unconditional security of the bennett 1992 quantum key ... · unconditional security of the bennett...
TRANSCRIPT
![Page 1: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/1.jpg)
Unconditional security of the Bennett 1992 quantum key-distribution protocol
over noisy and lossy channels
Kiyoshi TamakiThe Graduate Univ. for Advanced Studies(SOKENDAI), CREST
Collaboration withM. Koashi, N. Lütkenhaus, and N. Imoto
![Page 2: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/2.jpg)
Summary of my talk
• Motivations for the security proof of the B92• Introduction to Quantum Key Distribution
(QKD)• Unconditional Security of the B92 protocol• Summary
K. Tamaki, M. Koashi, and N. Imoto, Phys. Rev.Lett.90, 167904 (2003). (ch-loss free)
K. Tamaki, and N. Lütkenhaus, to appear in Phys. Rev A.quantu-ph/0308048. (over noisy and lossy ch)
![Page 3: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/3.jpg)
Quantum Key Distribution (QKD)
・A way to share a random bit string between Alice and Bob whose info leaks arbitrary small to Eve.
0100110101101
Alice Bob0100110101101??
Public Ch
Quantum Ch
Eve
B92 (Bennett in 1992):BB84 (Bennett and Brassard in 1984):
![Page 4: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/4.jpg)
Motivations for security proof of the B92
・The B92 is the simplest QKD.
・Clarifies the role of the nonorthogonality in conveyingsecret information.
![Page 5: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/5.jpg)
D. Mayers, Lec-Notes in Comp Science, 1109, Springer (1996).
H. Inamori, et.al. quant-ph/0107017.
P. W. Shor and J. Preskill, Phys.Rev.Lett, 85, 441, (2000).
BB84: M. Koashi and J. Preskill, Phys. Rev. Lett. 90, 057902 (2003).
D. Gottesman and H-K. Lo, quant-ph/0105121.
D. Gottesman, H-K. Lo, N. Lütkenhaus, and J. Preskill,
quant-ph/0212066 .
Works related with Coherent Attack
K. Tamaki, M. Koashi, and N. Imoto,
Phys. Rev.Lett.90, 167904 (2003). (ch-loss free)
K. Tamaki, and N. Lütkenhaus, to appear in Phys. Rev A.
B92:
![Page 6: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/6.jpg)
No Eve, noises and losses case (B92)
Alice
0 encoder
1
Bob
orQuantum Ch
?
?1
or
0
? : inconclusive
Single photon polarization1
0
0 1and : conclusive
![Page 7: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/7.jpg)
conclusive
conclusive
Alice Bob
inconclusive
0
1
1
0
1
?
Public Channel
Public Channel
Public Channel
or or?
?
1
0
?
1
?
1
?
0
![Page 8: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/8.jpg)
Alice
0 encoder
Bob
The effects of noises
noisenoise
or 0
1
1Error !
noise
Eve
Noises, eavesdropping Errors on the key
![Page 9: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/9.jpg)
・ QKD is possible over ideal situations
How to distribute the identical and secure secret key under the existence of eavesdropping, noises and losses?
![Page 10: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/10.jpg)
Assumptions
Alice has a perfect single photon source.
Bob’s detector is ideal (no dark count).
No channel losses (will be removed later)
Unconditional Security of the B92 protocol
Security against coherent attacks
![Page 11: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/11.jpg)
Protocol 1 (Secure)
The B92
(reduction)
Outline of the security proof of the B92
Key words: Error corrections, a Bell state, Entanglement distillation protocol (EDP)
![Page 12: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/12.jpg)
0110 0111Alice Bob
(1 bit error case)
11
Bit Error Syndrome
1
0
OK
NG
0 1NG
Erroneous bit is the 4 th bit !
0110 0110
Compare the syndrome of the suitably chosen subsets
Basic concept 1 (classical error correction)
![Page 13: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/13.jpg)
A Bell State :
Basic concept 2 (Bell state)
If Alice and Bob share pairs of the Bell state, the shared bit values are unconditionally secure.
(1) The Bell state is a pure state. (No correlation with the third system)
(2) The bit values are at random.
Alice Bob
1
1
0
1
1
0
![Page 14: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/14.jpg)
Basic concept 3 (The EDP based on CSS codes)
Alice Bobpairs
Bell states can be distilled.
: error rate in basis (bit error)
: error rate in basis (phase error)
By using CSS codes that correct up to bit errors and phase errors, in the limit of large ,
Shor and Preskill (2000)
![Page 15: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/15.jpg)
Alice Bob
:1
:1
OK
NG
By comparing the syndromes in both z and x basis and after performing Quantum error correction
:0
:1
NG
OK
1:
0:
1:
1:
: CSS Code
![Page 16: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/16.jpg)
Pairs of the Bell state
Quantum decoding
Alice Bob
No bit and phase errors in the basis states for the CSS codes
![Page 17: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/17.jpg)
Protocol 1 (Secure)
The B92
(reduction)
Outline of the security proof of the B92
The final purpose of this protocol is to distill pairs of the Bell state for the unconditionally secure key.
![Page 18: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/18.jpg)
Protocol 1
BobAlice
F succeeds or notPublic Ch
(1) Filtering operation
Keep the qubit pairs that have passed the filtering
Alice prepares
No Eve:
![Page 19: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/19.jpg)
Alice Bobpairs
Randomly permute the pairs of qubit
: number of the states that have passed the filtering
![Page 20: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/20.jpg)
BobAlice
(2) Bit error estimation
000
1
If too many errors are detected,then they abort the protocol
(2‘) Phase error estimation (via a property of the Filtering)
10Test bitsTest bits
Test bits gives us a good bit error estimation on untested qubit pairs
Choose the CSS code that correct up to the estimated errors
![Page 21: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/21.jpg)
Pairs of the Bell state
101
101
BobAlice
Public Ch
(3) The EDP based on CSS codes
(4) Measurements on the Bell states Quantum decoding
Alice Bob
Quantum error correction
![Page 22: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/22.jpg)
・ Protocol 1 is secure if the phase error rate estimation forthe EDP based on CSS codes is precise.
・The phase error rate has to be estimated from the bit error rate.c
The security of the Protocol 1 depends on whether they can distill the Bell state or not.
![Page 23: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/23.jpg)
BobAlice
0
0
01
10
The phase error rate estimation from the bit error rate
Test bitsTest bits
0
0
1
011
gedanken gedanken
Note: It is dangerous to put some assumptions on the state.
![Page 24: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/24.jpg)
: subspace spanned by
: subspace spanned by
NonorthogonalThe bit error and the phase error have a correlation !!
for givenUpper bound of
Qubit space
?
![Page 25: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/25.jpg)
σσα α σ
Test bit Untested bit
σ σβ β β
α β
σα σα σβ
Consider any -qubit state that is symmetric under any permutation
σα
σβ
For given , how much is
?
Question
For the estimation, we are allowed to regard the state as having stemmed from Independently and Identically Distributed quantum source !
ANS, the upper bound of
![Page 26: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/26.jpg)
Protocol 1 is unconditionally secure.
secret key can be distilled
By using the method, we can estimate the upper bound of the phase error rate from the bit error rate.
We can distill the Bell states by the EDP based on CSS codes
![Page 27: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/27.jpg)
Protocol 1 (Secure)
The B92
(reduction)
Outline of the security proof of the B92
Key words: Error correction, Bell state, Entanglement distillation protocol (EDP)
![Page 28: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/28.jpg)
BobAlice
Public Ch
The EDP based on CSS codes
Only the bit values on secret key are important
・ They do not need to detect phase error positions !
Observation 1 Shor and Preskill (2000)
101
101
Alice Bob
![Page 29: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/29.jpg)
No need for Quantum decode → Classical decode
(Note: Phase error rate is still necessary for the decode)
Q-decode
C-decode
Observation 2
Due to the property of the Quantum decoding in CSS codes
Shor and Preskill (2000)
110
![Page 30: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/30.jpg)
Reduction to the B92 protocol
Randomly chosen
(Alice’s side)
P.Ch
101
Preparation of the B92 states
key
Q-decode
C-decoding
Classical bit error correction !!
key
P.ChkeyC
-decode
C-decode corresponds to the privacy amplification
![Page 31: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/31.jpg)
Reduction to the B92 protocol (Bob’s side)
The B92 measurement and classical error correction !
C-decoding
Q-EC
keyC-EC
C-decoding
key
key
Q-decoding
C-EC
The filtering succeeds or not
Conclusive or not
![Page 32: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/32.jpg)
Success probability of the filtering=
The probability of obtaining the conclusive event
![Page 33: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/33.jpg)
Protocol 1 (Secure)
The B92
(reduction)
secret key can be distilled
Summary of our proof
secret key can be distilled
: number of the states that have passed the filtering
: number of the states that result in conclusive events
![Page 34: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/34.jpg)
Example of the phase error estimation
Actual phase error
:Actual bit error
:Estimated upper bound of phase error
: Two nonorthogonal single photon states
Trade-off
: depolarizing rate
![Page 35: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/35.jpg)
Example of the security
: Optimal net growth of secret key per pulse : depolarizing rate
The B92 over loss-free channel is secure up toc.f The BB84: (Shor and Preskill , 2000)
![Page 36: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/36.jpg)
BobAlice
F succeeds or notPublic Ch
Alice prepares
The B92 over lossy and noisy channel
![Page 37: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/37.jpg)
Example of the security and estimation
: Optimal net growth rate of secret key per pulse
: depolarizing rate : the prob that Bob detects single photon
The vacuum state
: L = 0
: L = 0.2
: L = 0.5
![Page 38: Unconditional security of the Bennett 1992 quantum key ... · Unconditional security of the Bennett 1992 quantum key-distribution protocol over noisy and lossy channels Kiyoshi Tamaki](https://reader030.vdocuments.net/reader030/viewer/2022041218/5e075a9c67b7f075a46f6122/html5/thumbnails/38.jpg)
We have proven the unconditional security of the B92 over lossy and noisy channel.(Assumption:an ideal single photon source, an ideal photon counter that discriminates between single photon and the other states)
Thanks to the filtering, we can upper bound the phase error rate from the bit error rate.
Accuracy of the phase error estimation for the EDP based on CSS codes depends on the nonorthogonality. The poor estimation makes the B92 weaker against noises.
K. Tamaki, M. Koashi, and N. Imoto, Phys. Rev.Lett.90, 167904 (2003). (ch-loss free)
K. Tamaki, and N. Lütkenhaus, To appear in Phys. Rev A.
Summary・
・
・
quantu-ph/0308048. (over noisy and lossy ch)