Quantum Key Distribution Kommentare Chances and Restrictions Norbert

Quantum Key Distribution Kommentare Chances and Restrictions Norbert Lütkenhaus Emmy Noether Research Group Institut für Theoretische Physik I Universität Erlangen-Nürnberg Institut für Optik, Information und Photonik Max-Planck Forschungsgruppe, Erlangen

Overview • What does Quantum Key Distribution do? • QKD and Correlations • Security intuition based on Quantum Mechanics • Performance in real implementations • Current Problems animieren

What is QKD about? EVE Classical Channel Alice Bob initial secret key 010110101 key (X): 010110101 Generated key: informtion theoretic security secure: I(X; Eve)=0 random: H(X) = n (maximal) universally composable ? ? ? Additional Resources: Correlations via Quantum Channel Restrictions: -initially point-to-point -max range 20 km (150 km? ) -key rate e. g. 100 bits/sec, increase to 100 kbits or more?

Correlations and information theoretic security Alice Bob E IAE Eve. IBE PABE(a, b, e) A IAB B Wyner Wire Tap Eve obtains degraded copy of message Alice and Bob can perform secure communication Lower bound on secrecy capacity CS: (rate of secret communication between Alice and Bob) - Csiszar, Körner, IEEE, IT 24, 339 (1978). CS > max {IAB - IAE, IAB -IBE } Upper Bounds on secrecy capacity CS: - U. M. Maurer, IEEE Trans. Inf. Theo. 39, 1733 (1993); -U. Maurer and S. Wolf, IEEE T. I. T. 45, 499 (1999). Cs I(A; B E) • Intrinsic Information: I(A; B E) I(A, B E) = min. E E I(A; B|E) with I(A; B|E) = H(A, E) + H(B, E) – H(A, B, E) – H(E)

IAE A Exploiting the Csiszar-Körner bound (one-way communication) E B IAB I‘(AB)E 3) Alice‘s bit string defines the key Amount of required classical communication A B to allow Bob to correct his errors: (1 -IAB) bits Estimate Eve‘s relevant information [C. Cachin, U. M. Maurer, IEEE Trans. Inf. Theo. 39, 1733 (1993). ] B I‘AB = 1 E I‘‘ (AB)E=0 A 1) 2) B I‘‘AB = 1 4) Privacy amplification: Shorten key by fraction

Quantum Mechanics • Signal states are represented by complex vectors, represented by • (dual vectors are represented by ) • Measurements correspond to set of positive, hermitian operators , one for each possible outcome ‘i’, that form the resolution of the identity operator • Quantum mechanics predicts the probability of a measurement outcome as the expectation value • Composed systems are described by state vectors that can be expressed as linear combination of tensor products of basis vectors of each individual system • Measurement on only one subsystem: use

Eavesdropping Eve U U unitary If can be verified to behave like the input states locally on system A for two non-orthogonal input states and , then we can show that holds for any linear combination of P(A, B, E) = P(A, B) P(E). No errors for non-orthogonal states Only trivial operation by Eve no leakage of information and . Eavesdropper

Bennett Brassard Protocol Quantum Part: Create random key: random signals random measurements Public discussion over faithful classical channel: distinguish deterministic from random processes Alice: Bob: Sifting (public discussion) 0: 1: 1 0 1 No errors: transmitted faithfully Key is secure 1

Shor-Preskill type security proof basis 0110… data 0101… Encoding into QECC code Quantum Error Correction Code Detector Decoding of QECC code noisy channel Quantum/classical procedure for CSS codes: Phase I: Quantum basis 0101… basis 0110… data 0101… noisy channel Detector data 0101… Phase II: Classical data 0101… 1) 2) data 0100… classical error correction classical privacy amplification data 0101… secret key

Gain formula The gain formula gives the number of secure bits after error correction and privacy amplification per signal sent by Alice: privacy amplification (Eve‘s additional information gained during error correction) privacy amplification (Eve‘s information gain that caused errors) 11 %

Realistic Signals Multi-photon signals No single photon sources (though getting there!) Source Several copies of signal state Eve can single out a copy No errors are caused Delayed measurement gives full information to Eve Weak laser pulse (without phase reference) Laser Alice Bob Multi-photon signals are a nuisance, but not an obstacle privacy amplification takes care of extra information

Unconditional security proof Inamori, NL, Mayers, quant-ph/0107017 Assumptions and settings: • Mixture of vacuum, single and multi-photon signals • Ideal polarization preparation (or equivalent) • No optical intrusion into Alice and Bob • No restrictions on Eve acting on signals • Detection probability independent of signal or basis choice Conservative approach: • Eve responsible for all observed errors and all loss Eve’s optimal strategy: • Split one photon off all multi-photon signals ( no error, but full information) • Eavesdrop on a few single photon signals to maintain expected number of detected signals • Block remaining single photon signals Eve knows a lot, but we know how much she knows: Error correction Privacy Amplification unconditionally secure key Minimal fraction of contributing single photon signals (only limit of long keys shown) e: error rate in sifted key pexp: detection rate Pmulti-photon probability υrep repetition rate

Optical implementation Example: Townsend, Opt. Fib. Tech. 4, 345 -370 (1998) Polarization: Relative phase between two optical modes low error rate over long distances (>150 km) Problem: Bob receives weak signals need excellent photo detectors

Achievable Rates as of 2000 Rates per time slot, optical fiber based implementations.

Commercial Applications Commercial product: operation on installed optical fiber © Magi. Q Technologies European effort: Id. Quantique (Geneva) EU IP “Secure Communication using Quantum Cryptography”

Quantum Communication and Correlations Phase I: Physical Set-Up Generation of correlations between Alice and Bob possibly containing hidden correlations with Eve Physics: correlated data with a promise. Which type of correlations are useful for Quantum Communication? (Classical) Computer Science: Solve Communication Problem with classically correlated data … Phase II: Classical Communication Protocol Advantage distillation (e. g. announcement of bases in BB 84 protocol) Error Correction ( Alice and Bob share the same key) Privacy Amplification ( generates secret key shared by Alice and Bob)

Potential for correlations secret bits per signal not secure (proven) Regime of Hope not secure (proven) protocol independent secure (proven) protocol e. g. weak coherent pulse BB 84 - [Inamori, NL, Mayers quant-ph/0107017] - [Gottesman, Lo, NL, Preskill quant-ph/0212066] typically 20 – 40 km distance (channel model) e. g about 100 km for BB 84 signals [Dusek, Jahma, NL, PRA 62 022306 (2000)]

Conclusions Quantum Key Distribution offers information theoretic secure key. It can be implemented with todays technology. We are still in the learning process to ramp up rate and distance. Warning: need to secure devices against side-channel attacks. QKD seems ideal topic for interface Physics and Computer Science: physics generates correlations with a promise computer science offers public discussion protocols to extract key