On the unconditional Security of QKD Schemes quant-ph/

Transcription

1 On the unondtonal Seurty of QKD Shemes quant-ph/9953

2 alk Outlne ntroduton to Quantum nformaton he BB84 Quantum Cryptosystem ve s attak Boundng ve s nformaton Seurty and Relalty

3 Works on Seurty C.A. Fuhs N. Gsn R.B. Grffths C. S. Nu A. Peres 997: optmal eavesdroppng.. Bham. Mor 997: lmted attaks. D. Mayers 998: results on POVMs. H.K. Lo and H.F. Chau 999 seurty usng quantum fault tolerane.. Bham M. Boyer P. O. Boykn. Mor V. Royhowdhury 999: nformaton vs. Dsturane. M. Ben-Or 999: ased on ompresson. P. Shor and J. Preskll : ased on quantum odes.

4 What Are quts quts? Quts are normalzed vetors from a omplex spae: Quantum operatons are Untary Operators on ths spae. Measurement of Quts s a set of postve operators that sum to whh gve output k wth a gven proalty: ( ) β α ψ β α β α ψ ψ ψ U ( ) ψ ψ k k p tr

5 Let s Measure Some xample quts! See that and s are postve so they defne a measurement ( ) j δ j tr he aove measurement tells exatly whh state was sent > or > onsder the two followng states: tr( ) ( ) tr hs measurement gves and wth equal proalty!

6 A Measurement for the - Bass See that - and s are postve so they defne a measurement he aove measurement tells exatly whh state was sent > or -> ut nothng aout > or >: tr tr tr ( ) tr( ) ( ) tr( ) ( ) tr( ) hs measurement gves and - wth equal proalty!

7 he BB84 (4-state) Sheme Ale wshes to generate a shared seret key wth Bo usng a quantum hannel and an authentated lassal hannel. Ale selets eah t randomly and then the ass: z z x x Ale Classal hannel Bo Quantum hannel

8 BB84 (Cont.) Ale After Bo reeves all the quts Ale announes on the lassal hannel whh ases were used. Now Bo measures n Ale s ass (z and { } or x and { - } ). he sent qut and measured qut should agree. hese values wll e used to form the key. Classal hannel xxzxzzzxxzzx Bo Quantum hannel

9 avesdroppng n addton to Ale and Bo there s ve: ve s not very ne and she wants the key. n an attempt to learn aout the key she may lsten to the lassal hannel and do quantum operatons on the hannel and some quts at her la. Quantum operatons are untary.... ve Ale Ueve j j ve j Bo

10 No Clonng of Quts Untarty of quantum operatons means that quts an t e oped exatly (no-lonng): Proof: U U he left sde of aove s normalzed and untary operatons preserve length so the rght sde s normalzed. nner produt s preserved so nner produt of the left sdes and rght sdes are equal: So: > Any attempt to learn quts dsturs them so ve auses rrors!

11 An xample Attak: (Measure and Resend) A smple attak ve ould perform s to measure eah qut n a random ass and send the result on to Bo. Half the tme ve guesses the ass orretly and learns the t. When she does not guess orretly the error rate s 5%. n total ths attak gves ve half the ts ut auses a 5% error rate. Ale Bo ve

12 CNO Attak z z z z z z z z z z z z z Hene n the x ass Bo s outome eomes random!! n general any nterferene y V leads to errors. n the z ass t works n the x ass:

13

14

15

16

17

18

19

20 BB84 (Cont.) o detet the effets of ve Ale selets a random suset of the quts to e announed as test ts. Ale and Bo ompare these ts to learn the error rate. f the error rate s small enough the test s passed and Ale announes the error orreton nformaton so Bo an orret hs errors. Now Ale and Bo have the same strngs ut ve may have some nformaton. Ale announes prvay amplfaton nformaton to redue ve s nformaton to zero.

21 BB 84 vs. PR Sheme BB 84 teleportaton s equvalent to the followng protool: Share PR pars Ale and Bo measure ther quts randomly n x and z ass. f ther ass hoe agrees on a par then they know eah other s ts otherwse ther measurement results are unorrelated. Ale announes her ass hoe over the pul hannel. Now Bo knows the t loatons where they agree. he rest of the protool s the same as n BB 84

22 rror Correton Ale sends a strng. Bo reeves a strng j. We assume they use a lnear ode wth a party hek matrx H whh s known to ve. Ale announes on the lassal hannel: H nfo ξ Ale Bo omputes: H j nfo Bo Hene Bo learns the syndrome of the errors: H hs syndrome gves nfo to ve! t must e onsdered n the proof! ξ ( ) nfo j nfo ξ Ale ξ Bo

23 Prvay Amplfaton Sne ve s gets some nformaton from her attak and from the CC syndrome measures must e taken to redue ve s nformaton. After Bo s errors are orreted he knows Ale s strng exatly. he key s defned y partes on ths strng: k l v l nfo f ve does not know even one t n the t mask for that key t she knows nothng aout that key t. Clearly there wll e onstrants on the v s for seurty (e.g. no two an e the same).

24 Assumptons n Our Proof rror orreton s a party hek ode. All errors are to the maxmum eneft of ve. Bo wats to learn the ass efore measurng. hs may e assumed wthout loss of generalty t does not atually requre Bo to have a Quantum Memory. We onsder only symmetr attaks for ve whh make some of the varales (j and ) ndependent. hs may e done wthout loss of generalty.

25 ve s State Wth Ale s knowledge one may wrte ve s transformaton: After the test ts are measured the state of ve and Bo eomes: Wth: ve test ψ nfo j U ve j Pr j j t j ' j j t ( j s) j ' j j t j test j nfo

26 ve s State (Cont.) he dstruton of ve s states for all ases of Bo s states s: ρ ve ( ψ ) ψ j j tr Bo j Beng generous people we an assume that ve keeps a state: ϕ j hs s only more nformatve to ve sne: tr j j ( ϕ ) ϕ j j ρ ve j

27 A New Bass for ve s States We defne a new ass for ve s states: hs d turns out to have a meanng: ( ) l l l n d η η ϕ η ( ) l l d η ϕ ˆ ( ) ( ) s j j d l k j k j k l j l k n Pr

28 Boundng ve s nformaton (epsode : he Quantum Menae) f two quantum states (ρ ρ ) are sent wth equal proalty the mutual nformaton of any measurement s ounded y: tr ρ ρ Usng the aove ve s mutual nformaton on one key t gven all lassal nformaton and all other ts s ounded (α s general v s the mnmum dstane of the PA and CC) α d ve α > vˆ/

29 Pr s Seurty Crteron Sne mutual nformaton s not small for all attaks (onsder the measure/resend) we use the followng seurty rteron: ( ) ( ) βn est pass s A; s Ae f the aove s met then the somewhat more ntutve rteron s also met: Pr ( βn / ) βn / est pass > Ae e ve

30 Boundng ve s nformaton (epsode : Proalty Strkes Bak) Usng the meanng of d we otan: ( ) ( ) ( ) < > a np v s s A s pass est / ˆ Pr ; Pr α α ( ) > ˆ / Pr v ve s α α Averagng the aove gves the followng:

31 Boundng ve s nformaton (epsode : Return of Classal Proaltes) By averagng over all ass hoes we get: ( ) ( ) ( ) ( ) < > < > a a np v np v s s s A s pass est / ˆ / ˆ Pr ) Pr( Pr ) Pr( ; Pr α α α α

32 Boundng ve s nformaton (Cont) ( ) ( ) ( ) ) ) ( Pr( ) ) ( Pr( Pr ) Pr( ; Pr ) ( a a a a np p n s np p n np p n s s s A s pass est a a < > < > < > ε ε α α α α ε Now we set the parameter v and average over orders (s): ( ) ε a p v n ˆ he last lne an e ounded wth Hoeffdng s ound.

33 Hoeffdng s Bound Hoeffdng s ound may e appled to ound the proalty of a mean of a set eng dfferent from the sampled mean. hs s what s needed to ound the mutual nformaton: ( ) ( ) ) ) ( Pr( ; Pr ε ε n a a e np p n s A s pass est < > Seurty has een shown ut ths assumes that a ode wth the desred dstane propertes s avalale.

34 Relalty of the Key For hgh error proteton we want the allowed error rate (p a ) to e as large as possle. For an (nkd) RLC d/n>δ exept wth: Pr ( d / n < δ ) ( δ ) n H ( δ ) ( r / n) f δ(p a ε)/n then almost all errors wll e orreted (exept an exponentally small fraton). n

35 Seurty of the Key Reall the mnmum dstane of the PACC s vn(p a ε). v s ounded elow y the dstane of the dual of the CCPA whh s a ode: Pr ( ) n r d where d n r m ( ) ( ) n H d / n ( δ < δ ) Wth the followng hoe: δ n ( ( r m n)/ n) ( ) δ ε Forng all these proaltes to e exponentally small gves serey rates p a

36 Serey Rates for RLC o get exponentally small ounds n n all the exponents need to e negatve whh gves: H ( p ε / n) H a < r / n ( p ) ( ) a ε H pa ε / n < Rseret As n tends to nfnty and ε tends to zero we have seurty when: ( p ) H ( p ) R < H seret a a

37 Plot of Serey Rate ( p ) H ( p ) Rseret < H a a Seret Key Rate Allowed rror Rate

38 Seret Key Rate Allowed rror Rate

39 Summary heoretal BB84 s seure for users wth a quantum hannel and lassal resoures. A lower ound on seret key rates s otaned whh s vald for all attaks. A threshold of 7.56% s otaned usng RLC.