Quantum key distribution without alternative measurements

Quantum key distribution without alternative measurements Ada ´n Cabello* Departamento de Fı ´sica Aplicada, Universidad de Sevilla, 41012 Sevilla, Spain 共Received 29 October 1999; published 18 April 2000兲 Entanglement swapping between Einstein-Podolsky-Rosen 共EPR兲pairs can be used to generate the same sequence of random bits in two remote places. A quantum key distribution protocol based on this idea is described. The scheme exhibits the following features. 共a兲It does not require that Alice and Bob choose between alternative measurements, therefore improving the rate of generated bits by transmitted qubit. 共b兲It allows Alice and Bob to generate a key of arbitrary length using a single quantum system 共three EPR pairs兲, instead of a long sequence of them. 共c兲Detecting Eve requires the comparison of fewer bits. 共d兲Entanglement is an essential ingredient. The scheme assumes reliable measurements of the Bell operator. PACS number共s兲: 03.67.Dd, 03.67.Hk, 03.65.Bz The two main goals of cryptography are for two distant parties, Alice and Bob, to be able to communicate in a form that is unintelligible to a third party, Eve, and to prove that the message was not altered in transit. Both of these goals can be accomplished securely if both Alice and Bob are in possession of the same secret random sequence of bits, a ‘‘key’’ 关1兴. Therefore, one of the main problems of cryptography is the key distribution problem, that is, how do Alice and Bob, who initially share no secret information, come into the possession of a secret key, while being sure that Eve cannot acquire even partial information about it. This problem cannot be solved by classical means, but it can be solved using quantum mechanics 关2兴. The security of protocols for quantum key distribution 共QKD兲such as the Bennett- Brassard 1984 共BB84兲关2兴, E91 关3兴, B92 关4兴, and other protocols 关5,6兴, is assured by the fact that while information stored in classical form can be examined and copied without altering it in any detectable way, it is impossible to do that when information is stored in unknown quantum states, because an unknown quantum state cannot be reliably cloned 共‘‘no-cloning’’ theorem 关7兴兲. In these protocols security is assured by the fact that both Alice and Bob must choose randomly between two possible measurements. In this paper I introduce a QKD scheme which does not require that Alice and Bob choose between alternative measurements. This scheme is based on ‘‘entanglement swapping’’ 关8–10兴be- tween two pairs of ‘‘qubits’’ 共quantum two-level systems兲, induced by a Bell operator measurement 关11兴. The Bell operator is a nondegenerate operator which acts on a pair of qubits iand j, and projects their combined state onto one of the four Bell states 兩 00 典 ij⫽1 冑 2共 兩 0 典 i丢 兩 0 典 j⫹ 兩 1 典 i丢 兩 1 典 j), 共1兲 兩 01 典 ij⫽1 冑 2共 兩 0 典 i丢 兩 0 典 j⫺ 兩 1 典 i丢 兩 1 典 j), 共2兲 兩 10 典 ij⫽1 冑 2共 兩 0 典 i丢 兩 1 典 j⫹ 兩 1 典 i丢 兩 0 典 j), 共3兲 兩 11 典 ij⫽1 冑 2共 兩 0 典 i丢 兩 1 典 j⫺ 兩 1 典 i丢 兩 0 典 j). 共4兲 Entanglement swapping works as follows. Consider a pair of qubits, iand j, prepared in one of the four Bell states, for instance, 兩 11 典 ij. Consider a second pair of qubits kand l prepared in another Bell state, for instance, 兩 01 典 kl . If a Bell operator measurement is performed on iand k, then the four possible results ‘‘00,’’ ‘‘01,’’ ‘‘10,’’ and ‘‘11’’ have the same probability to occur. In fact, the outcome of each measurement is purely random. Suppose that the result ‘‘00’’ is obtained, consequently the state of the pair iand kafter the measurement is 兩 00 典 ik . Moreover, the state of jand lis projected onto state 兩 10 典 jl . Therefore, the state of jand lbecomes entangled although they have never interacted. I will denote the initial state of the pairs i,jand k,l,inthe previous example by 兩 11 典 ij丢 兩 01 典 kl , and the final state of the pairs i,kand j,lby 兩 00 典 ik丢 兩 10 典 jl . Suppose that the initial state of the pairs i,jand k,lis a product of two Bell states and, as in the previous example, a Bell operator measurement is executed on two qubits, one of each pair; then, after the measurement the state of the pairs i,kand j,lbecomes a product of two Bell states. All possibilities are collected in Table I. The proposed scheme for QKD is illustrated in Fig. 1 and it is described as follows. 共i兲Consider six qubits numbered 1 to 6. Alice prepares qubits 1 and 2 in the Bell state 兩 11 典 12 , and qubits 3 and 5 in the Bell state 兩 10 典 35 . In a remote place, Bob prepares qubits 4 and 6 in the Bell state 兩 10 典 46 . All this information is public. 2 and 6 will be the only transmitted qubits during the process. Alice will always retain qubits 1, 3, and 5; and Bob will always retain qubit 4. 共ii兲Alice transmits qubit 2 to Bob using a public channel. This channel must be a transmission medium that isolates the state of the qubit from interactions with the environment. 共iii兲Alice secretly measures the Bell operator on qubits 1 and 3, and Bob secretly measures the Bell operator on qubits *Electronic address: [email protected] PHYSICAL REVIEW A, VOLUME 61, 052312 1050-2947/2000/61共5兲/052312共4兲/$15.00 ©2000 The American Physical Society61 052312-1 2 and 4. The results of both experiments are correlated, although Alice and Bob do not know how as yet. The purpose of the next step is to elucidate how the results are correlated without publicly revealing either of them. 共iv兲Bob transmits qubit 6 to Alice using a public channel. Then Alice measures the Bell operator on qubits 5 and 6, and publicly announces the result. Suppose that Alice has obtained ‘‘11’’ in her secret measurement on qubits 1 and 3. Then, since the initial state of 1, 2, 3, and 5 was 兩 11 典 12 丢 兩 10 典 35 , by using Table I Alice knows that the state of 2 and5is 兩 10 典 25 . In addition, suppose that Alice obtains ‘‘00’’ in the public measurement on 5 and 6. Then, since she knows that the previous state of 2, 4, 5, and 6 was 兩 10 典 25丢 兩 10 典 46 , by using Table I Alice knows that Bob has obtained ‘‘00’’ in his secret measurement on 2 and 4. Following a similar reasoning, Bob can know that Alice has obtained ‘‘11’’ in her secret measurement on 1 and 3. Previously, Alice and Bob have agreed to choose the sequence of results of Alice’s secret measurements to form the key. The two initial bits of the key are therefore ‘‘11.’’ The public information shared by Alice and Bob is not enough for Eve to acquire any knowledge of the result obtained by one of the parts. Using this information Eve only knows that one of the following four possible combinations of results for Alice and Bob’s secret measurements have occurred: ‘‘00’’ for Alice’s result and ‘‘11’’ for Bob’s, ‘‘01’’ and ‘‘10,’’ ‘‘10’’ and ‘‘01,’’ and ‘‘11’’ and ‘‘00.’’ One Bell state can be transformed into another just by rotating one of the qubits. Using this property, Alice 共Bob兲 can change the Bell state of qubits 1 and 3 共2 and 4兲to a previously agreed public state. Then the situation is similar to 共i兲and the next stage of the process can be started. This scheme for QKD has the following features. 共a兲It improves the rate of generated bits by transmitted qubit. In BB84 and in B92 共and in E91兲, Bob 共and Alice兲 must choose between two alternative measurements in order to preserve security. This implies that the number of useful random bits shared by Alice and Bob by transmitted qubit, before checking for eavesdropping, is 0.5 bits by transmitted qubit, both in BB84 and B92 共and 0.25 in E91兲,oratthe most, it can be made to approach 1 in Ref. 关6兴. In our scheme the rate is 1 bit by transmitted qubit. This is so because Alice and Bob always perform the same kind of measurement, a Bell operator measurement, and therefore, each of them acquires two correlated random bits after each stage of the process. In each of these stages, only two qubits are transmitted 共one from Alice to Bob and another from Bob to Alice兲. This improvement is very useful since a key must be as large as the message to be transmitted 共written as a sequence of bits兲, and cannot be reused for subsequent messages 关1兴. 共b兲It only requires a single quantum system 共three EPR pairs兲instead of a long sequence of quantum systems, to generate a key of arbitrary length. By contrast with previous schemes, in the one presented here no source of qubits is needed. The same two qubits 共qubits 2 and 6兲are transmitted to and from Alice and Bob over and over again 关12兴. 共c兲The detection of Eve requires the comparison of fewer bits. The transmitted qubits do not encode the bits that form the key, but only the type of correlation between the results of the experiments that allow Alice and Bob to secretly generate the key. Therefore, intercepting and copying them does not allow Eve to acquire any information about the key. In TABLE I. All possible results of a Bell operator measurement on qubits iand k. For example, if the initial state is 兩 11 典 ij 丢 兩 01 典 kl , you must locate 1101 on the left half of the table. Then, after a Bell operator measurement on iand k, the four possible final states are represented on the right half of the table by 0010, 0111, 1000, and 1101; where, for instance, 0010 means 兩 00 典 ik丢 兩 10 典 jl . Initial state 兩 ijkl 典 Possible final states 兩 ikjl 典 0000 0101 1010 1111 0000 0101 1010 1111 0001 0100 1011 1110 0001 0100 1011 1110 0010 0111 1000 1101 0010 0111 1000 1101 0011 0110 1001 1100 0011 0110 1001 1100 FIG. 1. QKD scheme based on entanglement swapping. The bold lines connect qubits in Bell states, the dashed lines connect qubits on which a Bell operator measurement is made, and the pointed lines connect qubits in Bell states induced by entanglement swapping. ‘‘00’’ means that the Bell state 兩 00 典 is public knowledge, 共00兲means that it is only known to Alice, 关00兴means that it is only known to Bob, 兩 00 兩 means that it is unknown to all the parts, 关(00)兴 means that it is only known to Alice and Bob, etc. ADA ´N CABELLO PHYSICAL REVIEW A 61 052312 052312-2 fact, the state of the transmitted qubits is public. However, Eve can use a strategy—also based on entanglement swapping—to learn Alice’s sequence of secret results. This strategy is illustrated in Fig. 2 and is described as follows. 共1a兲Consider the same scenario as in 共i兲but suppose Eve has two additional qubits 7 and 8, initially prepared in a Bell state, for instance, 兩 00 典 78 . 共1b兲Eve intercepts qubit 2 that Alice send to Bob and makes a Bell operator measurement on qubits 2 and 8. Then qubits 1 and 7 become entangled in a known 共to Eve兲Bell state. For instance, if after Eve’s measurement the state of 2 and8is 兩 00 典 28 , then the state of 1 and 7 becomes 兩 11 典 17 . 共2兲Therefore, after Eve’s intervention the real situation is not that described in 共ii兲. Now qubit 1 is entangled with Eve’s qubit 7, and 2 is entangled with Eve’s 8. 共3a兲In this new scenario, after Alice’s 共Bob’s兲measurement on qubits 1 and 3 共2 and 4兲, the state of qubits 5 and 7 共6 and 8兲becomes a Bell state. For instance, if Alice 共Bob兲 obtains ‘‘11’’ 共‘‘00’’兲, the state of qubits 5 and 7 共6 and 8兲 would be 兩 10 典 57 ( 兩 10 典 68). However, these states are unknown to Eve, because she 共still兲does not know the results of Alice’s and Bob’s measurements. 共3b兲Eve intercepts qubit 6 that Bob sends to Alice and makes a Bell operator measurement on qubits 6 and 8. This reveals the state they were in. Then Eve can know Bob’s result. For instance, in our example, Eve would find ‘‘10’’ and would know that Bob’s result was ‘‘00.’’ 共3c兲Eve makes a Bell operator measurement on qubits 7 and 8. Then qubits 5 and 6 becomes entangled in a Bell state 共still兲unknown to Eve, because she does not know Alice’s secret result. For instance, if Eve obtains ‘‘01,’’ then qubits 5 and 6 would be in the state 兩 01 典 56 . 共4兲Eve gives qubit 6 to Alice. Alice makes a measurement on 5 and 6 and announces the result. Then Eve can know the previous state of 5 and 7 ( 兩 10 典 57 , in our example兲 and the result of Alice’s measurement on 1 and 3 共‘‘11,’’ in our example兲. However, Eve’s intervention changes the correlation that Alice and Bob expect between their secret results. For instance, in our example, Bob, using his result and the result publicly announced by Alice, thinks that the two initial bits of the key are ‘‘10.’’ As in previous QKD protocols, in our scheme Alice and Bob can detect Eve’s intervention by publicly comparing a sufficiently large random subset of their sequences of bits, which they subsequently discard. If they find that the tested subset is identical, they can infer that the remaining untested subset is also identical, and therefore can form a key. In BB84, for each bit tested by Alice and Bob, the probability of that test revealing the presence of Eve 共given that Eve is indeed present兲is 1 4. Thus, if Nbits are tested, the probability of detecting Eve 共given that she is present兲is 1⫺(3 4)N.In our scheme if Alice and Bob compare a pair of bits generated in the same step, the probability for that test to reveal Eve is 3 4. Thus if npairs (N⫽2nbits兲are tested, the probability of Eve’s detection is 1⫺(1 2)N. This improvement in the efficiency of the detection of eavesdropping has been pointed out for a particular eavesdropping attack, it would be interesting to investigate whether more general attacks exist and whether the improvement in efficiency is also present in these cases. 共d兲It uses entanglement as an essential tool. QKD was the first practical application of quantum entanglement 关3兴. However, as shown in Ref. 关13兴, entanglement was not an essential ingredient, in the sense that almost the same goals can be achieved without entanglement. However, subsequent striking applications of quantum mechanics such as quantum dense coding 关14,15兴, teleportation of quantum states 关8,16,17兴, entanglement swapping 关8,9兴, and quantum com- FIG. 2. Eve’s strategy to obtain Alice’s secret result. 兵 00 其 means that the Bell state 兩 00 典 is only known to Eve. The remaining notation is the same as in Fig. 1. QUANTUM KEY DISTRIBUTION WITHOUT... PHYSICAL REVIEW A 61 052312 052312-3 putation 关18兴, are strongly based on quantum entanglement. The scheme described here relies on entanglement in the sense that it performs a task—QKD with properties 共a兲,共b兲, and 共c兲—that cannot be accessible without entanglement. The practical feasibility of the scheme described in this paper hinges on the feasibility of a reliable 共i.e., with 100% theoretical probability of success兲Bell operator measurement. Bell operator measurements are also required for reliable double density quantum coding and teleportation. As far as I know, the first proposals for a reliable Bell operator measurement are those which discriminate between the four polarization-entangled two-photon Bell states using entanglement in additional degrees of freedom 关19兴or using atomic coherence 关20兴. It is not expected that the protocol for QKD introduced in this paper will be able to improve existing experiments 关21兴 for real quantum cryptography in practice. Its main importance is conceptual: it provides a different quantum solution to a problem already solved by quantum mechanics. The author thanks J. L. Cereceda, O. Cohen, A. K. Ekert, C. Fuchs, T. Mor, and B. Orfila for helpful comments. This work was supported by the Universidad de Sevilla 共Grant No. OGICYT-191-97兲and the Junta de Andalucı ´a共Grant No. FQM-239兲. 关1兴The Vernam cipher or ‘‘one-time pad’’ 关G.S. Vernam, J. Am. Inst. Electr. Eng. 45, 109 共1926兲兴 is the only known absolutely secure method for encrypting a message 关C.E. Shannon, Bell Syst. Tech. J. 28, 657 共1949兲兴. Alice writes the message as sequence of bits, and adds the key to it, bit by bit, modulo 2. The result is the ‘‘ciphertext,’’ which is publicly transmitted. Bob can recover the message by adding the key to the ciphertext, modulo 2. If the same key is used for a second message, Eve can obtain the addition modulo 2 of both messages just by adding their chipertexts. If only a finite vocabulary is used in the messages, this is enough to reveal both of them. 关2兴C. H. Bennett and G. Brassard, in Proceedings of IEEE International Conference on Computers, Systems, and Signal Processing, Bangalore, India 共IEEE, New York, 1984兲, p. 175. 关3兴A.K. Ekert, Phys. Rev. Lett. 67, 661 共1991兲. 关4兴C.H. Bennett, Phys. Rev. Lett. 68, 3121 共1992兲. 关5兴L. Goldenberg and L. Vaidman, Phys. Rev. Lett. 75, 1239 共1995兲;77, 3265 共1996兲; A. Peres, ibid. 77, 3264 共1996兲;T. Mor, ibid. 80, 3137 共1998兲. 关6兴M. Ardehali, H.F. Chau, and H.-K. Lo, e-print quant-ph/9803007 共unpublished兲. 关7兴W.K. Wootters and W.H. Zurek, Nature 共London兲299, 802 共1982兲. 关8兴C.H. Bennett, G. Brassard, C. Cre ´peau, R. Jozsa, A. Peres, and W.K. Wootters, Phys. Rev. Lett. 70, 1895 共1993兲. 关9兴M. Z ˙ukowski, A. Zeilinger, M.A. Horne, and A.K. Ekert, Phys. Rev. Lett. 71, 4287 共1993兲; S. Bose, V. Vedral, and P.L. Knight, Phys. Rev. A 57, 822 共1998兲; J-W. Pan, D. Bouwmeester, H. Weinfurter, and A. Zeilinger, Phys. Rev. Lett. 80, 3891 共1998兲. 关10兴Entanglement swapping has been previously used in QKD for a different purpose, O. Cohen, Helv. Phys. Acta 70, 710 共1997兲. 关11兴S.L. Braunstein, A. Mann, and M. Revzen, Phys. Rev. Lett. 68, 3259 共1992兲. 关12兴Existing schemes for quantum key distribution can also work with a small numbers of qubits, as long as they are symmetrised so that in each round of the protocol Alice and Bob reverse their roles. 关13兴C.H. Bennett, G. Brassard, and N.D. Mermin, Phys. Rev. Lett. 68, 557 共1992兲. 关14兴C.H. Bennett and J. Wiesner, Phys. Rev. Lett. 69, 2881 共1992兲. 关15兴K. Mattle, H. Weinfurter, P.G. Kwiat, and A. Zeilinger, Phys. Rev. Lett. 76, 4656 共1996兲. 关16兴D. Bouwmeester, J. Pan, K. Mattle, M. Eibl, H. Weinfurter, and A. Zeilinger, Nature 共London兲390, 575 共1997兲. 关17兴D. Boschi, S. Branca, F. De Martini, L. Hardy, and S. Popescu, Phys. Rev. Lett. 80, 1121 共1998兲. 关18兴P. W. Shor, in Proceedings of the 35th Annual Symposium on the Foundations of Computer Science, Santa Fe, New Mexico, 1994 edited by S. Goldwasser 共IEEE, Los Alamitos, CA, 1994兲, p. 124; L.K. Grover, Phys. Rev. Lett. 79, 325 共1997兲, D.S. Abrams and S. Lloyd, ibid. 79, 2586 共1997兲. 关19兴P. G. Kwiat and H. Weinfurter, Phys. Rev. A 58, R2623 共1998兲. 关20兴M.O. Scully, B.-G. Englert, and C.J. Bednar, Phys. Rev. Lett. 83, 4433 共1999兲. 关21兴P.D. Townsend, Nature 共London兲385,47共1997兲; G. Ribordy, J-D. Gautier, N. Gisin, O. Guinnard, and H. Zbinden, Electron. Lett. 34, 2116 共1998兲; W.T. Buttler et al., Phys. Rev. Lett. 81, 3283 共1998兲; Phys. Rev. A 57, 2379 共1998兲. ADA ´N CABELLO PHYSICAL REVIEW A 61 052312 052312-4