Unconditionally secure key distillation from multi-photons

0.16 MB·English

by  Kiyoshi Tamaki

Unconditionally secure key distillation from multi-photons
Kiyoshi Tamaki and Hoi-Kwong Lo
Center for Quantum Information and Quantum Control,
Dept. of Electrical & Computer Engineering and Dept. of Physics,
University of Toronto, Toronto, Ontario, M5S 3G4, CANADA
In this paper, we prove that the unconditionally secure key can be surprisingly extracted from
multi-photon emission part in the photon polarization-based QKD. One example is shown by ex-
plicitlyprovingthatonecanindeedgenerateanunconditionallysecurekeyfromAlice’stwo-photon
emission partin “Quantumcryptographyprotocolsrobust against photonnumbersplittingattacks
for weak laser pulses implementations” proposed by V. Scarani et al., in Phys. Rev. Lett. 92,
057901 (2004), which is called SARG04. This protocol uses the same four states as in BB84 and
differs only in theclassical post-processing protocol. It is, thus,interesting to see how the classical
6 post-processing of quantum key distribution might qualitatively change its security. We also show
0 that one can generate an unconditionally secure key from the single to the four-photon part in a
0 generalized SARG04 that uses six states. Finally, we also compare the bit error rate threshold of
2 these protocols with the one in BB84 and the original six-state protocol assuming a depolarizing

n channel.
a
PACSnumbers: 03.67.Dd
J

4
2
Quantum key distribution (QKD) allows two separate then she sends vacuum state to Bob, which disguises for

parties, the sender Alice and the receiver Bob, to share channel losses. In other words, there is no reason that
4
a secret key with negligible leakage of its information to forbidsthegenerationofasecurekeyfromboththesingle-
v
5 an eavesdropper Eve. The best known QKD protocol photon and two-photon parts in a four-state protocol.
3 is BB84 protocol published by Bennett and Brassard in By modifying only the classical part in BB84, SARG04
0 1984 [1]. Many aspects of the BB84 protocol including might accomplish this.
2 the unconditional security [2, 3, 4] and its implementa-
1 Note that SARG04 differs fromBB84 only in the clas-
tions [5] has been investigated. BB84 is unconditionally
4 sical communication. Thus, it is very interesting to see
secure if Alice emits a single-photon. However, if Alice
0 how only the classical communication of QKD changes
emitsmulti-photon,Eveinprinciplegetsfullinformation
/ its security, which is a fundamentally interesting ques-
h onbitvalueswithoutinducinganybiterrorbyexploiting
p tion. This is related to the viewpoint of “ Entanglement
a photon number splitting attack (PNS) [6].
- as precondition for secure QKD” in [10]. So far, many
t
n Recently, Scarani, et.al. [7] have proposed a QKD studieshavebeendonetogenerateasingle-photonsource
a (SARG04) that is robust against PNS attack. This pro- in experiments for QKD [5]. Hence, the demonstration
u tocol uses exactly the same four states as the one in of a secure key from the two-photon part has an impact
q
BB84, and only the classical data processing is different to that direction of studies. Moreover, from practical
:
v from BB84. A key goal of this paper is to demonstrate viewpoint, an experiment for SARG04 should not be so
i that among many modifications of BB84 [8], SARG04 is difficult once an experiment for BB84 is available (e.g.
X
the first essential modification in the sense that it has a see [11]). It follows that to investigate which protocol
r
a property that BB84-type QKD has never accomplished, oneshouldperformisimportantfromthepracticalview-
i.e., one may generate a secure key not only from the point. In summary, to prove the unconditional security
single-photon part, but rather surprisingly also from a of SARG04 is an interesting question both from funda-
two-photon part. In SARG04, the classical part is mod- mental and practical viewpoints.
ified in such a way that after Alice’s initial broadcast,
Inthispaper,weprovethattheunconditionallysecure
the two remaining states are nonorthogonal. Thus, even
key can be surprisingly extracted not only from single-
by using PNS attack, Eve cannot discriminate the state
photonpart,butalsofrommulti-photonpartinthepho-
deterministically. This is anintuitionthatone mightex-
ton polarization-basedQKD, especially two-photon part
pect to generate a secure key from the two-photon part.
in the SARG04 protocol. Thus, our result clearly shows
We remark that this kind of secure key distillation is that the modification of only the classical communica-
naturalfromthe viewpointof anunambiguousstate dis- tion part in QKD can change its quality. In this paper,
crimination [9]. It is known that an unambiguous dis- we assume that Alice has a coherent light source and
criminationamongN states ofa qubitspaceis onlypos- Bob has a single-photon detector with no dark count.
sible when at least N 1 copies of the state are avail- To prove the security of the two-photon part, we gen-
−
able. This means in the case of four states that we have eralize the idea of “squash operation” in [4], where the
nochancetodistillakeyfrommorethanthetwo-photon authorstreatthemulti-photonpartjustbyassumingthe
part,becauseifEvesucceedsthediscrimination,thenshe worstcasescenarioforBB84. Inourcase,wecannotrely
canresendthecorrespondingstate,whileifshedoesnot, on this scenario,because this scenario completely denies
2
z the measurement outcome is conclusive or not, and if
ϕ- ϕ
1 (cid:13) 0 K = K′, then they discard all corresponding data. It
6
π/4 x is easy to see that Alice and Bob perform the same op-
erations as in BB84 (see also Fig. 1). Intuitively, the
ϕ- ϕ symmetrization of a quantum channel, including Eve’s
0 1
action, given by the random rotation R provides an ad-
vantagetoSARG04overtheB92. Actually,wewillprove
FIG. 1: Bob’s measurement basis in the Bloch sphere. Note an error threshold of SARG04 that is independent of
that the random rotation RK′ just changes the definition of quantum channel losses, which is a big difference from
theoutcomes and does not change thebases as a set. the case for the B92 [13].
Before proving the unconditional security of SARG04
with ν-photon, we describe how we treat the case that
a chance to generate a secure key form the two-photon Bob’s measurement outcome is both ϕj′ and ϕj′. This
part. Thegeneralizationwemadecanwidelyapplytothe happens because of multi-photon detections or dark
multi-photon parts in most of polarization based QKD, counts. Insuchacase,weimposeBobtodecidehismea-
suchasamodifiedSARG04protocol(basedonsixstates) surementoutcome randomly. Note that Bobcan equiva-
that we propose in this paper. In this protocol a secure lently do this by locally preparing a random qubit state
key can be generated from the single to the four-photon followed by the measurement on it. We pessimistically
part. assumethatEvepreparesthequbitstateinsteadofBob.
This paper consists of the following. We first present Since we can assume that Eve sends a qubit state in the
our notations and describe how SARG04 works. After non-ambiguitycase,withoutthreateninganysecuritywe
that,weprovethesecurityoftheprotocolwiththesingle- consider Eve who always sends a qubit state or vacuum
photon part and two-photon part. Finally, we compare state to Bob. This process can be regardedas a “squash
the security of SARG04 with the one of BB84, and we operation” [4].
end this paper with mentioning a natural generalization InordertoprovethesecurityofSARG04,weconstruct
of SARG04 followed by a summary. anunconditionallysecureEntanglementDistillationPro-
We first define several notations. 0 , 1 is a X- tocol with ν-photon (EDP-ν) that can be converted
x x
{| i | i}
basis for a qubit, which is related to Z-basis and Y- to SARG04 with ν-photon. This protocol employs an
basis by j [0 +( 1)j 1 ]/√2 (j = 0,1) and EDP [14]basedon Calderbank-Shor-Steane(CSS) codes
z x x
{| i ≡ | i − | i }
j [0 +i( 1)j 1 ]/√2 ,respectively. Wedefinea [3, 15]. In EDP-ν, Alice creates many pairs of qubits in
y x x
fir{o|lttearitii≡nogno|aproeiurantdor−YF-a=x|issiRin≡π8|0cxo}ishπ04x11|q+ubciots+π8si|n1xπ4ih(1|1xx|,iha0xπ|/−2 athnedsatfatteerr|Ψan(dν)oimABly=app√1l2y(in|0gzitAh|eνr,oϕt0aitBio+nR|1KziAto|νt,hϕe1isBys)-,
0 1 ), and ϕ cosπ 0 +( 1)jsinπ 1 , where tem B, Alice sends the system B to Bob. On the other
1t|1rqxouidbhuitcx≡e| PˆP(X1j=0Ψ||j)xjiih≡jxX|.ΨNo8Ψt|exXtiha,tχR−|ϕ1i==18|ϕ|(0xi0.i W0e in- hquanbdit,sBtaotbe,raannddotmhleynahpeplpieesrfothrme sroatafitlitoenrinRg−Kop′etroattiohne
| i ≡ | ih | † | 0±i √2 | zi| zi± whose successful and failure operation is described by
|1zi|1zi), |χ1±i= √12(|0zi|1zi±|1zi|0zi), |ν,ϕi≡|ϕi⊗ν, Kraus operators F and 11qubit−F2, respectively. Af-
and |ϕji satisfing hϕj|ϕji=0. termanyrepetitionofstaptesendingandBob’soperation,
WenowexplainhowSARG04works. Sincethisproto- they use classical communication so that they keep the
colissimilartoB92protocol[12],weexplainSARG04in qubit pairs where Bob’s filtering succeeds with K =K .
′
the contextofthe modificationofB92protocol. Imagine From these pairs, they randomly choose test pairs that
theB92whereAlicerandomlysends ν,ϕ (j =0,1)de- are subjected to measurements in the Z-basis by Alice
j
| i
pending on the bit value j, while Bob performs the B92 and Bob. Thanks to random sampling theorem, the test
measurementwhereherandomlychoosesameasurement pairs give us a good estimation of the bit error rate on
basisfrom ϕj′ , ϕj′ (j′ =0,1)(seealsoFig.1). Ifhis the remaining pairs (code pairs) provided that the num-
{| i | i}
measurementoutcome is ϕ or ϕ , which we call conclu- ber of the test and code pairs are large enough. If they
1 0
sive,thenBobbroadcaststhathegotaconclusiveresults. can estimate the upper bound of the phase error rate on
Fromtheoutcome,hecaninferwhichbitvalueAlicesent the code pairs, they can choose CSS codes that correct
to him, i.e., when the outcome is ϕ (ϕ ), he concludes both bit and phase errors on the code pairs so that they
1 0
that Alice sent bit value 0 (1). share some maximally entangled states in the form of
We can convert the above B92 into SARG04 just im- χ0+ . Finally, by performing Z-basis measurement on
| i
posing Alice to perform a rotation RK just before send- those states, they share a secret key.
ing the state, and imposing Bob to perform a rota- To confirm that EDP-ν is completely equivalent to
tion R K′ just before performing the B92 measurement. SARG04, first note that Alice can perform Z-basis mea-
−
Here, each of K and K is randomly chosen from 0 to 3 surement just before sending the system B without
′
(R0 11qubit). AfterBobperformsthemeasurement,Al- changing any measurement outcome. It follows that Al-
≡
icebroadcaststo BobwhichB92shehaschosen,i.e., she ice randomly sends ν,ϕ (j = 0,1), and this is ex-
j
| i
broadcasts K. If K =K , then Bob broadcasts whether actly what Alice does in SARG04. Similarly, we can
′
3
A RK R-K’ F straight forward. Moreover, to simplify Eve’s action, we
EVE B
define “trash” systems that are qubits originated from
Ψ(ν=2) RK 0x multi-photon, but Bob has no interest in. Since Bob
never care about the state of “trash” after Eve’s action,
we can safely assume that the final state of eachtrash is
FIG. 2: In the two-photon case (i.e., ν = 2), Alice first pre- ina particularstate, say 0 (see alsoFig.2). Since
x trash
pares three-qubit in the state of |Ψ(ν=2)iAB. After some op- we haveput no assumptio|noinAlice andBobother than
erations by Alice and Bob, they try to distill a key from a they use qubits, our basic strategy for the security proof
final state of the system A and B (black dots) if K =K′. can widely apply to any photon number part in most of
polarization based QKD.
(ν)
For the later convenience, let ρ be the pair
qubit
allow Bob to perform Z-basis measurement just after qubit state stemming from the ν-photon part. With
the filtering operation, which is completely the same this state, p is expressed as p = Tr ρ(ν) ,
as the measurement randomly chosen from ϕj′ , ϕj′ L,ν fil,ν h qubiti
rbFoa|tjsai′stziioh(njj′,′zi|t=Fi†s0=o,b1v)21i.|oϕujsT′ithhhϕisajt′|c.BanoBbyb’secoopsmeeebrnaintiibonyng{int|nhoetEinDiragP|n-dtνhoaimi}st pTbriht,ρνq(νu)b=it Tmrh′=ρq(0νu,1)bPiˆtP(|χmm=′,+−,i−)iPˆ.(T|χo1,ombit)aii,nρaq(nνud)bit,ppwhe,νfirs=t
completely the same as the one Bob does in SARG04. consider tPhe final state of Ψ(ν) after Alice, Bob, and
AB
Note that successful filtering events corresponds to the Eve’soperationswithK =|K .iThisstate isobtainedby
′
conclusive events. tracing out the every other pair from the total state, to
Since we have seen the equivalence of EDP-ν to whichEvehas performedanarbitraryoperation,includ-
SARG04, we prove the security of SARG04 based on ingtheoneincoherentattacks. Thefinal(unnormalized)
EDP-ν. Note that the bit error rate on the code pairs state canbe expressedasρ(ν) = ρ(f,ν),where f isan
fin f fin
is well estimated by the test pairs, hence all we have to index for an arbitrary matrix rePpresenting Eve’s action
consider is how to estimate the phase error rate on the E(f,ν) on ν-photon [18].
code qubit pairs from the bit error rate. Intuitively, this B
In the single-photon case (i.e., ν = 1), ρ(ν) =
phase error estimation is given by the symmetry of the fin
rotations R, and the property of the filtering operation ρ(ν=1) and ρ(f,ν=1) = ρ(f,ν=1). It is a bit te-
qubit fin qubit
F [13, 16]. Let us define p(Ll,)ν (L = {Bit,Phase,Fil}) dious but straight forward to see that pph,1 = 32pbit,1
as an expectation value for a particular lth qubit pair of for ρ(f,ν=1) stemming from any E(f,ν=1). Thus,
qubit B
the ν-photon part having an event in L, conditioned on by the linearity of the density matrix, we conclude
arbitraryconfigurationsofaneventinLorthefailurefil- that e(1) = 3e(1). Furthermore, one can also
ph 2 bit
teringincludingBob’svacuumdetectionforthe previous
show that χ ρ(ν=1) χ 2 χ ρ(ν=1) χ and
l 1 pairs. Furthermore,let us define a randomvariable h 0−| qubit| 0−i ≥ h 1+| qubit| 1+i
Xev−Lse,nνts≡LnwsLi,νth−νP-phsl=o1topn(Ll,)νa,ctwuahlelryehnasLs,νhaipsptehneednufmrobmer1ostf w2hhχi1c−h|iρmq(νup=blii1te)s|χt1h−aitth≥erehisχa0−m|ρuq(tνuu=bai1tl)|iχnf0o−rimaatliwonaybsethwoeledn,
pairtosth pair. BydirectlyapplyingAzuma’sinequality phase and bit error patterns.
[17] to Xs , one can show that s p(l) ns with In the two-photon case (ν = 2), ρq(νu=bi2t) and ρq(fu,bνi=t2)
exponentiLa,lνly as the number of pPairl=s1s iLn,νcr→easesL.,νThus, are obtained by taking projection to ρ(ν=2) and ρ(f,ν=2)
fin fin
we have the following theorem. by 0 that can be expressed via a 2 2 matrix,
x trash
| i ×
THEOREM: If Cp(l) +C p(l) > p(l) holds, then E(f,u) (u = 0,1) [19]. It is tedious but straight forward
bit,ν ′ fil,ν ph,ν B
Ce(ν)+C >e(ν) is exponentially reliable as the number toseethatify >g(x) 1 3 2x+ 6 6√2x+4x2
of bsuitccessf′ullypfihltering states increases. Here e(ν) is is satisfied, then xpbit,≡ν=26+(cid:16) y−pfil,ν=2p>pp−h,ν=2 holds fo(cid:17)r
the actual bit/phase error rate normalized by thebita/cphtual any E(f,u) [20]. Thus, we pessimistically conclude that
B
successful filtering events. xe(2)+g(x)=e(2). Note that e(2) =0 even when e(2) =
bit ph ph 6 bit
We emphasize that thanks to Azuma’s inequality this 0 because Inf[g(x)] = sin2 π, which means Eve can get
8
theoremholds evenwhenEveperforms the mostgeneral someinformationonthekeywithoutintroducinganybit
attack,includingcoherentattacks. Ourtheoremisagen- error in ν = 2 case. In ν = 2 case, we cannot find any
eralizationofthediscussionin[16]. Now,weareonlyleft mutual information between the bit and phase errors.
to obtainthe inequalityfora particularqubit pairinthe Since we have finished the phase error estimation, we
form of Cpbit,ν +C′pfil,ν >pph,ν. can calculate the key generation rate for SARG04. By
We remark that the pessimistic assumption on the assuming the random hashing CSS code [14, 21], the
stateEvesendstoBobandtheabovetheoremareimpor- key generation rate for ν-photon part R is asymptot-
ν
tant observations. With these observations, we are left ically represented by R = 1 H(X ,Z ) [21], where
ν ν ν
−
only to calculate the state of a qubit pair state, and find H(X ,Z ) is the entropy of bit and phase error pattern
ν ν
therelationshipthatholdsforanyEve’saction,whichare in the ν-photon part. By solving R > 0, we can show
ν
4
that up to e(1) 9.68% (this is the same as the one re- results and e is the bit error rate on every conclusive
bit ∼ bit
cently obtained in [22] without the “preprocessing”)and result.
e(b2it) ∼2.71%(whenx∼2.747)wecandistillasecurekey Note that our security analysis can directly apply
from the ν-photon part. To compare the bit error rate to a modified six-state protocol, where Alice and Bob
thresholdofSARG04totheoneofBB84,weassumethat additionally perform a random π/2 rotation around
sEtvaetesρim⊗uνleavtoeslvaesdteopo1la−riz43ipngρc⊗hνa+nn43pel(11wqhubeirte/2a)⊗νν-p.hHoetroen, {si|oϕnj′io,n|ϕtjh′ie}uanxaismibnigSuAoRusGs0t4a.teBdyisfcorlliomwininagtiothne, dwiesceuxs--
p is a depolarizing(cid:0)rate. S(cid:1)ince e(ν) = 4p/(3 + 4p) in pect that we may distill a secure key from the single
bit
this channel, the single-photon and two-photon part of to the four-photon part. Actually, one can show that
SARG04 is secure up to p 8.04% and p 2.08%, re- we can indeed generate a secure key from ν-photon part
∼ ∼
spectively while BB84 with one-way classical communi- up to the error rates of 11.2% (ν = 1), 5.60% (ν = 2),
cation is secure up to p 16.5% [3]. 2.37% (ν = 3), and 0.788% (ν = 4), which correspond
∼
We can express a total key rate R by using the de- to p 9.49%, p 4.45%, p 1.82%, and p 0.595%,
∼ ∼ ∼ ∼
coy state [23], which allows us to use an imperfect light respectively, while p 19.0% in the original six-state
∼
sourceandimperfectthresholddetectors. Thisideagives protocol with one-way classical communication [21, 24].
the lower bound of the fraction of Bob’s conclusive re-
Inthispaper,weprovethattheunconditionallysecure
sults conditioned on ν-photon emission as ξ(ν) and the
key canbe extractedfrommulti-photonemission partin
(ν)
upper bound of the bit error as e . From them, we the photon polarization-based QKD. Our result demon-
bit
can compute the upper bound of the conditional en- strates clearly that by changing only the classical post
tropy of the phase error pattern given the bit error processing protocol, the foundations of the security can
patter, which is denoted by H(Zν Xν). Hence, R = change qualitatively.
|
−Pconch(ebit)+ 2ν=1ξ(ν)(cid:16)1− H(Zν|Xν)(cid:17) [4, 21, 23]. WethankJ.-C.Boileau,J.Batuwantudawe,M.Koashi
Here, P is a fPraction that Bob obtains the conclusive and F. Fung for helpful discussions.
conc
[1] C.H. Bennett and G. Brassard, Proceedings of IEEE In- [14] C.H.Bennett,D.P.DiVincenzo,J.A.Smolin,andW.K.
ternational Conference on Computers, Systems and Sig- Wootters, Phys. Rev.A 54, 3824 (1996).
nal Processing, 175 (1984). [15] A.R.CalderbankandP.W.Shor,Phys.Rev.A54,1098
[2] D. Mayers, Lecture Notes in Computer Science, 1109, (1996),A.M.Steane,Proc.R.Soc.LondonA452,2551
Springer–Verlag, 343 (1996). H.-K. Lo and H. F. Chau, (1996).
Science 283, 2050 (1999). H. Inamori, N. Lu¨tkenhaus, [16] J. C. Boileau, K. Tamaki, J. Batuwantudawe, R.
and D. Mayers, quant-ph/0107017. Laflamme, and, J. Renes, Phys. Rev. Lett. 94 040503
[3] P. W. Shor, and J. Preskill, Phys. Rev. Lett. 85, 441 (2005).
(2000). [17] K. Azuma, TohukuMath. J. 19 357 (1967).
[4] D.Gottesman,H.-K.Lo,N.Lu¨etkenhaus,andJ.Preskill, [18] ρ(f,ν) ≡ Pˆ( 3 |ψ(ν)i), |ψ(ν)i = 11 ⊗
Quantum Information and Computation, Vol. 4, No. 5, fin K=0 K K A
325 (2004). (cid:18)F(−ν)KEB(f,ν) RKP⊗ν(cid:19)|Ψ(ν)iAB,whereF(−ν=K1) ≡FR−K,
[5] NM.oGd.isPinh,ysG,.7R4,ib1o4r5dy(2,0W02.).Tittel, and H. Zbinden, Rev. and F(−ν=K2) ≡(cid:0)FR−(cid:1)K⊗11trash.
[6] G.Brassard,N.Lu¨tkenhaus,T.Mor,B.C.Sanders,Phys. [19] ρq(fu,bνi=t2) = 3K=0Pˆ(|ΨKi), where |ΨKi ≡
[7] VRe.vS.cLaerattn.i,85A,.1A33c0in(,20G0.0)R.ibordy, and N. Gisin, Phys. 11A ⊗ (cid:16) 1u=0FRPB−KEB(f,u)RBK(cid:17)|ξ(K,u)i, |ξ(K,u)i ≡
Rev.Lett. 92, 057901 (2004). √12 hux|RPK|ϕ0i|0ziA|ϕ0iB+hux|RK|ϕ1i|1ziA|ϕ1iB ,
[8] H-K. Lo, H. F. Chau, and M. Ardehali, J. of Cryp- and(cid:2)EB(f,u) ≡trashh0x|EB(f,ν=2)|uxitrash. (cid:3)
tology, ISSN: 0933-2790 (Paper) 1432-1378 (Online), [20] Note the positivity of CAbit + C′Afil − Aph, where
March (2004), (10.1007/s00145-004-0142-y), (Springer- c~∗AL~cT = pL,ν=2, AL is a 8×8 matirx, and eight el-
Verlag New York,LLC). ArXiv:quant-ph/0011056. ements in~care directly taken from E(f,u).
B
[9] A.Chefles, arXiv:quant-ph/0105016. [21] H-K. Lo, Quantum Information and Computation, Vol.
[10] M. Curty, M. Lewenstein, N. Lu¨tkenhaus, Phys. Rev. 1, No.2, 81 (2001).
Lett.92, 217903 (2004) [22] C. Branciard, N. Gisin, B. Kraus, V. Scarani,
[11] C. Elliott, A. Colvin, D. Pearson, O. Pikalo, J. Schlafer, arXiv:quant-ph/0505035.
H.Yeh,arXiv:quant-ph/0503058. [23] H-K. Lo, X. Ma, and K. Chen, Phys. Rev. Lett 94,
[12] C. H. Bennett,Phys. Rev.Lett, 68, 3121 (1992). 230504 (2005).
[13] K.TamakiandN.Lu¨tkenhaus,Phys.Rev.A69,032316 [24] D. Bruss, Phys.Rev.Lett. 81, 3018 (1998).
(2004).