DevilsAvocado said:
- What about eavesdropper? Well to eliminate this, they send a predetermined subset of their bit strings to each other, for comparison. If "Illegal Eve" has tried to intercept the quantum channel, to steal the key, she will immediately be revealed since the two subsets won't match perfectly!
Some elaboration: in the BB84 protocol Alice and Bob perform \sigma_{z} and \sigma_{x} measurements (for photons, these correspond to rectilinear and diagonal polarisation measurements) on some quantum state \rho_{\mathrm{ABE}} that, in the worst case, you assume might be shared (and correlated with) an eavesdropper (Eve).
If Alice and Bob find that they get
perfectly correlated results in the cases where they made the same measurements (as determined by sacrificing and testing a random subset, as DevilsAvocado explained), then it's possible to show that Alice and Bob must have been sharing maximally entangled \lvert \Phi^{+} \rangle states:
\lvert \Phi^{+} \rangle_{\mathrm{AB}} = \frac{1}{\sqrt{2}} [ \lvert 0 \rangle_{\mathrm{A}} \lvert 0 \rangle_{\mathrm{B}} + \lvert 1 \rangle_{\mathrm{A}} \lvert 1 \rangle_{\mathrm{B}} ] \,. \qquad (1)
This is the
only quantum state that can produce perfectly correlated outcomes for both \sigma_{z} and \sigma_{x} measurements. In this case, if there's an eavesdropper, the only possibility for a state shared by Alice, Bob, and Eve is one of the form
\lvert \Psi \rangle_{\mathrm{ABE}} = \lvert \Phi^{+} \rangle_{\mathrm{AB}} \otimes \lvert \psi \rangle_{\mathrm{E}} \,, \qquad (2)
i.e. a state in which Eve is completely uncorrelated with Alice and Bob. This property of quantum physics is sometimes called the "monogamy of entanglement": if two parties (like Alice and Bob here) share a maximally entangled state (or really any pure state), then the same state cannot simultaneously be entangled with the environment or any third party (like Eve here). The security of (entanglement-based) quantum key distribution is based on this principle.
Of course this observation isn't very useful on its own. If you tried to implement a real QKD system just by testing for perfect correlations, any serious experimental physicist would laugh at you: there's simply no such thing as a perfect experiment. You're always going to have a certain amount of noise in your channel, the measurements won't be perfect, and so on, and so you're always going to detect a nonzero error rate in a QKD experiment regardless of whether there's an eavesdropper present. But for the purpose of establishing secrecy, one should assume in the worst case that
all the errors you see are the result of tampering by an eavesdropper (because the whole point of QKD is "security based only on the laws of physics").
This is where entropies and information theory come in. If you observe some small but nonzero error rate (call it \delta) in a QKD experiment, then generally the best you can do is say that Alice, Bob, and Eve are sharing some state \rho_{\mathrm{ABE}} that is
close to an ideal state of the form (2), and in which Eve might be partially correlated with Alice and Bob. In this case, it's known from results in information theory that Alice and Bob can still extract a shorter but nearly perfectly secure key by applying classical error correction and privacy amplification procedures to their raw key bits. The precise amount of key that can safely be extracted this way is quantified by certain entropies. For instance, many QKD security analyses of the last decade or so use a result called the Devetak-Winter bound, which for a given state \rho_{\mathrm{ABE}} says that (in the asymptotic limit) you can safely extract perfectly secret key at a rate given by
r = I(\mathrm{A} : \mathrm{B}) - \chi(\mathrm{A} : \mathrm{E}) \,, \qquad (3)
where I(\mathrm{A} : \mathrm{B}) is the mutual information between Alice and Bob's key bits and \chi(\mathrm{A} : \mathrm{E}) is the Holevo quantity between Alice and Eve. Intuitively, this says that the extractable key rate is quantified by how much information Bob has about Alice's version of the key minus how much information Eve has about it. For the BB84 protocol, if you do the exercise of minimising equation (3) over all quantum states compatible with a fixed error rate \delta, you'll obtain the Shor-Preskill [1] key rate
r = 1 - 2 h(\delta) \qquad (4)
(where h is the binary entropy function). This equals 1 for an error rate of zero, and drops to zero for an error rate of about \delta \approx 11\%. The implication is that, at least in the asymptotic limit, one can still extract a perfectly secret key from a BB84 implementation as long as the error rate is less than the Shor-Preskill bound of 11% (though possibly at a very reduced rate).
I should point out that this information theoretic approach to studying QKD security only really gained traction around 2005 or 2006, following the paper by Devetak and Winter [2] and a similar result by Renner, Gisin, and Kraus [3]. Earlier security proofs dating to about the year 2000 were based on results from the theory of entanglement distillation and quantum error correction codes (some papers still use this approach). Keep this in mind if you try to learn QKD from textbooks: Nielsen and Chuang was published in the year 2000, which is ancient history as far as QKD security analysis is concerned. As far as I know, Preskill also hasn't updated his lecture notes since he prepared them in the late 1990s and early 2000s.
Summary/TLDR:
- Intuitively, the security of entanglement-based QKD derives from the principle of monogamy of entanglement of quantum correlations.
- Entropies have an operational interpretation in QKD, where they quantify how much key can be securely extracted (using classical error correction and privacy amplification protocols) against an eavesdropper that is partially correlated with Alice and Bob.
References/further reading:
[1] P. W. Shor and J. Preskill,
Phys. Rev. Lett. 85, 441--444 (2000),
arXiv:quant-ph/0003004.
[2] I. Devetak and A. Winter,
Proc. R. Soc. A 461, 207--235 (2005),
arXiv:quant-ph/0306078.
[3] R. Renner, N. Gisin, and B. Kraus,
Phys. Rev. A 72, 012332 (2005),
arXiv:quant-ph/0502064.
[4] N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden,
Rev. Mod. Phys. 74, 145--195 (2002),
arXiv:quant-ph/0101098. (An early review article, a bit out of date now in some respects.)
[5] V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M. Dušek, N. Lütkenhaus, and M. Peev,
Rev. Mod. Phys. 81, 1301--1350 (2009),
arXiv:0802.4155 [quant-ph]. (A more recent review article, focusing more on the practical aspects of QKD security.)
[6] R. Renner, "Security of Quantum Key Distribution",
arXiv:quant-ph/0512258. (Renato Renner's PhD thesis.)
[7] M. Tomamichel and R. Renner,
Phys. Rev. Lett. 106, 110506 (2011),
arXiv:1009.2015 [quant-ph]. (Sketch of a recent and very elegant security proof of the BB84 protocol based on an entropic uncertainty relation.)
[8] Websites of
ID Quantique and http://www.magiqtech.com/MagiQ/Home.html. (Two companies that offer QKD systems commercially.)
