∑Quantum Key Distribution

CPSC 519/619: Quantum Computation John Watrous, University of Calgary Lecture 18: Quantum Key Distribution March 28, 2006 In this lecture we will begin discussing quantum cryptography. There are indeed many as- pects to cryptography, and many different cryptographic tasks that one may consider. Likely the first cryptographic task that comes to mind is private communication: Alice and Bob wish to communicate, and they do not want an eavesdropper (Eve) to learn any information about their communication. There are many other cryptographic tasks or protocols one may consider, such as message authentication, digital signatures, and voting schemes. Often these tasks are broken down into more primitive operations, such as bit-commitment and oblivious transfer. In this lecture we will just consider private communication, and will discuss bit commitment in the next lecture. A perfectly secure cryptosystem Let us first consider a purely classical situation. Suppose that Alice and Bob can communicate through a classical channel, and a third party Eve is able to monitor the communications on that channel. Alice wishes to transmit a particular message to Bob, and wants Eve to learn as little as possible about it. Eve wants to learn as much as possible about the message. In cryptography we always need to be precise about our assumptions and model. In this exam- ple, we will assume that the channel Alice and Bob are communicate through is an authenticated channel: when Bob receives a message, he can verify that it came from Alice (and vice versa). We will also assume that Eve cannot jam the channel or modify messages sent over it, meaning that Alice and Bob always receive one another’s messages without error. channel Alice 6 Bob ? Eve There exists a provably secure classical scheme, known as the one-time pad, for accomplishing the task at hand. It requires that Alice and Bob share a sequence of random bits, called a private key, that is secret from Eve. This private key could have been created a long time ago, and is completely independent of the message Alice wishes to send. The key must be of the same length as the message. The scheme works as follows. 109

One-time Pad Alice and Bob share a private key K ∈{0, 1}n. Alice wishes to send Bob a message M She computes E = K (bitwise exclusive ∈{0, 1}n. ⊕MOR) and sends E (the encrypted message) to Bob. M.Bob receives E, and computes E ⊕K. The result is E ⊕K = M ⊕K ⊕K = Eve can learn nothing (aside from the length of the message) by looking at E. If K is uniformly distributed, then so too is E. One very important note is that the key K can only be used once (hence the name “one-time pad”). If they were to use it twice with two different messages, the encrypted texts would be E1 = M1 ⊕K E2 = M2 ⊕K. Eve could then compute E1 ⊕E2 = M1 ⊕M2, which could contain a lot of information about M1 and M2. This could also allow Eve to learn something about K that could be exploited if Alice and Bob were to use the key a third time. The one-time pad is unbreakable (if used properly), but it is very inefficient or impossible in many situations. For instance, a single entity such as a bank or online business may wish to communicate securely with many different individuals, and may not have met with them previously to exchange a key. It is impossible for two parties to classically generate a secure private key over a public channel. Quantum key distribution The aim of quantum key distribution is to allow Alice and Bob to generate a secure private key that can be used for the one-time pad without having to meet privately. They will be able to accomplish this task by using quantum information. There are a few different schemes for doing this, such as: 1. BB84. Easy to implement, relatively hard to prove security. 2. B92. Similar to BB84. 3. Lo-Chau. Hard to implement, easy to prove security. We will only look at BB84, so named because its inventors Charles Bennett and Gilles Brassard proposed it in 1984. Proofs of security actually took a long time; Mayers gave a (complicated) proof in 1998, and Shor and Preskill gave a fairly simple proof based on the theory of quantum error correcting codes in 2000. Once again, we need to be precise about our assumptions. We will assume that as before, Alice and Bob can communicate over a classical channel that is authenticated and cannot be tampered 110

with, but that is readable by Eve.4 We will call this the public channel. They can also send qubits over a quantum channel. Eve has full access to this channel, meaning that she can intercept mes- sages sent by Alice or Bob, perform measurements or quantum computations on these messages, and transmit the modified qubits to whichever party was to receive them in the first place. The BB84 Key Exchange Protocol (first stage) Alice randomly generates two strings of bits x, y ∈{0, 1}m. Define and These four states may be pictured |ψ00⟩= |0⟩, |ψ10⟩= |1⟩, |ψ01⟩= |+⟩, |ψ11⟩= |−⟩.as follows: |ψ10⟩ |ψ01⟩ |ψ00⟩ |ψ11⟩ Alice prepares m qubits in the state |ψx,y⟩= |ψx1y1⟩|ψx2y2⟩· · · |ψxmym⟩ and sends these m qubits over a quantum channel to Bob. Bob receives m qubits, although they may not longer be in the state |ψx,y⟩because Eve may havetampered with them, or possibly the channel is noisy. (To understand how the protocol works, it is helpful to imagine first that Eve is not present and the channel is not noisy, so Bob receives precisely the state |ψx,y⟩.) Bob randomly chooses y′ and measures each qubit received from Alice as follows: ∈{0, 1}m, If y′i = 0, Bob measures qubit i (with respect to the standard basis). • If y′i = 1, Bob performs a Hadamard transform on qubit i and then measures it with respect • to the standard basis. (Equivalently, Bob measures qubit i with respect to the diagonal basis interpreting the result as 0 or 1, respectively.) {|+⟩, |−⟩}, Let x′ be the string corresponding to the results of Bob’s measurements. The important ∈{0, 1}mthing to note at this point is that if yi = y′i for some i and there was no noise or eavesdropping, then it is certain that xi = x′i. 4It is not a trivial assumption that the classical channel is authenticated, and this assumption represents an inevitable weakness of quantum key distribution. In the lecture I have briefly discussed how authenticated channels can be implemented using very short private keys (that only need to remain private for the duration of the protocol). 111

Finally, Alice and Bob publicly compare y and y′. They discard all bits xi and x′i for which yi y′i. ̸=The remaining bits of x and x′ represent a “semi-private” (and possibly noisy) key that will go into the next stage of the protocol. End of protocol (stage 1). Example 22. Suppose m = 8. Alice randomly chooses x = 01110100 y = 11010001. She sends |ψx,y⟩to Bob. Suppose there is no tampering of the message, so Bob receives precisely |ψx,y⟩. He randomlychooses y′ = 01110110 and measures. The first qubit is in state and because y′1 = 0 Bob measures in |ψ01⟩= |+⟩,the standard basis. He will get a uniform random bit; say x′1 = 1. The second qubit is in state and because y′2 = 1 Bob measures in the diagonal basis. He gets x′2 = 1 with|ψ11⟩= |−⟩,certainty this time. Continuing in this way, we might obtain the following table: x y x′ y′ 0 1 1 0 1 1 1 1 1 0 0 1 1 1 1 1 0 0 0 0 1 0 1 1 0 0 1 1 0 1 1 0 Alice and Bob publicly compare y and y′. They agree at positions 2, 4, and 5, so they keep the bits of x and x′ at these positions and discard the rest: x y x′ y′ 0 1 1 0 1 1 1 1 1 0 0 1 1 1 1 1 0 0 0 0 1 0 1 1 0 0 1 1 0 1 1 0 The three remaining bits of x and x′ agree. 112

Of course the difficulty arises when Eve tries to extract information about x. The general principle working for Alice and Bob is the uncertainty principle—Eve cannot learn something about |ψx,y⟩without disturbing it. In particular, Eve does not know y, so she cannot hope to learn the bits of x without making some mistakes and causing some disturbance to |ψ⟩. For example, suppose that yi = y′i for some index i, but Eve decided to measure qubit number i. Perhaps she measures the qubit in the Breidbart basis |φ0⟩= cos(π/8) |0⟩+ sin(π/8) |1⟩, |φ1⟩= −sin(π/8) |0⟩+ cos(π/8) |1⟩, which is pictured as follows: |ψ10⟩ |φ1⟩ |ψ01⟩ |φ0⟩ |ψ00⟩ |ψ11⟩ This is a good basis for Eve to choose—she will learn xi with probability cos2(π/8) ≈0.85. How- ever, this measurement will cause the i-th qubit to be in state |φ0⟩or |φ1⟩after Eve’s measurement.When Bob then measures, he will then get x′i xi with probability sin2(π/8) even though ̸= ≈.15,he should get xi = x′i with certainty. Informal and unsubstantiated claim: the more Alice learns about x, the more positions in which x and x′ will disagree. The difficulty in proving security in general is that Eve may use any strategy allowed by quantum mechanics—it is not sufficient to consider just a single attack such as measuring each qubit in the Breidbart basis. Second stage of protocol. Alice and Bob now need to estimate how much Eve might know about x and x′. They do this by sacrificing some of the remaining bits of x and x′, say one-half of them (selected randomly). By comparing these bits publicly, they can estimate the error rate with high accuracy, and if it is too large they abort (Eve potentially has too much information for them to succeed). The maximum error rate that can be tolerated is about 11%. If they have an acceptable error rate, Alice and Bob will have two strings x and x′ (which now include only the bits that they did not sacrifice to estimate the error) that agree in a high percentage of positions with high probability. They have some bound on the amount of information Eve possesses about these strings. 113

Classical cryptography can now take over. They perform: 1. Information reconciliation. 2. Privacy amplification. Information reconciliation is essentially distributed error correction that corrects x and x′ so that they agree in all positions with very high probability. This may leak some information about these strings, but not too much. Privacy amplification transforms a shared string about which Eve has some bounded amount of information and compresses it to a shared string about which Eve has almost no information. Basically, Alice and Bob apply some suitable hash function to their shared strings. End of protocol (stage 2). There has been a lot of work done on information reconciliation and privacy amplification, but we will not have time to discuss these things in detail. In the lecture I have discussed some simplified versions of these problems to give you the feel for how they might work, but I will not include these examples in the notes. 114