Table Of ContentQuantum Tomographic Cryptography with a Semiconductor Single Photon Source
Dagomir Kaszlikowski,1 L. C. Kwek,2,1 Jenn Yang, Lim,1 Frederick H. Willeboordse,1 and Shiang Yong, Looi1
1Department of Physics, National University of Singapore, Singapore 117542, Singapore
2National Institute of Education, Nanyang Technological University, Singapore 639798, Singapore
In this paper we analyze the security of the so-called quantum tomographic cryptography with
the source producing entangled photons via an experimental scheme proposed in Phys. Rev. Lett.
92, 37903 (2004). We determine the range of the experimental parameters for which the protocol
is secure against themost general incoherent attacks.
PACSnumbers: 03.67. -a,89.70. +c
5 INTRODUCTION gle photon source and the method described by Fattal
0
et al. [5]. Alice and Bob independently and randomly
0
choose to measure three tomographically complete ob-
2 Theneedtotransmitinformationsecurelybetweentwo
partiesisoffparamountimportanceinmilitaryandcom- servables σx, σy and σz (Pauli operators) on each qubit.
n
At the end of the transmission, they publicly announce
a mercial communication. The discovery of the possibility
J of secure communicationbasedonphotons has triggered their choice of observables for each qubit pair. They
1 numerousinvestigationsinthisfield. Animportantissue thendividetheirmeasurementresultsaccordingtothose
1 in quantum communication is the ability to distribute for which their measurement bases match, and those for
which their measurement bases do not match. Exchang-
a key securely between distant parties, and a number
1 ing a subsetof their measurements allowsAlice and Bob
of schemes such as the BB84 [1] and Ekert91 [2] have
v
to tomographically reconstruct the density operator of
1 been proposed for this purpose. In particular, the to-
5 mographicquantumkeydistributionschemeproposedin the two-qubit state they share. Those measurements for
0 Ref.[3]inwhichAlice andBobutilize atomographically which their bases match can be used for key generation.
1 According to the discussion presented in Ref. [5] the
complete set of observables to distribute the key as well
0 as perform full state tomography on their key distribu- density matrix describing the photon source has the fol-
5
lowing form in the (say) σ basis:
0 tion source has been shown to be powerful as it severely z
/ limits Eve’s eavesdropping possibilities, when compared
h 2α
to BB84 or Ekert91. An extension of this scheme to the
p 1 β +β +2γ β β
- more general class of Bell diagonal states has also been ̺(z) = 1 2 1− 2 ,(1)
nt proposed in Ref. [4]. 2 β1−β2 β1+β2−2γ
2α
a On the practical side, quantum key distribution
u
(QKD) is a sufficiently advanced field so that there is
where
q
already the possibility for commercialization of some of
:
v the QKD devices. However, security analysis of generic 2g
α =
Xi devices is not always straightforward. RT + RT +4g
r Recently, using the pulsed optical excitation of a sin- R + T 2V
a gle quantum dot from a sample of self-assembled InAs β1 = 2(TR +RT−)+8g
quantum dots in a GaAs matrix, it was shown that it T R
is possible to use linear optics techniques to induce po- R + T +2V
β = T R
larization entanglement between single photons emitted 2 2(R + T)+8g
T R
independentlyfromthesource[5,6,7]. Suchatechnique R T
canbe feasibly appliedto produceentangledphotons for γ = T − R . (2)
2(R + T)+8g
QKD. In this letter, we exploit the tomographic QKD T R
scheme [3] to study the security of QKD based on such
Themeaningoftheexperimentallyaccessibleparameters
solid state devices.
R,T,V and g is the following: R(T) denotes the reflec-
tivity (transmittivity) of the beamsplitters in the Mach-
Zehnderinterferometerusedintheexperiment(theratio
TOMOGRAPHIC QKD R reported in Ref. [5] was 1.1). The parameter V de-
T
notes the overlap of the wave packets of two consecutive
In the tomographic QKD scheme [3], a central source photonsemergingfromthequantumdot,andg (denoted
distributes entangled qubits to Alice and Bob. Here, in Ref.[5] as g(2)) is the equal time second-order correla-
we assume that these qubits arise from polarization- tionfunction. Furthermore,in orderforentanglementto
entangled photons generated using a quantum dot sin- exist in the two photon state, we require that V >2g.
2
From the point of view of the security analysis, where
it is more convenient to express the density matrix
(1)1k=i0n√1t2hωekbB|mellkmbka+siasi{(ω|m=abi−}a1,)b=d0e,1n.oteHs etrhee,B|mellabsitat=e hea′b′|eabi = (cid:26)δ√aβaγ1′βδ2bbδ′a,a′(1−δbb′)+δaa′δbb′, aa==10.,
in the mth basis (m=x,y,z). We have (6)
P
Tracing out Eve gives the mixed state Eq. (3) that Al-
α
ice and Bob measure and this purification is the most
α
̺(z) = (3) general one as far as eavesdropping is concerned. Note
Bell β γ
1 that because of the tomography performed by Alice and
γ β2 Bob,Evecannotprepareastatethatwouldgivehersome
additionalcorrelationsacrossdifferentqubits emittedby
and in the remaining two other bases
the source. This considerably reduces the number of co-
herent eavesdropping strategies Eve can use. More pre-
α
cisely, the only possibility of a coherentattack for Eve is
β γ
̺(y) =̺(x) = 1 − . (4) to collect her ancillas and perform some collective mea-
Bell Bell α
surements on them. In this paper we do not investigate
−γ β2 this scenario and assume that Eve measures her ancillas
one by one.
Fromtheirstatetomography,AliceandBobcandeter-
Eve’s purification, when expressed in different bases,
minehowtheparameters R,gandV affectthesecurityof
T reads
their key. Fromthese parameters,they can compute, for
eachbasis,the maximalstrengthofcorrelationsbetween 1
ψ = µ(z) z ,z fz
Eve and any one of them. The Csisza´r-Ko¨ner (CK) the- | ABEi ak| k k+ai| aki
orem[9]thenguaranteesthatifthe correlationsbetween kX,a=0q
Alice and Bob are stronger than those between Eve and 1
= µ(y) y ,y fy
either of them, a secure key can be established through ak| k k+ai| aki
one-way error correcting codes, with the efficiency given kX,a=0q
bytheCK yield. Thusforeachbasis,thereisaCKyield 1
= µ(x) x ,x fx , (7)
forAliceandBob’sbitdata,andtheycanfindoutwhich ak| k k+ai| aki
basis will give them a positive CK yield. They will then kX,a=0q
make use of data only from those bases with a positive
where
yield to establish their key, rejecting the bits obtained
from the remaining measurements. It is interesting to µ(z) = δ α+δ (δ δ )γ+ β1+β2
note that in the tomographic protocol presented in [3], ak a,0 a,1 k,0− k,1 2
(cid:18) (cid:19)
Alice and Bob do not have to do this as the yield is the α+β α+β
same regardless of the measurement basis. µ(axk) =µ(ayk) = δa,0 2 1 +δa,1 2 2. (8)
The ancilla kets have the following inner products
EAVESDROPPING δkk′, if a=a′ =0,
nelS.uIpnpoosredewretohmavaekeanoueravaensadlyrosipspfeorolEpvroeoifn, wteheascshuamne- hfaz′k′|fazki = δkk′ +(1−δkk′)√(iβf1βa+1β=−2β)a22−′4=γ21,,
0, if a=a.
′
the worst-case scenario in which she is in full control 6
of the qubit-distributing source, and that all the factors hfax′k′|faxki = hfay′k′|fayki
that contribute to experimental imperfections (parame- δkk′ +(1−δkk′)αα−+ββ11, if a=a′ =0;
tteierIssn.Ro,rTd,egr atondobVt)aianreadsumeutcohheinrfoearmveastdiroonppaisngpoascstiibvlie- = δ−kk√′(+α+(β11γ−)(αδ+kβk2′))ωαα+−k+ββ22k′,, ififaa=6=aa′′=. 1;
aboutthekeygeneratedbyAliceandBob,Eveentangles (9)
their qubits with ancilla states e(z) in her possession.
| abi Eve’seavesdroppingstrategythenproceedsasfollows.
She prepares the following state:
After Alice and Bob announce their measurement bases
and the basis they intend to use for key generation, Eve
ψ = √αz e(z) +√αz e(z)
| ABEi | 00i| 00i | 01i| 01i knows which pairs of qubits contribute to the key and
+ β z e(z) + β z e(z) , (5) that her ancilla for each of those pairs is a mixture of
1| 10i| 10i 2| 11i| 11i
p p
3
four possible states. Formally this can be viewed as a caneasilybedoneusingaprojectivemeasurement. After
transmission of information from Alice and Bob to Eve that, depending on the outcome of the projection (a=0
encodedinthequantumstateofEve’sancilla. Tofindthe or a = 1), Eve has a mixture of two ancilla states each
optimaleavesdroppingstrategy,shehastomaximizethis corresponding to Alice and Bob’s result.
informationtransferby achoice ofa suitable generalized Ifsheprojectsintothea=0subspace,Evewillpossess
measurementknownasaPositiveOperatorValuedMea- a mixture of equiprobable orthogonalancilla states
sure (POVM) [8]. For example, if Alice and Bob chose
1 1
to obtain their key from the x basis, Eve would obtain ̺(z) = fz fz + fz fz , (13)
E,a=0 2| 00ih 00| 2| 01ih 01|
the following mixed state of ancillas,
which she can distinguish perfectly.
1
̺(x) = µ(x) fx fx . (10) On the other hand, if she projects into the a=1 sub-
E ak| akih ak| space,shewillobtainamixtureofnon-orthogonalancilla
k,a=0
X
states instead:
Evehastofindtheoptimalmeasurementthatwillextract
from the transmission as much information as possible, ̺(z) = 1 + γ fz fz
the so-called accessible information. E,a=1 (cid:18)2 2α+β1+β2(cid:19)| 10ih 10|
1 γ
+ fz fz . (14)
2 − 2α+β +β | 11ih 11|
INCOHERENT ATTACK (cid:18) 1 2(cid:19)
We shall denote the inner product of the two ancilla
Theconditionsforwhichourprotocolissecureagainst states by λ β1−β2 . If these states are
Eve’sincoherenteavesdroppingattackisgivenbytheCK ≡ √(β1+β2)2−4γ2
equiprobable, which happens if γ = 0 or R = T, the
theorem: a secure key can be generated from a raw key
optimal measurement for Eve would be the so-called
sequence by means of a suitably chosen error-correcting
square-root measurement [10, 11]. Its POVM is given
codeandclassicalone-waycommunicationbetweenAlice
by ω ω , ω ω , where
0 0 1 1
and Bob if the mutual information between Alice and {| ih | | ih |}
Bob ( (A;B)) exceeds that between Eve and either one 1
I ω = √η fz + 1 η fz
of them (the CK regime). For the protocol considered, | 10i 1 2η − | 10i − | 11i
themutualinformationbetweenAliceandEve( (A;E)), −1 (cid:16) p (cid:17)
andBobandEve,arethesamesothatsecurityiIsassured |ω11i = 1 2η 1−η|f1z0i−√η|f1z1i ,
as long as − (cid:16)p (cid:17) (15)
(A;B) > (A;E). (11)
I I with η = 1(1+√1 λ2) being the probability of deter-
2 −
Furthermore, the difference in mutual information mining a given state correctly.
(A;B) (A;E) gives the CK yield for the distilled In general, the ancilla states will not occur with the
I − I
key. Due to the asymmetric nature of the state in the same probability, and the optimal measurement for Eve
σ andσ /σ bases,the yieldis differentforthosebases. will then not be the square-rootmeasurement. Consider
z x y
The yield is the same for σx and σy. As mentioned ear- the POVM {|ω˜10ihω˜10|,|ω˜11ihω˜11|}, where
lier, Alice and Bob will choose only those measurement
ω˜ = cosθ ω sinθ ω
bases which give them a positive yield and use the data 10 10 11
| i | i− | i
from those bases for key generation. ω˜11 = sinθ ω10 +cosθ ω11 . (16)
| i | i | i
We shall now present the POVM that maximizes the
These states are rotated from the square-root measure-
information transmitted from Alice and Bob to Eve for
ment states by an angle θ. We then have the following
a given basis.
Suppose Eve receives a state in the σ basis: conditional probabilities
z
̺(z) = 1 µ(z) fz fz , (12) p(ω˜10|f1z0) = √ηcosθ− 1−ηsinθ 2
E ak| akih ak|
kX,a=0 p(ω˜ fz ) = (cid:16)√ηsinθ+ p1 ηcosθ(cid:17)2
11| 10 −
where the kets have the structure given by Eq. (9). An-
(cid:16) p (cid:17)2
cillas from the correlation subspace (a = 0) are orthog- p(ω˜ fz ) = 1 ηcosθ √ηsinθ
10| 11 − −
onal to all other states; those from the anti-correlation
(cid:16)p (cid:17)2
subspace (a = 1) are in general non-orthogonal among p(ω˜ fz ) = 1 ηsinθ+√ηcosθ , (17)
11| 11 −
themselves.
(cid:16)p (cid:17)
In the first step, Eve sorts the mixture of the ancillas where, for instance, p(ω˜ fz ) denotes the probability
11| 11
into two sub-ensembles according to the index a. This of getting the result of the measurement corresponding
4
to the projector ω˜ ω˜ provided the state fz was Ifweadopt g , g , g , g asanorthonormalba-
| 11ih 11| | 11i {| 0i | 1i | 2i | 3i}
sent. sis, the optimal measurement for Eve can then be ex-
UsingtheprobabilitiesinEq.(17),wecancomputethe pressed as ω ω , ω ω , ω ω , ω ω , where
0 0 1 1 2 2 3 3
{| ih | | ih | | ih | | ih |}
mutual informationbetween Alice and Eveas a function
of θ. The optimal measurement for Eve is then given by
the θ that maximizes the mutual information between
them. (ω0 , ω1 , ω2 , ω3 )
| i | i | i | i
Suppose now that Eve receives ancillas from the σx a a b b
basis. If Alice measured bit ‘0’ (k = 0, probability 1), −b b a a
Eve will obtain the state 2 =(|g0i,|g1i,|g2i,|g3i) c −c d d ,(25)
−
̺k(x=)0 = (α+β1)|f0x0ihf0x0|+(α+β2)|f1x0ihf1x0|,(18) d d c −c
andifAlice measured‘1’(k =1,probability 1), Evewill
2
obtain the state
̺(x) = (α+β )fx fx +(α+β )fx fx .(19) andinwhicha,b,c,darerealnumbers. Theseparameters
k=1 1 | 01ih 01| 2 | 11ih 11| are also related by
The structure of the (normalized) ancillas is given by
Eq. (9):
α β
fx fx = − 1 λ 1
h 00| 01i α+β ≡ 0 a2+b2 =
1 2
α β
hf1x0|f1x1i = α−+β2 ≡λ1 c2+d2 = 1 (26)
2 2
hf0xk′|f1xki = − (α+βγ)(α+β )ωk+k′ ≡µωk+k′.
1 2
(20)
p so that the operators decompose the identity.
Now, the total state describing Eve’s ancillas is given
by Asbefore,wecancomputethemutualinformationbe-
α+β α+β tweenAliceandEve (A;E)forthis basisandmaximize
̺(x) = 1 fx fx + 1 fx fx I
2 | 00ih 00| 2 | 01ih 01| it over the two independent variables a and c to obtain
α+β α+β themaximuminformationthatEvecanobtainaboutAl-
+ 2 fx fx + 2 fx fx ,
2 | 10ih 10| 2 | 11ih 11| ice’s measurements.
(21)
It should be mentioned here that the optimality of
which has the following eigenkets
the above POVMs for the three bases was deduced and
1 confirmed numerically using the algorithms presented in
g = (fx + fx )
| 0i | 00i | 01i Refs. [12, 13].
0
N
1
g = (fx + fx )
| 1i | 10i | 11i TableIsummarizestheresultsofthecomputationsfor
1
N1 various values of g and V. We fixed the ratio R = 1.1
g = (κ (fx fx )+η(fx fx )) T
| 2i + | 00i−| 01i | 10i−| 11i (the value reported in Ref. [5]). We see that for certain
2
N values of g and V (the first row of the table), for which
1
|g3i = 3 (κ−(|f0x0i−|f0x1i)+η(|f1x0i−|f1x1i)), the state is still entangled, the CK yield (denoted as ∆)
N isnegativeinallthemeasurementbases. Forsuchstates,
(22)
according to the CK theorem, one cannot extract secure
where bits by means of one-way communication (because the
CK yield is zero). More interesting are cases where the
κ = β β (β β )2+4γ2
2 1 2 1
± − ± − CK yield is negative in one measurement basis and pos-
η = 2γ α+βp2. (23) itive in another. In such cases, Alice and Bob reject the
sα+β1 data obtained by measurements in the basis with neg-
The normalization constants (k =0,1,2,3)read: ative yield and process only the data from the basis for
k
N
whichtheCKyieldispositive. ThetotalCKyieldisthen
= 2(1+λ )
N0 0 the equally-weighted average of only the positive yields
1 = p2(1+λ1) fromthe three measurementbases. In the case where all
N
N2 = pα+4β β1κ2++4γ2 β1− (β2−β1)2+4γ2 tfrhoemCaKllythieeldbsasaerse.positive, Alice and Bob use the data
r 1
(cid:16) (cid:16) p (cid:17)(cid:17)
4
= β κ2 +4γ2 β + (β β )2+4γ2 .
N3 rα+β1 1 − 1 2− 1
(cid:16) (cid:16) p ((cid:17)24(cid:17))
5
σ σ
z x,y
RT g V I(A;B) max I(A;E) yield, ∆z I(A;B) max I(A;E) yield,∆x,y overall yield
1.1 0.1 0.6 0.3478 0.6070 -0.2592 (×) 0.1872 0.4320 -0.2448 (×) 0
0.02 0.4 0.7598 0.7550 0.0048 0.1085 0.1088 -0.0003 (×) 13∆z =0.0016
0.1 0.84 0.3478 0.3528 -0.005 (×) 0.3869 0.3755 0.0114 13∆y+ 31∆x =0.0076
0.1 0.9 0.3478 0.2845 0.0633 0.4525 0.3321 0.1204 13∆z+ 31∆y+ 13∆x =0.1014
TABLEI:Tableofyieldsinthethreebasesfor R =1.1, anddifferentvaluesofg andV. Duetotheasymmetricnatureofthe
T
state in the σz and σx/σy bases, the yield is different for those bases. The yield is the same in σx and σy. Crosses mean that
thedata from thisbasis is not used for thekey generation.
V
1
VV 1
00..7755 0.8
00..55 0.6
0.4
00..2255
0.8 0.2
00
1 0
0.75 0.6
0.5
CK yield
0.25 0.4
0
00..22
0.2
00..11
gg
0 0 g
0 0.05 0.1 0.15 0.2
FIG. 1: Three-dimensional plot of the CK yield for perfect beamsplitters R = T (left), and the corresponding contour plot
(right). The threshold for security is given by thecontour for which theCK yield is zero. For g=0, security is guaranteed as
long as V is greater than zero, although fewer secure bitscan be distilled for smaller V.
InFig.1,weshowtheoverallCKyieldplottedagainst valueofg canbesmallbutnotexactlyzero(forexample,
g andV in the caseofperfect beamsplitters (R=T). In the value of g reported in [6] was 0.02). In this case, the
this case the state produced by the source is a mixture protocol is secure over a smaller range of V. Even then,
of Bell states. The security thresholds for such states we conjecture that the information that Eve can extract
have been analyzedin Ref. [4]. We observethat the pro- from her ancillas in the σ or σ basis is negligible, and
x y
tocol is always secure against incoherent attacks as long the protocol remains pretty robust against all possible
as g = 0 and V > 0, although fewer secure bits can be attacks by her in those bases.
distilled for smaller V. If V is zero the state becomes
separable and, of course, one cannot extract any secure
bits. Moredetailedanalysisrevealsthatthesestates(for
which R = T, g = 0 and V > 0) have the interesting
propertythatthe mutualinformationbetweenAlice and
Eveis alwayszerowhenAliceperformsmeasurementsin
NOISY CHANNEL
σ orσ basis. This is due to the factthatEve’sancillas
x y
corresponding to different outcomes of Alice’s measure-
ments inthe σ andσ basesarethe same,whichmeans
x y So far, we have excluded the effects of noise in the
thattheydonotcarryanyinformationwhatsoeverabout
channelsothatAliceandBobexpecttoreceivethestate
Alice’s and Bob’s correlations. Therefore, if Alice and
‘as-is’fromthe source. Inrealityhowever,this isnotthe
Bob agree on using only the data from the σ and σ
x y case: AliceandBobcanexpecttheirquantumchannelto
measurements (this reduces the efficiency), the protocol
beaffectedbyinteractionwiththeenvironment. Wenext
becomes secure against all possible attacks by Eve (un-
consider what happens when there is symmetric white
conditionalsecurity). Inrealistic situations however,the
noisepresentinthe channel,i.e. the state that Alice and
6
CK yield
F = 0
0.7
0.6
F = 0.1
0.5
0.4
F = 0.2
0.3
0.2 F = 0.3
0.1
V
0.2 0.4 0.6 0.8 1
FIG. 2: Overall CK yield for R = 1.1 and g = 0.02 and different amounts of noise in the channel F. For a noiseless channel
T
(F = 0), when V . 0.39, one can no longer extract secure bits by means of one-way communication because the CK yield is
zero. As the amount of noise increases, the CK yield drops until for F & 0.42, where we will not be able to distill any secure
bits at all (because the CK yield is 0 for all V).
Bob expect to receive is of the form: Analysisshowsthat the optimalPOVMforEve is ofthe
same form as that presented earlier.
2α
1 F β +β +2γ β β
̺(z) = − 1 2 1− 2
2 β β β +β 2γ
1 2 1 2
− −
2α
F Asbefore,wecanobtaintheconditionforsecurityand
+ 1 1, (27) the CK yield for various proportions of noise and this is
4 ⊗
shownin Fig. 2, for fixed values of R =1.1 and g =0.02
T
where we have a proportion F (0 F 1) of unbi- (values reported in Ref. [5, 6]). We candistill less secure
≤ ≤
asednoiseadmixedto the originalstate fromthe source. bits as the amount of noise increases.
CONCLUSION also wish to thank Marek Zukowski for valuable discus-
sions.
We have analyzed the security of the tomographic
QKD protocol using a source of entangled photons pro-
ducedinthe experimentalschemeproposedbyFattalet.
al [5] against the most general incoherent attacks.
[1] C. H. Bennett and G. Brassard, Proceedings of IEEE
Using the analysis presented in this paper we can give Conference on Computers, Systems, and Signal Process-
the number of secure bits that can be distilled by means ing, Bangalore, India (IEEE, New York,1984), p. 175.
of one-way communication between Alice and Bob as [2] A. K. Ekert,Phys. Rev.Lett. 67, 661 (1991).
a function of the experimentally accessible parameters [3] Yeong Cherng Liang, Dagomir Kaszlikowski, Berthold-
R,T,g andV, andfordifferentdegreesofunbiasednoise GeorgEnglert,LeongChuanKwek,andC.H.Oh,Phys.
Rev. A 68, 022324 (2003).
in the channel F.
[4] D. Kaszlikowski, J. Y. Lim, D. K. L. Oi, F. H.
Willeboordse, Ajay Gopinathan, L. C. Kwek, eprint
arXiv/quant-ph/0408088 (2004)
ACKNOWLEDGEMENTS [5] D. Fattal, K. Inoue, J. Vuˆckovi´c, C. Santori, G. S.
Solomon, Y. Yamamoto, Phys. Rev. Lett. 92, 37903
(2004).
DK and LCK wish to acknowledge support from
[6] C. Santori, M. Plton, G. Solomon, Y. Dale, Y. Ya-
A*STAR Grant R-144-000-071-305. DK wishes to ac- mamoto, Phys. Rev.Lett. 86, 1502 (2001).
knowledge NUS Grant R-144-000-089-112. DK and JYL
7
[7] C. Santori, D. fattal, M. Plton, G. Solomon, Y. Ya- [11] C. W. Helstrom, Quantum Detection and Estimation
mamoto, Phys.Rev.B 66, 045308 (2002). Theory (Academic Press, New York,1976).
[8] E. B. Davies, Quantum Theory of Open Systems (Aca- [12] Ajay Gopinathan, privatecommunication.
demic Press, London,1976). [13] J. Reh´acek, B.-G. Englert, D. Kaszlikowski, eprint
[9] I.Csisz´ar and J. K¨orner, IEEE-IT24 339 (1978). arXiv/quant-ph/0408134 (2004)
[10] A.Chefles, Contemp. Phys. 41, 401 (2000).
