Quantum key distribution with 2-bit quantum codes

0.12 MB·

by  Xiang-Bin Wang

Quantum key distribution with 2-bit quantum codes
Xiang-Bin Wang
∗
Imai Quantum Computation and Information project, ERATO, Japan Sci. and Tech. Corp.
Daini Hongo White Bldg. 201, 5-28-3,Hongo, Bunkyo, Tokyo 113-0033,Japan
0 i
We propose a prepare-and-measure scheme for quantum (cid:18) i −0 (cid:19). These operators represent for a bit flip er-
key distribution with 2-bit quantum codes. The protocol is ror only, a phase flip error only and both error, re-
unconditionallysecureunderwhatevertypeofintercept-and-
spectively. The detected bit (or phase) flip error rate
resend attack. Given the symmetric and independent errors
is the summation of σ (or σ ) error rate and σ er-
x z y
tothetransmittedqubits,ourschemecantolerateabiterror
ror rate. The Z,X,Y basis are defined by the basis of
rate up to 26% in 4-state protocol and 30% in 6-state proto-
4 0 , 1 , 0 1 , 0 i1 , respectively.
col, respectively. These values are higher than all currently {| i | i} {| i±| i} {| i± | i}
0 Main idea. We proposearevised2-EPPschemewhichis
known threshold values for the prepare-and-measure proto-
0 unconditionallysecureandwhichcanfurtherincreasethe
cols. Moreover, we give a practically implementable linear
2 thresholds of error rates given the independent channel
optics realization for our scheme.
n Introduction. Quantum key distribution (QKD) is dif- errors. We propose to let Alice send Bob the quantum
a states randomly chosenfrom 1 (00 + 11 ), 1 (00
J ferent from classical cryptography in that an unknown {√2 | i | i √2 | i−
quantum state is in principle not known unless it is dis- 11 ), 00 , 11 . Asweshallsee,thesestatesarejustthe
4 | i | i | i}
turbed,ratherthanthe conjectureddifficultyofcomput- quantumphase-fliperror-rejection(QPFER)codeforthe
ing certain functions. The first published protocol, pro- BB84 state 0 , 1 , 1 (0 + 1 ), 1 (0 1 ) .
3 {| i | i √2 | i | i √2 | i−| i }
v posed in 1984 [1], is called BB84 (C. H. Bennett and G. In our 4-state protocol, the tolerable channel bit-flip
7 Brassard.) For a history of the subject, one may see e.g. and phase-flip rate is raised to 26% for the symmetric
5 [2]. Since then, studies on QKD are extensive. Strict channel with independent noise. (A symmetric channel
0 mathematical proofs for the unconditional security have is defined as the one with equal distribution of errors of
8
been given already [3–5]. It is greatly simplified if one σ ,σ ,σ .) Notethatthetheoreticalupperboundof25%
0 x z y
connects this with the quantum entanglement purifica- [11]onlyholdsforthose4-stateschemeswhereAliceand
3
tion protocol (EPP) [3,6–10]. Very recently, motivated Bob only test the error rate before any error removing
0
/ for higher bit error rate tolerance and higher efficiency, steps. However, this is not true with the delay of error
h
Gottesman and Lo [11] studied the classicalization of test. Considering the standard purification protocol [7]
p
EPP with two way communications (2-EPP).Their pro- with symmetric channel, one may distill the maximally
-
t tocolhasincreasedthe tolerablebiterrorrateofchannel entangledstatesoutoftherawpairswhoseinitialbit-flip
n
to 18.9% and 26.4% for 4-state QKD and 6-state QKD, errorand phase-fliperrorare 33.3%. In our 4-state pro-
a
u respectively. Very recently, these values have been up- tocol, we delay the error test by one step of purification
q graded to 20% and 27.4% by Chau [12]. with 2-bit QPFER code. This raises the tolerable chan-
: Thetypeofprepare-and-measureQKDschemesispar- nel flipping rates.
v
i ticularly interesting because it does not need the very The QPFER code. We shall use the following QPFER
X
difficult technique of quantum storage. In this paper, code:
r we propose a new prepare-and-measurescheme with the
a assistance of2-bit quantum codes. The linear opticalre- 0 0 (00 + 11 )/√2
| i| i−→ | i | i
alizationisshowninFig.(1,2). Inourscheme,Aliceshall 1 0 (00 11 )/√2. (1)
send both qubits of the quantum codes to Bob, there- | i| i−→ | i−| i
fore they do not need any quantum storage. Bob will Here the second qubit in the left side of the arrow is
first check the parity of the two qubits by the polarizing the ancilla for the encoding. This code is not assumed
beamsplitter (PBS)andthen decodethe code withpost to reduce the errors in all cases. But in the case that
selection. The 2-bit code is produced by the SPDC pro- the channel noise is uncorrelatedor nearly uncorrelated,
cess [13], see in Fig.(1). it works effectively. Consider an arbitrary state α0 +
1
| i
1 β 1 1(qubit1)andanancillastate 0 2(qubit2). Taking
We shall use the representation of 0 = ; 1 = | i | i
| i (cid:18)0(cid:19) | i unitary transformation of Eq(1) we obtain the following
0 0 1 1 0 un-normalized state:
. We denote σ = ,σ = ,σ =
(cid:18)1(cid:19) x (cid:18)1 0 (cid:19) z (cid:18)0 1(cid:19) y
− α(0 1 0 2+ 1 1 1 2)+β(0 1 0 2 1 1 1 2) (2)
| i | i | i | i | i | i −| i | i
This can be regarded as the encoded state for α0 +
1
| i
β 1 . Alice then sends both qubits to Bob. In receiving
1
∗email: [email protected] th|emi , Bob first takes a parity check, i.e. he compares
the bit values of the two qubits in Z basis. Note that
1
this collective measurement does not destroy the code and to see whether formula (3) indeed holds, based on
state itself. Specifically, the parity check operation can our prior knowledge of physical channel noise.
be done by the PBS in Fig.(2): there, states 0 , 1 are Our protocol with linear optical realization. In the BB84
| i | i
forhorizontalandverticalpolarizationphotonstates,re- protocol, there are only four different states. Therefore
spectively. Since a PBS transmits 0 and reflects 1 , Alice may directly prepare random states from the set
if incident beams (beam 1 and 2) o|f tihe PBS are b|otih of 1 (00 + 11 ), 1 (00 11 ), 00 , 11 and sends
{√2 | i | i √2 | i−| i | i | i}
horizontally polarizedor vertically polarized, there must them to Bob. This is equivalent to first preparing the
be one photon on each output beams (beam 1’ and 2’); BB84 states and then encoding them by eq.(1). We pro-
if the polarizations of two incident beams are one hori- pose the following 4-state protocol with implementation
zontalandonevertical,oneoftheoutputbeamsmustbe of linear optics in Fig(1) and Fig(2):
empty. After the parity check, if bit values are different, 1 Alice prepares N 2-qubit quantum codes with N/4 of
Bob discards the whole 2-qubit code, if they are same, them being prepared in 00 or 11 with equal probabil-
Bob decodes the code. In decoding, he measures qubit 1 ity and 3N/4 of them be|ingi pre|paried in 1 (00 11 )
inX basis,ifheobtains + ,hetakesaHadamardtrans- √2 | i±| i
with equal probability. All codes are put in randomly
| i
1 1
formation H = 1 to qubit 2; if he obtains order. She records the the “preparation basis” as X
√2(cid:18)1 1(cid:19) basis for code 00 or 11 ; and as Z basis for code
−
for qubit 1, he takes the Hadamard transformation 1 (00 11 ).|Anidshe|reciordsthebitvalueof0forthe
t|−oiqubit 2 and then flips qubit 2 in Z basis. Suppose √2 | i±| i
code 00 or 1 (00 + 11 ); bit value 1 for the code 11
the original channel error rates of σx,σy,σz types are | i √2 | i | i | i
p ,p ,p , respectively. Let p =1 p p p . or 1 (00 11 ). She sends each 2-qubit code to Bob.
x0 y0 z0 I0 − x0− y0− z0 √2 | i−| i
One may easily verify the probability distribution and In Fig.(1), any of the above four states can be produced
error type for the survived and decoded states (qubit 2) from the nonlinear crystal by appropriately setting the
in following table polarizationofthepumplight[15]. 2Bobchecksthepar-
ityofeach2-qubitcodeinZbasis. Hediscardsthecodes
JCE probability decoded state error type
whenever the 2 bits have different values and he takes
I I p2 α0 +β 1 I
⊗ I0 | i | i the following measurement if they have same values: he
I σz 2pI0pz0 α1 +β 0 σx measuresqubit1inXbasisandqubit2ineitherXbasis
{ ⊗ } | i | i
σz ⊗σz p2z0 α|0i+β|1i I or Z basis with equal probability. If Bob has measured
σy ⊗σy p2y0 α|0i−β|1i σz qubit 2 in X (or ) Z basis, he records the “measurement
σx⊗σx p2x0 α|0i−β|1i σz basis”asZ (or)Xbasis[16]andweshallsimply callthe
σx σy 2px0py0 α1 β 0 σy qubit as Z-bit (or X-bit) latter on. If he obtains + + ,
{ ⊗ } | i− | i | i| i
+ 0 , or 0 , he records bit value 0 for that
The first column lists the various types of joint channel | i| i |−i|−i |−i| i
code; if he obtains + , 1 , + or + 1 , he
errors(JCE)before decoding. α β denotes both α |−i| i |−i| i | i|−i | i| i
{ ⊗ } ⊗ records bit value 1 for that code. In our linear optical
β and β α. According to this table, the error rate
realization, Bob’s detections are done by post selection
⊗
distribution for the survived raw pairs after decoding is:
inFig.(2): Ifbeam1’andbeam2’eachcontainsonepho-
ton, beam 1 and beam 2 must have the same bit values.
p2 +p2
p = I0 z0 , Otherwise, their bit values must be different. This re-
 I (pI0+pz0)2+(px0+py0)2 quires Bob to only accept the events of two fold clicking
 pz = (pI0+pzp022x)p20++p(pp2yx00+py0)2, (3) woaclfbiitcoehkvveeedonnmtdseeemnctteluiiccostkntoeerbddefrdcdoeoimtsrecrcea{tsroDpdro3end,fDrd.o4iMmn,Dgo{5rreD,uDol1ve6,,eD}r.t,2o}aActachllonordosdetihtnahegcerctetooyptphttheeedesr
x0 y0 events,clickingofD3orD4meansmeasurementinZba-
p = ,
 pxy = ((ppII00++ppzz002))22pI++0p((zpp0xx00++ppyy00))22. satT(oDilshs2oebt,,oDectabw3lmie)coakcm2ifon’or,g2lrd’ceo,osfcpcrDorloiercn5rskdpeoissnorpngtDoodn6oibndfmigitn(egDtvaoat1nol,s“uDZ“em6Xo)eb,fab(asD0asui;s1sri”,tesDw”mf3oofe)orn,fr(othDhlidini2ss,cXDrrleei5cccb)kooairrsnoddigsr;.
With this formula, the phase flip error to the decoded
of (D2,D6),(D2,D4), (D1,D5) or (D1,D3) corresponds to
states is obviously reduced. Note that this formula does
bit value 1. 3 Bob announces which codes have been
not hold for the correlated channel errors. Even though
discarded. Alice and Bob compare the “preparation ba-
the noise of the physical channel is uncorrelated, in car-
sis” and “measurement basis” of each bits decoded from
rying out the QKD task, we should not use this formula
thesurvivedcodesbyclassicalcommunication. Theydis-
to deduce the flipping rates of the decoded qubits based
cardthosebitswhose“measurementbasis”disagreewith
on our knowledge of the physical channel noise, i.e., the
“preparation basis”. Bob announces the bit value of all
values of p ,p ,p ,p . But we can choose to directly
I0 x0 y0 z0 X-bits. He also randomly chooses the same number of
test the error rate of the survived and decoded qubits
2
Z bits andannounces their values. If toomany ofthem Theaboveprotocolistotallyequivalenttotheonebased
−
disagree with Alice’s record, they abort the protocol. 4 on entanglement purification therefore it is uncondition-
Now they regard the tested error rates on Z-bits as the ally secure [14]. Here we give a simple security proof.
bit-flip rate and the tested error rate on X-bits as phase
flip rate. They reduce the bit flip rate in the following NC
u1 1 2’
way: they randomly group all their unchecked bits with
each group containing 2 bits. They compare the parity p PBS
of each group. If the results are different, they discard
2 1’
both bits. If the results are same, they discard one bit
Alice u2 Bob
and keep the other. They repeatedly do so for a number
of rounds until they believe that both bit flip rate and
phase flip rate can be reduced to less than 5% with the
FIG.1. QKDschemewith 2-bitquantumcodes. PBS:po-
next step being taken. 5 They then randomly group the
larizing beam splitter. NC: nonlinear crystals used in SPDC
remained bits with each group containing r bits. They
process,p: pumplightinhorizontalpolarization,u1: unitary
use the parity ofeachgroupas the new bits. 6 They use
rotator, u2: phase shifter. u1 takes the value of 0, π/2, π/4
the classical CSS code [6] to distill the final key. toproduceemissionstate|11i,|00i,|φ+i,respectively. u2can
Notethatinthisprotocol,Sinceformula(3)isnotuncon- beeither I or σz
ditionally true, Alice and Bob check the bit errorsafter
decodingthe 2-bitquantumcodes. Ifthe detected errors
are significantly larger than the expected values calcu- D6 D5
D4 D3
lated from eq.(3), they will abort the protocol. That is
to say, if formula (3) really works, they continue, if it BS
does not work, they abort it. After any round of bit flip RPBS
errorrejectioninstep4,theerrorratewillbeiteratedby
PBS
1 2’
equation(1) in ref.[12]. After the phase errorcorrection
instep5,thenewerrorratesatisfiestheinequalityoffor- PBS
mula (3) of ref. [12] provided that pI > 1/2. The above 2 1’
steps to removethe bit-flip errorandphase-fliperrorare
unconditionallytruesinceAlice andBobhavepairedthe D2 D1
qubitsrandomly. Eventhoughtheerrorsofthedecoded
RPBS
qubits are arbitrarily correlated, the above steps always
work as theoretically expected.
FIG.2. Bob’s action in QKD scheme of figure(1). RPBS:
Given p ,p ,p , if there exits a finite number k, after
x y z Rotated polarizing beam splitter which transmits the state
k rounds ofbit-fliperror-rejection,we canfind ar which
|+i and reflects state |−i). BS: 50:50 beam splitter. D rep-
satisfy
resentsforaphotondetector. WithRPBS,onemaymeasure
theincident beam in {|+i,|−i} basis.
r(p +p ) 5%
x y
≤
e−2r(0.5−pz−py)2 5%, (4) Security proof. Consider two protocols, protocol P0
≤
and protocol P. In protocol P0, Alice directly sends Bob
onecanthenobtaintheunconditionallysecureandfaith-
eachindividual qubits. In protocol P, Alice first encodes
ful final key with a classical CSS code [6].
each individual qubits by a certain error rejection code
Inthe4-stateprotocol,wedon’tdetecttheσ errorfor
y and then sends each quantum codes to Bob. We denote
the states decodedfromthe survivedcodes,therefore we encoding operation as Eˆ and parity check and decoding
have to assume py = 0 after the quantum parity check operation by Dˆ. Bob will first check parity of each code
and decoding. But we do not have to assume p = 0,
y0 and decode the survived codes. After decoding, Alice
actually Alice and Bob never test any error rate before
and Bob continue the protocol. Suppose except for the
decoding in the protocol. However, if the channel noise operationsofDˆ andEˆ everythingelseinprotocolP0and
is symmetric and uncorrelated, after the quantum de- protocol P is identical and operation Dˆ or Eˆ do not re-
coding,bothσ error(p )andσ error(p )arereduced,
z z y y quireanyinformationoftheoriginalqubititself,thenwe
i.e., the detectable phase error rate has been reduced in have the following theorem: If protocol P0 is secure
a rate as it should be i.e., eq.(3). We then start from with arbitrary lossy channel, then protocol P is
the un-symmetricerrorratewithassumptionpy =0and also secure. The proof of this theorem is very simple.
p ,p being thedetectedbit-fliprateandphase-fliprate,
x z SupposePisinsecure. ThenEve. mustbeabletoattack
respectively. After the calculation, we find that the tol-
the final key by certain operation. Denote Eve’s attack
erable error rate of bit flip or phase flip is 26% for the
during the period that all codes are transmitted from
4-state protocol. Moreover, in the case that the channel Alice to Bob as Aˆ. Eve may obtain significant informa-
errordistributionitselfispy0 =0;px0 =pz0,thetolerable tion to final key with operation Aˆ and other operations
channel errorrate for our protocolis p =p 21.7%.
x0 z0
≤
3
(Qˆ) after Bob receives the qubits. If this is true, then in attackmustnotaffecttheerrorratesdetectedonthede-
protocol P0, Eve may take the operation of DˆAˆEˆ in the codedqubitsifshewantstohideherpresence. Thatisto
same period and then send the decoded states to Bob, say, if Eve hides her presence, all results about the final
withallotheroperationsidenticaltothoseinprotocolP. key of our protocol can be correctly estimated based on
(The time orderis fromrightto left.) To Alice andBob, the known properties of the physical channel, no mat-
it looks like that they are carrying out protocol P0 with ter what type of attack she has used. Given a physical
a lossy channel now, because Eve will have to discard channel with its noise being un-correlated and symmetric
some of the 2-bit quantum codes after the parity check and higher than the thresholds of all other prepare-and-
in decoding. All final results from protocol P0 with at- measureprotocols butlowerthanthat ofourprotocol, our
tack QˆDˆAˆEˆ must be identical to protocolP with attack protocol is the only one that works. In practice, one may
QˆAˆ, since everything there with the two protocols are simply separate the 2 qubits of the quantum code sub-
now the same. This completes our proof of the theorem. stantially to guaranteethe un-correlationof the physical
OurQKDprotocolinprevioussectionisjustthemodified channel noise. This is to say, the error threshold advan-
Chau protocol [12] with encoding and decoding added. tage of our protocol is actually unconditional in practice.
We can regard our protocol as P and Chau protocol as Looseends in practice. Multi-pairemissioninSPDCand
P0 in applying our theorem. Since Gottesman-Lo pro- darkcountingofdetectorshavenotbeenconsidered. We
tocol [11] or Chau protocol [12] are all unconditionally believetheseissuescanberesolvedalongthesimilarlines
securewitharbitrarylossychannel,weconcludethatour in the case of BB84 implemented with a weak coherent
protocol must be also unconditionally secure. light source.
6-state protocol. Ourprotocolcanobviouslybeextended Acknowledgement: I thank Prof Imai H for support.
tothe6-stateprotocol[17]. Indoingso,Alicejustchange The extended version of this work has been submitted
the initially random codes by adding N/4 codes from toQIT-EQISworkshop(Kyoto)[14]. I thank the anony-
1[(00 + 11 ) i(00 11 )] . This is equivalent to mous referees of the workshop for their comments and
{12(| 00i |i1i1 )±. S|heir−eg|ardis a}ll this type codes as Y- suggestions. I thank Dr B. S. Shi for discussions on the
√2 {| i∓ | i } source design.
bits. In decoding the codes, Bob’s “measurement basis”
israndomlychosenfrom3basis,X,YandZ.Alldecoded
X-bits, Y-bits and the same number of randomly cho-
sen decoded Z will be used as the check bits. Since the
Hadamard transform switches the two eigenstates of σ ,
y
after decoding, whenever Bob measures qubit 2 in Y ba-
sis, he needs to flip the measurementoutcome so that to
[1] C.H.BennettandG.Brassard,Proceedings of IEEEIn-
obtain everything the same as that in the 2-EPP with
ternational Conference on Computers, Systems and Sig-
quantum storages [14]. In such a way, if the channel
nal Processing, Bangalore, India, 1984, (IEEE Press,
is symmetric, Bob will find p = 0. And he will know
y 6 1984), pp.175–179; C.H.BennettandG.Brassard, IBM
px,py,pz exactly instead of assuming py = 0. This will Technical Disclosure Bulletin 28, 3153–3163 (1985).
increase the tolerable error rate accordingly. In the case
[2] N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Re-
symmetric physical channel, our 6-state protocol toler- views of Modern Physics, vol. 74, pp. 145-195.
ates the flipping rate up to 30%. [3] H.-K. Lo and H.F. Chau, Science, 283, 2050(1999)
Subtlety of the “conditional advantage”. un-symmetric [4] D. Mayers, Journal of ACM, 48,351.
effective channel. Although the advantage of a higher [5] E. Biham, M. Boyer, P. O. Boykin, T. Mor, and V.
threshold is conditional, the security of our protocol is Roychowdhury, Proceedings of the Thirty-Second An-
unconditional. That is to say, whenever our protocol nual ACM Symposium on Theory of Computing(STOC)
produces any final key, Eve’s information to that key (ACM Press, New York,2000), p. 715.
must be exponentially close to zero, no matter whether [6] P. W. Shor and J. Preskill, Phys. Rev. Lett.,
Eve uses coherent attack or individual attack. Our pro- 85,441(2000).
tocol is totally different from the almost useless proto- [7] C. H. Bennett, D. P. DiVincenzo, J. A. Smolin, and W.
col which is only secure with uncorrelated channel noise. K. Wootters, Phys.Rev.A54, 3824(1996)
There are two conditions for the error threshold advan- [8] D. Deutsch, A. Ekert, R. Jozsa, C. Macchiavello,
S. Popescu, and A. Sanpera, Phys. Rev. Lett., 77,
tage:
2818(1996); Erratum Phys. Rev.Lett. 80, 2022 (1998).
(1) The noise of physical channel should be the type
[9] D. Gottesman and J. Preskill, Phys.
where eq.(3) holds; (2) Eve. is not detected in the error
Rev.A63,22309(2001).
test, i.e., the result of error test must be in agreement
[10] A. R. Calderbank and P. Shor, Phys. Rev. A54,
with the expected result given by eq.(3).
1098(1996), A. M. Steane, Proc. R. Soc. London A452,
Bothconditions here are verifiableby the protocolitself.
2551(1996).
The second condition is a condition for any QKD proto-
[11] D. Gottesman and H.-K. Lo, IEEE Transactions on In-
col. Thefirstconditionisontheknownphysicalchannel
formation Theory,49, 457(2003).
ratherthanEve’schannelinQKD.Inourprotocol,Eve’s
[12] H. F. Chau, Phys. Rev.A66, 060302(R) (2002).
4
[13] P. G. Kwiat, K. Mattle, H. Weinfurter, A. Zeilinger,
A.V. Sergienko, and Y. H. Shih, Phys. Rev. Lett. 75,
4337(1995).
[14] Onemay see details in X.B. Wang, quant-ph/0306156.
[15] P.G. Kwiat et al, Phys.Rev.A60, R773(1999).
[16] Here Bob has omitted the Hadamard transformation as
appeared in theEPP.
[17] D.Bruss, Phys.Rev. Lett.81, 3018(1998).
5