BB84 Quantum Key Distribution: Difference between revisions
m (→Pseudo Code) |
|||
Line 67: | Line 67: | ||
<u>'''Stage 1'''</u> Distribution and measurement | <u>'''Stage 1'''</u> Distribution and measurement | ||
#For i=1,2,...,n | #For i=1,2,...,n | ||
## Sender chooses random bits <math>X_i\ | ## Sender chooses random bits <math>X_i\epsilon\{0,1\}</math> and <math>A_i\epsilon_R\{0,1\}</math> such that <math>P(X_i=1)=\gamma</math> | ||
## Sender prepares <math>H^{X_i}\ | ## Sender prepares <math>H^{X_i}|A_i\rangle</math> and sends it to Bob | ||
## Receiver announces receiving a state | ## Receiver announces receiving a state | ||
## Receiver chooses bit <math>Y_i\in_R\{0,1\}</math> such that <math>P(Y_i=1)=\gamma</math> | ## Receiver chooses bit <math>Y_i\in_R\{0,1\}</math> such that <math>P(Y_i=1)=\gamma</math> | ||
## Receiver measures <math>H^{X_i}\ | ## Receiver measures <math>H^{X_i}|A_i\rangle</math> in basis <math>\{H^{Y_i}|0\rangle, H^{Y_i}|1\rangle\}</math> with outcome <math>B_i</math> | ||
*At this stage Sender holds strings <math>X_1^n, A_1^n</math> and Receiver <math>Y_1^n, B_1^n</math>, all of length <math>n</math> | *At this stage Sender holds strings <math>X_1^n, A_1^n</math> and Receiver <math>Y_1^n, B_1^n</math>, all of length <math>n</math> | ||
Line 78: | Line 78: | ||
#For i=1,2,....,n | #For i=1,2,....,n | ||
## If <math>X_i=Y_i</math> | ## If <math>X_i=Y_i</math> | ||
### <math>A_1^{n'} = A_1^{n'}. | ### <math>A_1^{n'} = A_1^{n'}.</math>append</math>(A_i)</math> | ||
### <math>B_1^{n'} = B_1^{n'}. | ### <math>B_1^{n'} = B_1^{n'}.</math>append<math>(B_i)</math> | ||
### <math>X_1^{n'} = X_1^{n'}. | ### <math>X_1^{n'} = X_1^{n'}.</math>append<math>(X_i)</math> | ||
### <math>Y_1^{n'} = Y_1^{n'}. | ### <math>Y_1^{n'} = Y_1^{n'}.</math>append<math>(Y_i)</math> | ||
*Now Sender holds strings <math>X_1^{n'}, A_1^{n'}</math> and Receiver <math>Y_1^{n'}, B_1^{n'}</math>, all of length <math>n'\leq n</math> | *Now Sender holds strings <math>X_1^{n'}, A_1^{n'}</math> and Receiver <math>Y_1^{n'}, B_1^{n'}</math>, all of length <math>n'\leq n</math> | ||
<u>'''Stage 3'''</u> Parameter estimation | <u>'''Stage 3'''</u> Parameter estimation | ||
Line 91: | Line 91: | ||
## size<math>Q</math> += 1\; | ## size<math>Q</math> += 1\; | ||
Both Sender and Receiver, each, compute <math>Q_X = \frac{1}{\tn{size}Q} \sum_{i=1}^{n'}Q_i</math> | *Both Sender and Receiver, each, compute <math>Q_X = \frac{1}{\tn{size}Q} \sum_{i=1}^{n'}Q_i</math></br> | ||
<u>'''Stage 4'''</u> Error correction | <u>'''Stage 4'''</u> Error correction | ||
<math>C(\cdot,\cdot)</math> is an error correction subroutine determined by the previously estimated value of <math>Q_Z</math> and with error parameters <math>\epsilon'_{\rm EC}</math> and <math>\epsilon_{\rm EC}</math> | #<math>C(\cdot,\cdot)</math> is an error correction subroutine determined by the previously estimated value of <math>Q_Z</math> and with error parameters <math>\epsilon'_{\rm EC}</math> and <math>\epsilon_{\rm EC}</math> | ||
Both Sender and Receiver run <math>C(A_1^{n'},B_1^{n'})</math>. Receiver obtains <math>\tilde{B}_1^{n'}</math> | #Both Sender and Receiver run <math>C(A_1^{n'},B_1^{n'})</math>. | ||
#Receiver obtains <math>\tilde{B}_1^{n'}</math> | |||
<u>'''Stage 5'''</u> Privacy amplification | <u>'''Stage 5'''</u> Privacy amplification | ||
<math>PA(\cdot,\cdot)</math> is a privacy amplification subroutine determined by the size <math>\ell</math>, computed from Eq.(3), and with secrecy parameter <math>\epsilon_{\rm PA}</math> | #<math>PA(\cdot,\cdot)</math> is a privacy amplification subroutine determined by the size <math>\ell</math>, computed from Eq.(3), and with secrecy parameter <math>\epsilon_{\rm PA}</math> | ||
Sender and Receiver run $PA(A_1^{n'},\tilde{B}_1^{n'})$ and obtain secret keys $K_A, K_B$\; | #Sender and Receiver run $PA(A_1^{n'},\tilde{B}_1^{n'})$ and obtain secret keys $K_A, K_B$\; | ||
==Relevant Papers== | ==Relevant Papers== |
Revision as of 19:05, 11 November 2018
Functionality Description
The BB84 protocol implements the task of Quantum Key Distribution (QKD). The protocol enables two parties, Alice and Bob, to establish a classical secret key by preparing and measuring qubits. The output of the protocol is a classical secret key which is completely unknown to any third party, namely an eavesdropper.
Tags: Two Party, Quantum Enhanced Classical Functionality, Specific Task, Device Independent QKD, Six State QKD
Requirements
- Network Stage: Prepare and Measure
- Relevant Network Parameters: (see Prepare and Measure)
- Benchmark values:
- Minimum number of rounds ranging from to depending on the network parameters, for commonly used secure parameters.
- , taking a depolarizing model as benchmark. Parameters satisfying are sufficient.
- requires Authenticated classical channel, Random number generator.
Example:
Outline
The protocol shares a classical between two parties, sender (Alice) and receiver (Bob). The BB84 quantum key distribution protocol is composed by the following steps:
- Distribution: This step involves preparation, exchange and measurement of quantum states. For each round of the distribution phase, Sender randomly chooses a basis (a pair of orthogonal states) out of two available bases (X and Z). She then randomly chooses one of the two states and prepares the corresponding quantum state in the chosen basis. She sends the prepared state to Bob. Upon receiving the state, Receiver announces that he received the state and randomly chooses to measure in the either of the two available bases (X or Z). The outcomes of the measurements give Bob a string of classical bits. The two parties repeat the above procedure times so that at the end of the distribution phase each of them holds an -bit string.
- Sifting: Both parties publicly announce their choices of basis and compare them. They discard the rounds in which Receiver measured in a different basis than the one prepared by Sender.
- Parameter estimation: Both parties use a fraction of the remaining rounds (in which both measured in the same basis) in order to estimate the quantum bit error rate (QBER).
- Error correction: Both together, choose a classical error correcting code and publicly communicate in order to correct their string of bits. At the end of this phase both parties hold the same bit-string.
- Privacy amplification: Both use an extractor on the previously established string to generate a smaller but completely secret string of bits, which is the final key.
Properties
- Notations Used:
- number of total rounds of the protocol.
- size of the secret key.
- bits of input of Sender and Receiver, respectively, that define the measurement basis.
- bits of output of Sender and Receiver, respectively.
- final key of Sender and Receiver, respectively.
- is the quantum bit error rate QBER in the basis.
- is the quantum bit error rate QBER in the basis estimated prior to the protocol.
- is the Hadamard gate. .
- is the probability that Alice (Bob) prepares (measures) a qubit in the basis.
- , are the error probabilities of the error correction protocol.
- is the error probability of the privacy amplification protocol.
- is the error probability of the parameter estimation.
- The protocol-
- is Information-theoretically secure
- requires synchronous network, authenticated public classical channel, secure from coherent attacks
- implements -QKD, which means that it generates an -correct, -secret key of length in rounds. The security parameters of this protocol are give by
Failed to parse (SVG (MathML can be enabled via browser plugin): Invalid response ("Math extension cannot connect to Restbase.") from server "https://wikimedia.org/api/rest_v1/":): {\displaystyle \epsilon_{\rm corr}&=\epsilon_{\rm EC},</br> \epsilon_{\rm sec}&= \epsilon_{\rm PA}+\epsilon_{\rm PE}, } and the amount of key that is generated is given by Failed to parse (syntax error): {\displaystyle \ell\geq & (1-\gamma)^2n \de{ 1-h(Q_X+\nu) -h(Q_Z)}</br> &\;\;\; -\sqrt{(1-\gamma)^2n}\de{4\log\de{2\sqrt{2}+1} \de{\sqrt{\log\frac{2}{\epsilon_{\rm PE}^2}}+ \sqrt{\log \frac{8}{{\epsilon'}_{\rm EC}^2}}}}</br> &\;\;\; -\log\de{\frac{8}{{\epsilon'}_{\rm EC}^2}+\frac{2}{2-\epsilon'_{\rm EC}} }-\log \de{\frac{1}{\epsilon_{\rm EC}}}- 2\log\de{\frac{1}{2\epsilon_{\rm PA}}}} where Failed to parse (SVG (MathML can be enabled via browser plugin): Invalid response ("Math extension cannot connect to Restbase.") from server "https://wikimedia.org/api/rest_v1/":): {\displaystyle \nu = \sqrt{ \frac{(1+\gamma^2n)((1-\gamma)^2+\gamma^2)}{(1-\gamma)^2\gamma^4n^2}\log\de{\frac{1}{\epsilon_{\rm PE}}}}} and is the binary entropy function.
In Eq.~\eqref{eq:keylength}, the parameters $\epsilon_{\rm EC}$ and $\epsilon'_{\rm EC}$ are error probabilities of the classical error correction subroutine. At the end of the error correction step, if the protocol does not abort, then Alice and Bob share equal strings of bits with probability at least $1-\epsilon_{\rm EC}$. The parameter $\epsilon'_{\rm EC}$ is related with the completeness of the error correction subroutine, namely that for an honest implementation, the error correction protocol aborts with probability at most $\epsilon'_{\rm EC}+\epsilon_{\rm EC}$. The parameter $\epsilon_{\rm PA}$ is the error probability of the privacy amplification subroutine and $\epsilon_{\rm PE}$ is the error probability of the parameter estimation subroutine used to estimate $Q_X$. (See Quantum Key Distribution for the precise security definition)
Pseudo Code
- Input:
- Output:
Stage 1 Distribution and measurement
- For i=1,2,...,n
- Sender chooses random bits and such that
- Sender prepares and sends it to Bob
- Receiver announces receiving a state
- Receiver chooses bit such that
- Receiver measures in basis with outcome
- At this stage Sender holds strings and Receiver , all of length
Stage 2 Sifting
- Alice and Bob publicly announce
- For i=1,2,....,n
- If
- append</math>(A_i)</math>
- append
- append
- append
- If
- Now Sender holds strings and Receiver , all of length
Stage 3 Parameter estimation
- For
- size = 0
- If{
- Sender and Receiver publicly announce $A_i, B_i$\;
- Sender and Receiver compute , where is the Kronecker delta
- size += 1\;
- Both Sender and Receiver, each, compute Failed to parse (unknown function "\tn"): {\displaystyle Q_X = \frac{1}{\tn{size}Q} \sum_{i=1}^{n'}Q_i}
Stage 4 Error correction
- is an error correction subroutine determined by the previously estimated value of and with error parameters and
- Both Sender and Receiver run .
- Receiver obtains
Stage 5 Privacy amplification
- is a privacy amplification subroutine determined by the size , computed from Eq.(3), and with secrecy parameter
- Sender and Receiver run $PA(A_1^{n'},\tilde{B}_1^{n'})$ and obtain secret keys $K_A, K_B$\;