Arxiv:Quant-Ph/0611235V1 23 Nov 2006 Xes Fipsn Eetbeerr Ewe Lc and the Alice 6]

Home , BB84

arXiv:quant-ph/0611235v1 23 Nov 2006 xes fipsn eetbeerr ewe lc and the Alice 6]. at between [5, bit errors key Bob target detectable shared the imposing the sending of of on measurement expense is information her Alice obtain makes to that then qubit qubit Eve BB84 Bob. the to with it entangles ru niiulpoo takcnb copihdwith accomplished controlled- Slut- be a can [3], attack Peres individual-photon and erful Fuchs by oper- Papers sky BB84 ideal photons. conditions. under information single gain much ating can of how (Eve) lieu is eavesdropper in question the pulses fundamental laser more weak A such of configu- use conditions, for the operating particularly as nonideal involve [2], subject that the analyses rations been security has vouchsafed BB84 many is then, security of Since that laws. way the physical a by to such which pulses in in single-photon (Bob) (QKD) receiver transmits (Alice) distribution sender key the quantum for (BB84) v upistetre ui othe to qubit target the supplies Eve ∗ have We elements. optical linear efficiently only be using can and implemented deterministic are quantum gates two-photon SPTQ standard gates, of to states Compared orientation) sin- spatial photon. polariza- (or the a the momentum the logic qubits: and independent SPTQ tion two In carries in photon logic gle experiment. quantum proof-of-principle (SPTQ) us- a two-qubit implemented be single-photon can ing probe entangling (FPB) Brandt Fuchs-Peres- the of QKD. diagram BB84 Block attacking for online) probe (Color Brandt 1: FIG. lcrncades [email protected] address: Electronic n18 ent n rsad[]pooe protocol a proposed [1] Brassard and Bennett 1984 In ehv eetyson[]ta hsFuchs-Peres- this that [6] shown recently have We opeepyia iuaino h nagigpoeatta entangling-probe the of simulation physical Complete tal et Alice eerhLbrtr fEetois ascuet Instit Massachusetts Electronics, of Laboratory Research 4,adBad 5 hwta h otpow- most the that show [5] Brandt and [4], . ahu Kim Taehyun ASnmes 36.d 36.a 42.65.Lm 03.67.-a, 03.67.Dd, numbers: PACS fu processing information determini quantum efficient k of an simulations sifted access of physical has Bob’s utility Eve and the because illustrates Rén Alice attack, experiment true to the a imparts for of she simulation predictions physical errors theoretical the includin of with results, function agreement measurement good Our Bennet in the against protocol. attack distribution individual-photon powerful most not ehv sddtriitcsnl-htntoqbt(PQ q (SPTQ) qubit two single-photon deterministic used have We Eve ( cnot ae silsrtdi i.1, Fig. in illustrated As gate. ) ∗ noSokgnntWrbr,Fac .C og n eryH Jeffrey and Wong, C. N. Franco Wersborg, genannt Stork Ingo , cnot ae which gate, Dtd etme ,2018) 5, September (Dated: Bob t fTcnlg,Cmrde ascuet 23,USA 02139, Massachusetts Cambridge, Technology, of ute rmteBB84 the from ak v esu her basis, up computational sets Eve tack, rvosydemonstrated previously oto ui ai o Eve’s (a for bases. basis different between qubit Relations Control online) (Color 2: FIG. B4plrzto tts (b) states. polarization BB84 osuyteeetvns fpiayapicto when amplification opportunity privacy attacked. the of is BB84 effectiveness affords of the it presence study and the to in errors, eavesdropping physical against realistic security BB84 fundamental of the sim- limit of physical investigation the measurements allows Nevertheless, ulation nondemolition [6]. Eve quantum to available if but were receiver, attack Bob’s true to a measured access be needs must Eve not carrier that photon the so single because theoretical jointly, simulation a physical with of a agreement qubits only two good is in BB84, It are attacking predictions. on results experiment the first to and is the This knowledge errors. pow- physical our including most BB84, the on of attack simulation erful physical complete a as probe quan- tasks. few-qubit processing investigate affords information to way logic tum powerful SPTQ yet simple platform. a logic quantum SPTQ this agtqbtbasis. qubit target hsnfo h orplrzto ttso h horizontal- the ( of states vertical polarization four the from chosen nti okw s PQlgct mlmn h FPB the implement to logic SPTQ use we work this In nB8,AiesnsBbasnl htnrandomly photon single a Bob sends Alice BB84, In A i esrmn.TeST rb ol become could probe SPTQ The measurement. his tcqatmlgcfrpromn realistic performing for logic quantum stic nctions. hsclsuc n aeerr,are errors, gate and source physical g oBbspyia eevrmdl.This module. receiver physical Bob’s to 1 -rsad18 B8)qatmkey quantum (BB84) 1984 t-Brassard | | iifrainotie yEea a as Eve by obtained information yi H 1 0 ybt.Tecreteprmn sa is experiment current The bits. ey C i i – C C V V a (b) (a) = cos( = atmlgct mlmn the implement to logic uantum and ) H − - V sin( ± ko h B4protocol BB84 the on ck ai,a hw nFg 2(a), Fig. in shown as basis, π/ {| D 45 π/ cnot 0 8) 0 i ◦ 8) cnot C H | ( C H , | D H | 1 i cnot – | aewt t control-qubit its with gate i i T sin( + A C cos( + 0 7 and [7] } i ae.I h P at- FPB the In bases. ) ie by given , and Shapiro . aerfrne othe to referenced gate π/ 1 π/ | 8) T swap T 8) 1 | i V | V eaiet the to relative i π/ i , T 8 ae in gates [8] . 1 rotation 8 T 0 0 T (1) ) 2

Eve’s Having selected the error probability, PE, that she is will- Photon 1 Pol. RE initialization ing to create, Eve prepares her probe qubit (cnot’s tar- < SWAP get) in the initial state Pol. RA R-ʌ/8 Rʌ/8 RB Bob Photon 2 Tin = (C + S) 0 T + (C S) 1 T /√2 | i { | i − | i } Mtm 0 Eve cos θin 0 T + sin θin 1 T (2) ≡ | i | i FIG. 3: Quantum circuit diagram for the FPB-probe attack. where C = √1 2PE,S = √2PE, and 0 T, 1 T is the target qubit’s− computational basis. After{| i the| icnot} Photon 1 of a polarization-entangled singlet photon pair her- alds photon 2 and sets Eve’s probe qubit to its initial state. operation—with inputs from Alice’s photon and Eve’s The swap gate allows Alice’s qubit to be set in the polar- probe—the two qubits become entangled. For each of ization mode of photon 2, whose momentum mode is Eve’s Alice’s four possible inputs, H , V , D , and A , the cnot | i | i | i | i probe qubit. The gate entangles Alice’s qubit with output of the cnot gate is Eve’s qubit. RE, rotation by Eve; RA, rotation by Alice; RB, rotation by Bob; R±π/8, rotation by angle ±π/8. H Tin Hout H T0 + V T , (3) | i| i → | i ≡ | i| i | i| Ei V Tin Vout V T1 + H T , (4) D1 Eve D5 | i| i → | i ≡ | i| i | i| Ei D Tin Dout D T0 A T , (5) Alice’s P4 E P1 BB84 | i| i → | i ≡ | i| i − | i| i Bob’s D4 A Tin Aout A T1 D T , (6) H1 setting D3 | i| i → | i ≡ | i| i − | i| Ei analysis Q1 H2 Q2 H4 H5 where T0 , T1 , and TE are defined in the target qubit’s D2 computational| i i basis| (seei Fig. 2(b)) as: SPDC SWAP P−CNOT H3 P2 P3 C S C S T0 + 0 T + 1 T , (7) | i ≡ √2 2 | i √2 − 2 | i FIG. 4: (Color online) Experimental configuration for a com- C S C S plete physical simulation of the FPB attack on BB84. SPDC, T1 0 T + + 1 T , (8) spontaneous parametric down-conversion source; H, half-wave | i ≡ √ − 2 | i √ 2 | i 2 2 plate; Q, quarter-wave plate; P, polarizing beam splitter; D, S single-photon detector. T ( 0 T 1 T) . (9) | Ei ≡ 2 | i − | i Consider the case in which Bob measures in the same 0, 1 and E = 0, 1 denote the ensembles of possible basis that Alice employed and his outcome matches what {bit values} that Bob{ and} Eve receive on an error-free sift Alice sent. Then, according to Eqs. (3)–(6), the target event. The Rényi information (in bits) that Eve learns qubit is projected into either T0 or T1 . After Alice about each error-free sift event is | i | i and Bob compare their basis selections over the classical 1 1 1 channel, Eve can learn about their shared bit value by 2 2 IR log2 P (b) + P (e) log2 P (b e) , distinguishing between the T0 and T1 output states of ≡− =0 ! =0 =0 | ! | i | i b e b her target qubit. To do so, she employs the minimum X X X (10) error probability receiver for distinguishing between T0 where P (b), P (e) are the a priori probabilities for Bob’s | i and T1 by performing a projective measurement along and Eve’s{ bit values,} and P (b e) is the conditional prob- | i 0 T and 1 T. Eve can then correlate the measurement ability for Bob’s bit value to| be b given that Eve’s is | i | i of 0 T ( 1 T) with T0 ( T1 ). Note that this projec- e. According to Bayes’ rule, P (b e) can be calculated in | i | i | i | i tive measurement is not perfect unless T0 and T1 are terms of P (b,e) which is the probability| of both Bob’s | i | i orthogonal and hence coincide with the target’s compu- bit to be b and Eve’s bit to be e: tational basis, 0 T and 1 T. | i | i 1 Of course, Eve’s information gain comes at a cost: Eve P (b e)= P (b,e)/ P (b,e), (11) has caused an error event whenever Alice and Bob choose | b=0 a common basis and Eve’s probe output state is TE . X 2 When Alice sent H and Bob measured in the H–V| ba-i where P (b = 0,e) = ( H T e ) Hout and P (b = | i | h |2 ⊗ h | | i| sis, Eq. (3) then shows that Alice and Bob will have an 1,e) = ( V T e ) Vout in the case of H–V basis | h | ⊗ h | | i| error event if the measured output state is V TE . The ( H corresponds to b = 0). A similar calculation for the 2 | i probability that this will occur is T T =| Si| /2=i P . D–A basis, with D corresponding to b = 0 then leads E E E | i For the other three cases in Eqs. (4)–(6),h | i the error event to the final result corresponds to the last term in each expression. There- 4PE(1 2PE) fore the conditional error probabilities are identical, and IR = log2 1+ − 2 . (12) (1 PE ) hence PE is the unconditional error probability. − To quantify Eve’s information gain, we use the Rényi Ideally, Eve’s Rényi information is the same for both the information that she derives about the sift events in H–V and D–A bases, but in actual experiments it may which Bob correctly measures Alice’s qubit. Let B = differ, owing to differing equipment errors in each basis. 3

Coincidence Estimated Expected Alice PE |1i|0i |1i|1i |0i|1i |0i|0i |1i|0i |1i|1i |0i|1i |0i|0i |1i|0i |1i|1i |0i|1i |0i|0i 0 1356 1836 23408 23356 0.027 0.037 0.469 0.468 0 0 0.500 0.500 |Di 0.1 2840 4220 9664 32592 0.058 0.086 0.196 0.661 0.050 0.050 0.167 0.733 0.33 7512 9496 1512 30916 0.152 0.192 0.031 0.625 0.167 0.167 0 0.667 0 22664 23388 1140 1112 0.469 0.484 0.024 0.023 0.500 0.500 0 0 |Ai 0.1 8480 34492 4088 2052 0.173 0.702 0.083 0.042 0.167 0.733 0.050 0.050 0.33 1096 32360 9384 6564 0.022 0.655 0.19 0.133 0 0.667 0.167 0.167

TABLE I: Data samples, estimated probabilities, and theoretical values for D and A inputs with Bob using the same basis as Alice, and for predicted error probabilities PE = 0, 0.1, and 0.33. |0i|1i corresponds to Bob’s measuring |Di and Eve’s measuring |1iT. Column 1 shows the state Alice sent and column 2 shows the predicted error probability PE . “Coincidence” columns show coincidence counts over a 40-s interval. “Estimated” columns show the measured coincidence counts normalized by the total counts of all four detectors, and “Expected” shows the theoretical values under ideal operating conditions.

Figure 3 shows the quantum circuit diagram of our wave plate (QWP) Q1 and a half-wave plate (HWP) H1, SPTQ implementation of the FPB probe. We start with followed by single-photon detection (D1) through a po- a pair of polarization-entangled photons in the singlet larizing beam splitter (PBS) P1 along H. Q1 was used state. Photon 1 is used as a trigger to herald photon 2 to compensate an intrinsic phase shift ξ imposed by the as a single-photon pulse for the BB84 protocol. A swap swap gate on the target-qubit basis 0 T, 1 T . We ◦ {| i | i } operation applied to photon 2 exchanges its polarization have independently measured ξ 88 . Therefore, the RE ≃ ′ and momentum qubits so that the polarization of photon operation prepared the momentum qubit in Tin with a 1 and the momentum of photon 2 are now entangled in Q1-imposed phase shift ξ | i a singlet state. Eve encodes her probe qubit in the mo- ′ iξ mentum state of photon 2 by projecting photon 1 along Tin cos θin 0 T + e sin θin 1 T . (13) | i≡ | i | i an appropriate polarization state set by a polarization swap rotation RE. The polarization state of photon 2 after the The extra phase shift of the gate would bring Eve’s swap gate is Alice’s qubit, which is set by rotation RA. probe qubit to be in Tin of Eq. 2. swap | i Similarly, Bob’s polarization analysis of Alice’s qubit is After the gate, RA and R−π/8 were combined in p-cnot set by RB. The cnot gate in Fig. 3 is preceded by a π/8 a single operation. The gate had the same phase swap rotation and followed by a +π/8 rotation because the− ba- shift problem as the gate, so we used a HWP (H2) sis for the cnot’s control qubit is rotated by π/8 from the and a QWP (Q2) to compensate for this phase shift and BB84 bases, as noted in Fig. 2. The cnot gate that Eve to impose the required rotation. After H2 and Q2 Alice’s employs is a polarization-controlled not (p-cnot) gate qubit becomes that uses the polarization qubit as the control and the iχ ΨA cos θA 0 C + e sin θA 1 C, (14) momentum qubit of the same photon as the target. We | i≡ | i | i have previously demonstrated such a gate in a polariza- ◦ where χ ( 98 ) is the compensating phase shift and θA tion Sagnac interferometer with an embedded dove prism ◦ ◦ ◦ ◦ is 22.5 ,≃22.5 , 67.5 , or 112.5 for H , D , V or A , [7]. We have also demonstrated the swap operation [8] respectively,− as shown in Fig. 2(a).| Similarlyi | i | wei com-| i by cascading three cnot gates: a momentum-controlled bined R 8 and RB into a single HWP (H3) in Fig. 4 and not (m-cnot), a p-cnot, and another m-cnot. π/ a PBS (P2) was used by Bob to analyze the polarization Figure 4 shows our experimental setup for implement- of Alice’s qubit. ing the quantum circuit. We used a bidirectionally Eve measured her qubit by a projective measurement pumped Sagnac interferometric down-conversion source along the 0 T– 1 T (spatially, R–L) basis. A HWP [11] with a periodically poled KTiOPO4 (PPKTP) crys- (H4/H5) was| i placed| i in the R or L beam path, as in- tal to generate polarization-entangled photons at 810 nm dicated in Fig. 4, so that the R and L beams would in the singlet state. The measured flux was 700 pairs/s be distinguished by their orthogonal polarizations. This per mW of pump in a 1 nm bandwidth at ∼99.45% visi- ∼ polarization tagging simplified their measurements by a bility quantum interference. The collimated output beam PBS (P3/P4) and single-photon detectors. The four de- had a beam waist of w0 =0.53 mm. In a collimated con- tectors uniquely identified the two qubits of photon 2. figuration, the momentum state of a photon is the same For example, D2 (D3) indicates R (L) for Eve’s qubit, as the spatial orientation of the beam, which we use the and either D2 or D3 suggests H polarization after Bob’s right–left (R–L) basis in this experiment. The L and R analyzer. Therefore, in our physical simulation, the joint beams were separated by 2 mm. ∼ measurement by Bob and Eve yields Bob’s polarization For each photon pair, photon 1 is used to herald the information and Eve’s momentum information. arrival of photon 2 and also to remotely control the mo- In data collection, we measured coincidences between mentum qubit of photon 2 by postselection. RE polariza- D1 and one of the detectors for photon 2. Table I shows tion rotation by Eve was implemented using a quarter- two data sets for Alice’s input of D and A polarizations 4

1 parameters. We assume that the phases ξ in Eq. (13) and χ in Eq. (14) could be inaccurate, and similarly for 0.8

R A I the setting of θ in Eq. (14) that might be caused by the wave plates. We also model the unitary p-cnot gate as 0.6 cos α ie−iδ sin α 0 0 0.4 ieiδ sin α cos α 0 0  iδ  ,

é 0 0 ie sin α cos α

R nyiinformation − − 0.2  0 0 cos α ie iδ sin α   −   (15) 0 where α = 0 and δ = 0 for an ideal p-cnot gate. Finally 0 0.1 0.2 0.3 0.4 0.5 we assume that Bob’s HWP (H3) setting of θB was not Errorprobability PE perfect such that

FIG. 5: (Color online) Eve’s Rényi information IR about H cos θ 0 C sin θ 1 C , (16) Bob’s error-free sifted bits as a function of error probability | i → B| i − B| i PE that her eavesdropping creates. Solid squares, solid line: V sin θB 0 C + cos θB 1 C , (17) theoretical curve from Eq. (12). Solid diamonds, solid line: | i → | i◦ ◦ | i where θB should equal 22.5 ( 22.5 ) in the H–V (D–A) measured values for H–V basis. Solid triangles, solid line: basis. − measured values for D–A basis. Open diamonds, dashed line: We fit the data by minimizing the differences be- fitted curve with error model for H–V basis. Open triangles, dashed line: fitted curve with error model for D–A basis. tween 96 measurements and the calculated numbers based on this error model. The fitting results show ◦ ◦ that ∆ξ 3 , ∆χ 11 , ∆θA(H,D,V,A) = ◦ ◦ ≃ ◦ ◦ ≃ − ◦ ◦ and compares with the expected values for the ideal case. 3.2 , 0.9 , 0.7 , 2.3 , α = 12.3 , δ = 3.6 , { − − } ◦ ◦ From the raw data, we calculate the Rényi information ∆θB(H/V, D/A) = 1.8 , 0 . As expected, the phase {− } IR based on Eq. (10), and Fig. 5 plots IR as a func- errors are relatively small and those associated with θA tion of the error probability PE for the ideal case (solid and θB are within the resolution of the rotating mounts squares, solid line), for the measured values with inputs housing the wave plates. The non-zero α also agrees with in the H–V basis (solid diamonds, solid line), and for the measured classical visibility of 94% for the p-cnot the measured values with inputs in the D–A basis (solid gate. We plot the fitted IR based on this model in Fig. 5 triangles, solid line). We note that no background counts for the H–V basis (open diamonds, dashed line) and the were subtracted and the coincidence window was 1 ns. D–A basis (open triangles, dashed line). ∼ In the ideal case with PE = 0, Eve gets no information, In summary, we have demonstrated experimentally the IR = 0, and Alice and Bob have no error bits. However, first complete physical simulation of the entangling-probe due to experimental errors such as imperfect gate fideli- attack, showing that Eve can gain Rényi information of ties, we measured 5% of the sifted bits had errors. For up to 0.9 under realistic operating conditions, including a ∼ cnot PE =1/3, Eve obtains perfect information, IR = 1, but gate that does not have an ultrahigh fidelity. Our in our experiment, Eve gained a maximum IR = 0.9 or, results suggest the possible amount of information gain on average, Eve gained 95% of the correct information by Eve with current technology and the need to evaluate about Bob’s error-free sifted bits. the required level of privacy amplification. To understand the errors involved in the experiment, This work was supported by BBN Technologies under we model our experimental setup with some non-ideal the DARPA QuIST program.

[1] C. H. Bennett and G. Brassard, in Proceedings of IEEE [8] M. Fiorentino, T. Kim, and F. N. C. Wong, Phys. Rev. International Conference on Computers, Systems, and A 72, 012318 (2005). Signal Processing, Bangalore, India (IEEE, New York, [9] C. H. Bennett, F. Bessette, G. Brassard, L. Salvail, and 1984), p. 175. J. Smolin, J. Cryptology 5, 3 (1992). [2] N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev. [10] C. H. Bennett, T. Mor, and J. A. Smolin, Phys. Rev. A Mod. Phys. 74, 145 (2002). 54, 2675 (1996); E. Biham and T. Mor, Phys. Rev. Lett. [3] C. A. Fuchs and A. Peres, Phys. Rev. A 53, 2038 (1996). 78, 2256 (1997); D. Mayers, in Proceedings of the 16th [4] B. A. Slutsky, R. Rao, P.-C. Sun, and Y. Fainman, Phys. Annual International Cryptography Conference, Santa Rev. A 57, 2383 (1998). Barbara, California, edited by N. Roblitz (Springer, [5] H. E. Brandt, Phys. Rev. A 71, 042312 (2005). Berlin, 1996). [6] J. H. Shapiro and F. N. C. Wong, Phys. Rev. A 73, [11] T. Kim, M. Fiorentino, and F. N. C. Wong, Phys. Rev. 012315 (2006). A 73, 012316 (2006); F. N. C. Wong, J. H. Shapiro, and [7] M. Fiorentino and F. N. C. Wong, Phys. Rev. Lett. 93, T. Kim, Laser Phys. 16, 1517 (2006). 070502 (2004);