The security of two-state quantum key distribution against individual attack is estimated when the channel has losses and noises. We assume that Alice and Bob use two nonorthogonal single-photon polarization states. To make our analysis simple, we propose a modified B92 protocol in which Alice and Bob make use of inconclusive results and Bob performs a kind of symmetrization of received states. Using this protocol, Alice and Bob can estimate Eve's information gain as a function of a few parameters which reflect the imperfections of devices or Eve's disturbance. In some parameter regions, Eve's maximum information gain shows counter-intuitive behavior, namely, it decreases as the amount of disturbances increases. For a small noise rate Eve can extract perfect information in the case where the angle between Alice's two states is small or large, while she cannot extract perfect information for intermediate angles. We also estimate the secret key gain which is the net growth of the secret key per one pulse. We show the region where the modified B92 protocol over a realistic channel is secure against individual attack.
We discuss long code problems in the Bennett-Brassard 1984 (BB84) quantum key distribution protocol and describe how they can be overcome by concatenation of the protocol. Observing that concatenated modified Lo-Chau protocol finally reduces to the concatenated BB84 protocol, we give the unconditional security of the concatenated BB84 protocol.
We propose a new kind of individual attack, based on randomly selected dissipation, on Bennett-Brassard 1984 protocol of practical quantum key distribution (QKD) system with lossy and noisy quantum channel. Since an adversary with super quantum channel can disguise loss and errors induced by his attack as that of the system, he can obtain innegligible amount of information for a practical QKD system, without being detected by legal participants.
This paper provides a formula for the sacrifice bit-length for privacy amplification with the Bennett-Brassard 1984 protocol for finite key lengths when we employ the decoy method. Using the formula, we can guarantee the security parameter for realizable quantum key distribution system. The key generation rates with finite key lengths are numerically evaluated. The proposed method improves the existing key generation rate even in the asymptotic setting.
We show that the security proof of the Bennett 1992 protocol over loss-free channel in (K. Tamaki, M. Koashi, and N. Imoto, Phys. Rev. Lett. 90, 167904 (2003)) can be adapted to accommodate loss. We assumed that Bob's detectors discriminate between single photon states on one hand and vacuum state or multi-photon states on the other hand.
We calculate eavesdropper's optimal information on raw bits in Bennett-Brassard 1984 quantum key distribution (BB84 QKD) and six-state scheme in coherent attacks, using a formula by Lo and Chau [Science 283 (1999) 2050] with single photon assumption. We find that eavesdropper's optimal information in QKD without public announcement of bases [Phys. Lett. A 244 (1998) 489] is the same as that of a corresponding QKD WITH it in the coherent attack. We observe a sum-rule concerning each party's information.
We prove the unconditional security of the original Bennett 1992 protocol with strong reference pulse. We show that we may place a projection onto suitably defined qubit spaces before the receiver, which makes the analysis as simple as qubit-based protocols. Unlike the single-photon-based qubits, the qubits identified in this scheme are almost surely detected by the receiver even after a lossy channel. This leads to the key generation rate that is proportional to the channel transmission rate for proper choices of experimental parameters.
We present a tight security analysis of the Bennett-Brassard 1984 protocol taking into account the finite size effect of key distillation, and achieving unconditional security. We begin by presenting a concise analysis utilizing the normal approximation of the hypergeometric function. Then next we show that a similarly tight bound can also be obtained by a rigorous argument without relying on any approximation. In particular, for the convenience of experimentalists who wish to evaluate the security of their QKD systems, we also give explicit procedures of our key distillation, and also show ho…
Unconditional security proofs of the Bennett-Brassard protocol of quantum key distribution have been obtained recently. These proofs cover also practical implementations that utilize weak coherent pulses in the four signal polarizations. Proven secure rates leave open the possibility that new proofs or new public discussion protocols obtain larger rates over increased distance. In this paper we investigate limits to error rate and signal losses that can be tolerated by future protocols and proofs.
In practical quantum cryptography, the source sometimes produces multi-photon pulses, thus enabling the eavesdropper Eve to perform the powerful photon-number-splitting (PNS) attack. Recently, it was shown by Curty and Lutkenhaus [Phys. Rev. A 69, 042321 (2004)] that the PNS attack is not always the optimal attack when two photons are present: if errors are present in the correlations Alice-Bob and if Eve cannot modify Bob's detection efficiency, Eve gains a larger amount of information using another attack based on a 2->3 cloning machine. In this work, we extend this analysis to all distances…
In this paper we set forth a novel connection between the Bennett 1992 protocol and a Bell inequality. This allows us to extend the usual prepare-and-measure protocol to its entanglement-based formulation. We exploit a recent result in the frame of device-independent quantum key distribution to provide a simple, model-independent, security proof for the new protocol. The minimum efficiency required for a practical implementation of the scheme is the lowest reported to date.
We discuss the potential of quantum key distribution (QKD) for long distance communication by proposing a new analysis of the errors caused by dark counts. We give sufficient conditions for a considerable improvement of the key generation rates and the security thresholds of well-known QKD protocols such as Bennett-Brassard 1984, Phoenix-Barnett-Chefles 2000, and the six-state protocol. This analysis is applicable to other QKD protocols like Bennett 1992. We examine two scenarios: a sender using a perfect single-photon source and a sender using a Poissonian source.
We investigate a new strategy for incoherent eavesdropping in Ekert's entanglement based quantum key distribution protocol. We show that under certain assumptions of symmetry the effectiveness of this strategy reduces to that of the original single qubit protocol of Bennett and Brassard.
A central goal in information theory and cryptography is finding simple characterizations of optimal communication rates subject to various restrictions and security requirements. Ideally, the optimal key rate for a quantum key distribution (QKD) protocol would be given by {\em single-letter formula} involving a simple optimization over a single use of an effective channel. We explore the possibility of such a formula for one of the simplest and most widely used QKD protocols--Bennett-Brassard-84 (BB84) with one way classical post-processing. We show that a conjectured single-letter key-rate f…
Hong-Ou-Mandel test to verify indistinguishability of the states emitted from a quantum key distribution transmitter implementing decoy Bennett-Brassard 1984 protocol
Graduate School of Information Science and Technology, Hokkaido University（北海道大学信息科学技术研究生院）；Faculty of Information Science and Technology, Hokkaido University（北海道大学信息科学技术学部）；NEC Corporation（日本电气株式会社）；National Institute of Information and Communications Technology（国立情报学研究所）
We consider the security of the Bennett-Brassard 1984 (BB84) protocol for Quantum Key Distribution (QKD), with arbitrary individual imperfections simultaneously in the source and detectors. We provide the secure key generation rate, and show that only two parameters must be bounded to ensure security; the basis dependence of the source and a detector blinding parameter. The system may otherwise be completely uncharacterized and contain large losses.
This paper provides a security proof of the Bennett-Brassard (BB84) quantum key distribution protocol in practical implementation. To prove the security, it is not assumed that defects in the devices are absorbed into an adversary's attack. In fact, the only assumption in the proof is that the source is characterized. The proof is performed by lower-bounding adversary's Renyi entropy about the key before privacy amplification. The bound reveals the leading factors reducing the key generation rate.
We analyse the finite-size security of the efficient Bennett-Brassard 1984 protocol implemented with decoy states and apply the results to a gigahertz-clocked quantum key distribution system. Despite the enhanced security level, the obtained secure key rates are the highest reported so far at all fibre distances.
Bennet-Brassard 1984 (BB84) protocol, we optimize the ratio of the choice of two bases, the bit basis and the phase basis by using the second order expansion for the length of the generation keys under the coherent attack. This optimization addresses the trade-off between the loss of transmitted bits due to the disagreement of their bases and the estimation error of the error rate in the phase basis. Then, we derive the optimum ratio and the optimum length of the generation keys with the second order asymptotics. Surprisingly, the second order has the order $n^{3/4}$, which is much larger than…
We present an approach to the unconditional security of quantum key distribution protocols based on the uncertainty principle. The approach applies to every case that has been treated via the argument by Shor and Preskill, and relieve them from the constraints of finding quantum error correcting codes. It can also treat the cases with uncharacterized apparatuses. We derive a secure key rate for the Bennett-Brassard-1984 protocol with an arbitrary source characterized only by a single parameter representing the basis dependence.
It is the first scheme which allows the detection apparatus to achieve both the photon number of arriving signals and quantum bit error rate of the multiphoton pulses precisely. We show that the upper bound of the fraction of the tagged multiphoton pulses counts is $μ$, which is independent of the channel loss and the intensity of the decoy source. Such upper bound is $inherent$ and cannot be reduced any longer as long as the weak coherent scouces and high lossy channel are used. We show that our scheme can be implemented even if the channel loss is very high. A stronger intensity of the pulse…
Most experimental realizations of quantum key distribution are based on the Bennett-Brassard 1984 (so-called BB84) protocol. In a typical optical implementation of this scheme, the sender uses an active source to produce the required BB84 signal states. While active state preparation of BB84 signals is a simple and elegant solution in principle, in practice passive state preparation might be desirable in some scenarios, for instance, in those experimental setups operating at high transmission rates. Passive schemes might also be more robust against side-channel attacks than active sources. Typ…
In this work we present a security analysis for quantum key distribution, establishing a rigorous tradeoff between various protocol and security parameters for a class of entanglement-based and prepare-and-measure protocols. The goal of this paper is twofold: 1) to review and clarify the state-of-the-art security analysis based on entropic uncertainty relations, and 2) to provide an accessible resource for researchers interested in a security analysis of quantum cryptographic protocols that takes into account finite resource effects. For this purpose we collect and clarify several arguments sp…
We consider the security of the Bennett-Brassard 1984 (BB84) protocol for Quantum Key Distribution (QKD), in the presence of bit and basis dependent detector flaws. We suggest a powerful attack that can be used in systems with detector efficiency mismatch, even if the detector assignments are chosen randomly by Bob. A security proof is provided, valid for any basis dependent, possibly lossy, linear optical imperfections in the channel/receiver/detectors. The proof does not assume the so-called squashing detector model.
We prove the security of the 1984 protocol of Bennett and Brassard (BB84) for quantum key distribution. We first give a key distribution protocol based on entanglement purification, which can be proven secure using methods from Lo and Chau's proof of security for a similar protocol. We then show that the security of this protocol implies the security of BB84. The entanglement-purification based protocol uses Calderbank-Shor-Steane (CSS) codes, and properties of these codes are used to remove the use of quantum computation from the Lo-Chau protocol.
We prove the unconditional security of quantum key distribution protocols using attenuated laser pulses with M different linear polarizations. When M=4, the proof covers the so-called SARG04 protocol [V.~Scarani et al., Phys. Rev.\ Lett. {\bf 92}, 057901 (2004)], which uses exactly the same quantum communication as the Bennett-Brassard 1984 protocol. For a channel with transmission $η$, we show that the key rate in SARG04 scales as $O(η^{3/2})$. When we increase the number of states to M=2k-1 or 2k, the key rate scaling improves as $O(η^{(k+1)/k})$.
The Fuchs-Peres-Brandt (FPB) probe realizes the most powerful individual attack on Bennett-Brassard 1984 quantum key distribution (BB84 QKD) by means of a single controlled-NOT (CNOT) gate. This paper describes a complete physical simulation of the FPB-probe attack on polarization-based BB84 QKD using a deterministic CNOT constructed from single-photon two-qubit quantum logic. Adding polarization-preserving quantum nondemolition measurements of photon number to this configuration converts the physical simulation into a true deterministic realization of the FPB attack.
We propose an information-theoretically secure encryption scheme for classical messages with quantum ciphertexts that offers detection of eavesdropping attacks, and re-usability of the key in case no eavesdropping took place: the entire key can be securely re-used for encrypting new messages as long as no attack is detected. This is known to be impossible for fully classical schemes, where there is no way to detect plain eavesdropping attacks. This particular application of quantum techniques to cryptography was originally proposed by Bennett, Brassard and Breidbart in 1982, even before propos…
Quantum key distribution can be performed with practical signal sources such as weak coherent pulses. One example of such a scheme is the Bennett-Brassard protocol that can be implemented via polarization of the signals, or equivalent signals. It turns out that the most powerful tool at the disposition of an eavesdropper is the photon-number splitting attack. We show that this attack can be extended in the relevant parameter regime such as to preserve the Poissonian photon number distribution of the combination of the signal source and the lossy channel.
We derive a bound for the security of QKD with finite resources under one-way post-processing, based on a definition of security that is composable and has an operational meaning. While our proof relies on the assumption of collective attacks, unconditional security follows immediately for standard protocols like Bennett-Brassard 1984 and six-states. For single-qubit implementations of such protocols, we find that the secret key rate becomes positive when at least N\sim 10^5 signals are exchanged and processed. For any other discrete-variable protocol, unconditional security can be obtained us…
We suggest here a two-point eavesdropping strategy to two nonorthogonal states protocol of quantum key distribution over a fiber-optic channel. Suppose that the single-photon sources and detectors of Alice, Bob and Eves are ideal ones, the two-point attack can break the two nonorthogonal states protocol if the distance between Alice and Bob is sufficiently long. For single-photon type B92 protocol, the upper bound of distance is about 30 kilometers. It is interesting that Bennett's original multi-photon protocol is secure against both two-point attack and beam splitting attack, even if the pro…
We present security proofs for a protocol for Quantum Key Distribution (QKD) based on encoding in finite high-dimensional Hilbert spaces. This protocol is an extension of Bennett's and Brassard's basic protocol from two bases, two state encoding to a multi bases, multi state encoding. We analyze the mutual information between the legitimate parties and the eavesdropper, and the error rate, as function of the dimension of the Hilbert space, while considering optimal incoherent and coherent eavesdropping attacks. We obtain the upper limit for the legitimate party error rate to ensure uncondition…
We examine a situation that $n$ eavesdroppers attack the Bennett-Brassard cryptographic protocol via their own optimal and symmetric strategies. Information gain and mutual information with sender for each eavesdropper are explicitly derived. The receiver's error rate for the case of arbitrary $n$ eavesdroppers can be derived using a recursive relation. Although first eavesdropper can get mutual information without disturbance arising due to other eavesdroppers, subsequent eavesdropping generally increases the receiver's error rate. Other eavesdroppers cannot gain information on the input sign…
We discuss the `no-clicking' event, which is harmful for legitimate users in Bennett-Brassard 1984 quantum key distribution: We describe an attack where no-clicking events are utilized in the same way as double-clicking events are utilized in the quantum Trojan-pony attack. We discuss how to deal with the no-clicking events. We discuss how to estimate the security of the protocol against the proposed attack by using a formula involved with the fraction of adversarial removals of events.
Cryptographic scheme proposed by Bennett, Brassard, and Mermin [Phys. Rev. Lett. {\bf 68}, 557 (1992)] is reformulated in a version involving two polarizing Mach-Zehnder interferometers. Such a form, although physically equivalent to the original one, makes its security explicit, suggestive and easy to explain to non-experts.
We show how single system steering can be exhibited by classical light, a feature originating from superposition in classical optics that also enables entanglement and Bell-violation by classical light beams. Single system steering is the temporal analogue of Einstein-Podolsky-Rosen (EPR) steering in the quantum domain, enabling control of the state of a remote system, and can hence be connected to the security of secret key generation between two remote parties. We derive the steering criterion for a single mode coherent state when displaced parity measurements are performed at two different …
Phase randomization is a very important assumption in the Bennett-Brassard 1984 quantum key distribution (QKD) system with a weak coherent source. Thus an active phase modulator is needed to randomize the phase of source. However, it is hard to check whether the phase of source is randomized totally or not in practical QKD systems. In this paper a partially random phase attack is proposed to exploit this imperfection. Our analysis shows that Eve can break the security of a two-way QKD system by using our attack, even if an active phase randomization is adopted by Alice. Furthermore, the numeri…
In conventional quantum key distribution protocols, the secure key is normally extracted from the measurement outcomes of the system. Here, a different approach is proposed, where the secure key is extracted from the measurement bases, rather than outcomes. Compared to the original Bennett-Brassard-1984 protocol, the proposed protocol involves no hardware change but modifications in data postprocessing. We show that this protocol is more robust against detector efficiency attacks and photon-number-splitting attacks when practical detectors and photon sources are used.
An attack on the ``Bennett-Brassard 84''(BB84) quantum key-exchange protocol in which Eve exploits the action of gravitation to infer information about the quantum-mechanical state of the qubit exchanged between Alice and Bob, is described. It is demonstrated that the known laws of physics do not allow to describe the attack. Without making assumptions that are not based on broad consensus, the laws of quantum gravity, unknown up to now, would be needed even for an approximate treatment. Therefore, it is currently not possible to predict with any confidence if information gained in this attack…
We prove the security of the Bennett-Brassard (BB84) quantum key distribution protocol in the case where the source and detector are under the limited control of an adversary. Our proof applies when both the source and the detector have small basis-dependent flaws, as is typical in practical implementations of the protocol. We derive a general lower bound on the asymptotic key generation rate for weakly basis-dependent eavesdropping attacks, and also estimate the rate in some special cases: sources that emit weak coherent states with random phases, detectors with basis-dependent efficiency, an…
Security of quantum key distribution against sophisticated attacks is among the most important issues in quantum information theory. In this work we prove security against a very important class of attacks called collective attacks (under a compatible noise model) which use quantum memories and gates, and which are directed against the final key. Although attacks stronger than the collective attacks can exist in principle, no explicit example was found and it is conjectured that security against collective attacks implies also security against any attack.
Temporal steering, which is a temporal analogue of Einstein-Podolsky-Rosen steering, refers to temporal quantum correlations between the initial and final state of a quantum system. Our analysis of temporal steering inequalities in relation to the average quantum bit error rates reveals the interplay between temporal steering and quantum cloning, which guarantees the security of quantum key-distribution based on mutually-unbiased bases against individual attacks. The key distributions analyzed here include the Bennett-Brassard 1984 protocol (BB84) and the six-state 1998 protocol by Bruss (B98)…
Quantum Key Distribution (QKD) with classical Bob has recently been suggested and proven robust. Following this work, QKD with classical Alice was also suggested and proven robust. The above protocols are ideal in the sense that they make use of qubits. However, in the past, well-known QKD protocols that were proven robust and even proven unconditionally secure, when qubits are used, were found to be totally insecure when photons are used. This is due to sensitivity to photon losses (e.g., Bennett's two-state protocol) or sensitivity to losses combined with multi-photon states (e.g., the photo…
We derive a proof of security for the Differential Phase Shift Quantum Key Distribution (DPSQKD) protocol under the assumption that Eve is restricted to individual attacks. The security proof is derived by bounding the average collision probability, which leads directly to a bound on Eve's mutual information on the final key. The security proof applies to realistic sources based on pulsed coherent light. We then compare individual attacks to sequential attacks and show that individual attacks are more powerful.
We present strong attacks against quantum key distribution schemes which use quantum memories and quantum gates to attack directly the final key. We analyze a specific attack of this type, for which we find the density matrices available to the eavesdropper and the optimal information which can be extracted from them. We prove security against this attack and discuss security against any attack allowed by the rules of quantum mechanics.
In this article I present a protocol for quantum cryptography which is secure against attacks on individual signals. It is based on the Bennett-Brassard protocol of 1984 (BB84). The security proof is complete as far as the use of single photons as signal states is concerned. Emphasis is given to the practicability of the resulting protocol. For each run of the quantum key distribution the security statement gives the probability of a successful key generation and the probability for an eavesdropper's knowledge, measured as change in Shannon entropy, to be below a specified maximal value.
In this paper, we rigorously prove the intuition that in security proofs for BB84 one may regard an incoming signal to Bob as a qubit state. From this result, it follows that all security proofs for BB84 based on a virtual qubit entanglement distillation protocol, which was originally proposed by Lo and Chau [H.-K. Lo and H. F. Chau, Science 283, 2050 (1999)], and Shor and Preskill [P. W. Shor and J. Preskill, Phys. Rev. Lett. 85, 441 (2000)], are all valid even if Bob's actual apparatus cannot distill a qubit state explicitly. As a consequence, especially, the well-known result that a higher …
Despite enormous progress both in theoretical and experimental quantum cryptography, the security of most current implementations of quantum key distribution is still not established rigorously. One of the main problems is that the security of the final key is highly dependent on the number, M, of signals exchanged between the legitimate parties. While, in any practical implementation, M is limited by the available resources, existing security proofs are often only valid asymptotically for unrealistically large values of M. Here, we demonstrate that this gap between theory and practice can be …
In quantum cryptosystems, variations in detector efficiency can be exploited to stage a successful attack. This happens when the efficiencies of Bob's two detectors are different functions of a control parameter accessible to Eve (e.g., timing of the incoming pulses). It has previously been shown that the Bennett-Brassard 1984 (BB84) protocol is vulnerable to this attack. In this paper, we show that several other protocols and encodings may also be vulnerable. We consider a faked states attack in the case of a partial efficiency mismatch on the Scarani-Acin-Ribordy-Gisin 2004 (SARG04) protocol…
In this paper, we briefly show how the quantum key distribution with blind polarization bases [Kye et al., Phys. Rev. Lett. 95, 040501 (2005)] can be made secure against the invisible photon attack.
Unconditional security of the BB84 quantum key distribution protocol has been proved by exploiting the fundamental laws of quantum mechanics, but the practical quantum key distribution system maybe hacked by considering the imperfect state preparation and measurement respectively. Until now, different attacking schemes have been proposed by utilizing imperfect devices, but the general security analysis model against all of the practical attacking schemes has not been proposed. Here, we demonstrate that the general practical attacking schemes can be divided into the Trojan horse attack, strong …
We investigate the performance of Gaussianmodulated coherent-state QKD protocols in the presence of canonical attacks, which are collective Gaussian attacks resulting in Gaussian channels described by one of the possible canonical forms. We present asymptotic key rates and then we extend the results to the finite-size regime using a recently-developed toolbox for composable security.
We analyze the security against collective attacks for a homodyne-based continuous-variable quantum key distribution protocol using binary coherent states and postselection. We derive a lower bound of the secret key rate in an asymptotic scenario, and numerically optimize it for the case of a symmetric Gaussian channel.
In this paper, we briefly show how the quantum key distribution with blind polarization bases [Kye et al., Phys. Rev. Lett. 95, 040501 (2005)] can be made secure against the impersonation attack.
We propose the use of intra-particle entanglement to enhance the security of a practical implementation of the Bennett-Brassard-1984 (BB84) quantum key distribution scheme. Intra-particle entanglement is an attractive resource since it can be easily generated using only linear optics. Security is studied under a simple model of incoherent attack for protocols involving two or all five mutually unbiased bases. In terms of efficiency of secret key generation and tolerable error rate, the latter is found to be superior to the former. We find that states that allow secrecy distillation are necessa…
We provide a security analysis of continuous-variable quantum key distribution (CVQKD) with discrete modulation against general attacks in a realistic finite-size regime. To realize this goal, we first prove security of the continuous-variable quantum key distribution protocol with discrete modulation against collective attacks by using the reliable tomography of the covariance matrix, leading to the reliable and tight error bounds in the derived confidence regions. Combining the proof with de Finetti reduction, the discrete-modulation-based continuous-variable quantum key distribution (DM-CVQ…
We study the role of discrete rotational symmetry in quantum key distribution by generalizing the well-known Bennett-Brassard 1984 (BB84) and Scarani-Acin-Ribordy-Gisin 2004 (SARG04) protocols. We observe that discrete rotational symmetry results in the protocol's invariance to continuous rotations, thus leading to a simplified relation between bit and phase error rates and consequently a straightforward security proof.
We investigate the security of continuous-variable (CV) quantum key distribution (QKD) using coherent states in the presence of quadrature excess noise. We consider an eavesdropping attack which uses a linear amplifier and beam splitter. This attack makes a link between beam-splitting attack and intercept-resend attack (classical teleportation attack). We also show how postselection loses its efficiency in a realistic channel.
Measurement-device-independent quantum key distribution protocol, whose security analysis does not rely on any assumption on the detection system, can immune the attacking against detectors. We give a first composable security analysis for continuous-variable measurement-device-independent quantum key distribution using squeezed states against general coherent attacks. The security analysis is derived based on the entanglement-based scheme considering finite size effect. A version of entropic uncertainty relation is exploited to give a lower bound on the conditional smooth min-entropy by trust…
Basic techniques to prove the unconditional security of quantum cryptography are described. They are applied to a quantum key distribution protocol proposed by Bennett and Brassard in 1984. The proof considers a practical variation on the protocol in which the channel is noisy and photons may be lost during the transmission. The initial coding into the channel must be perfect (i.e., exactly as described in the protocol). No restriction is imposed on the detector used at the receiving side of the channel, except that whether or not the received system is detected must be independent of the basi…
