Picture-perfect Quantum Key Distribution Aleks Kissinger1, Sean Tull2, and Bas Westerbaan1 1Institute for Computing and Information Sciences, Radboud University Nijmegen 2Department of Computer Science, University of Oxford We provide a new way to bound the se- Such schemes form part of the program of post- curity of quantum key distribution using quantum cryptography [6]. only two high-level, diagrammatic features On the other hand Bennett and Brassard pro- of quantum processes: the compositional posed a completely different unauthenticated key behavior of complementary measurements agreement protocol, now called BB84 [5], whose and the essential uniqueness of purifica- security is not based on a mathematical prob- tion. We begin by demonstrating a proof lem, but on physical assumptions on quantum in the simplest case, where the eavesdrop- mechanical systems. In this protocol Alice needs per doesn’t noticeably disturb the chan- to be able to send Bob qubits. In most implemen- nel at all and has no quantum memory. tations, like [31], this is done by sending photons We then show how this approach extends over a fiber optic cable, where the qubits are en- straightforwardly to account for an eaves- coded in the polarization of the photons. After dropper with quantum memory and the BB84 other variations have been proposed, no- presence of noise. tably E91 [15], and they are all indiscriminately referred to as Quantum Key Distribution (QKD). 1 Introduction In their original paper, Bennett and Brassard give a short argument for the security of BB84. Traditionally in cryptography, parties use pre- Feeling this proof was not satisfactory, subse- shared keys to communicate securely. In 1976 quent authors have proposed more meticulous Diffie and Hellman introduced the first key agree- proofs, for instance [22]. However, this added ment protocol that allows two parties, say Alice rigor came at the cost of complexity, prompting and Bob, to securely establish a key over an in- Shor and Preskill to publish a `simple proof' [29]. secure channel [14]. There are two caveats to its This did not settle the matter: many subsequent security. First, it's an unauthenticated key agree- publications have appeared on the security of ment protocol,1 and second, its security hinges on BB84 and its variants, differing not only in lev- the difficulty of computing discrete logarithms. els of rigor vs. simplicity, but also in the physi- Famously, Shor showed in 1994 [28] that a (large- cal assumptions and the efficiency of the proto- scale stable) quantum computer is able to calcu- col itself (e.g. qubits required per bit of shared late discrete logarithms with ease, breaking Diffie key) [2,4, 16, 19{21, 23{26]. and Hellman's original scheme. The present paper contributes another proof There are other key agreement protocols whose to the mix, whose primary aim is simplicity. It arXiv:1704.08668v3 [quant-ph] 19 Jul 2017 security is based on mathematical problems is quite different from those that came before, which are believed to be difficult, even for quan- in that we adopt a purely graphical notation tum computers. An example is NewHope [3,7]. and rely on techniques which arose in categor- Aleks Kissinger: [email protected] ical quantum mechanics [1] and the diagram- Sean Tull: [email protected] matic approach to quantum theory [11]. We will Bas Westerbaan: [email protected] show that two high-level features of quantum processes{namely the behavior of complemen- 1An attacker Eve that can intercept and modify all communication between Alice and Bob, can simply im- tary measurements under composition [10] and personate Bob and perform all the steps Bob would. Now the essential uniqueness of purification of quan- Alice thinks she established a shared key with Bob, where tum channels [9]–suffice to show that there exists in reality she established a shared key with Eve. no quantum process with which an eavesdropper 1 can undetectably extract information about Al- holds. We remove the second limitation in Sec- ice and Bob's shared key. tion5 by showing the same graphical proof from We begin by briefly reviewing the graphical Section3 goes through, thanks to the continuity notation for quantum processes, including de- properties of purification and diagram rewriting, pictions of purification and complementary mea- if we replace equality by -closeness in the com- surements. In Section3, we describe a version of pletely bounded norm (written ` ··· =ε ··· '). This cb BB84 in this notation and give a one-line version enables us to give a security bound for the QKD of a proof of correctness which already appears in protocol comparable to the one suggested in [17]. the literature [11, 13], but makes the (unreason- In particular, the fact that Eve's process disturbs ably) strong assumption that Eve is only allowed the channel very little can be formulated as: to measure and re-prepare in the Z and X bases. Our first main result removes this assumption, allowing Eve to perform any quantum process to (attempt to) extract information from Alice and ε ε Φ = Φ = Bob's channel: cb cb Bob ... Eve Φ √ This implies that Eve's process is within N of Alice a separable one: ... We then formulate the condition that Eve's chan- √ nel remains undetected by means of two equa- N ε Φ = ρ tions, corresponding to the cases where Alice and cb Bob's measurement choices agree: for some constant N depending only on the di- mension of Alice and Bob's system. Φ = Φ = 2 Preliminaries Using the behavior of complementary measure- Throughout the paper, we will use string di- ments, we show that this implies that Eve's chan- agram notation for linear maps and channels. nel separates: [11] Systems are depicted as wires and maps as Bob ... Eve Bob ... Eve boxes. To make it clear whether we are work- ing with linear maps between Hilbert spaces or Φ = ρ completely positive maps (CP-maps), we will de- pict finite-dimensional Hilbert spaces H, K, . as Alice Alice thin wires and the associated spaces of operators ... ... B(H), B(K),... as thick wires. While already much more general than previ- A linear map V : H → K and CP-map ous graphical proofs, this still makes two very Φ: B(H) → B(K) (for Hilbert spaces H, K) are strong assumptions. First, it assumes that Eve depicted respectively as: performs the same process each time Alice and Bob use their channel. Second, it assumes all equalities are exact, so it offers no guarantees in K B(K) the presence of noise. V Φ We remove the first limitation in Section4 H B(H) by allowing Eve to maintain an arbitrarily large quantum memory between usages of the chan- We omit wire labels if they are irrelevant or clear nel, and show that the separation argument still from context. Compositions of maps is depicted 2 by plugging boxes together vertically: 2.1 Purification The linear map that sends ρ ∈ B(H) to its trace B(L) L is a CP-map Tr : B(H) → C, which we draw as V Ψ a `ground' symbol: V ◦ U =: K Ψ ◦ Φ =: B(K) Tr = U Φ H Using this notation, we can express the prop- B(H) erty of a CP-map being trace-preserving as fol- lows: and tensor products by putting boxes side-by- side: Φ = H0 K0 B(H0) B(K0) U ⊗V =: U V Φ⊗Ψ =: Φ Ψ Furthermore, any linear map U : H → K in- duces a CP-map Ub : B(H) → B(K) via: H K B(H) B(K) Ub(ρ) = U ρ U † (1) Similarly, maps between tensor products such as We call a CP-map pure if it is of the form of (1). U : H → K ⊗ L or Φ: B(H) → B(K) ⊗ B(L) We call this method of turning a linear map into are depicted as boxes with multiple input/output a pure CP-map doubling. wires: An important theorem about CP-maps is that K L B(K) B(L) any CP-map can be represented in an essentially unique manner, by means of a pure CP-map and U Φ the trace. H B(H) Theorem 2.1 (Stinespring / purification, U : H → K ⊗ L Φ: B(H) → B(K ⊗ L) [8, 30]). For any completely positive map Φ: B(H) → B(K) there is a Hilbert space L and where we identify B(H) ⊗ B(K) =∼ B(H ⊗ K). linear map V : H → K ⊗ L with Identity linear maps/CP-maps are represented as `plain wires': Φ = Vb (2) 1H =: H 1B(H) =: B(H) Moreover, for any (other) linear map V 0 : H → K ⊗L satisfying (2), there is a unitary U : L → L since U ◦ 1H = 1K ◦ U = U and similarly for CP- such that: maps. The trivial system C is depicted as `no wire', since H ⊗ =∼ H and B(H) ⊗ =∼ B(H). C C U Regarding vectors as linear maps v : C → H and V 0 = positive operators as CP-maps ρ : C → B(H), we V can depict vectors |ψi ∈ H and quantum states in ρ ∈ B(H) respectively as maps from 0 to 1 wire: 2.2 Spiders and decoherence H B(H) To each orthonormal basis (ONB) {|ii} of a ψ ρ (finite-dimensional) Hilbert space H, we asso- ciate a family of linear maps called spiders as Similarly, we can depict linear functionals follows: hψ| : H → C and CP-maps of the form e: B(H) → C as maps from 1 to 0 wires: n ... n := = X |i . ii hi . i| e m ψ ... | {z } | {z } i n m H B(H) m 3 where a spider with zero legs is a complex number That is, it projects a positive matrix written with D, the dimension of the Hilbert space.