Attacking Quantum Key Distribution with Single-Photon Two-Qubit

Attacking quantum key distribution with single-photon two-qubit quantum logic Jeffrey H. Shapiro∗ and Franco N. C. Wong Massachusetts Institute of Technology, Research Laboratory of Electronics, Cambridge, Massachusetts 02139 USA (Dated: September 14, 2018) The Fuchs-Peres-Brandt (FPB) probe realizes the most powerful individual attack on Bennett- Brassard 1984 quantum key distribution (BB84 QKD) by means of a single controlled-NOT (CNOT) gate. This paper describes a complete physical simulation of the FPB-probe attack on polarization- based BB84 QKD using a deterministic CNOT constructed from single-photon two-qubit quantum logic. Adding polarization-preserving quantum nondemolition measurements of photon number to this configuration converts the physical simulation into a true deterministic realization of the FPB attack. PACS numbers: 03.67.Dd, 03.67.Lx, 42.50.Dv, 42.40.Lm I. INTRODUCTION proaches have been discussed [4]. Our particular objec- tive will be to show that current technology permits physical simulation of the Fuchs-Peres-Brandt (FPB) probe Bennett-Brassard 1984 quantum key distribution [5], i.e., the most powerful individual attack on single- (BB84 QKD) using single-photon polarization states photon BB84, and that developments underway in quan- works as follows [1]. In each time interval allotted for tum nondemolition (QND) detection may soon turn this a bit, Alice transmits a single photon in a randomly se- physical simulation into a full implementation of the at- lected polarization, chosen from horizontal (H), vertical tack. Thus we believe it is of interest to construct the (V ), +45◦, or 45◦, while Bob randomly chooses to de- physical simulation and put BB84’s security to the test: tect photons in− either the H/V or 45◦ bases. Bob dis- how much information can Eve really derive about the closes to Alice the sequence of bit intervals± and associated key that Alice and Bob have distilled while keeping Alice measurement bases for which he has detections. Alice and Bob oblivious to her presence. then informs Bob which detections occurred in bases co- incident with the ones that she used. These are the sift The remainder of this paper is organized as follows. events, i.e., bit intervals in which Bob has a detection and In Sec. II we review the FPB probe and its theoret- his count has occurred in the same basis that Alice used. ical performance. In Sec. III we describe a complete An error event is a sift event in which Bob decodes the physical simulation of this probe constructed from single- incorrect bit value. Alice and Bob employ a prescribed photon two-qubit (SPTQ) quantum logic. We conclude, set of operations to identify errors in their sifted bits, in Sec. IV, by showing how the addition of polarization- correct these errors, and apply sufficient privacy ampli- preserving QND measurements of photon number can fication to deny useful key information to any potential convert this physical simulation into a true determinis- eavesdropper (Eve). At the end of the full QKD pro- tic realization of the FPB attack on polarization-based cedure, Alice and Bob have a shared one-time pad with BB84. which they can communicate in complete security. In long-distance QKD systems, most of Alice’s photons will go undetected, owing to propagation loss and II. THE FUCHS-PERES-BRANDT PROBE arXiv:quant-ph/0508051v2 22 Sep 2005 detector inefficiencies. Dark counts and, for atmospheric QKD systems, background counts can cause error events In an individual attack on single-photon BB84 QKD, in these systems, as can intrusion by Eve. Employing Eve probes Alice’s photons one at a time. In a collective an attenuated laser source, in lieu of a true single-photon attack, Eve’s measurements probe groups of Alice’s pho- source, further reduces QKD performance as such sources tons. Less is known about collective attacks [6], so we are typically run at less than one photon on average per will limit our consideration to individual attacks. Fuchs bit interval, and the occurrence of multi-photon events, and Peres [7] described the most general way in which although rare at low average photon number, opens up an individual attack could be performed. Eve supplies a additional vulnerability. Security proofs have been pub- probe photon and lets it interact with Alice’s photon in a lished for ideal BB84 [2], as have security analyses that unitary manner. Eve then sends Alice’s photon to Bob, incorporate a variety of non-idealities [3]. Our attention, and performs a probability operator-valued measurement however, will be directed toward attacking BB84 QKD, (POVM) on the probe photon she has retained. Slutsky as to our knowledge no such experiments have been per- et al. [8] demonstrated that the Fuchs-Peres construct— formed, although a variety of potentially practical ap- with the appropriate choice of probe state, interaction, and measurement—affords Eve the maximum amount of Rényi information about the error-free sifted bits that Bob receives for a given level of disturbance, i.e., for a ∗Electronic address: [email protected] given probability that a sifted bit will be received in er- 2 |V i ror. Brandt [5] extended the Slutsky et al. treatment by |1i showing that the optimal probe could be realized with a ◦ 45 ◦ single CNOT gate. Figure 1 shows an abstract diagram of |− i |+45 i the resulting Fuchs-Peres-Brandt probe. In what follows we give a brief review of its structure and performance— |0i see [5] for a more detailed treatment—where, for simplic- ity, we assume ideal conditions in which Alice transmits |Hi a single photon per bit interval, there is no propagation loss and no extraneous (background) light collection, and both Eve and Bob have unity quantum efficiency pho- FIG. 2: (Color online) Computational basis for Eve’s CNOT todetectors with no dark counts. These ideal conditions gate referenced to the BB84 polarization states. imply there will not be any errors on sifted bits in the absence of eavesdropping; the case of more realistic con- CNOT’s input and the kets on the right-hand side de- ditions will be discussed briefly in Sec. IV. note the Bob Eve state of the control and target qubits at the CNOT’s⊗ output. Similarly, when Alice uses the Eve 45◦ basis, Eve’s CNOT gate has the following behav- Alice Bob ior,± ◦ ◦ ◦ +45 Tin +45 T+ + 45 TE (8) | ◦i| i −→ | ◦i| i |− ◦i| i 45 Tin 45 T− + +45 TE . (9) FIG. 1: (Color online) Block diagram of the Fuchs-Peres- |− i| i −→ |− i| i | i| i Brandt probe for attacking BB84 QKD. Suppose that Bob measures in the basis that Alice has employed and his outcome matches what Alice sent. In each bit interval Alice transmits, at random, a single Then Eve can learn their shared bit value, once Bob dis- photon in one of the four BB84 polarization states. Eve closes his measurement basis, by distinguishing between uses this photon as the control-qubit input to a CNOT the T+ and T− output states for her target qubit. Of gate whose computational basis—relative to the BB84 course,| i this knowledge| i comes at a cost: Eve has caused polarization states—is shown in Fig. 2, namely an error event whenever Alice and Bob choose a com- mon basis and her target qubit’s output state is TE . 0 cos(π/8) H + sin(π/8) V (1) | i | i ≡ | i | i To maximize the information she derives from this intru- 1 sin(π/8) H + cos(π/8) V , (2) sion, Eve applies the minimum error probability receiver | i ≡ − | i | i for distinguishing between the single-photon polarization in terms of the H/V basis. Eve supplies her own probe states T+ and T− . This is a projective measurement photon, as the target-qubit input to this CNOT gate, in | i | i onto the polarization basis d+ , d− , shown in Fig. 3 the state and given by {| i | i} T C + + S , (3) | ini≡ | i |−i + + d+ = | i |−i = 0 (10) where C = √1 2PE, S = √2PE, = ( 0 1 )/√2, | i √2 | i − |±i | i ± | i and 0 PE 1/2 will turn out to be the error prob- + ≤ ≤ d− = | i − |−i = 1 . (11) ability that Eve’s probe creates on Bob’s sifted bits [9]. | i √2 | i So, as PE increases from 0 to 1/2, Tin goes from + to . The (unnormalized) output states| i that may| occuri for|−i this target qubit are |T−i |d−i = |1i S |T+i T± C + (4) | i ≡ | i± √2|−i S E T . (5) d = 0 | i ≡ √2|−i | +i | i Here is how the FPB probe works. When Alice uses the H/V basis for her photon transmission, Eve’s CNOT gate effects the following transformation, FIG. 3: (Color online) Measurement basis for Eve’s minimum- error-probability discrimination between |T+i and |T−i. H T H T− + V TE (6) | i| ini −→ | i| i | i| i V Tin V T+ + H TE , (7) | i| i −→ | i| i | i| i Two straightforward calculations will now complete where the kets on the left-hand side denote the Al- our review of the FPB probe. First, we find the error ice Eve state of the control and target qubits at the probability that is created by Eve’s presence. Suppose ⊗ 3 Alice and Bob use the H/V basis and Alice has sent H . Alice and Bob will incur an error if the control target| i 1 ⊗ 0.9 output from Eve’s CNOT gate is V TE . The proba- | i| 2 i 0.8 bility that this occurs is TE TE = S /2 = PE.

Load more