In this paper we set forth a novel connection between the Bennett 1992 protocol and a Bell inequality. This allows us to extend the usual prepare-and-measure protocol to its entanglement-based formulation. We exploit a recent result in the frame of device-independent quantum key distribution to provide a simple, model-independent, security proof for the new protocol. The minimum efficiency required for a practical implementation of the scheme is the lowest reported to date.
We discuss long code problems in the Bennett-Brassard 1984 (BB84) quantum key distribution protocol and describe how they can be overcome by concatenation of the protocol. Observing that concatenated modified Lo-Chau protocol finally reduces to the concatenated BB84 protocol, we give the unconditional security of the concatenated BB84 protocol.
We propose a new kind of individual attack, based on randomly selected dissipation, on Bennett-Brassard 1984 protocol of practical quantum key distribution (QKD) system with lossy and noisy quantum channel. Since an adversary with super quantum channel can disguise loss and errors induced by his attack as that of the system, he can obtain innegligible amount of information for a practical QKD system, without being detected by legal participants.
Unconditional security proofs of the Bennett-Brassard protocol of quantum key distribution have been obtained recently. These proofs cover also practical implementations that utilize weak coherent pulses in the four signal polarizations. Proven secure rates leave open the possibility that new proofs or new public discussion protocols obtain larger rates over increased distance. In this paper we investigate limits to error rate and signal losses that can be tolerated by future protocols and proofs.
This paper provides a formula for the sacrifice bit-length for privacy amplification with the Bennett-Brassard 1984 protocol for finite key lengths when we employ the decoy method. Using the formula, we can guarantee the security parameter for realizable quantum key distribution system. The key generation rates with finite key lengths are numerically evaluated. The proposed method improves the existing key generation rate even in the asymptotic setting.
The quantum key distribution protocol without public announcement of bases is equipped with a two-way classical communication symmetric entanglement purification protocol. This modified key distribution protocol is unconditionally secure and has a higher tolerable error rate of 20%, which is higher than previous scheme without public announcement of bases.
We present a tight security analysis of the Bennett-Brassard 1984 protocol taking into account the finite size effect of key distillation, and achieving unconditional security. We begin by presenting a concise analysis utilizing the normal approximation of the hypergeometric function. Then next we show that a similarly tight bound can also be obtained by a rigorous argument without relying on any approximation. In particular, for the convenience of experimentalists who wish to evaluate the security of their QKD systems, we also give explicit procedures of our key distillation, and also show ho…
We prove the unconditional security of the original Bennett 1992 protocol with strong reference pulse. We show that we may place a projection onto suitably defined qubit spaces before the receiver, which makes the analysis as simple as qubit-based protocols. Unlike the single-photon-based qubits, the qubits identified in this scheme are almost surely detected by the receiver even after a lossy channel. This leads to the key generation rate that is proportional to the channel transmission rate for proper choices of experimental parameters.
Most experimental realizations of quantum key distribution are based on the Bennett-Brassard 1984 (so-called BB84) protocol. In a typical optical implementation of this scheme, the sender uses an active source to produce the required BB84 signal states. While active state preparation of BB84 signals is a simple and elegant solution in principle, in practice passive state preparation might be desirable in some scenarios, for instance, in those experimental setups operating at high transmission rates. Passive schemes might also be more robust against side-channel attacks than active sources. Typ…
Bennet-Brassard 1984 (BB84) protocol, we optimize the ratio of the choice of two bases, the bit basis and the phase basis by using the second order expansion for the length of the generation keys under the coherent attack. This optimization addresses the trade-off between the loss of transmitted bits due to the disagreement of their bases and the estimation error of the error rate in the phase basis. Then, we derive the optimum ratio and the optimum length of the generation keys with the second order asymptotics. Surprisingly, the second order has the order $n^{3/4}$, which is much larger than…
In practical quantum cryptography, the source sometimes produces multi-photon pulses, thus enabling the eavesdropper Eve to perform the powerful photon-number-splitting (PNS) attack. Recently, it was shown by Curty and Lutkenhaus [Phys. Rev. A 69, 042321 (2004)] that the PNS attack is not always the optimal attack when two photons are present: if errors are present in the correlations Alice-Bob and if Eve cannot modify Bob's detection efficiency, Eve gains a larger amount of information using another attack based on a 2->3 cloning machine. In this work, we extend this analysis to all distances…
It is the first scheme which allows the detection apparatus to achieve both the photon number of arriving signals and quantum bit error rate of the multiphoton pulses precisely. We show that the upper bound of the fraction of the tagged multiphoton pulses counts is $μ$, which is independent of the channel loss and the intensity of the decoy source. Such upper bound is $inherent$ and cannot be reduced any longer as long as the weak coherent scouces and high lossy channel are used. We show that our scheme can be implemented even if the channel loss is very high. A stronger intensity of the pulse…
We show that the security proof of the Bennett 1992 protocol over loss-free channel in (K. Tamaki, M. Koashi, and N. Imoto, Phys. Rev. Lett. 90, 167904 (2003)) can be adapted to accommodate loss. We assumed that Bob's detectors discriminate between single photon states on one hand and vacuum state or multi-photon states on the other hand.
Hong-Ou-Mandel test to verify indistinguishability of the states emitted from a quantum key distribution transmitter implementing decoy Bennett-Brassard 1984 protocol
Graduate School of Information Science and Technology, Hokkaido University（北海道大学信息科学技术研究生院）；Faculty of Information Science and Technology, Hokkaido University（北海道大学信息科学技术学部）；NEC Corporation（日本电气株式会社）；National Institute of Information and Communications Technology（国立情报学研究所）
A central goal in information theory and cryptography is finding simple characterizations of optimal communication rates subject to various restrictions and security requirements. Ideally, the optimal key rate for a quantum key distribution (QKD) protocol would be given by {\em single-letter formula} involving a simple optimization over a single use of an effective channel. We explore the possibility of such a formula for one of the simplest and most widely used QKD protocols--Bennett-Brassard-84 (BB84) with one way classical post-processing. We show that a conjectured single-letter key-rate f…
In this article I discuss Charlie's Bennett's influence in quantum information theory and our answers to the question whether quantum entanglement is `monogamous'.
The security of two-state quantum key distribution against individual attack is estimated when the channel has losses and noises. We assume that Alice and Bob use two nonorthogonal single-photon polarization states. To make our analysis simple, we propose a modified B92 protocol in which Alice and Bob make use of inconclusive results and Bob performs a kind of symmetrization of received states. Using this protocol, Alice and Bob can estimate Eve's information gain as a function of a few parameters which reflect the imperfections of devices or Eve's disturbance. In some parameter regions, Eve's…
We claim that the nonlocality without entanglement revealed quite recently by Bennett {\it et al.} [quant-ph/9804053] should be rather interpreted as {\it Einstein-Podolsky-Rosen paradox without entanglement}. It would be true nonlocality without entanglement if one knew that quantum mechnics provides the best possible means for extracting information from physical system i.e. that it is ``operationally complete''.
We discuss the potential of quantum key distribution (QKD) for long distance communication by proposing a new analysis of the errors caused by dark counts. We give sufficient conditions for a considerable improvement of the key generation rates and the security thresholds of well-known QKD protocols such as Bennett-Brassard 1984, Phoenix-Barnett-Chefles 2000, and the six-state protocol. This analysis is applicable to other QKD protocols like Bennett 1992. We examine two scenarios: a sender using a perfect single-photon source and a sender using a Poissonian source.
We investigate a new strategy for incoherent eavesdropping in Ekert's entanglement based quantum key distribution protocol. We show that under certain assumptions of symmetry the effectiveness of this strategy reduces to that of the original single qubit protocol of Bennett and Brassard.
We prove the security of the 1984 protocol of Bennett and Brassard (BB84) for quantum key distribution. We first give a key distribution protocol based on entanglement purification, which can be proven secure using methods from Lo and Chau's proof of security for a similar protocol. We then show that the security of this protocol implies the security of BB84. The entanglement-purification based protocol uses Calderbank-Shor-Steane (CSS) codes, and properties of these codes are used to remove the use of quantum computation from the Lo-Chau protocol.
We propose the use of intra-particle entanglement to enhance the security of a practical implementation of the Bennett-Brassard-1984 (BB84) quantum key distribution scheme. Intra-particle entanglement is an attractive resource since it can be easily generated using only linear optics. Security is studied under a simple model of incoherent attack for protocols involving two or all five mutually unbiased bases. In terms of efficiency of secret key generation and tolerable error rate, the latter is found to be superior to the former. We find that states that allow secrecy distillation are necessa…
This paper is an appendix to a previous paper: quant-ph/0101123 ``Relaxation Method for Calculating Quantum Entanglement", by Robert Tucci. For certain mixtures of Bell basis states, namely the Werner States, we use the theoretical machinery of our previous paper to derive algebraic formulas for: the pure and mixed minimization entanglements (i.e., E_{pure} and E_{mixed}), their optimal decompositions and their entanglement operators. This complements and corroborates some results that were obtained numerically but not algebraically in our previous paper. Some of the algebraic formulas present…
We apply the inseparability criterion for $2 \times 2$ systems, local filtering and Bennett et al. purification protocol [Phys. Rev. Lett. {\bf 76}, 722 (1996)] to show how to distill {\it any} inseparable $2\times 2$ system. The extended protocol is illustrated geometrically by means of the state parameters in the Hilbert-Schmidt space.
We present and analyze a quantum key distribution protocol based on sending entangled N-qubit states instead of single-qubit ones as in the trail-blazing scheme by Bennett and Brassard (BB84). Since the qubits are sent individually, an eavesdropper is limited to accessing them one by one. In an intercept-resend attack, this fundamental restriction allows one to make the eavesdropper's information on the transmitted key vanish if even one of the qubits is not intercepted. The implied upper bound 1/(2N) for Eve's information is further shown not to be the lowest since in the case N = 2, the info…
We prove the unconditional security of the Bennett 1992 protocol, by using a reduction to an entanglement distillation protocol initiated by a local filtering process. The bit errors and the phase errors are correlated after the filtering, and we can bound the amount of phase errors from the observed bit errors by an estimation method involving nonorthogonal measurements. The angle between the two states shows a trade-off between accuracy of the estimation and robustness to noises.
We construct new entanglement distillation protocols by interpolating between the recurrence and hashing protocols. This leads to asymptotic two-way distillation protocols, resulting in an improvement of the distillation rate for all mixed Bell diagonal entangled states, even for the ones with very high fidelity. We also present a method how entanglement-assisted distillation protocols can be converted into non-entanglement-assisted protocols with the same yield.
Bennett et al. \cite{BDF+99} identified a set of orthogonal {\em product} states in the $3\otimes 3$ Hilbert space such that reliably distinguishing those states requires non-local quantum operations. While more examples have been found for this counter-intuitive ``nonlocality without entanglement'' phenomenon, a complete and computationally verifiable characterization for all such sets of states remains unknown. In this Letter, we give such a characterization for the $3\otimes 3$ space.
It is demonstrated that for the entanglement-based version of the Bennett-Brassard (BB84) quantum key distribution protocol, Alice and Bob share provable entanglement if and only if the estimated qubit error rate is below 25% or above 75%. In view of the intimate relation between entanglement and security, this result sheds also new light on the unconditional security of the BB84 protocol in its original prepare-and-measure form. In particular, it indicates that for small qubit error rates 25% is the ultimate upper security bound for any prepare-and-measure BB84-type QKD protocol. On the contr…
A utility theory of entanglement is formulated, based on the von Neumann--Morgenstern theorem. As a specific example, a protocol for measurement--induced entanglement is studied, in which the amount of entanglement obtained depends on the random result of a measurement on an ancilla. It is shown that the maximization of the utility requires a non--trivial strategy. The results are especially useful when the interaction between the ancilla and the systems to be entangled is weak.
We present an one-time-pad key communication protocol that allows secure direct communication with entanglement. Alice can send message to Bob in a deterministic manner by using local measurements and public communication. The theoretical efficiency of this protocol is double compared with BB84 protocol. We show this protocol is unconditional secure under arbitrary quantum attack. And we discuss that this protocol can be perfectly implemented with current technologies.
We prove that there is a trade-off relation between the entanglement cost and the number of rounds of communication, for two distant parties to accomplish a bidirectional quantum information task by local operations and classical communication (LOCC). We consider an implementation of a class of two-qubit controlled-unitary gate by LOCC assisted by shared entanglement, in an information theoretical scenario of asymptotically many input pairs and vanishingly small error. We prove the trade-off relation by showing that one ebit of entanglement per pair is necessary to be consumed for implementing…
A complementary behavior between local mutual information and average output entanglement is derived for arbitrary bipartite ensembles. This leads to bounds on the yield of entanglement in distillation protocols that involve disinguishing. This bound is saturated in the hashing protocol for distillation, for Bell-diagonal states.
We introduce a new protocol in continuous variable entanglement distillation that requires only linear temporal and constant physical or spatial resources.Compared with the existing protocols, our protocol uses atom-photon entanglement to substitute for atom-atom entanglement in existing protol, which will not only save the number of quantum memories, but also has the advantages in operation efficiency and temporal saving. The distillation can be realized by a fixed model of iterations, in which only three quantum memories and photon detectors are required.
We introduce new teleportation protocols which are generalizations of the original teleportation protocols that use the Pauli group [Bennett, et al. Physical Review Letters, 70(13) 1895-1899] and the port-based teleportation protocols, introduced by Hiroshima and Ishizaka [Physical Review Letters, 101(24) 240501], that use the symmetric permutation group. We derive sufficient condition for a set of operations, which in general need not form a group, to give rise to a teleportation protocol and provide examples of such schemes. This generalization leads to protocols with novel properties and is…
We show a deterministic secure direct communication protocol using single qubit in mixed state. The security of this protocol is based on the security proof of BB84 protocol. It can be realized with current technologies.
We use the noisy entanglement-assisted classical capacity formula [arXiv:1609.08592] to create a coherent-attack security framework for Gaussian two-way quantum key distribution protocols in the asymptotic region.
We propose a quantum key distribution (QKD) protocol that enables three parties agree at once on a shared common random bit string in presence of an eavesdropper without use of entanglement. We prove its unconditional security and analyze the key rate.
We show the equivalence of two approaches to the design of entanglement distillation protocols. The first approach is based on local unitary operations that yield permutations of tensor products of Bell states. The second approach is based on stabilizer codes.
We recall several cryptographic protocols based on entanglement alone and also on entanglement swapping. We make an exposition in terms of the geometrical aspects of the involved Hilbert spaces, and we concentrate on the formal nature of the used transformations.
We discuss quantum key distribution protocols using quantum continuous variables. We show that such protocols can be made secure against individual gaussian attacks regardless the transmission of the optical line between Alice and Bob. This is achieved by reversing the reconciliation procedure subsequent to the quantum transmission, that is, using Bob's instead of Alice's data to build the key. Although squeezing or entanglement may be helpful to improve the resistance to noise, they are not required for the protocols to remain secure with high losses. Therefore, these protocols can be impleme…
In the literature, strong coin tossing protocols based on bit commitment have been proposed. Here we examine a protocol that instead tries to achieve the task by sharing entanglement securely. The protocol uses only qubits, and has bias 1/4. This is equal to the best known bias for bit commitment based schemes.
We present multiparty entanglement purification protocols that are capable of purifying arbitrary graph states directly. We develop recurrence and breeding protocols and compare our methods with strategies based on bipartite entanglement purification in static and communication scenarios. We find that direct multiparty purification is of advantage with respect to achievable yields and minimal required fidelity in static scenarios, and with respect to obtainable fidelity in the case of noisy operations in both scenarios.
It is shown how the evidence state space in quantum bit commitment may be made to depend on the bit value 0 or 1 with split entangled pairs. As a consequence, one can obtain a protocol that is perfectly concealing, but is also $ε$-binding because the bit-value dependent evidence space prevents the committing party from cheating by means of a local transformation that is independent of the part of evidence state space that has never been in his possession.
We present a general theoretical framework for both deterministic and probabilistic entanglement transformations of bipartite pure states achieved via local operations and classical communication. This framework unifies and greatly simplifies previous works. A necessary condition for ``pure contraction'' transformations is given. Finally, constructive protocols to achieve both probabilistic and deterministic entanglement transformations are presented.
We study the problem of general entanglement purification protocols. Suppose Alice and Bob share a bipartite state $ρ$ which is ``reasonably close'' to perfect EPR pairs. The only information Alice and Bob possess is a lower bound on the fidelity of $ρ$ and a maximally entangled state. They wish to ``purify'' $ρ$ using local operations and classical communication and create a state that is arbitrarily close to EPR pairs. We prove that on average, Alice and Bob cannot increase the fidelity of the input state significantly. We also construct protocols that may fail with a small probability, and …
We demonstrate an efficient experimental procedure based on entanglement swapping to determine the Bell nonlocality measure of Horodecki et al. [Phys. Lett. A 200, 340 (1995)] and the fully-entangled fraction of Bennett et al. [Phys. Rev. A 54, 3824 (1996)] of an arbitrary two-qubit polarization-encoded state. The nonlocality measure corresponds to the amount of the violation of the Clauser-Horne-Shimony-Holt (CHSH) optimized over all measurement settings. By using simultaneously two copies of a given state, we measure directly only six parameters. Our method requires neither full quantum stat…
We present an entanglement purification protocol for a mixture of a pure entangled state and a pure product state, which are orthogonal to each other. The protocol is combination of bisection method and one-way hashing protocol. We give recursive formula for the rate of the protocol for different states, i.e. the number of maximally entangled two-qubit pairs obtained with the protocol per a single copy of the initial state. We also calculate numerically the rate for some states.
The notion of entanglement is the most well-known nonclassical correlation in quantum mechanics and a fundamental resource in quantum information and computation. This correlation, which is displayed by certain classes of quantum states, is of utmost importance when dealing with protocols such as quantum teleportation, cryptography, and quantum key distribution. In this paper, we exploit a classification of tripartite entanglement by introducing the concepts of entangled hypergraph and evolving entangled hypergraph as data structures suitable to model quantum protocols which use entanglement. …
Security of passive entanglement-based key distribution protocols
Network Innovation Laboratories, NTT, Inc.（NTT网络创新实验室）；NTT Research Center for Theoretical Quantum Information, NTT, Inc.（NTT理论量子信息研究中心）；Basic Research Laboratories, NTT, Inc.（NTT基础研究所）
We propose a hybrid (continuous-discrete variable) quantum repeater protocol for distribution of entanglement over long distances. Starting from entangled states created by means of single-photon detection, we show how entangled coherent state superpositions, also known as `Schrödinger cat states', can be generated by means of homodyne detection of light. We show that near-deterministic entanglement swapping with such states is possible using only linear optics and homodyne detectors, and we evaluate the performance of our protocol combining these elements.
We introduce a new protocol, the channel-state coding protocol, to quantum Shannon theory. This protocol generates entanglement between a sender and receiver by coding for a noisy quantum channel with the aid of a noisy shared state. The mother and father protocols arise as special cases of the channel-state coding protocol, where the channel is noiseless or the state is a noiseless maximally entangled state, respectively. The channel-state coding protocol paves the way for formulating entanglement-assisted quantum error-correcting codes that are robust to noise in shared entanglement. Finally…
We analyze the security of the efficient two-party quantum private comparison protocol with decoy photons and two-photon entanglement. It is shown that the compromised third party (TP) can obtain the final comparison result without introducing any detectable errors in the standard semi-honest model. The attack strategy is discussed in detail and an improvement of this protocol is demonstrated. The idea of our attack might be instructive for the cryptanalysis of quantum cryptographic schemes.
We show how to convert a quantum stabilizer code to a one-way or two-way entanglement distillation protocol. The proposed conversion method is a generalization of those of Shor-Preskill and Nielsen-Chuang. The recurrence protocol and the quantum privacy amplification protocol are equivalent to the protocols converted from [[2,1]] stabilizer codes. We also give an example of a two-way protocol converted from a stabilizer better than the recurrence protocol and the quantum privacy amplification protocol. The distillable entanglement by the class of one-way protocols converted from stabilizer cod…
We classify protocols of entanglement distribution as excessive and non-excessive ones. In a non-excessive protocol, the gain of entanglement is bounded by the amount of entanglement being communicated between the remote parties, while excessive protocols violate such bound. We first present examples of excessive protocols that achieve a significant entanglement gain. Next we consider their use in noisy scenarios, showing that they improve entanglement achieved in other ways and for some situations excessive distribution is the only possibility of gaining entanglement.
We construct the protocols to achieve probabilistic and deterministic entanglement transformations for bipartite pure states by means of local operations and classical communication. A new condition on pure contraction transformations is provided.
