We study eavesdropping in quantum key distribution with the six state protocol,when the signal states are mixed with white noise. This situation may arise either when Alice deliberately adds noise to the signal states before they leave her lab, or in a realistic scenario where Eve cannot replace the noisy quantum channel by a noiseless one. We find Eve's optimal mutual information with Alice, for individual attacks, as a function of the qubit error rate. Our result is that added quantum noise can make quantum key distribution more robust against eavesdropping.
We show an eavesdropping scheme on Bostr\UNICODE{0xf6}m-Felbinger communication protocol (called ping-pong protocol) [Phys. Rev. Lett. 89, 187902 (2002)] in an ideal quantum channel. A measurement attack can be perfectly used to eavesdrop Alice's information instead of a most general quantum operation attack. In a noisy quantum channel, the direct communication is forbidden. We present a quantum key distribution protocol based on the ping-pong protocol, which can be used in a low noisy quantum channel. And we give a weak upper bound on the bit-error ratio that the detection probability $d$ sho…
The paper [Howard E. Brandt, "Conclusive eavesdropping in quantum key distribution," J. Opt. B: Quantum Semiclass. Opt. 7 (2005)] is generalized to include the full range of error rates for the projectively measured quantum cryptographic entangling probe, and also the full range of inconclusive rates for the entangling probe measured with the POVM receiver.
I present an eavesdropping on the protocol proposed by W.-H. Kye, et al. [Phys. Rev. Lett. 95, 040501 (2005)]. I show how an undetectable Eve can steal the whole information by labeling and then measuring the photons prepared by the user Alice.
The technological possibilities of a realistic eavesdropper are discussed. Two eavesdropping strategies taking profit of multiphoton pulses in faint laser QKD are presented. We conclude that, as long as storage of Qubits is technically impossible, faint laser QKD is not limited by this security issue, but mostly by the detector noise.
Employing the fundamental laws of quantum physics, Quantum Key Distribution (QKD) promises the unconditionally secure distribution of cryptographic keys. However, in practical realisations, a QKD protocol is only secure, when the quantum bit error rate introduced by an eavesdropper unavoidably exceeds the system error rate. This condition guarantees that an eavesdropper cannot disguise his presence by simply replacing the original transmission line with a less faulty one. Unfortunately, this condition also limits the possible distance between the communicating parties, Alice and Bob, to a few …
We consider the collective eavesdropping of the BB84 and six-state protocols. Since these protocols are symmetric in the eigenstates of conjugate bases, we consider collective attacks having the same kind of symmetry. We then show how these symmetric collective attacks are sufficiently strong in order to minimize the Devetak-Winter rates. In fact, it is quite easy to construct simple examples able to reach the unconditionally-secure key-rates of these protocols.
A multi-user quantum key distribution protocol is proposed with single particles and the collective eavesdropping detection strategy on a star network. By utilizing this protocol, any two users of the network can accomplish quantum key distribution with the help of a serving center. Due to the utilization of collective eavesdropping detection strategy, the users of the protocol just need have the ability of performing certain unitary operations. Furthermore, we present three fault-tolerant versions of the proposed protocol, which can combat with the errors over different collective-noise chann…
We analyze the application of bright reference pulses to prevent the photon-number-splitting attack in weak-pulse quantum key distribution. Under the optimal eavesdropping strategy as far as we know, the optimal parameters of bright reference and signal pulses can ensure a secure transmission distance up to 146 km. To realize the quantum key distribution scenario with up-present techniques, we present an experimentally feasible scheme to create a large splitting ratio between bright reference and signal pulses, and to switch the bright reference pulses away from signal pulses to avoid the afte…
Quantum secret-sharing protocols involving N partners (NQSS) are key distribution protocols in which Alice encodes her key into $N-1$ qubits, in such a way that all the other partners must cooperate in order to retrieve the key. On these protocols, several eavesdropping scenarios are possible: some partners may want to reconstruct the key without the help of the other ones, and consequently collaborate with an Eve that eavesdrops on the other partners' channels. For each of these scenarios, we give the optimal individual attack that the Eve can perform. In case of such an optimal attack, the a…
We introduce new sophisticated attacks with a Hong-Ou-Mandel interferometer against quantum key distribution (QKD) and propose a new QKD protocol grafted with random basis shuffling to block up those attacks. When the polarization basis is randomly and independently shuffled by sender and receiver, the new protocol can overcome the attacks even for not-so-weak coherent pulses. We estimate the number of photons to guarantee the security of the protocol.
We address the question of quantifying eavesdropper's information gain in an individual attack on systems of quantum key distribution. It is connected with the concept of conclusive eavesdropping introduced by Brandt. Using the BB84 protocol, we examine the problem of estimating a performance of conclusive entangling probe. The question of interest depends on the choice of a quantitative measure of eavesdropper's information about the error-free sifted bits. The Fuchs--Peres--Brandt probe realizes a very powerful individual attack on the BB84 scheme. In the usual formulation, Eve utilizes the …
We introduce a new quantum key distribution protocol that uses d-level quantum systems to encode an alphabet with c letters. It has the property that the error rate introduced by an intercept-and-resend attack tends to one as the numbers c and d increase. In dimension d=2, when the legitimate parties use a complete set of three mutually unbiased bases, the protocol achieves a quantum bit error rate of 57.1%. This represents a significant improvement over the 25% quantum bit error rate achieved in the BB84 protocol or 33% in the six-state protocol.
We thoroughly analyse the novel quantum key distribution protocol introduced recently in quant-ph/0412075, which is based on minimal qubit tomography. We examine the efficiency of the protocol for a whole range of noise parameters and present a general analysis of incoherent eavesdropping attacks with arbitrarily many steps in the iterative key generation process. The comparison with the tomographic 6-state protocol shows that our protocol has a higher efficiency (up to 20%) and ensures the security of the established key even for noise parameters far beyond the 6-state protocol's noise thresh…
We experimentally implemented an eavesdropping attack against the Ekert protocol for quantum key distribution based on the Wigner inequality. We demonstrate a serious lack of security of this protocol when the eavesdropper gains total control of the source. In addition we tested a modified Wigner inequality which should guarantee a secure quantum key distribution.
Security of Binary-Modulated Optical Key Distribution Against Quantum-Enhanced Coherent Eavesdropping
Centre for Quantum Optical Technologies, Centre of New Technologies, University of Warsaw（华沙大学新技术中心量子光学技术研究中心）；Faculty of Physics, University of Warsaw（华沙大学物理学院）；Dipartimento di Fisica “Aldo Pontremoli”, Università degli Studi di Milano（米兰大学阿尔多·庞特罗莫利物理系）；Istituto Nazionale di Fisica Nucleare, Sezione di Milano（意大利国家核物理研究所米兰分部）
The security of a cryptographic key that is generated by communication through a noisy quantum channel relies on the ability to distill a shorter secure key sequence from a longer insecure one. We show that -- for protocols that use quantum channels of any dimension and completely characterize them by state tomography -- the noise threshold for classical advantage distillation is substantially lower than the threshold for quantum entanglement distillation because the eavesdropper can perform powerful coherent attacks. The earlier claims that the two noise thresholds are identical, which were b…
An entanglement witness approach to quantum coherent state key distribution and a system for its practical implementation are described. In this approach, eavesdropping can be detected by a change in sign of either of two witness functions, an entanglement witness S or an eavesdropping witness W. The effects of loss and eavesdropping on system operation are evaluated as a function of distance. Although the eavesdropping witness W does not directly witness entanglement for the system, its behavior remains related to that of the true entanglement witness S. Furthermore, W is easier to implement …
By employing real-time monitoring of single-photon avalanche photodiodes we demonstrate how two types of practical eavesdropping strategies, the after-gate and time-shift attacks, may be detected. Both attacks are identified with the detectors operating without any special modifications, making this proposal well suited for real-world applications. The monitoring system is based on accumulating statistics of the times between consecutive detection events, and extracting the afterpulse and overall efficiency of the detectors in real-time using mathematical models fit to the measured data. We ar…
In search of a quantum key distribution scheme that could stand up for more drastic eavesdropping attack, I discover a prepare-and-measure scheme using $N$-dimensional quantum particles as information carriers where $N$ is a prime power. Using the Shor-Preskill-type argument, I prove that this scheme is unconditional secure against all attacks allowed by the laws of quantum physics. Incidentally, for $N = 2^n > 2$, each information carrier can be replaced by $n$ entangled qubits. And in this case, I discover an eavesdropping attack on which no unentangled-qubit-based prepare-and-measure quantu…
The security of quantum cryptography is guaranteed by the no-cloning theorem, which implies that an eavesdropper copying transmitted qubits in unknown states causes their disturbance. Nevertheless, in real cryptographic systems some level of disturbance has to be allowed to cover, e.g., transmission losses. An eavesdropper can attack such systems by replacing a noisy channel by a better one and by performing approximate cloning of transmitted qubits which disturb them but below the noise level assumed by legitimate users. We experimentally demonstrate such symmetric individual eavesdropping on…
In semiquantum key-distribution (Boyer et al.) Alice has the same capability as in BB84 protocol, but Bob can measure and prepare qubits only in $\{|0\rangle, |1\rangle\}$ basis and reflect any other qubit. We study an eavesdropping strategy on this scheme that listens to the channel in both the directions. With the same level of disturbance induced in the channel, Eve can extract more information using our two-way strategy than what can be obtained by the direct application of one-way eavesdropping in BB84.
The security of quantum key distribution (QKD) can easily be obscured if the eavesdropper can utilize technical imperfections of the actual implementation. Here we describe and experimentally demonstrate a very simple but highly effective attack which even does not need to intercept the quantum channel at all. Only by exploiting the dead time effect of single photon detectors the eavesdropper is able to gain (asymptotically) full information about the generated keys without being detected by state-of-the-art QKD protocols. In our experiment, the eavesdropper inferred up to 98.8% of the key cor…
In a recent Letter (Phys. Rev. Lett. 95 (2005) 010503) Barrett, Hardy and Kent (BHK) considered a very interesting question which of the fundamental laws of physics ensure security of quantum cryptographic protocols. In particular, they presented quantum key distribution protocol and claimed its security in a very general framework, which allows - what they call - postquantum eavesdropping strategies i.e. which "allows for eavesdroppers who can break the laws of quantum mechanics, as long as nothing they can do implies the possibility of superluminal signaling". In this Comment, however, we sh…
A quantum protocol is described which enables a user to send sealed messages and that allows for the detection of active eavesdroppers. We examine a class of eavesdropping strategies, those that make use of quantum operations, and we determine the information gain versus disturbance caused by these strategies. We demonstrate this tradeoff with an example and we compare this protocol to quantum key distribution, quantum direct communication, and quantum seal protocols.
In this article we deal with the security of the BB84 quantum cryptography protocol over noisy channels using generalized privacy amplification. For this we estimate the fraction of bits needed to be discarded during the privacy amplification step. This estimate is given for two scenarios, both of which assume the eavesdropper to access each of the signals independently and take error correction into account. One scenario does not allow a delay of the eavesdropper's measurement of a measurement probe until he receives additional classical information. In this scenario we achieve a sharp bound.…
In Gaussian quantum key distribution eavesdropping attacks are conventionally modeled through the universal entangling cloner scheme, which is based on the premise that the whole environment is under control of the adversary, i.e., the eavesdropper purifies the system. This assumption implies that the eavesdropper has either access to an identity (noiseless) channel or infinite amount of entanglement in order to simulate such an identity channel. In this work, we challenge the necessity of this assumption, and we propose a teleportation-based eavesdropping attack, where the eavesdropper is not…
The Gaussian quantum key distribution protocol based on coherent states and heterodyne detection [Phys. Rev. Lett. 93, 170504 (2004)] has the advantage that no active random basis switching is needed on the receiver's side. Its security is, however, not very satisfyingly understood today because the bounds on the secret key rate that have been derived from Heisenberg relations are not attained by any known scheme. Here, we address the problem of the optimal Gaussian individual attack against this protocol, and derive tight upper bounds on the information accessible to an eavesdropper. The opti…
We describe a nuclear magnetic resonance (NMR) experiment which implements an efficient one-to-two qubit phase-covariant cloning machine(QPCCM). In the experiment we have achieved remarkably high fidelities of cloning, 0.848 and 0.844 respectively for the original and the blank qubit. This experimental value is close to the optimal theoretical value of 0.854. We have also demonstrated how to use our phase-covariant cloning machine for quantum simulations of bit by bit eavesdropping in the four-state quantum key distribution protocol.
Protecting secure random key from eavesdropping in quantum key distribution protocols has been well developed. In this letter, we further study how to detect and eliminate eavesdropping on the random base string in such protocols. The correlation between the base string and the key enables Alice and Bob to use specific privacy amplification to distill and reuse the previously shared base string with unconditional security and high efficiency. The analysis of the unconditional secure reusable base string brings about new concept and protocol design technique.
We consider the security of the BB84, six-state and SARG04 quantum key distribution protocols when the eavesdropper doesn't have access to a quantum memory. In this case, Eve's most general strategy is to measure her ancilla with an appropriate POVM designed to take advantage of the post-measurement information that will be released during the sifting phase of the protocol. After an optimization on all the parameters accessible to Eve, our method provides us with new bounds for the security of six-state and SARG04 against a memoryless adversary. In particular, for the six-state protocol we sho…
In a Letter, Cabello proposed a quantum key distribution (QKD) Protocol which attended to Holevo limit. In this comment, we show that Eve could use a simple plan to distinguish among quantum keys, without being detected by Alice and Bob. In following, we show that our approach is not restricted to Cabello Protocol. With attention to our Eavesdropping approach, it seems that Mor's arguments for no-cloning principal for orthogonal states is not general enough to avoid eavesdropping.
Using polarization-entangled photons from spontaneous parametric downconversion, we have implemented Ekert's quantum cryptography protocol. The near-perfect correlations of the photons allow the sharing of a secret key between two parties. The presence of an eavesdropper is continually checked by measuring Bell's inequalities. We investigated several possible eavesdropper strategies, including pseudo-quantum non-demolition measurements. In all cases, the eavesdropper's presence was readily apparent. We discuss a procedure to increase her detectability.
We provide a complete proof of the security of quantum cryptography against any eavesdropping attack including coherent measurements even in the presence of noise. Polarization-based cryptographic schemes are shown to be equivalent to EPR-based schemes. We also show that the performance of a noisy channel approaches that of a noiseless one as the error rate tends to zero. (i.e., the secrecy capacity $C_s (ε) \to C_s (0)$ as $ε\to 0$.) One implication of our results is that one can {\it double} the efficiency of a most well-known quantum cryptographic scheme proposed by Bennett and Brassard sim…
Quantum key distribution (QKD) promises information theoretic secure key as long as the device performs as assumed in the theoretical model. One of the assumptions is an absence of information leakage about individual photon detection outcomes of the receiver unit. Here we investigate the information leakage from a QKD receiver due to photon emission caused by detection events in single-photon detectors (backflash). We test commercial silicon avalanche photodiodes and a photomultiplier tube, and find that the former emit backflashes. We study the spectral, timing and polarization characteristi…
This paper presents a prepare-and-measure scheme using $N$-dimensional quantum particles as information carriers where $N$ is a prime power. One of the key ingredients used to resist eavesdropping in this scheme is to depolarize all Pauli errors introduced to the quantum information carriers. Using the Shor-Preskill-type argument, we prove that this scheme is unconditionally secure against all attacks allowed by the laws of quantum physics. For $N = 2^n > 2$, each information carrier can be replaced by $n$ entangled qubits. In this case, there is a family of eavesdropping attacks on which no u…
Passive light-source side channel in quantum key distribution (QKD) makes the quantum signals more distinguishable thus provides additional information about the quantum signal to an eavesdropper. The explicit eavesdropping strategies aimed at the passive side channel known to date were limited to the separate measurement of the passive side channel in addition to the operational degree of freedom. Here we show how to account for the joint eavesdropping on both operational degree of freedom and the passive side channel of the generic form. In particular, we use the optimal phase-covariant clon…
The theory of quantum cryptography aims to guarantee unconditional information-theoretic security against an omnipotent eavesdropper. In many practical scenarios, however, the assumption of an all-powerful adversary is excessive and can be relaxed considerably. In this paper we study secret key distillation across a lossy and noisy quantum wiretap channel between Alice and Bob, with a separately parameterized realistically lossy quantum channel to the eavesdropper Eve. We show that under such restricted eavesdropping, the key rates achievable can exceed the secret key distillation capacity aga…
We consider one of the quantum key distribution protocols recently introduced in Ref. [Pirandola et al., Nature Physics 4, 726 (2008)]. This protocol consists in a two-way quantum communication between Alice and Bob, where Alice encodes secret information via a random phase-space displacement of a coherent state. In particular, we study its security against a specific class of individual attacks which are based on combinations of Gaussian quantum cloning machines.
We analyze theoretically optimal operation of an optical key distribution (OKD) link based on fine intensity modulation of an optical signal transmitted over an attenuating channel to a direct detection receiver. With suitable digital postprocessing, the users may generate a secret key that will be unknown to an unauthorized party collecting passively a fraction of the signal that escapes detection by the legitimate recipient. The security is ensured by the presence of the shot noise that inevitably accompanies eavesdropper's attempt to detect the collected signal. It is shown that the key amo…
A secret key shared through quantum key distribution between two cooperative players is secure against any eavesdropping attack allowed by the laws of physics. Yet, such a key can be established only when the quantum channel error rate due to eavesdropping or imperfect apparatus is low. Here, I report a practical quantum key distribution scheme making use of an adaptive privacy amplification procedure with two-way classical communication. Then, I prove that the scheme generates a secret key whenever the bit error rate of the quantum channel is less than $0.5-0.1\sqrt{5} \approx 27.6%$, thereby…
When the 4-state or the 6-state protocol of quantum cryptography is carried out on a noisy (i.e. realistic) quantum channel, then the raw key has to be processed to reduce the information of an adversary Eve down to an arbitrarily low value, providing Alice and Bob with a secret key. In principle, quantum algorithms as well as classical algorithms can be used for this processing. A natural question is: up to which error rate on the raw key is a secret-key agreement at all possible? Under the assumption of incoherent eavesdropping, we find that the quantum and classical limits are precisely the…
We introduce the concept of a superlinear threshold detector, a detector that has a higher probability to detect multiple photons if it receives them simultaneously rather than at separate times. Highly superlinear threshold detectors in quantum key distribution systems allow eavesdropping the full secret key without being revealed. Here, we generalize the detector control attack, and analyze how it performs against quantum key distribution systems with moderately superlinear detectors. We quantify the superlinearity in superconducting single-photon detectors based on earlier published data, a…
We present security proofs for a protocol for Quantum Key Distribution (QKD) based on encoding in finite high-dimensional Hilbert spaces. This protocol is an extension of Bennett's and Brassard's basic protocol from two bases, two state encoding to a multi bases, multi state encoding. We analyze the mutual information between the legitimate parties and the eavesdropper, and the error rate, as function of the dimension of the Hilbert space, while considering optimal incoherent and coherent eavesdropping attacks. We obtain the upper limit for the legitimate party error rate to ensure uncondition…
Practical implementations of quantum cryptography use attenuated laser pulses as the signal source rather than single photons. The channels used to transmit are also lossy. Here we give a simple derivation of two beam-splitting attacks on quantum cryptographic systems using laser pulses, either coherent or mixed states with any mean photon number. We also give a simple derivation of a photon-number splitting attack, the most advanced, both in terms of performance and technology required. We find bounds on the maximum disturbance for a given mean photon number and observed channel transmission …
We propose a scheme for quantum key distribution (QKD) protocol with dual-rail displaced photon states. Displaced single photon states carry bit value of code which may be extracted while coherent states carry nothing and they only provide inconclusive outcome. Developed QKD protocol works with experimental attendant noise to observe presence of malicious Eve. Pulses with large amplitudes unlike conventional QKD relying on faint laser pulses are used that may approximate it to standard telecommunication communication and may show resistance to eavesdropping even in settings with high attenuati…
In this Reply we propose a modified security proof of the Quantum Dense Key Distribution protocol detecting also the eavesdropping attack proposed by Wojcik in his Comment.
We report two key distribution schemes achieved by swapping quantum entanglement. Using two Bell states, two bits of secret key can be shared between two distant parties that play symmetric and equal roles. We also address eavesdropping attacks against the schemes.
A general proof of the security against eavesdropping of a previously introduced protocol for two-party quantum key distribution based on entanglement swapping [Phys. Rev. A {\bf 61}, 052312 (2000)] is provided. In addition, the protocol is extended to permit multiparty quantum key distribution and secret sharing of classical information.
We propose an information-theoretically secure encryption scheme for classical messages with quantum ciphertexts that offers detection of eavesdropping attacks, and re-usability of the key in case no eavesdropping took place: the entire key can be securely re-used for encrypting new messages as long as no attack is detected. This is known to be impossible for fully classical schemes, where there is no way to detect plain eavesdropping attacks. This particular application of quantum techniques to cryptography was originally proposed by Bennett, Brassard and Breidbart in 1982, even before propos…
