| i is given by
Y = k if the measurement outcome is F , (10)
′ k
minS(XEP)
under the condition that the measurement outcome is either Tr[ρ (I (F| +F ))] −H(X′|Y′), (12)
1,AB 0 1
F or F . Observe the difference between X and X . X is not ⊗
0 1 ′ ′
wherethe minimumis takenoverthe setof parametersin Eq.
defined but X is defined to be 0 when Bob’s measurement
(3) such that
outcome is either F or F .
0¯ 1¯
Weshallshowtheasymptotickeyratepersingletransmitted Tr[(0 0 F + 1 1 F )ρ ]
0 1 1,AB
qubitthat is neitherannouncedforthe channelestimation nor | ih |⊗ | ih |⊗
= Tr[(0 0 F + 1 1 F )ρ ], (13)
discarded due to the measurement outcome being F0¯ or F1¯. | ih |⊗ 0 | ih |⊗ 1 1,AB,q
Note that Eq. (9) is Eve’s ambiguity per a qubit that is not Tr[(1 1 F0+ 0 0 F1)ρ1,AB]
| ih |⊗ | ih |⊗
announced for the channel estimation but can be discarded. = Tr[(1 1 F + 0 0 F )ρ ]. (14)
0 1 1,AB,q
| ih |⊗ | ih |⊗
[6] R. Renner, “Security of quantum key distribution,” International Jour-
Proposed nal on Quantum Information, vol. 6, no. 1, pp. 1–127, Feb. 2008,
0.035
arXiv:quant-ph/0512258 (originally published as Ph.D thesis, ETH
0.03 Zürich,Switzerland, 2005).
[7] R.Renner,N.Gisin,andB.Kraus,“Information-theoretic securityproof
0.025 forquantum-key-distribution protocols,” Phys. Rev. A,vol. 72, no. 1, p.
012332,Jul.2005,arXiv:quant-ph/0502064.
e
at 0.02 [8] K. Tamaki, M. Koashi, and N. Imoto, “Unconditionally secure key
r
y distributionbasedontwononorthogonalstates,”Phys.Rev.Lett.,vol.90,
ke 0.015 no.16,p.167904,Apr.2003,arXiv:quant-ph/0212162.
[9] S. Watanabe, R. Matsumoto, and T. Uyematsu, “Tomography increases
0.01 key rates of quantum-key-distribution protocols,” Phys. Rev. A, vol. 78,
no.4,p.042316,Oct.2008,arXiv:0802.2419.
0.005
0
4.5 5 5.5 6 6.5
depolarizing rate
Fig.1. AsymptoticKeyRate:Theconventionalmethods[4],[7],[8]cannot
generate keyatdepolarizing rateabove4.2%andtheyarenot plotted.
We also required that parameters in Eq. (3) represent a
completely positive map. We stress that we do not restrict
the range of minimization to the depolarizing or the Pauli
channels. The minimization is carried out over the set of all
the qubit channels with (13) and (14).
The FindMinimum function in Mathematica 8.04 was used
for the minimization. The program source code and the
computation results are included in this eprint.
We only considered α = 0.39 and did not optimized the
value of α in Eq. (1). The key rate is plotted in Fig. 1. The
convex optimization did not converge in 105 iterations when
the depolarizing rate 4.5%. The key rate is plotted from
≤
depolarizing rate 4.6%.
≥
IV. Conclusion
In this paper, we reformulated the secure key rate formula
of the B92 protocol as a convex optimization. We have not
resortedtoskillfulmanipulationofinequalities,andthesecure
key rate is computed simply by a numerical optimization
procedure.TheresultshowsthattheB92protocolcansecurely
generate key at significantly higher depolarizing rates than
previous security analyzes.
Acknowledgment
The author would like to thank K. Azuma, G. Kato, K.
Tamaki and T. Tsurumaru for helpful discussions. This re-
search is partly supported by NICT and JSPS.
References
[1] C. H. Bennett and G. Brassard, “Quantum cryptography: Public key
distribution and coin tossing,” in Proc. IEEE Intl. Conf. on Computers,
Systems,andSignalProcessing,1984,pp.175–179.
[2] C. H. Bennett, “Quantum cryptography using any two nonorthogonal
states,”Phys.Rev.Lett.,vol.68,no.21,pp.3121–3124, May1992.
[3] S. Boyd and L. Vandenberghe, Convex Optimization. Cambridge
University Press,2004.
[4] M. Christandl, R. Renner, and A. Ekert, “A generic security proof for
quantum keydistribution,” Mar.2004,arXiv:quant-ph/0402131.
[5] M. A. Nielsen and I. L. Chuang, Quantum Computation and Quantum
Information. Cambridge, UK:CambridgeUniversity Press,2000.
