We present a new protocol for practical quantum cryptography, tailored for an implementation with weak coherent pulses. The key is obtained by a very simple time-of-arrival measurement on the data line; an interferometer is built on an additional monitoring line, allowing to monitor the presence of a spy (who would break coherence by her intervention). Against zero-error attacks (the analog of photon-number-splitting attacks), this protocol performs as well as standard protocols with strong reference pulses: the key rate decreases only as the transmission $t$ of the quantum channel. We present also two attacks that introduce errors on the monitoring line: the intercept-resend, and a coherent attack on two subsequent pulses. Finally, we sketch several possible variations of this protocol.
We propose and discuss a specific scheme allowing to realize a Quantum Cryptography qutrit protocol. This protocol exploits the polarization properties of single frequency and single spatial mode biphotons.
We describe how to modify the BB84 protocol for quantum cryptography in order to make it deterministic. We study both theoretical and experimental aspects of this issue, showing that the new scheme is as secure as the old one, more efficient on small-scale distances, and within the range of current technology.
Recently, counterfactual quantum cryptography proposed by T. G. Noh [Phys. Rev. Lett. 103, 230501 (2009)] becomes an interesting direction in quantum cryptography, and has been realized by some researchers (such as Y. Liu et al's [Phys. Rev. Lett. 109, 030501 (2012)]). However, we find out that it is insecure in practical high lossy channel setting. We analyze the secret key rates in lossy channel under a polarization-splitting-measurement attack. Analysis indicates that the protocol is insecure when the loss rate of the one-way channel exceeds $50%$.
We study a general family of quantum protocols for position verification and present a new class of attacks based on the Clifford hierarchy. These attacks outperform current strategies based on port-based teleportation for a large class of practical protocols. We then introduce the Interleaved Product protocol, a new scheme for position verification involving only the preparation and measurement of single-qubit states for which the best available attacks have a complexity exponential in the number of classical bits transmitted.
In this article I present a protocol for quantum cryptography which is secure against attacks on individual signals. It is based on the Bennett-Brassard protocol of 1984 (BB84). The security proof is complete as far as the use of single photons as signal states is concerned. Emphasis is given to the practicability of the resulting protocol. For each run of the quantum key distribution the security statement gives the probability of a successful key generation and the probability for an eavesdropper's knowledge, measured as change in Shannon entropy, to be below a specified maximal value.
In this letter, first, we investigate the security of a continuous-variable quantum cryptographic scheme with a postselection process against individual beam splitting attack. It is shown that the scheme can be secure in the presence of the transmission loss owing to the postselection. Second, we provide a loss limit for continuous-variable quantum cryptography using coherent states taking into account excess Gaussian noise on quadrature distribution. Since the excess noise is reduced by the loss mechanism, a realistic intercept-resend attack which makes a Gaussian mixture of coherent states g…
A number of questions associated with practical implementations of quantum cryptography systems having to do with unconditional secrecy, computational loads and effective secrecy rates in the presence of perfect and imperfect sources are discussed. The different types of unconditional secrecy, and their relationship to general communications security, are discussed in the context of quantum cryptography. In order to actually carry out a quantum cryptography protocol it is necessary that sufficient computational resources be available to perform the various processing steps, such as sifting, er…
The use of quantum bits (qubits) in cryptography holds the promise of secure cryptographic quantum key distribution schemes. Unfortunately, the implemented schemes can be totally insecure. We provide a thorough investigation of security issues for practical quantum key distribution, taking into account channel losses, a realistic detection process, and modifications of the ``qubits'' sent from the sender to the receiver. We first show that even quantum key distribution with perfect qubits cannot be achieved over long distances when fixed channel losses and fixed dark count errors are taken int…
Practical implementations of quantum cryptography use attenuated laser pulses as the signal source rather than single photons. The channels used to transmit are also lossy. Here we give a simple derivation of two beam-splitting attacks on quantum cryptographic systems using laser pulses, either coherent or mixed states with any mean photon number. We also give a simple derivation of a photon-number splitting attack, the most advanced, both in terms of performance and technology required. We find bounds on the maximum disturbance for a given mean photon number and observed channel transmission …
In the next years the data transmission connections will constitute one of the principal tools of communication among cities, enterprises and public administration. With their enhanced connectivity, the systems and nets of information are now exposed to an increased vulnerability and new safety problems are emerging. Insofar Quantum Key Distribution (QKD) has matured to real world applications and can enhance the safety of the communication nets. In this paper we present the QKD network designed and implemented by Selex-SI and we give an overview of the obtained results.
We present a secure network communication system that operated with decoy-state quantum cryptography in a real-world application scenario. The full key exchange and application protocols were performed in real time among three nodes, in which two adjacent nodes were connected by approximate 20 km of commercial telecom optical fiber. The generated quantum keys were immediately employed and demonstrated for communication applications, including unbreakable real-time voice telephone between any two of the three communication nodes, or a broadcast from one node to the other two nodes by using one-…
In practical quantum key distribution, weak coherent state is often used and the channel transmittance can be very small therefore the protocol could be totally insecure under the photon-number-splitting attack. We propose an efficient method to verify the upper bound of the fraction of counts caused by multi-photon pluses transmitted from Alice to Bob, given whatever type of Eve's action. The protocol simply uses two coherent states for the signal pulses and vacuum for decoy pulse. Our verified upper bound is sufficiently tight for QKD with very lossy channel, in both asymptotic case and non-…
Quantum-cryptography key distribution (QCKD) experiments have been recently reported using polarization-entangled photons. However, in any practical realization, quantum systems suffer from either unwanted or induced interactions with the environment and the quantum measurement system, showing up as quantum and, ultimately, statistical noise. In this paper, we investigate how ideal polarization entanglement in spontaneous parametric downconversion (SPDC) suffers quantum noise in its practical implementation as a secure quantum system, yielding errors in the transmitted bit sequence. Because al…
Quantum Key Exchange (QKE, also known as Quantum Key Distribution or QKD) allows communicating parties to securely establish cryptographic keys. It is a well-established fact that all QKE protocols require that the parties have access to an authentic channel. Without this authenticated link, QKE is vulnerable to man-in-the-middle attacks. Overlooking this fact results in exaggerated claims and/or false expectations about the potential impact of QKE. In this paper we present a systematic comparison of QKE with traditional key establishment protocols in realistic secure communication systems.
Quantum cryptography has attracted much recent attention due to its potential for providing secret communications that cannot be decrypted by any amount of computational effort. This is the first analysis of the secrecy of a practical implementation of the BB84 protocol that simultaneously takes into account and presents the {\it full} set of complete analytical expressions for effects due to the presence of pulses containing multiple photons in the attenuated output of the laser, the finite length of individual blocks of key material, losses due to error correction, privacy amplification, con…
Quantum cryptography is an emerging technology in which two parties may simultaneously generate shared, secret cryptographic key material using the transmission of quantum states of light. The security of these transmissions is based on the inviolability of the laws of quantum mechanics and information-theoretically secure post-processing methods. An adversary can neither successfully tap the quantum transmissions, nor evade detection, owing to Heisenberg's uncertainty principle. In this paper we describe the theory of quantum cryptography, and the most recent results from our experimental fre…
Quantum cryptography could well be the first application of quantum mechanics at the individual quanta level. The very fast progress in both theory and experiments over the recent years are reviewed, with emphasis on open questions and technological issues.
The phenomenon of quantum erasure has long intrigued physicists, but has surprisingly found limited practical application. Here, we propose an erasure-based protocol for quantum key distribution (QKD) that promises inherent security against detector attacks.
We prove that in the BB84 quantum cryptography protocol Alice and Bob do not need to make random bases-choice for each qubit: they can keep the same bases for entire blocks of qubits. It suffices that the raw key consists of many such qubit-blocks. The practical advantage of reducing the need for random number is emphasized.
Quantum Cryptography, or more accurately, Quantum Key Distribution (QKD) is based on using an unconditionally secure ``quantum channel'' to share a secret key among two users. A manufacturer of QKD devices could, intentionally or not, use a (semi-)classical channel instead of the quantum channel, which would remove the supposedly unconditional security. One example is the BB84 protocol, where the quantum channel can be implemented in polarization of single photons. Here, use of several photons instead of one to encode each bit of the key provides a similar but insecure system. For protocols ba…
In practical quantum cryptography, the source sometimes produces multi-photon pulses, thus enabling the eavesdropper Eve to perform the powerful photon-number-splitting (PNS) attack. Recently, it was shown by Curty and Lutkenhaus [Phys. Rev. A 69, 042321 (2004)] that the PNS attack is not always the optimal attack when two photons are present: if errors are present in the correlations Alice-Bob and if Eve cannot modify Bob's detection efficiency, Eve gains a larger amount of information using another attack based on a 2->3 cloning machine. In this work, we extend this analysis to all distances…
We investigate the performance of continuous variable quantum key distribution scheme in a practical setting. More specifically, we take non-ideal error reconciliation procedure into account. The quantum channel connecting the two honest parties is assumed to be lossy but noiseless. Secret key rates are given for the case that the measurement outcomes are postselected or a reverse reconciliation scheme is applied. The reverse reconciliation scheme loses its initial advantage in the practical setting. If one combines postselection with reverse reconciliation however, much of this advantage can …
Quantum key distribution (QKD) is a concept of secret key exchange supported by fundamentals of quantum physics. Its perfect realization offers unconditional key security, however, known practical schemes are potentially vulnerable if the quantum channel loss exceeds a certain realization-specific bound. This discrepancy is caused by the fact that any practical photon source has a non-zero probability of emitting two or more photons at a time, while theory needs exactly one. We report an essentially different QKD scheme based on both quantum physics and theory of relativity. It works flawlessl…
Quantum cryptography is reviewed, first using entanglement both for the intuition and for the experimental realizations. Next, the implementation is simplified in several steps until it becomes practical. At this point entanglement has disappeared. This method can be seen as a lesson of Applied Physics. Finally, security issues, e.g. photon number splitting attacks, and counter-measures are discussed.
We describe a new error reconciliation protocol {\it Winnow} based on the exchange of parity and Hamming's ``syndrome'' for $N-$bit subunits of a large data set. {\it Winnow} was developed in the context of quantum key distribution and offers significant advantages and net higher efficiency compared to other widely used protocols within the quantum cryptography community. A detailed mathematical analysis of Winnow is presented in the context of practical implementations of quantum key distribution; in particular, the information overhead required for secure implementation is one of the most im…
We propose an alternative quantum cryptography protocol using the quantum interference effect. The efficiency of creating sifted key can reach 100\% in principle, which is higher than previous protocols. Especially, compared with the typical quantum key distribution, the present scheme does not require the authorized parties to check their bases. Because the potential eavesdropper can only access part of the quantum system, the proposed scheme has natural practical security advantages. The scheme can be implemented with current technologies and opens promising possibilities for quantum cryptog…
Over decades quantum cryptography has been intensively studied for unconditionally secured data transmission in a quantum regime. Due to the quantum loopholes caused by imperfect single photon detectors and/or lossy quantum channels, however, the quantum cryptography is practically inefficient and even vulnerable to eavesdropping. Here, a method of unconditionally secured key distribution potentially compatible with current fiber-optic communications networks is proposed in a classical regime for high-speed optical backbone networks. The unconditional security is due to the quantum superpositi…
We consider the cloning of sequences of qubits prepared in the states used in the BB84 or 6-state quantum cryptography protocol, and show that the single-qubit fidelity is unaffected even if entire sequences of qubits are prepared in the same basis. This result is of great importance for practical quantum cryptosystems because it reduces the need for high-speed random number generation without impairing on the security against finite-size attacks.
Like all of quantum information theory, quantum cryptography is traditionally based on two level quantum systems. In this letter, a new protocol for quantum key distribution based on higher dimensional systems is presented. An experimental realization using an interferometric setup is also proposed. Analyzing this protocol from the practical side, one finds an increased key creation rate while keeping the initial laser pulse rate constant. Analyzing it for the case of intercept/resend eavesdropping strategy, an increased error rate is found compared to two dimensional systems, hence an advanta…
We present a setup for quantum cryptography based on photon pairs in energy-time Bell states and show its feasability in a laboratory experiment. Our scheme combines the advantages of using photon pairs instead of faint laser pulses and the possibility to preserve energy-time entanglement over long distances. Moreover, using 4-dimensional energy-time states, no fast random change of bases is required in our setup : Nature itself decides whether to measure in the energy or in the time base.
We present the fundamental principles behind quantum key distribution and discuss a few well-known QKD protocols. Bearing in mind that the majority of our readers are from engineering and experimental optics, we focus more on the experimental implementation of various QKD protocols rather than security analysis. Another important topic that is covered here is the study of the security of practical QKD systems.
Uniquely among the sciences, quantum cryptography has driven both foundational research as well as practical real-life applications. We review the progress of quantum cryptography in the last decade, covering quantum key distribution and other applications.
A quantum key distribution system may be probed by an eavesdropper Eve by sending in bright light from the quantum channel and analyzing the back-reflections. We propose and experimentally demonstrate a setup for mounting such a Trojan-horse attack. We show it in operation against the quantum cryptosystem Clavis2 from ID~Quantique, as a proof-of-principle. With just a few back-reflected photons, Eve discerns Bob's secret basis choice, and thus the raw key bit in the Scarani-Acín-Ribordy-Gisin 2004 protocol, with higher than 90% probability. This would clearly breach the security of the cryptos…
We perform a comprehensive analysis of practical quantum cryptography (QC) systems implemented in actual physical environments via either free-space or fiber-optic cable quantum channels for ground-ground, ground-satellite, air-satellite and satellite-satellite links. (1) We obtain universal expressions for the effective secrecy capacity and rate for QC systems taking into account three important attacks on individual quantum bits, including explicit closed-form expressions for the requisite amount of privacy amplification. Our analysis also includes the explicit calculation in detail of the t…
This paper presents a practical method of quantum tomography for decoding the state of photons in a multistage cryptography protocol. This method works if the polarization angles are defined on a fixed plane, as is assumed in several quantum cryptography protocols. We show if there are 2m polarization angles in a fixed plane, we need m number of filters and m2 number of photons through each filter.
This is a study of the security of the Coherent One-Way (COW) protocol for quantum cryptography, proposed recently as a simple and fast experimental scheme. In the zero-error regime, the eavesdropper Eve can only take advantage of the losses in the transmission. We consider new attacks, based on unambiguous state discrimination, which perform better than the basic beam-splitting attack, but which can be detected by a careful analysis of the detection statistics. These results stress the importance of testing several statistical parameters in order to achieve higher rates of secret bits.
Quantum cryptography allows one to distribute a secret key between two remote parties using the fundamental principles of quantum mechanics. The well-known established paradigm for the quantum key distribution relies on the actual transmission of signal particle through a quantum channel. This paper shows that the task of a secret key distribution can be accomplished even though a particle carrying secret information is not in fact transmitted through the quantum channel. The proposed protocols can be implemented with current technologies and provide practical security advantages by eliminatin…
The laws of physics play a crucial role in the security of quantum key distribution (QKD). This fact has often been misunderstood as if the security of QKD would be based only on the laws of physics. As the experts know well, things are more subtle. We review the progresses in practical QKD focusing on (I) the elements of trust that are common to classical and quantum implementations of key distribution; and (II) some threats to security that have been highlighted recently, none of which is unredeemable (i.e., in principle QKD can be made secure). This leads us to guess that the field, similar…
In this paper, we describe a robust quantum cryptography scheme with a heralded single photon source based on the decoy-state method, which has been shown by numerical simulations to be advantageous compared with many other practical schemes not only with respect to the secure key generation rate but also to secure transmission distance. We have experimentally tested this scheme, and the results support the conclusions from numerical simulations well. Although there still exist many deficiencies in our present systems, it's still sufficient to demonstrate the advantages of the scheme. Besides,…
A new quantum cryptography implementation is presented that combines one-way operation with an autocompensating feature that has hitherto only been available in implementations that require the signal to make a round trip between the users. Using the concept of advanced waves, it is shown that this new implementation is related to the round-trip implementations in the same way that Ekert's two-particle scheme is related to the original one-particle scheme of Bennett and Brassard. The practical advantages and disadvantages of the proposed implementation are discussed in the context of existing …
Quantum cryptography is going to find practically useful applications. Recently some first quantum cryptographic solutions became available on the market. For clients it is important to be able to compare the quality and properties of the proposed products. To this end one needs to elaborate on specifications and standards of solutions in quantum cryptography. We propose and discuss a list of characteristics for the specification, which includes numerical evaluations of the security of solution and can be considered as a standard for quantum key distribution solutions. The list is based on the…
A practical quantum key distribution (QKD) protocol necessarily runs in finite time and, hence, only a finite amount of communication is exchanged. This is in contrast to most of the standard results on the security of QKD, which only hold in the limit where the number of transmitted signals approaches infinity. Here, we analyze the security of QKD under the realistic assumption that the amount of communication is finite. At the level of the general formalism, we present new results that help simplifying the actual implementation of QKD protocols: in particular, we show that symmetrization ste…
We give a proof that entanglement purification, even with noisy apparatus, is sufficient to disentangle an eavesdropper (Eve) from the communication channel. In the security regime, the purification process factorises the overall initial state into a tensor-product state of Alice and Bob, on one side, and Eve on the other side, thus establishing a completely private, albeit noisy, quantum communication channel between Alice and Bob. The security regime is found to coincide for all practical purposes with the purification regime of a two-way recurrence protocol. This makes two-way entanglement …
We propose a variational quantum attack algorithm (VQAA) for classical AES-like symmetric cryptography, as exemplified the simplified-data encryption standard (S-DES). In the VQAA, the known ciphertext is encoded as the ground state of a Hamiltonian that is constructed through a regular graph, and the ground state can be found using a variational approach. We designed the ansatz and cost function for the S-DES's variational quantum attack. It is surprising that sometimes the VQAA is even faster than Grove's algorithm as demonstrated by our simulation results. The relationships of the entanglem…
Counterfactual quantum cryptography (CQC), recently proposed by Noh, is featured with no transmission of signal particles. This exhibits evident security advantage, such as its immunity to the well known PNS attack. In this paper, the theoretical security of CQC protocol against the general intercept-resend attacks is proved by bounding the information of an eavesdropper Eve more tightly than in Yin's proposal[Phys. Rev. A 82, 042335 (2010)]. It is also showed that practical CQC implementations may be vulnerable when equipped with imperfect apparatuses, by proving that a negative key rate can …
Quantum cryptography is information-theoretically secure owing to its solid basis in quantum mechanics. However, generally, initial implementations with practical imperfections might open loopholes, allowing an eavesdropper to compromise the security of a quantum cryptographic system. This has been shown to happen for quantum key distribution (QKD). Here we apply experience from implementation security of QKD to several other quantum cryptographic primitives. We survey quantum digital signatures, quantum secret sharing, source-independent quantum random number generation, quantum secure direct…
The existing theory of decoy-state quantum cryptography assumes the exact control of each states from Alice's source. Such exact control is impossible in practice. We develop the theory of decoy-state method so that it is unconditionally secure even there are state errors of sources, if the range of a few parameters in the states are known. This theory simplifies the practical implementation of the decoy-state quantum key distribution because the unconditional security can be achieved with a slightly shortened final key, even though the small errors of pulses are not corrected.
Despite enormous progress both in theoretical and experimental quantum cryptography, the security of most current implementations of quantum key distribution is still not established rigorously. One of the main problems is that the security of the final key is highly dependent on the number, M, of signals exchanged between the legitimate parties. While, in any practical implementation, M is limited by the available resources, existing security proofs are often only valid asymptotically for unrealistically large values of M. Here, we demonstrate that this gap between theory and practice can be …
A hierarchical metropolitan quantum cryptography network upon the inner-city commercial telecom fiber cables is reported in this paper. The seven-user network contains a four-node backbone net with one node acting as the subnet gateway, a two-user subnet and a single-fiber access link, which is realized by the Faraday-Michelson Interferometer set-ups. The techniques of the quantum router, optical switch and trusted relay are assembled here to guarantee the feasibility and expandability of the quantum cryptography network. Five nodes of the network are located in the government departments and …
Quantum cryptographic key distribution (QKD) uses extremely faint light pulses to carry quantum information between two parties (Alice and Bob), allowing them to generate a shared, secret cryptographic key. Autocompensating QKD systems automatically and passively compensate for uncontrolled time dependent variations of the optical fiber properties by coding the information as a differential phase between orthogonally-polarized components of a light pulse sent on a round trip through the fiber, reflected at mid-course using a Faraday mirror. We have built a prototype system based on standard te…
In this paper, we propose quantum position-verification schemes where all the channels are untrusted except the position of the prover and distant reference stations of verifiers. We review and analyze the existing QPV schemes containing some pre-shared data between the prover and verifiers. Most of these schemes are based on non-cryptographic assumptions, that is, quantum/classical channels between the verifiers are secure. It seems impractical in the environment fully controlled by adversaries and would lead to security compromise in practical implementations. However, our proposed formulism…
Reliable Entropy Estimation from Observed Statistics for Device-Independent Quantum Cryptography
Institute for Quantum Information, RWTH Aachen University（亚琛工业大学量子信息研究所）；Institut für Theoretische Physik, Leibniz Universität Hannover（汉诺威莱布尼茨大学理论物理研究所）
Quantum cryptography visualized: assessing visual attention on multiple representations with eye tracking in an AR-enhanced quantum cryptography student experiment
Security in quantum cryptography is continuously challenged by inventive attacks targeting the real components of a cryptographic setup, and duly restored by new counter-measures to foil them. Due to their high sensitivity and complex design, detectors are the most frequently attacked components. Recently it was shown that two-photon interference from independent light sources can be exploited to avoid the use of detectors at the two ends of the communication channel. This new form of detection-safe quantum cryptography, called Measurement-Device-Independent Quantum Key Distribution (MDI-QKD),…
Quantum key distribution (QKD) allows two remote parties to grow a shared secret key. Its security is founded on the principles of quantum mechanics, but in reality it significantly relies on the physical implementation. Technological imperfections of QKD systems have been previously explored, but no attack on an established QKD connection has been realized so far. Here we show the first full-field implementation of a complete attack on a running QKD connection. An installed eavesdropper obtains the entire 'secret' key, while none of the parameters monitored by the legitimate parties indicate …
Mistrustful cryptography includes important tasks like bit commitment, oblivious transfer, coin flipping, secure computations, position authentication, digital signatures and secure unforgeable tokens. Practical quantum implementations presently use photonic setups. In many such implementations, Alice sends photon pulses encoding quantum states and Bob chooses measurements on these states. In practice, Bob generally uses single photon threshold detectors, which cannot distinguish the number of photons in detected pulses. Also, losses and other imperfections require Bob to report the detected p…
The Differential-Phase-Shift (DPS) and the Coherent-One-Way (COW) are among the most practical protocols for quantum cryptography, and are therefore the object of fast-paced experimental developments. The assessment of their security is also a challenge for theorists: the existing tools, that allow to prove security against the most general attacks, do not apply to these two protocols in any straightforward way. We present new upper bounds for their security in the limit of large distances ($d \gtrsim 50$km with typical values in optical fibers) by considering a large class of collective attac…
In this article we deal with the security of the BB84 quantum cryptography protocol over noisy channels using generalized privacy amplification. For this we estimate the fraction of bits needed to be discarded during the privacy amplification step. This estimate is given for two scenarios, both of which assume the eavesdropper to access each of the signals independently and take error correction into account. One scenario does not allow a delay of the eavesdropper's measurement of a measurement probe until he receives additional classical information. In this scenario we achieve a sharp bound.…
