A Simulative Comparison of BB84 Protocol with its Improved Version

Transcription

1 JCS&T Vol. 7 No. 3 October 007 A Simulative Comparison of BB84 Protocol with its Improve Version Mohsen Sharifi an Hooshang Azizi Computer Engineering Department Iran University of Science an Technology, Tehran, Iran s: {msharifi, hazizi}@iust.ac.ir ABSTRACT Public key cryptosystems can well become voi with the avent of increibly high performance quantum computers. The unerlying principles of these computers themselves, namely quantum mechanics, provie the solution to the key istribution problem. This paper explains how cryptography will be benefite from quantum mechanics, through a short introuction to classical cryptography, an the general principles of quantum cryptography an the BB84 protocol for key istribution. Then we review a moification to the BB84 protocol that is logically claime to increase its efficiency. We then valiate this claim by presenting our simulation results for BB84 an its improve protocols an show that the efficiency of the improve protocol coul be ouble without unermining the security level of BB84 protocol. Keywors: Cryptography, BB84 Protocol, Quantum Cryptography, Quantum Key Distribution.. INTRODUCTION Although public-key cryptosystems, especially with large an ranomly generate keys, are safe within the context of current technology, they can well become voi when increibly high performance quantum computers come into real existence an use. A quantum algorithm with polynomial time for factorization has alreay been iscovere [], so if quantum computers become a reality, RSA an other public-key cryptosystems woul become obsolete. This is where quantum cryptography comes to the rescue, offering a new solution to the key istribution problem by using the quantum mechanics principles. Quantum cryptography, better name quantum key istribution, allows Alice an Bob to create a ranom secret key base on quantum mechanics an to verify that the key has not been eavesroppe [,3,4]. Quantum cryptography is base on the principles of quantum physics, for example, measurement of photon polarization with incompatible basis moifies the photon polarization. Also one cannot measure simultaneously the polarization of a photon in the rectilinear an the iagonal bases. These facts are the core of quantum key istribution protocols. Various schemes for quantum cryptography have been propose, such as B9, BB84, an EPR [,4]. For brevity, we will consier the well-known scheme BB84. B9 is similar to BB84, an EPR exploit quantum entanglement.. BB84 PROTOCOL BB84 protocol was propose by Bennett an Brassar [5]. Between Alice an Bob two channels are neee: quantum an classical. Alice sens photons to Bob through quantum channel. Then they use classical channel to agree on the same key base on transmitte photons. BB84 Protocol consists of three steps: raw key extraction, key error correction, an privacy amplification. Raw key extraction is as follows:. Alice sens Bob a sequence of photons ranomly polarize. Corresponing Author 04

2 JCS&T Vol. 7 No. 3 October 007. For each photon, Bob ranomly chooses rectilinear or iagonal bases to measure it. 3. Bob announces to Alice his bases but not results). 4. Alice transmits back which measurements are one in compatible bases. 5. Alice an Bob throw away photons measure in incompatible bases, ecoing remaining photons to 0 an that make the raw key. Their raw keys must be the same if no eavesropping has occurre. So, they compare some bits of their raw keys for eavesropping. For security analysis [6], let us assume Eve eavesrops an measures a photon. With probability, Eve s measurement is one in incompatible basis an moifies the photon polarization. Then Bob measures the moifie photon, an photon polarization moifies an with probability become ifferent from Alice s polarization. Thus, Alice an Bob s photon polarization is ifferent with probability * = 4. This means that the probability of successful eavesropping is 3 4. If Eve measures n photons, she oes not moify their polarization with the probability n 3 4) that goes to zero as n grows, therefore her eavesropping is etecte with near certain probability. Error may appear in raw key ue to noisy environment. If raw keys of Alice an Bob iffer ue to environment noise, they must remove all ifferences, proucing an error free common key. This process is calle error correction an various schemes coul be applie [,3], for example D parity check scheme. In the scheme, Alice an Bob organize their raw keys into D square matrix an exchange parities of the rows an columns. Any row or column that has ifferent parities is iscare. To ensure privacy, also iagonals of matrix are iscare. After error correction, Eve may have partial information of the key. Thus Alice an Bob nee to lower own Eve s information to an arbitrary low value using some privacy amplification protocols [,3]. The ata rate an transmission length are two values of interest for quantum key istribution [4,7]. Accoring to quantum bit error rate QBER) an raw key rate, a general formula coul be euce for them [4,7]. The raw key rate is the prouct of the pulse rate v, the average number of photons per pulse µ, the transfer efficiency η t, an the etector efficiency η : R raw = v µηt η Eq. ) The factor is ue to the bases incompatibility. The transfer efficiency can be expresse as: L f l + L B 0 η = 0 Eq. ) t L f is the losses in the fiber in where is the length of fiber, an losses at Bob in B. B km, l L B is internal Two factors may cause errors in raw key, imperfect etector an ark count. Imperfect etector introuce R opt = Rraw popt errors in raw key where p opt is the probability of wrong etection of polarization. R et = 4 v p ark errors arise from ark count photon etection when there are no photons) where p ark is the probability to get a ark count. The QBER is efine as the ratio of wrong bits to total receive bits: Rwrong R Ropt + R error QBER = = Rwrong + Rright Rraw Rraw park popt + = QBERopt + QBERet µ η η t Eq. 3) Tancevski [7] has estimate the fraction of bits lost ue to error correction as: r ec 7 QBER = QBER log ) Eq. 4) et = 05

3 JCS&T Vol. 7 No. 3 October 007 an the fraction of bits lost ue to privacy amplification as: r pa + 4QBER 4QBER ) = + log Eq. 5) So the final bit rate is: R = r ) r ) R Eq. 6) final ec pa As transmission length l increases, transfer efficiency ηt falls rapily own, which in turn causes more errors in raw key an a ecrease in the final bit rate to zero. So the maximum transmission length coul be compute. The first experimental emonstration of quantum key istribution was performe in 989 over 30 cm in air [5]. Since then, the fiel has progresse remarkably. At Los Alamos National Laboratories, secret key have been transmitte in optical fiber over 67 km [8], an up to 0 km in free space [9]. One of the main rawbacks of quantum cryptography though is that it provies no mechanism for authentication. Some rawbacks such as limite istance an limite ata rate are technological an must be solve before quantum cryptography can be use wiely in the market [0]. 3. IMPROVED BB84 Since Alice an Bob choose the two bases with the same probability, the probability of Alice an Bob s basis compatibility is ) ) ) ) + =, so half of the photons are thrown away. Arehali et al. [] has propose an improvement that ecreases iscare photons, thereby increasing the bit rate of the protocol. The basic iea is that Alice an Bob choose the two bases with ifferent probabilities, rectilinear basis with probability α an iagonal basis with probability α, so they choose the same basis with probability: P = α + α) Eq. 7) α which goes to as α goes to zero. This means that Alice an Bob bases of almost raw all photons are the same, so the bit rate of protocol coul be ouble. With the moification, the probability of choosing iagonal basis for a photon is: α) Eq. 8) α + α) which goes to as α goes to zero, so bases of almost all photons are iagonal an protocol coul be efeate because Eve can use the iagonal basis an measures polarization of many photons without moifying them an causes a few error. To prevent the attack, error estimation is refine. In contrast to the BB84 protocol, which estimates a single error rate, two error rates e, e are estimate in the refine protocol: e when Eve uses iagonal basis while Alice an Bob use rectilinear basis, an e when Eve uses rectilinear basis while Alice an Bob use iagonal basis. The final error rate is the maximum of e, e. Now if Eve measures photons along the iagonal basis, although e is zero, e increase about 50%), so the final error is high an eavesropping is etecte. Let us assume Eve measures each photon along the rectilinear basis with probability p, along the iagonal basis with probability p, an oes not measure with probability p p. If Alice an Bob use the rectilinear basis an Eve uses the iagonal basis, Alice an Bob s polarization is ifferent with probability, so e = p because Eve chooses iagonal basis with the probability p. Similarly, e = p. Note that e, e are inepenent of the value of α an only epen on Eve s eavesropping strategy, so the improve protocol is as secure as BB84 protocol. Although smaller α leas to higher bit rate, it leas to fewer rectilinear polarize photons an if number of rectilinear polarize photons is too few, e coul not be accurate. Thus accoring to the number of total photons, the appropriate value of α must be aapte. 06

4 JCS&T Vol. 7 No. 3 October SIMULATION OF IMPROVED BB84 In this section, we present simulation results of BB84 an its improve protocols that inclue comparing efficiency an security. Efficiency means key bit rate an security means raw key error rate vs. eavesropping rate. We simulate quantum channel an photon transfer, implement error estimation, error correction, an privacy amplification. Also we simulate Eve s eavesropping when we evaluate security of protocols. We simulate 300 nm fiber optic that its loss is L B B = km. In the 300 nm wavelength, the efficiency of photon etector is η = 0. 0 an the probability of ark count is p = 0 5 ark. Loss at photon etector L B an error ue to imperfect etector QBER are ignore because their opt values are small. The average number of 7 photons per pulse is µ = 0. an 0 pulses were use in the simulation. 0% of raw key were compare in the error estimation. We have use a 0*0 matrix for error correction an repeate error correction process until no error foun. We repeate the simulation 00 times an euce the results accoring them, so we think that results are reliable. Three ifferent values were chosen for efficiency comparison: 0.50, 0.5, 0.0). As mentione before, the probability of Alice an Bob s basis compatibility is P = α + α) so: α α = 0.50 P α = 0.5 P α = 0.0 P0.0 P0.5 P0.50 =.49 P0.0 P =.936 = 0.50 = 0.5 = = 0.50 = = Simulation results shown in Figure valiate the same conclusion: the ratio of bit rate with α = 0. 5 to the bit rate with α = 0.50 original BB84) is almost.5, an also the bit rate with α = 0. 5 to the bit rate with α = original BB84) is almost.9. For security comparison, the raw key error rate vs. eavesropping rate was compute, as shown in Figure. The curves for ifferent values of α are similar. This means that any etectable eavesropping in BB84 protocol is etectable in the improve protocol. We assume Eve coul etermine pulses that have more than a photon, measure a photon of the pulse an sen remaining photons of the pulse to Bob, so her eavesropping is not etectable. However 5% of non-empty pulses have more than a photon an Eve couln t evise successful attack. Also we assume Eve choose two bases with the same probability. Bit Rate Figure : Efficiency vs. transmission length of BB84 an its improve protocols Estimate Error Distance Eavesropping Percent Figure : Error rate vs. eavesropping rate of BB84 an its improve protocols Eve coul choose the bases with ifferent probabilities; the simulation results of this 07

5 JCS&T Vol. 7 No. 3 October 007 behavior are shown in Figure 3. We chose three values for eavesropping 0%, 50%, an 00%) an for each value, the raw key error rate vs. eavesropping rate were compute. Choosing two bases with the same probability, results in a etectable minimum error rate. Estimate Error Figure 3: Error rate vs. iagonal bases percent of BB84 an its improve protocols 5. CONCLUSION Quantum cryptography offers a new solution to the key istribution problem. Its security is base on principles of quantum mechanics. BB84 is a protocol for key istribution using these principles, but with the eficiency of losing half of the photons when ifferent bases are use. We have reviewe an available refinement to BB84 protocol that coul logically increase its efficiency. The refinement involves using rectilinear an iagonal bases with ifferent probabilities. We have simulate the BB84 an its refine version an have shown facts an figures that in comparison with the BB84, the efficiency of the refine protocol coul be almost ouble without affecting the security of BB REFERENCES [] P. Shor, Polynomial-Time Algorithms for Prime Factorization an Discrete Logarithms on a Quantum Computer, SIAM Journal of Computing, 6, 997. P [] S. J. Lomonaco, A Talk on Quantum Cryptography or How Alice Outwits Eve, Archive, 00 [3] V. Volovich, an Y. I. Volovich, On Classical an Quantum Cryptography, Archive, 00 [4] N. Gisin, G. Ribory, W. Tittel, an H. Zbinen, Quantum Cryptography, Group of Applie Physics, University of Geneva, 00. [5] H. Bennet, F. Bessette, G. Brassar, L. Salvail, an J. Smolin, Experimental Quantum Cryptography, Journal of Cryptography, Vol. 5, 99, pp [6] D. Mayers, Unconitional Security in Quantum Cryptography, Preprint at Los Alamos Physics Preprint Archive, [7] H. Zbinen, H. Bechmann-Pasquinucci, N. Gisin, an G. Ribory, Quantum Cryptography, Applie Physics B 67, 998, pp [8] D. Stucki, N. Gisin, O. Guinnar, G. Riory, an H. Zbinen, Quantum Key Distribution over 67 km with a Plug & Play System, New Journal of Physics 4, 00. [9] R. J. Hughes, J. E. Norholt, D. Derkacs, an C. G. Peterson, Practical Free-Space Quantum Key Distribution over 0 km in Daylight an at Night, Preprint at Los Alamos Physics Preprint Archive, 00 [0] H. K. Lo, Will Quantum Cryptography Ever Become a Successful Technology in the Marketplace?, MagiQ Technologies Inc., 00. [] M. Arehali, H. F. Chau, an H. K. Lo, Efficient Quantum Key Distribution, Archive,