Practical implementations of quantum cryptography use attenuated laser pulses as the signal source rather than single photons. The channels used to transmit are also lossy. Here we give a simple derivation of two beam-splitting attacks on quantum cryptographic systems using laser pulses, either coherent or mixed states with any mean photon number. We also give a simple derivation of a photon-number splitting attack, the most advanced, both in terms of performance and technology required. We find bounds on the maximum disturbance for a given mean photon number and observed channel transmission efficiency for which a secret key can be distilled. We start by reviewing two incoherent attacks that can be used on single photon quantum cryptographic systems. These results are then adapted to systems that use laser pulses and lossy channels.
We study optimal eavesdropping in quantum cryptography with three-dimensional systems, and show that this scheme is more secure than protocols using two-dimensional states. We generalize the according eavesdropping transformation to arbitrary dimensions, and discuss the connection with optimal quantum cloning.
An elementary derivation of best eavesdropping strategies for the 4 state BB84 quantum cryptography protocol is presented, for both incoherent and two--qubit coherent attacks. While coherent attacks do not help Eve to obtain more information, they are more powerful to reveal the whole message sent by Alice. Our results are based on symmetric eavesdropping strategies, which we show to be sufficient to analyze these kind of problems.
We find a resonance behavior in the disturbance when an eavesdropper chooses a near-optimal strategy intentionally or unintentionally when the usual Bennett-Brassard cryptographic scheme is performed between two trusted parties. This phenomenon tends to disappear when eavesdropping strategy moves far from the optimal one. Therefore, we conjecture that this resonant effect is a characteristic for the eavesdropping strategy near to optimal one. We argue that this effect makes the quantum cryptography more secure against the eavesdropper's attack.
All incoherent as well as 2- and 3-qubit coherent eavesdropping strategies on the 6 state protocol of quantum cryptography are classified. For a disturbance of 1/6, the optimal incoherent eavesdropping strategy reduces to the universal quantum cloning machine. Coherent eavesdropping cannot increase Eve's Shannon information, neither on the entire string of bits, nor on the set of bits received undisturbed by Bob. However, coherent eavesdropping can increase as well Eve's Renyi information as her probability of guessing correctly all bits. The case that Eve delays the measurement of her probe u…
It is shown that the optimum strategy of the eavesdropper, as described in the preceding paper, can be expressed in terms of a quantum circuit in a way which makes it obvious why certain parameters take on particular values, and why obtaining information in one basis gives rise to noise in the conjugate basis.
Intermediate states are known from intercept/resend eavesdropping in the BB84 quantum cryptographic protocol. But they also play fundamental roles in the optimal eavesdropping strategy on BB84 and in the CHSH inequality. We generalize the intermediate states to arbitrary dimension and consider intercept/resend eavesdropping, optimal eavesdropping on the generalized BB84 protocol and present a generalized CHSH inequality for two entangled quNits based on these states.
A generalization of the quantum cryptographic protocol by Bennett and Brassard is discussed, using three conjugate bases, i.e. six states. By calculating the optimal mutual information between sender and eavesdropper it is shown that this scheme is safer against eavesdropping on single qubits than the one based on two conjugate bases. We also address the question for a connection between the maximal classical correlation in a generalized Bell inequality and the intersection of mutual informations between sender/receiver and sender/eavesdropper.
Using polarization-entangled photons from spontaneous parametric downconversion, we have implemented Ekert's quantum cryptography protocol. The near-perfect correlations of the photons allow the sharing of a secret key between two parties. The presence of an eavesdropper is continually checked by measuring Bell's inequalities. We investigated several possible eavesdropper strategies, including pseudo-quantum non-demolition measurements. In all cases, the eavesdropper's presence was readily apparent. We discuss a procedure to increase her detectability.
Alice and Bob wish to communicate without the archvillainess Eve eavesdropping on their conversation. Alice, decides to take two college courses, one in cryptography, the other in quantum mechanics. During the courses, she discovers she can use what she has just learned to devise a cryptographic communication system that automatically detects whether or not Eve is up to her villainous eavesdropping. Some of the topics discussed are Heisenberg's Uncertainty Principle, the Vernam cipher, the BB84 and B92 cryptographic protocols. The talk ends with a discussion of some of Eve's possible eavesdrop…
We describe a nuclear magnetic resonance (NMR) experiment which implements an efficient one-to-two qubit phase-covariant cloning machine(QPCCM). In the experiment we have achieved remarkably high fidelities of cloning, 0.848 and 0.844 respectively for the original and the blank qubit. This experimental value is close to the optimal theoretical value of 0.854. We have also demonstrated how to use our phase-covariant cloning machine for quantum simulations of bit by bit eavesdropping in the four-state quantum key distribution protocol.
We consider the Bennett-Brassard cryptographic scheme, which uses two conjugate quantum bases. An eavesdropper who attempts to obtain information on qubits sent in one of the bases causes a disturbance to qubits sent in the other basis. We derive an upper bound to the accessible information in one basis, for a given error rate in the conjugate basis. Independently fixing the error rate in the conjugate bases, we show that both bounds can be attained simultaneously by an optimal eavesdropping probe, consisting of two qubits. The qubits' interaction and their subsequent measurement are described…
We consider one of the quantum key distribution protocols recently introduced in Ref. [Pirandola et al., Nature Physics 4, 726 (2008)]. This protocol consists in a two-way quantum communication between Alice and Bob, where Alice encodes secret information via a random phase-space displacement of a coherent state. In particular, we study its security against a specific class of individual attacks which are based on combinations of Gaussian quantum cloning machines.
The security of a cryptographic key that is generated by communication through a noisy quantum channel relies on the ability to distill a shorter secure key sequence from a longer insecure one. We show that -- for protocols that use quantum channels of any dimension and completely characterize them by state tomography -- the noise threshold for classical advantage distillation is substantially lower than the threshold for quantum entanglement distillation because the eavesdropper can perform powerful coherent attacks. The earlier claims that the two noise thresholds are identical, which were b…
In this article we deal with the security of the BB84 quantum cryptography protocol over noisy channels using generalized privacy amplification. For this we estimate the fraction of bits needed to be discarded during the privacy amplification step. This estimate is given for two scenarios, both of which assume the eavesdropper to access each of the signals independently and take error correction into account. One scenario does not allow a delay of the eavesdropper's measurement of a measurement probe until he receives additional classical information. In this scenario we achieve a sharp bound.…
Quantum key distribution (QKD) promises information theoretic secure key as long as the device performs as assumed in the theoretical model. One of the assumptions is an absence of information leakage about individual photon detection outcomes of the receiver unit. Here we investigate the information leakage from a QKD receiver due to photon emission caused by detection events in single-photon detectors (backflash). We test commercial silicon avalanche photodiodes and a photomultiplier tube, and find that the former emit backflashes. We study the spectral, timing and polarization characteristi…
A simplified eavesdropping-strategy for BB84 protocol in quantum cryptography (refer to quant-ph/9812022) is proposed. This scheme implements by the `indirect copying' technology. Under this scheme, eavesdropper can exactly obtain the exchanged information between the legitimate users without being detected.
In quantum cryptography the optimal eavesdropping strategy requires that the eavesdropper uses quantum memories in order to optimize her information. What happens if the eavesdropper has no quantum memory? It is shown that the best strategy is actually to adopt the simple intercept/resend strategy.
We present a protocol for quantum cryptography in which the data obtained for mismatched bases are used in full for the purpose of quantum state tomography. Eavesdropping on the quantum channel is seriously impeded by requiring that the outcome of the tomography is consistent with unbiased noise in the channel. We study the incoherent eavesdropping attacks that are still permissible and establish under which conditions a secure cryptographic key can be generated. The whole analysis is carried out for channels that transmit quantum systems of any finite dimension.
A general framework of optimal eavesdropping on BB84 protocol was provided by Fuchs et al. [Phys. Rev. A, 1997]. An upper bound on mutual information was derived, which could be achieved by a specific type of interaction and the corresponding measurement. However, uniqueness of optimal interaction was posed as an unsolved problem there and it has remained open for almost two decades now. In this paper, we solve this open problem and establish the uniqueness of optimal interaction up to rotation. The specific choice of optimal interaction by Fuchs et al. is shown to be a special case of the for…
We consider the two-way quantum cryptographic protocol with coherent states assuming direct reconciliation. A detailed security analysis is performed considering a two-mode coherent attack, that represents the residual eavesdropping once the parties have reduced the general attack by applying symmetric random permutations. In this context we provide a general analytical expression for the keyrate, discussing the impact of the residual two-mode correlations on the security of the scheme. In particular we identify the optimal eavesdropping against two-way quantum communication, which is given by…
The safety of a quantum key distribution system relies on the fact that any eavesdropping attempt on the quantum channel creates errors in the transmission. For a given error rate, the amount of information that may have leaked to the eavesdropper depends on both the particular system and the eavesdropping strategy. In this work, we discuss quantum cryptographic protocols based on the transmission of weak coherent states and present a new system, based on a symbiosis of two existing ones, and for which the information available to the eavesdropper is significantly reduced. This system is there…
We discuss the unambiguous measurement of quantum nonorthogonal states in connection with the quantum cryptography. We show that checking a ratio of null one to signal is essential in detecting a certain kind of eavesdropping in the case of two nonorthogonal states quantum cryptography. We prove that it is not needed in the case of the four states quantum cryptography.
We investigate a new strategy for incoherent eavesdropping in Ekert's entanglement based quantum key distribution protocol. We show that under certain assumptions of symmetry the effectiveness of this strategy reduces to that of the original single qubit protocol of Bennett and Brassard.
We introduce the concept of a superlinear threshold detector, a detector that has a higher probability to detect multiple photons if it receives them simultaneously rather than at separate times. Highly superlinear threshold detectors in quantum key distribution systems allow eavesdropping the full secret key without being revealed. Here, we generalize the detector control attack, and analyze how it performs against quantum key distribution systems with moderately superlinear detectors. We quantify the superlinearity in superconducting single-photon detectors based on earlier published data, a…
We consider two-way continuous-variable quantum key distribution, studying its security against general eavesdropping strategies. Assuming the asymptotic limit of many signals exchanged, we prove that two-way Gaussian protocols are immune to coherent attacks. More precisely we show the general superadditivity of the two-way security thresholds, which are proven to be higher than the corresponding one-way counterparts in all cases. We perform the security analysis first reducing the general eavesdropping to a two-mode coherent Gaussian attack, and then showing that the superadditivity is achiev…
The recent application of the principles of quantum mechanics to cryptography has led to a remarkable new dimension in secret communication. As a result of these new developments, it is now possible to construct cryptographic communication systems which detect unauthorized eavesdropping should it occur, and which give a guarantee of no eavesdropping should it not occur. CONTENTS P3. Cryptographic systems before quantum cryptography P7. Preamble to quantum cryptography P10. The BB84 quantum cryptographic protocol without noise P16. The BB84 quantum cryptographic protocol with noise P19..The B92…
We investigate the security of continuous-variable (CV) quantum key distribution (QKD) using coherent states in the presence of quadrature excess noise. We consider an eavesdropping attack which uses a linear amplifier and beam splitter. This attack makes a link between beam-splitting attack and intercept-resend attack (classical teleportation attack). We also show how postselection loses its efficiency in a realistic channel.
We discuss a quantum key distribution scheme in which small phase and amplitude modulations of CW light beams carry the key information. The presence of EPR type correlations provides the quantum protection. We identify universal constraints on the level of shared information between the intended receiver (Bob) and any eavesdropper (Eve) and use this to make a general evaluation of security. We identify teleportation as an optimum eavesdropping technique.
In this paper we investigate the security of a quantum cryptographic scheme which utilizes balanced homodyne detection and weak coherent pulse (WCP). The performance of the system is mainly characterized by the intensity of the WCP and postselected threshold. Two of the simplest intercept/resend eavesdropping attacks are analyzed. The secure key gain for a given loss is also discussed in terms of the pulse intensity and threshold.
The peculiar properties of quantum mechanics allow two remote parties to communicate a private, secret key, which is protected from eavesdropping by the laws of physics. So-called quantum key distribution (QKD) implementations always rely on detectors to measure the relevant quantum property of single photons. Here we demonstrate experimentally that the detectors in two commercially available QKD systems can be fully remote-controlled using specially tailored bright illumination. This makes it possible to tracelessly acquire the full secret key; we propose an eavesdropping apparatus built of o…
It has previously been shown that the gated detectors of two commercially available quantum key distribution (QKD) systems are blindable and controllable by an eavesdropper using continuous-wave illumination and short bright trigger pulses, manipulating voltages in the circuit [L. Lydersen et al., Nat. Photonics DOI:10.1038/nphoton.2010.214]. This allows for an attack eavesdropping the full raw and secret key without increasing the quantum bit error rate (QBER). Here we show how thermal effects in detectors under bright illumination can lead to the same outcome. We demonstrate that the detecto…
We consider a variant of the BB84 protocol for quantum cryptography, the prototype of tomographically incomplete protocols, where the key is generated by one-way communication rather than the usual two-way communication. Our analysis, backed by numerical evidence, establishes thresholds for eavesdropping attacks on the raw data and on the generated key at quantum bit error rates of 10% and 6.15%, respectively. Both thresholds are lower than the threshold for unconditional security in the standard BB84 protocol.
We find that the generally accepted security criteria are flawed for a whole class of protocols for quantum cryptography. This is so because a standard assumption of the security analysis, namely that the so-called square-root measurement is optimal for eavesdropping purposes, is not true in general. There are rather large parameter regimes in which the optimal measurement extracts substantially more information than the square-root measurement.
Like all of quantum information theory, quantum cryptography is traditionally based on two level quantum systems. In this letter, a new protocol for quantum key distribution based on higher dimensional systems is presented. An experimental realization using an interferometric setup is also proposed. Analyzing this protocol from the practical side, one finds an increased key creation rate while keeping the initial laser pulse rate constant. Analyzing it for the case of intercept/resend eavesdropping strategy, an increased error rate is found compared to two dimensional systems, hence an advanta…
Over decades quantum cryptography has been intensively studied for unconditionally secured data transmission in a quantum regime. Due to the quantum loopholes caused by imperfect single photon detectors and/or lossy quantum channels, however, the quantum cryptography is practically inefficient and even vulnerable to eavesdropping. Here, a method of unconditionally secured key distribution potentially compatible with current fiber-optic communications networks is proposed in a classical regime for high-speed optical backbone networks. The unconditional security is due to the quantum superpositi…
All existing quantum cryptosystems use non-orthogonal states as the carriers of information. Non-orthogonal states cannot be cloned (duplicated) by an eavesdropper. In result, any eavesdropping attempt must introduce errors in the transmission, and therefore, can be detected by the legal users of the communication channel. Orthogonal states are not used in quantum cryptography, since they can be faithfully cloned without altering the transmitted data. In this Letter we present a cryptographic scheme based on orthogonal states, which also assures the detection of any eavesdropper.
We provide a complete proof of the security of quantum cryptography against any eavesdropping attack including coherent measurements even in the presence of noise. Polarization-based cryptographic schemes are shown to be equivalent to EPR-based schemes. We also show that the performance of a noisy channel approaches that of a noiseless one as the error rate tends to zero. (i.e., the secrecy capacity $C_s (ε) \to C_s (0)$ as $ε\to 0$.) One implication of our results is that one can {\it double} the efficiency of a most well-known quantum cryptographic scheme proposed by Bennett and Brassard sim…
BBN, Harvard, and Boston University are building the DARPA Quantum Network, the world's first network that delivers end-to-end network security via high-speed Quantum Key Distribution, and testing that Network against sophisticated eavesdropping attacks. The first network link has been up and steadily operational in our laboratory since December 2002. It provides a Virtual Private Network between private enclaves, with user traffic protected by a weak-coherent implementation of quantum cryptography. This prototype is suitable for deployment in metro-size areas via standard telecom (dark) fiber…
We analyze the security of quantum cryptography schemes for $d$-level systems using 2 or $d+1$ maximally conjugated bases, under individual eavesdropping attacks based on cloning machines and measurement after the basis reconciliation. We consider classical advantage distillation protocols, that allow to extract a key even in situations where the mutual information between the honest parties is smaller than the eavesdropper's information. In this scenario, advantage distillation protocols are shown to be as powerful as quantum distillation: key distillation is possible using classical techniqu…
Proofs of the security of quantum key distribution are propositions about models written in the mathematical language of quantum mechanics, and the issue is the linking of such models to actual devices in an experiment on security. To explore this issue, we adapt Wittgenstein's method of language games to view quantum language in its application to experimental activity involving transmitting and receiving devices. We sketch concepts with which to think about models in relation to experiments, without assuming the experiments accord with any model included is a concept of one quantum-mechanica…
We study the mapping which occurs when a single qubit in an arbitrary state interacts with another qubit in a given, fixed state resulting in some unitary transformation on the two qubit system which, in effect, makes two copies of the first qubit. The general problem of the quality of the resulting copies is discussed using a special representation, a generalization of the usual Schmidt decomposition, of an arbitrary two-dimensional subspace of a tensor product of two 2-dimensional Hilbert spaces. We exhibit quantum circuits which can reproduce the results of any two qubit copying machine of …
The promise of secure cryptographic quantum key distribution schemes is based on the use of quantum effects in the spin space. We point out that in fact in many current quantum cryptography protocols the space part of the wave function is neglected. However exactly the space part of the wave function describes the behaviour of particles in ordinary real three-dimensional space. As a result such schemes can be secure against eavesdropping attacks in the abstract spin space but could be insecure in the real three-dimensional space. We discuss an approach to the security of quantum key distributi…
Correlations of the type discussed by EPR in their original 1935 paradox for continuous variables exist for the quadrature phase amplitudes of two spatially separated fields. These correlations were experimentally reported in 1992. We propose to use such EPR beams in quantum cryptography, to transmit with high efficiency messages in such a way that the receiver and sender may later determine whether eavesdropping has occurred. The merit of the new proposal is in the possibility of transmitting a reasonably secure yet predetermined key. This would allow relay of a cryptographic key over long di…
We propose a novel double-entanglement-based quantum cryptography protocol that is both efficient and deterministic. The proposal uses photon pairs with entanglement both in polarization and in time degrees of freedom; each measurement in which both of the two communicating parties register a photon can establish one and only one perfect correlation and thus deterministically create a key bit. Eavesdropping can be detected by violation of local realism. A variation of the protocol shows a higher security, similarly to the six-state protocol, under individual attacks. Our scheme allows a robust…
Real sources of entangled photon pairs (like parametric down conversion) are not perfect. They produce quantum states that contain more than only one photon pair with some probability. In this paper it is discussed what happens if such states are used for the purpose of quantum key distribution. It is shown that the presence of "multi-pair" signals (together with low detection efficiencies) causes errors in transmission even if there is no eavesdropper. Moreover, it is shown that even the eavesdropping, that draws information only from these "multi-pair" signals, increases the error rate. Info…
Methods of quantum mechanics promise information-theoretic security for various protocols in cryptography. However, impossibility of some cryptographic applications such as standard bit commitment, oblivious transfer, multiparty secure computations and ideal coin tossing in quantum regime leaves an obvious question on the completeness of quantum cryptography. Instead of using wide range of rules and techniques for a variety of cryptographic applications, we demonstrate here a unified structure for quantum cryptography based on quantum non-local correlations. The unified framework achieves same…
The security of quantum cryptography is guaranteed by the no-cloning theorem, which implies that an eavesdropper copying transmitted qubits in unknown states causes their disturbance. Nevertheless, in real cryptographic systems some level of disturbance has to be allowed to cover, e.g., transmission losses. An eavesdropper can attack such systems by replacing a noisy channel by a better one and by performing approximate cloning of transmitted qubits which disturb them but below the noise level assumed by legitimate users. We experimentally demonstrate such symmetric individual eavesdropping on…
Quantum cryptographic protocols solve the longstanding problem of distributing a shared secret string to two distant users by typically making use of one-way quantum channel. However, alternative protocols exploiting two-way quantum channel have been proposed for the same goal and with potential advantages. Here we overview a security proof for two-way quantum key distribution protocols, against the most general eavesdropping attack, that utilize an entropic uncertainty relation. Then, by resorting to the `smooth' version of involved entropies, we extend such a proof to the case of finite key …
We examine a situation that $n$ eavesdroppers attack the Bennett-Brassard cryptographic protocol via their own optimal and symmetric strategies. Information gain and mutual information with sender for each eavesdropper are explicitly derived. The receiver's error rate for the case of arbitrary $n$ eavesdroppers can be derived using a recursive relation. Although first eavesdropper can get mutual information without disturbance arising due to other eavesdroppers, subsequent eavesdropping generally increases the receiver's error rate. Other eavesdroppers cannot gain information on the input sign…
Since, in general, non-orthogonal states cannot be cloned, any eavesdropping attempt in a Quantum Communication scheme using non-orthogonal states as carriers of information introduces some errors in the transmission, leading to the possibility of detecting the spy. Usually, orthogonal states are not used in Quantum Cryptography schemes since they can be faithfully cloned without altering the transmitted data. Nevertheless, L. Goldberg and L. Vaidman [\prl 75 (1995) 1239] proposed a protocol in which, even if the data exchange is realized using two orthogonal states, any attempt to eavesdrop i…
When the 4-state or the 6-state protocol of quantum cryptography is carried out on a noisy (i.e. realistic) quantum channel, then the raw key has to be processed to reduce the information of an adversary Eve down to an arbitrarily low value, providing Alice and Bob with a secret key. In principle, quantum algorithms as well as classical algorithms can be used for this processing. A natural question is: up to which error rate on the raw key is a secret-key agreement at all possible? Under the assumption of incoherent eavesdropping, we find that the quantum and classical limits are precisely the…
In the cryptographic context, an earlier unexplored application of the temporal version of the Bell-type inequality is shown here in the device-independent (DI) scenario. This is done by using the Leggett-Garg inequality (LGI) to demonstrate the security against eavesdropping in a quantum key distribution (QKD) scheme. This typically involves a higher dimensional attack against which the standard BB84 protocol is insecure. For this purpose, we invoke an appropriate form of LGI. While the key generation is done by the usual Bennett-Brassard 1984 (BB84) method, the security check against device …
We extend the security proof for continuous variable quantum key distribution protocols using post selection to account for arbitrary eavesdropping attacks by employing the concept of an equivalent protocol where the post-selection is implemented as a series of quantum operations including a virtual distillation. We introduce a particular `Gaussian' post selection and demonstrate that the security can be calculated using only experimentally accessible quantities. Finally we explicitly evaluate the performance for the case of a noisy Gaussian channel in the limit of unbounded key length and fin…
We propose several methods for quantum key distribution (QKD) based upon the generation and transmission of random distributions of coherent or squeezed states, and we show that they are are secure against individual eavesdropping attacks. These protocols require that the transmission of the optical line between Alice and Bob is larger than 50 %, but they do not rely on "non-classical" features such as squeezing. Their security is a direct consequence of the no-cloning theorem, that limits the signal to noise ratio of possible quantum measurements on the transmission line. Our approach can als…
