BB84 Quantum Key Distribution

1
BB84 Quantum Key Distribution

• Alice chooses random bitstrings a and b each of
  length (4?)n,
• Alice encodes each bit ai as 0gt,1gt if bi0
  and as gt,-gt if bi1,
• Alice sends the resulting states to Bob,
• Bob receives (4?)n qubits, announces this fact,
  and measures each of them in random X or Z basis
  according random bitstring b obtaining a,
• Alice announces b,
• Alice and Bob keep 2n bits in positions i?????
  such that bibi,
• Alice selects a subset of n positions T in I and
  announces ai to Bob for all i e T,
• Bob reports the number of errors
  tieTailtgtai, if tgttmax then Alice and Bob
  abort,
• Alice and Bob apply reconciliation
  (error-correction) and privacy
• amplification (PA) upon the qubits in
  KI-T

PA
2
Lo-Chau Quantum Key Distribution

1. Alice creates 2n EPR pairs in state each in state
   b00gt, and picks a random 2n bitstring b,
2. Alice randomly selects n EPR pairs T for checking
   Eves interference,
3. Alice performs H on the second qubit of each pair
   i such that bi1, she sends the second qubit of
   each pair to Bob,
4. Bob receives them and announces it,
5. Alice announces b and T,
6. Bob applies H on the qubits where bi1,
7. Alice and Bob measure their qubits in T in the Z
   basis, publicly share the result. If more than t
   errors occurred they abort,
8. Alice and Bob measure their remaining qubits
   according a check matrix for a predetermined
   n,m-CSS code correcting any t errors. They
   share the results, corrects and get m nearly
   perfect EPR pairs,
9. Alice and Bob measure the m EPR pairs in the Z
   basis to get a shared secret-key.

3
Family of CSS codes
Remember that CSS codewords are defined as
Equivalently, we can define CSSu,v as follows
CSSu,v codes all work the same way than CSS codes.
4
CSSxz(C1,C2) is a basis

• C1 is a n,k1,t-linear code,
• C2 is a n,k2-linear code such that the dual of
  C2 corrects t errors.

Assume H1 is the parity check for C1 and H2 is
the parity check for C2.
We have seen that

• When A measures H1 she gets sx randomly in
  0,1n-k1,
• When A measures H2 she gets sz randomly in
  0,1k2.
• After error-correction and decoding they get

5
Error-Rate Estimation
Estimating the number of bit and phase flips
6
A non-local test

• Since Alice and Bob are physically separated, the
  previous
• test cannot be performed. However,
• Notice that the same result than before would be
  obtained
• if for each position either bit flip or phase
  flip would be
• tested but not both.
• Observe also that
• which means that bit flips and phase flips can
  be detected
• by applying both the Z or the X measurements
  and comparing
• if they got different eigenvalues.
• Notice that Alice and Bob by doing this make the
  detection of both bit-flip and phase-flip
  impossible on a single qubit.

7
Bit-Flips and Phase-Flips
It follows that the number of phase-flips and bit
flips are distributed identically since H is
applied randomly and Eve cannot find any
information about when it is the case.
Only measuring for bit-flips gives a bound on
both the number phase-flips and bit-flips.
8
High Fidelity Implies Low Entropy
Lemma 12.9 If ltb00(n) rb00(n) gt gt 1-2-s, then
S(r) lt
(2ns1/ln2)2-sO(2-2s).
Proof
It follows that S(r) lt S(rmax) where
9
Application to Lo-Chau Protocol

• If the estimate for the number of errors is
  accurate and
• is such that the QECC allows to fix them then
  Alice and Bob share m perfect EPR pairs,

• Since the estimate is mistaken only with
  negligible
• probability 2-an then the state shared by Alice
  and Bob is
• such that ltb00(n) rb00(n) gt gt 1-2-an,

• By the Corollary to the Holevo bound, the amount
  of Shannon
• information available to the Eavesdropper, about
  the
• outcome of Alices and Bobs measurements
  determining
• the key, is negligible,

• This is a secure Quantum Key distribution
  protocol!

10
Modified Lo-Chau Protocol
Alice creates n random check bits, and n EPR
pairs in state b00gt. She encodes n qubits in
state 0gt or 1gt according the check bits and
picks a random 2n-bit string b,

1. Alice creates 2n EPR pairs each in state b00gt,
   and picks a random 2n bitstring b,
2. Alice randomly selects n EPR pairs T for checking
   Eves interference,
3. Alice performs H on the qubit to be sent for each
   i such that bi1, she sends the qubits to Bob,
4. Bob receives them and announces it,
5. Alice announces b and T,
6. Bob applies H on the qubits where bi1,
7. Alice and Bob measure their qubits in T in the Z
   basis, publicly share the result. If more than
   t-?n errors occurred they abort,
8. Alice and Bob measure their remaining qubits
   according a check matrix for a predetermined
   n,m-CSS code correcting t errors. They share
   the results, correct and get m nearly perfect EPR
   pairs,
9. Alice and Bob measure the m EPR pairs in the Z
   basis to get a shared secret-key.

Alice randomly picks n positions T to put the
check qubits among n EPR pairs,
Bob measures the check qubits in Z basis,
publicly shares the result with Alice, if more
than t-?n errors occurred then they abort.
11

1. Alice creates n random check bits, and n EPR
   pairs in state b00gt. She also encodes n qubits
   in state 0gt or 1gt according the check bits and
   picks a random 2n-bit string b,
2. Alice randomly picks n positions T to put the
   check qubits among n EPR pairs,
3. Alice performs H on the qubit to be sent for each
   i such that bi1, she sends the qubits to Bob,
4. Bob receives them and announces it,
5. Alice announces b and T,
6. Bob applies H on the qubits where bi1,
7. Bob measures the check qubits in 0gt,1gt basis,
   publicly shares the result with Alice, if more
   than t-?n errors occurred then they abort.
8. Alice and Bob measure their remaining qubits
   according the check matrix for a CSSx,z(C1,C2)
   where x and z are random. They share the results,
   correct the errors, decode and gets m perfect
   EPR pairs.
9. Alice and Bob measure the m EPR pairs in the Z
   basis to get a shared secret-key.

The key is random and determined by Alice here
The random CSS code is randomly selected by
Alice when she measures.
12
Removing the Need for EPR Pairs

• At step 8, Alice gets x and z randomly and
  uniformly since
• At step 9, Alice obtains a random m-bit sting k
  encoded in CSSxz(C1,C2) code

mk1-k2
All those measurements commute with Eve and Bob
actions. They could all occur at the very
beginning!
13
Bob needs storing!
CSS codes protocol

1. Alice creates n random check bits, and n EPR
   pairs in state b00gt. She also encodes n qubits
   in state 0gt or 1gt according the check bits and
   picks a random 2n-bit string b,
2. Alice randomly picks n positions T to put the
   check qubits among n EPR pairs,
3. Alice performs H on the qubit to be sent for each
   i such that bi1, she sends the qubits to Bob,
4. Bob receives them and announces it,
5. Alice announces b and T,
6. Bob applies H on the qubits where bi1,
7. Bob measures the check qubits in Z basis,
   publicly shares the result with Alice, if more
   than t-?n errors occurred then they abort.
8. Alice and Bob measure their remaining qubits
   according the check matrix for a CSSx,z(C1,C2)
   where x and z are random. They share the results,
   correct the errors, decode and gets m perfect
   EPR pairs.
9. Alice and Bob measure the m EPR pairs in the Z
   basis to get a shared secret-key.

Alice creates n random check bits, a random m bit
key k, random x and z. She encodes kgt in
CSSxz(C1,C2). She also encodes n qubits in state
0gt or 1gt according the check bits and picks a
random 2n-bit string b.
Alice randomly chooses T and put the check
qubits among the encoded kgt,
Still needs quantum Computer!!!
Alice announces x,z, b and T to Bob,
Bob corrects and decodes the remaining qubits
according the CSSxz(C1,C2) code,
Bob measures the decoded qubits in basis Z and
gets key k.
14
Removing the need for Quantum Computer
z and correcting e2 are now useless!
15
CSS codes protocol
But Alice does!

• Alice creates n random check bits, a random m bit
  key k, random x and z. She encodes kgt in
  CSSxz(C1,C2). She also encodes n qubits in state
  0gt or 1gt according the check bits and picks a
  random 2n-bit string b.
• Alice randomly chooses T and put the check
  qubits among the encoded kgt,
• Alice performs H on the qubit to be sent for each
  i such that bi1, she sends the qubits to Bob,
• Bob receives them and announces it,
• Alice announces x,z, b and T to Bob,
• Bob applies H on the qubits where bi1,
• Bob measures the check qubits in 0gt,1gt basis,
  publicly shares the result with Alice, if more
  than t-?n errors occurred then they abort.
• Bob corrects and decodes the remaining qubits
  according the CSSxz(C1,C2) code,
• Bob measures the decoded qubits in basis Z and
  gets key k.

Alice announces x, b and T to Bob,
Bob measures the remaining qubits to get
vkwxe1 and subtracts x before correcting e1
to get vkw,
Bob computes the coset vkwC2vkC2 in order to
get k.
Bob doesnt need to do quantum error-correction!
16
Removing Alices encoding
Since Alice does not need to announce z, she
sends a mixture
When w1w2ltgt0 then half the z will produce -1 and
half 1
This state is simpler to create than a CSS
encoding
Alice classically chooses w in C2 at random,
constructs vkwxgt as before using random x and
k.
17
Alice creates n random check bits, a random x, a
random vk in C1/C2, and a random w in C2. She
encodes n qubits in state 0gt or 1gt according
vkwx. She also encodes n qubits in state 0gt or
1gt according the check bits and picks a random
2n-bit string b.

• Alice creates n random check bits, a random m bit
  key k, random x and z. She encodes kgt in
  CSSxz(C1,C2). She also encodes n qubits in state
  0gt or 1gt according the check bits and picks a
  random 2n-bit string b.
• Alice randomly chooses T and put the check
  qubits among the encoded kgt,
• Alice performs H on the qubit to be sent for each
  i such that bi1, she sends the qubits to Bob,
• Bob receives them and announces it,
• Alice announces x, b and T to Bob,
• Bob applies H on the qubits where bi1,
• Bob measures the check qubits in 0gt,1gt basis,
  publicly shares the result with Alice, if more
  than t-?n errors occurred then they abort.
• Bob measures the remaining qubits to get
  vkwxe1 and subtracts x before correcting e1
  to get vkw,
• Bob computes the coset vkwC2vkC2 in order to
  get k.

Alice randomly chooses T to put as check qubits
among the encoded vkwxgt,
No more quantum computer needed
18
Further Simplifications
in C2
in C1/C2
in 0,1n
Alice sends
Bob gets
Alice announces
Bob subtracts
If Alice chooses vk in C1 then w becomes useless!!
19
Further Simplifications
in 0,1n
in C1
Alice sends
Bob gets
Alice announces
Bob subtracts
Notice that vkx is completely random, so Alice
could choose x at random and send xgt with no
change for the rest of the world.
20
Alice could prepare the qubits already in bases b!
Almost BB84

• Alice creates n random check bits, a random x, a
  random vk in C1/C2, and a random w in C2. She
  encodes n qubits in state 0gt or 1gt according
  vkwx. She also encodes n qubits in state 0gt or
  1gt according the check bits and picks a random
  2n-bit string b.
• Alice randomly chooses T and put the check
  qubits among the encoded kgt,
• Alice performs H on the qubit to be sent for each
  i such that bi1, she sends the qubits to Bob,
• Bob receives them and announces it,
• Alice announces x, b and T to Bob,
• Bob applies H on the qubits where bi1,
• Bob measures the check qubits T in 0gt,1gt
  basis, publicly shares the result with Alice, if
  more than t-?n errors occurred then they abort.
• Bob measures the remaining qubits to get
  vkwxe1 and subtracts x before correcting e1
  to get vkw,
• Bob computes the coset vkwC2vkC2 in order to
  get k.

Alice chooses random vk in C1 and creates 2n
qubits in states 0gt and 1gt according to 2n
random bits. She also picks a random b in
0,12n,
Alice randomly chooses n check positions T while
the others are xgt,
Alice announces b, x-vk, and T to Bob,
Bob measures the remaining qubits to get xe,
subtracts x-vk to get vk e, and corrects e
according C1 to finally get vk,
Alice and Bob compute the coset vkC2 in order
to get k.
Only quantum memory remains to be removed
21
Almost done

• Alice could pick (4?)n random bits, for each she
  creates a qubit in basis 0gt,1gt or gt,-gt
  according b.
• Upon reception, Bob could measure randomly in the
  X or Z basis.
• When Alice announces b, they keep only the
  matching positions.
• Only then, Alice chooses the check qubits.

22
Secure BB84

• Alice creates (4??n random bits,
• For each bit, she creates a qubit in the Z or X
  basis according a
• random b,
• Alice sends the resulting qubits to Bob,
• Alice chooses a random vk in C1,
• Bob receives and publicly announces it. He
  measures each qubit in
• random Z or X basis,
• Alice announces b,
• Alice and Bob only keep the qubits measured and
  sent in the same
• basis. Alice randomly picks 2n of the
  remaining positions and picks
• n for testing,
• Alice and Bob publicly compared their check bits.
  If too many errors
• occurred then they abort. Alice is left
  with xgt and Bob with xegt.
• Alice announces x-vk. Bob subtracts this from his
  result and corrects
• according C1 to obtain vk,
• Alice and Bob compute the coset vkC2 in C1 to
  obtain k.

23
Tolerable noise level for secure QKD
Randomizing the positions of errors allows for
correcting t errors with a code of
minimum distance about t (with good prob).
24
QKD for Sale!
Plug-and-play Quantum Key Distribution system
that was designed for research and development
applications. It is the ideal tool for
researchers interested to contribute to the
field of Quantum Cryptography.
Link Encryptors are hardware Quantum
Cryptography appliances for point-to-point
wire-speed link encrpytion. Quantum Key
Distribution and AES encryption engines are
combined in a stand-alone unit. Vectis is a
layer 2 encryption device that securely bridges
two Fast Ethernet fiber optic networks.