Quantum Entanglement Assisted Key Distribution

Transcription

1 Quantum Entanglement Assisted Key Distribution Ke Tang *, Ping Ji *+, Xiaowen Zhang * Graduate Center, City University of New York, ke.tang@qc.cuny.edu + John Jay College of Criminal Justice, City University of New York, pji@jjay.cuny.edu Abstract Quantum correlations or entanglement is a basic ingredient for many applications of quantum information theory. One important application that exploits the correlation nature of entangled photon states is quantum key distribution, which is proven unbreakable in principle and provides the highest possible security that is impossible in classical information theory. However, generating entangled photon pairs is not a simple task -- only approximately one out of a million pump photons decay into a signal and idler photon pair. This low rate of entangled photon pairs is further reduced by the overhead required in order for the rectification of the inevitable errors due to channel imperfections or caused by potential eavesdroppers. As a consequence, quantum key distribution suffers from a low bit rate, which is in the order of hundreds to thousands bits per second or below. On the other hand, the classical public key distribution does not impose a tight limit on the transmission rate. However, it is subject to the risks of eavesdroppers sitting in the middle of the insecure channel. In this paper, we propose a hybrid key distribution method which uses public key distribution method to generate a raw key, and then uses entanglement assisted communication to modify the raw key by inserting a number of quantum bits in the raw key. Building upon the foundation of the unconditional security of quantum key distribution, we use the privacy amplification to make the affection of inserted bits expand to a whole key. Our quantum entanglement assisted key distribution scheme greatly improves the efficiency of key distribution while without compromising the level of security achievable by quantum cryptography. I. Introduction In modern cryptographic techniques, two key encryption schemes have been broadly used: the symmetric-key encryption and the public-key encryption. In public-key cryptography, messages are exchanged using keys that derived from factoring the product of two extremely large (>100 digits) prime numbers, which assumes the difficulty of certain mathematical problems. On the other hand, the main practical problem with symmetric-key cryptography is to determine a secret key securely. Theoretically, two users who would like to communicate with each other may agree on a secrete key in advance, however, in practice, it is difficult to avoid eavesdroppers to hijack the key and intervene the conversation. In the cryptography literature this is referred to as the key distribution problem. A few methods have been proposed to solve the key-distribution problem, including involving a central key distribution center and employing publicly-discussed keys based on large prime numbers (e.g., the Diffie-Hellman key exchange algorithm). However, the existing key distribution algorithms suffer various shortages one way or another such as central point failure, or being computationally expensive. Quantum encryption, nonetheless, sheds the light on the path to negotiating and distributing secrete-keys in a secure and efficient fashion. Quantum physics has excited and fascinated people for the last century. However it is only in the past decades that novel applications were found, that would make explicitly use of the Quantum Information and Computation V, edited by Eric J. Donkor, Andrew R. Pirich, Howard E. Brandt, Proc. of SPIE Vol. 6573, 65730S, (2007) X/07/$18 doi: / Proc. of SPIE Vol S-1

2 fundamental principles of quantum mechanics [12]. The most straightforward application of quantum cryptography is the distribution of secret keys in the public-key management system. In Quantum communication channels, the elements of quantum information exchanged are observations of quantum states: typically photons that are generated into particular state by the sender and then observed by the receiver. Specifically, the sender encodes the photon into quantum states, the receiver observes these states, and then by public discussion of the observations the sender and receiver agree on a body of information they share (with arbitrarily high probability). Depending on how the observation is carried out, different aspects of the system can be measured for example, polarizations of photons can be expressed in any of three different bases: rectilinear, circular, and diagonal but observing in one basis randomizes the conjugates. Thus, if the receiver and sender do not agree on what basis of a quantum system they are being used, the information obtained by the receiver is useless. Once the secret bit string is agreed to, the technique of privacy amplification can be used to reduce an outsider s potential knowledge of it to an arbitrarily low level. Through Quantum physics channels, the amount of information that may be transmitted is limited; however it is provably very secure [13]. By taking advantage of existing secret-key cryptographic algorithms, this initial transfer can be leveraged to achieve a secure transmission of large amounts of data at much higher speeds. Quantum cryptography is thus an excellent replacement for the Diffie- Hellman key exchange algorithm. An important issue of quantum mechanics is the impossibility to copy quantum states. Due to the so called no-cloning-theorem one qubit can not be duplicated in the way that full information from the original quantum state of a photon is copied to another photon [3]. Quantum entanglement, a term originally coined by the Austrian physicist Erwin Schroedinger, is furthermore the essence of quantum physics. The quantum entanglement describes the situation where two entangled particles can only be illustrated by their joint behavior. This has the intriguing consequence that measurements on the individual particles will always lead to random results although perfect correlations are observed for measurement outcomes of both particles no matter how far apart the two particles are [12]. Albert Einstein called this astonishing behavior spooky action at a distance. Entanglement plays a decisive role in many quantum communication and quantum computation schemes. As a physical resource for these protocols it is important to be able to generate, manipulate and distribute entanglement as accurate and efficient as possible. In theory, these correlations should be maintained over arbitrary distances, but the practical limitation for fiber based entanglement distribution is the absorption and decoherence due to polarization mode dispersion. On the other hand, the classical communication via optical fibers is very well established nowadays. The transmission rate of the Internet can easily approach GBit/s. That corresponds to many million photons per bit and subsequently the receiver electronics is possible to make a decision between 0 and 1 for all incoming photon bursts. Provided by the nice features of highly secured communication over quantum channels and the fast transmission rate over traditional data channels, in this paper, we propose a hybrid key distribution protocol Quantum Entanglement Assisted Key (QEAK) Distribution Protocol that inherent the philosophy in traditional public-key distribution algorithms utilized by the highspeed Internet, and in the meantime borrows the unbreakable quantum bits to facilitate key generation and propagation. In particular, in this paper, we propose a hybrid key distribution method which uses public key distribution method to generate a raw key, and then uses Proc. of SPIE Vol S-2

3 entanglement assisted communication to modify the raw key by inserting a number of quantum bits in the raw key. Building upon the foundation of the unconditional security of quantum key distribution, we use the privacy amplification to make the affection of inserted bits expand to a whole common key between a sender and a receiver. The rest of this paper is organized as following: in Section II, we briefly discuss the classic public-key distribution scheme that utilizes RSA with one time padding; in Section III, we introduce EPR and entanglement assisted communication in detail; in Section IV, we present our hybrid key distribution protocol, QEAK, in detail; in Section V, we explore the performance of the QEAK approach; and finally, in Section VI, we conclude our paper and present the future directions of this work. II. Classical public key distribution schema RSA and one time pad In cryptography, the one-time pad (OTP) is an encryption algorithm which has been proven to be unbreakable when properly deployed. In OTP the plaintext is combined with a random key or a "pad" with the length as long as the plaintext. To use OTP, the two communication parties, Alice and Bob, need two secure and identical random sequences of bits (the key) which are assumed to be previously produced and securely issued to both Alice and Bob. To get the encrypted message, Alice uses XOR logical operation to combine her plaintext, with the key, and then transmits the encoded message to Bob. On the other side, Bob performs the XOR operation on the encrypted message with the key sequence, and thereafter restores the plaintext. One-time padding scheme is information-theoretically secure, where the encrypted message provides no information about the original message, and the cryptanalyst may get any message using different pad with equal probability. One of the critics for one time padding scheme lies in the fact where the key must be exchanged securely between the two end users before the enciphered message being transmitted, which may introduce uncertainty. This issue can be partly solved by using public key distribution (PKD) scheme. PKD uses a pair of cryptographic keys designated as the public key and the private key, which are derived based on prime number theories. In this paper, we adopt one of the best PKD algorithms the RSA algorithm that is described in 1977 by Ron Rivest, Adi Shamir and Len Adleman at MIT to set forth our study. We briefly present RSA algorithm as the following. Suppose Alice and Bob communicate over an insecure (open) transmission medium, and Alice wants Bob to send her a private (or secure) message. The RSA protocol can accordingly be divided into three phases: key generation, encoding message and decoding message. Here, Alice first takes the following steps to generate a public key and a private key: 1. Choose two large prime number p and q, so that p q, randomly and independently. 2. Compute n= pq 3. Compute the totient. φ ( n) = ( p 1)( q 1) 4. Choose an integer e such that 1 < e< φ( n) which is coprime to φ ( n). 5. Compute d such that de 1(mod φ( n)) Thereafter, the public key that consists of number n the modulus, and number e the public exponent, is generated as the tuple (n, e); in the meantime, the private key that consists of Proc. of SPIE Vol S-3

4 number n which is publicly known and appears in the public key, and the number d the private exponent, is kept as the tuple (n, d). After generating the key pairs, Alice transmits the public key to Bob, and keeps the private key secretly to herself. Now if Bob wishes to send a message M to Alice, he converts M into a number m (where m<n) by using a reversible operation that has been previously agreed with e Alice. Bob then computes the ciphertext c= m (mod n), and transmits c to Alice. When Alice receives c from Bob, she can recover the plaintext m from c by conducting the computation d of m= c (mod n). Given m, Alice may recover the original message M easily. The security of the RSA cryptosystem is primarily based the mathematical challenges of deriving large prime factorizations for some numbers. Full cryptanalysis for an RSA ciphertext is considered to be infeasible based on the mathematical difficulty behind it. If a government or criminal organization has a mathematician who figures out how to factor large numbers quickly and efficiently, then much of the information that's encrypted on today's Internet and almost everywhere else will suddenly become vulnerable to eavesdropping and wiretapping. In 1993, Peter Shor published Shor s factoring algorithm [14], which shows that a quantum computer could in principle perform the same kind of factorization within polynomial time, rendering RSA and related algorithms obsolete. However, quantum computation is not expected to be developed to such a level for many years. III. EPR and Entanglement assisted communication To avoid the prohibitively expensive cost in the mathematical computational complexity, there has been a substantial interest in the development and deployment on quantum cryptography system, another provably secured encryption system based on quantum physics. Built upon two counter intuitive features of quantum physics, the uncertainty and entanglement, two different types of quantum cryptographic protocols have been defined. The first protocol uses the polarization of photons to encode the bits of information and relies on quantum randomness to keep the eavesdropper (e.g., Eve) from learning the secret key. The second protocol, the Ekert scheme (first proposed by Artur Ekert in 1991) [15] uses entangled photon states to encode the bits and relies on the fact that the information defining the key only comes into being after measurements are performed by Alice and Bob. In this paper, we are not going to introduce a novel and conceptually puzzling practical uses of entanglement: teleportation (Bennett et al. 1993). In 1935, Einstein and his colleagues Podolsky, Rosen imagined a scenario (EPR paradox) that would let people to measure both the position and momentum of a particle. Although the EPR paradox is originally devised as a thought experiment that should expose quantum mechanics' incompleteness, in 1964, John Bell showed that the predictions of quantum mechanics in the EPR thought experiment had much stronger statistical correlations from the predictions of the hidden variable theories. These differences, expressed using inequality relations known as "Bell's inequalities", are in principle experimentally detectable. After the publication of Bell's paper, a variety of experiments were devised to test Bell's inequalities and some dramatic violations of the inequality have been reported. The entanglement (non local outcome of EPR), which Einstein famously addressed it as spooky action at a distance, plays a key role in today s quantum information processes. It shows to us an anti-intuitive idea of instant communication of data through quantum correlation. Proc. of SPIE Vol S-4

5 Here, we would like to introduce a maximally entangled state, 1 Φ + = (1 1 + A B 0 A 0 B ), and 2 use the Dirac Bra-Ket notation to represent it. Practically, we may think that the entangled system consists of two photons with a mystical link between them. The states 0 and 1 have the physical meaning of the photon spinning up or down (the particle's spin-component along some dimension x, y or z). We then can easily map the states into the classical data bits 0 or 1. In the entangled state notation, the subscriptions A and B indicate the two communication parties Alice and Bob. Let us now examine the properties of the entanglement state Φ. If Alice measures the + photon along x axis (we assume x axis is along the vertical direction) and gets a result up with 50% probability, then no matter how far Bob s particle is, Bob s measurement result along the x axis (vertical direction) must be up. Provided the above knowledge, let us now explore the protocol: 1. A source generates photon pair Φ+ and sends one of the photons to Alice and another one to Bob 2. Alice and Bob independently and randomly selects a direction axis x or y and measures the photon s spin. 3. With 50% probability, Alice and Bob choose the same dimension. If so, their measurement results are the same and provide them a common key bit. 4. Repeat steps 1 to 3 until Alice and Bob share enough amount of bits to construct a security key 5. Alice and Bob thereafter use one time padding encryption scheme to encode and decode their communication messages. Alice Measure spin along x or y Source Φ + Bob Measure spin along x or y Figure 1. QKD Basic Setup Figure 1 illustrates the simple key distribution scenario from the quantum channel as we have presented above. We consider this protocol secure since it is virtually impossible to hijack the keys exchanged through the quantum channel. This is due to the fact that creating three entangled photons would decrease the strength of each photon to such a degree that it would be easily detected. Eve therefore cannot use a man-in-the-middle attack, since she would have to measure an entangled photon and disrupt the other photon, then she would have to re-emit both photons. This is also impossible due to the laws of quantum physics. However, the technological challenges of the QKD protocol exists in how to produce entangled photons and transmit them and exploit the intrinsic randomness, which requires significantly more computation cost than the classical data bit transmission. IV. Hybrid key distribution protocol As we have discussed, encryption key distribution against sophisticated attacks is one of the most challenging problems to be investigated in the field of cryptography. Unlike classic key distribution algorithms which employ various mathematic techniques to prevent eavesdropping, Proc. of SPIE Vol S-5

6 quantum key distribution is focused on the physics phenomenon of the quantum world. The restriction of any measurement of quantum system will disturb the system can let us detect the existence of eavesdroppers, and so to realize secure key distribution. In this paper, we propose a hybrid key distribution protocol for the cryptography system, where quantum bits and classic data bits are put together to derive a secure encryption key. One important feature of this protocol is to save the large amount of expensive physical resources, i.e., the EPR pairs generated in Quantum channels, and in the same time, to adopt the virtually unbreakable property of Quantum key distribution into the public-key distribution system. In this hybrid protocol, we consider that Alice and Bob share two communication channels: a quantum channel which can transmit quantum states; and a classical channel which is utilized to transmit regular data bits. In fact, the quantum channel and classical channel can both be integrated into the same optic fiber media. In the following, we introduce our hybrid key distribution protocol in detail. Using PKD to generate a raw key: Alice and Bob first run the RSA protocol. After generating the public and private key, Alice sends Bob an encoded message, e c= ( kraw) (mod n) for Bob to decode later. After Bob has successfully received and decoded the message, Alice and Bob will share a common raw key k raw. Here, we assume the length of the key k raw as l. Using QKD to generate a short quantum key: After the establishment of a common key, k raw, Alice and Bob use the quantum key distribution (QKD) approach to negotiate a sequence of quantum bits, until the length of this sequence is 2 logl + 1. We consider this new generated quantum bit sequence as a key k quan that is virtually secure. Generating a mixed key: Now Alice and Bob share a common key k raw which is conducted through traditional data channel and may not be completely secure, and meanwhile a quantum key k quan which is derived from a quantum channel and is considered cannot be cloned. Thereafter, Alice and Bob agree to use the following procedure to generate a new secrete key: Both of Alice and Bob consider the bits between digits i and logl+i as location index and use the bit at the positions logl+i+1 in k quan to replace the original bit located in the same digit in the raw key k raw. Here, we assume i [ 1, logl], and thus there are totally logl bits in the raw key to be replaced. Applying privacy Amplification: At last, Alice and Bob perform the classical method of privacy amplification to generate a new mixed key k hybrid. The classical protocol works as follows: Alice randomly chooses pairs of bits and announces which bits she has chosen (e.g. bit number 103 and bit number 537). Alice and Bob then replace the two bits by their XOR values independently. Here if the eavesdropper Eve only has partial information about the two bits, consider for example that Eve only knows the value of the first bit yet nothing about the second bit, then Eve cannot successfully get the information by performing the XOR operation. Even if Eve knows the value of both bits with 60% probability, the probability for her to correctly guess the value of the XOR computation is still limited at = 52%. If Alice and Bob repeat the process for enough number of times, then the two communication parties can successfully reduce Eve s knowledge about the information to an arbitrarily low level. Proc. of SPIE Vol S-6

7 From the above hybrid key distribution protocol, Alice and Bob can securely generate a key k hybrid for their later communication based on public-key cryptographic infrastructure. The Quantum Entanglement Assisted Key distribution (QEAK) protocol enjoys the security provided by using privacy amplification in the same time saves the usage of the expensive EPR pairs. In the next section, we discuss the security and efficiency features of QEAK approach in a greater detail. V. Security and Efficiency for QEAK The security of our QEAK key distribution protocol depends on the keys generated by the RSA protocol and the QKD scheme and also relies on the privacy amplification mechanism being used. Here, for RSA particularly, the security highly depends on the large-prime factorization problem for some numbers. As of 2005, the largest number factored by generalpurpose methods has been shown as 663 bits long, and the typical length of RSA keys is bits long [RSA Conference]. In general, the RSA approach is considered to be secure when the modulus n is sufficiently large. In QEAK protocol, we suggest that 2048 or 4096 bits to be used in the key. Furthermore, unlike RSA, the security of QKD depends on the quantum law. Because of the fragile nature of qubits, any eavesdropping (measurement) activity may disturb the quantum states, and this disruption can be detected by Alice and Bob easily. Thus, the quantum cryptographic protocol has been considered secure. From all of above, we conclude that our hybrid key distribution scheme the QEAK key distribution protocol enjoys intensively protected security, which is provided by both the mathematical challenges of solving large-prime factors for large numbers and the usage of privacy amplification that can reduce Eve s knowledge about the communication to an arbitrarily low level. In addition, we also believe our QEAK approach is efficient in the sense that comparing with the l qubits required in a pure QKD protocol, QEAK only needs to transmit 2logl qubits. This has significantly saved the physical resources that are necessary, provided that entangled photons are expensive resources. Moreover, to transmit quantum bits, it requires much longer time than the classical bits transmission (typically 10 5 bit per second vs bits per seconds). Our hybrid key distribution approach not only enjoys the security merit provided by quantum cryptography, but also efficiently utilized the high-speed traditional data communication channel. In the hybrid scheme, the repeating time of privacy amplification depends on the level of the eavesdropper s knowledge about the raw key. When using a longer key of RSA, we can reduce our repeating time of privacy amplification significantly. Furthermore, both the quantum channel and the traditional channel that we have discussed can be integrated in one optical fiber, which indicates a great level of flexibility for the QEAK scheme to be implemented in the future. VI. Conclusion In this paper, we have proposed a hybrid key distribution method Quantum Entanglement Assisted Key Distribution (QEAK) that utilizes public key distribution method to generate a raw key, and then uses entanglement assisted communication to modify the raw key by inserting a number of quantum bits in the key. Building upon the foundation of the unconditional security of quantum key distribution, we use the privacy amplification to make the affection of inserted bits expand to a whole key. Our quantum entanglement assisted key distribution scheme greatly improves the efficiency usage of the expensive quantum bits in the key while without Proc. of SPIE Vol S-7

8 compromising the level of security achievable by quantum cryptography. Due to page limits, we have not presented the performance evaluation details of our scheme in this paper. Instead, we discuss the security and efficiency of our QEAK approach in general. In our future work, we would like to conduction performance evaluation schemes to investigate the performance of QEAK by quantitatively characterizing important parameters. We would also like to propose a quantum entanglement assisted key management infrastructure for large scale networks and formulate the applicability and the performance of the network based QEAK accordingly. References [1] Einstein, A., Podolsky, B and Rosen, N. Can Quantum-mechanical Description of Physical Reality Be Considered Complete? Phys. Rev (1935) [2] Bell, J. S. On the Einstein-Podolsky-Rosen Paradox. Physics 1, , 1964 [3] W.K. Wootters et al., Nature 299 (1982), 802 [4] Bennett, C. H. and Wiesner, S. J. Communication via One- and Two-Particle Operators on Einstein-Podolsky-Rosen States Phys. Rev. Lett (1992) [5] Michler, M., Mattle, K., Weinfurter, H. and Zeilinger, A. Interferometric Bell-state analysis Phys. Rev. A 53 R1209 (1996) [6] Mattle, K., Weinfurter, H., Kwiat, P. G. and Zeilinger, A. Dense Coding in Experimental Quantum Communication Phys. Rev. Lett (1996) [7] M. Nielson, I. Chuang, Quantum computation and quantum Information, Cambridge university press2000. [8] R. Horodecki and M. Horodecki, Phys. Rev. A54, 1838(1996) [9] S. Popescu, Phys. Rev. Lett. 72, 797 (1994) [10] Preskill, J. Quantum Information and Computation, Lecture Notes, Sections (1998) [11] Kak, S. Paradox of Quantum Information quant-ph/ [12] A. Poppe, A. Fedrizzi, H. Hubel, R. Ursin, and A. Zeilinger, Entangled State Quantum Key Distribution and Teleportation, ECOC 2005 Symposia (Invited report, 31 European Conference on Optical Communication) [13] Hoi-Kwong Lo, H. F. Chau Unconditional Security of Quantum Key Distribution over Arbitrarily Long Distances, Science 26 March 1999: Vol no. 5410, pp [14] P. W. Shor, Algorithms for quantum computation: discrete logarithms and factoring, in Proceedings of the 35 Annual Symposium on the Foundations of Computer Science, edited by S. Goldwasser (IEEE Computer Society Press, Los Alamitos, CA), pp (1994). [15] A. K. Ekert, Quantum cryptography based on Bell s theorem Physics Review Letter 67, 661 (1991). Proc. of SPIE Vol S-8