Editing BB84 Quantum Key Distribution

This [https://core.ac.uk/download/pdf/82447194.pdf example protocol] implements the task of [[Quantum Key Distribution]] (QKD). The protocol enables two parties to establish a classical secret key by preparing and measuring qubits. The output of the protocol is a classical secret key which is completely unknown to any third party, namely an eavesdropper.  

* '''Network:''' we assume the existence of an authenticated public classical channel between Alice and Bob.

* '''Timing:''' we assume that the network is synchronous.

* '''Adversarial model:''' [[coherent attacks]].

 

The protocol shares a classical key between two parties, Alice and Bob.

The BB84 quantum key distribution protocol consists of the following steps:

*'''Distribution:''' This step involves preparation, exchange and measurement of quantum states. For each round of the distribution phase, Alice randomly chooses a basis (a pair of orthogonal states) out of two available bases (X and Z). She then randomly chooses one of the two states and prepares the corresponding quantum state in the chosen basis. She sends the prepared state to Bob. Upon receiving the state, Bob announces that he received the state and randomly chooses to measure in the either of the two available bases (X or Z). The outcomes of the measurements give Bob a string of classical bits. The two parties repeat the above procedure <math>n</math> times so that at the end of the distribution phase each of them holds an <math>n</math>-bit string.

*'''Sifting:''' Alice and Bob publicly announce their choices of basis and compare them. They discard the rounds in which Bob measured in a different basis than the one prepared by Alice.

*'''Parameter estimation:'''  Alice and Bob use a fraction of the remaining rounds (in which both measured in the same basis) in order to estimate the [[quantum bit error rate]] (QBER).

*'''Error correction:''' Alice and Bob choose a classical error correcting code and publicly communicate in order to correct their string of bits. At the end of this phase Alice and Bob hold the same bit-string.

*'''Privacy amplification:''' Alice and Bob use an [[extractor]] on the previously established string to generate a smaller but completely secret string of bits, which is the final key.

==Requirements ==

*'''Relevant Network Parameters:''' transmission error <math>\epsilon_T</math>, measurement error <math>\epsilon_M</math> (see [[:Category:Prepare and Measure Network Stage|Prepare and Measure]])

**Minimum number of rounds ranging from <math>\mathcal{O}(10^2)</math> to <math>\mathcal{O}(10^5)</math> depending on the network parameters <math>\epsilon_T,\epsilon_M</math>, for commonly used security parameters.

**<math>QBER \leq 0.11</math>, taking a depolarizing model as benchmark. Parameters satisfying <math> \epsilon_T+\epsilon_M\leq 0.11</math> are sufficient to asymptotically get positive secret key rate.

*requires [[random number generator]].

 

 

*<math>X_i, Y_i</math> bits of input of Alice and Bob, respectively, that define the measurement basis.

*<math>A_i,B_i</math> bits of output of Alice and Bob, respectively.

*<math>Z_1^n</math> is a shorthand notation for the string <math>Z_1,\ldots, Z_n</math>.

*<math>K_A,K_B</math> final key of Alice and Bob, respectively.

*<math>\gamma</math> is the probability that Alice (Bob) prepares (measures) a qubit in the <math>X</math> basis.

The protocol implements <math>(n,\epsilon_{\rm corr},\epsilon_{\rm sec},\ell)</math>-QKD, which means that it generates an <math>\epsilon_{\rm corr}</math>-correct, <math>\epsilon_{\rm sec}</math>-secret key of length <math>\ell</math> in <math>n</math> rounds. The security parameters of this protocol are given by

<math>\epsilon_{\rm corr}=\epsilon_{\rm EC},\

<math> \begin{align}

\ell \geq & (1-\gamma)^2n (1-h(Q_X+\nu) -h(Q_Z)) \\ &-\sqrt{(1-\gamma)^2n}\big(4\log(2\sqrt{2}+1)(\sqrt{\log\frac{2}{\epsilon_{\rm PE}^2}}+ \sqrt{\log \frac{8}{{\epsilon'}_{\rm EC}^2}})) \\& -\log(\frac{8}{{\epsilon'}_{\rm EC}^2}+\frac{2}{2-\epsilon'_{\rm EC}})-\log (\frac{1}{\epsilon_{\rm EC}})- 2\log(\frac{1}{2\epsilon_{\rm PA}})  

</math>  

</br>where <math>\nu = \sqrt{ \frac{(1+\gamma^2n)((1-\gamma)^2+\gamma^2)}{(1-\gamma)^2\gamma^4n^2}\log(\frac{1}{\epsilon_{\rm PE}}})</math>

In the above equation for key length, the parameters <math>\epsilon_{\rm EC}</math> and <math>\epsilon'_{\rm EC}</math> are error probabilities of the classical error correction subroutine. At the end of the error correction step, if the protocol does not abort, then Alice and Bob share equal strings of bits with probability at least <math>1-\epsilon_{\rm EC}</math>. The parameter <math>\epsilon'_{\rm EC}</math> is related with the completeness of the error correction subroutine, namely that for an honest implementation, the error correction protocol aborts with probability at most <math>\epsilon'_{\rm EC}+\epsilon_{\rm EC}</math>.  

The parameter <math>\epsilon_{\rm PA}</math> is the error probability of the privacy amplification subroutine and <math>\epsilon_{\rm PE}</math> is the error probability of the parameter estimation subroutine used to estimate <math>Q_X</math>  

(see [[Quantum Key Distribution]] for the precise security definition).

==Protocol Description==

'''1.''' Distribution and measurement

#For <math>i=1,...,n</math>

##  Alice chooses random bits <math>X_i\in\{0,1\}</math> and <math>A_i\in_R\{0,1\}</math> such that <math>P(X_i=1)=\gamma</math>

##  Alice prepares <math>H^{X_i}|A_i\rangle</math> and sends it to Bob

##  Bob announces receiving a state

##  Bob chooses bit <math>Y_i\in_R\{0,1\}</math> such that <math>P(Y_i=1)=\gamma</math>

##  Bob measures <math>H^{X_i}|A_i\rangle</math> in basis <math>\{H^{Y_i}|0\rangle, H^{Y_i}|1\rangle\}</math> with outcome <math>B_i</math>

''At this stage Alice holds strings <math>X_1^n, A_1^n</math> and Bob <math>Y_1^n, B_1^n</math>, all of length <math>n</math>.''

 

'''2.''' Sifting   

#For <math>i=1,...,n</math>

### <math>A_1^{n'} = A_1^{n'}.</math>append<math>(A_i)</math>

''Now Alice holds strings <math>X_1^{n'}, A_1^{n'}</math> and Bob <math>Y_1^{n'}, B_1^{n'}</math>, all of length <math>n'\leq n</math>.''  

#Both Alice and Bob, each, compute <math>Q_X = \frac{1}{\text{size}Q} \sum_{i=1}^{n'}Q_i</math></br>

'''4.''' Error correction

 

''<math>C(\cdot,\cdot)</math> is an error correction subroutine (see [[BB84 Quantum Key Distribution #References| [9]]]) determined by the previously estimated value of <math>Q_Z</math> and with error parameters  <math>\epsilon'_{\rm EC}</math> and <math>\epsilon_{\rm EC}</math>

#Both Alice and Bob run <math>C(A_1^{n'},B_1^{n'})</math>''.  

#Bob obtains <math>\tilde{B}_1^{n'}</math>

'''5.''' Privacy amplification

 

''<math>PA(\cdot,\cdot)</math> is a privacy amplification subroutine (see [[BB84 Quantum Key Distribution #References| [10]]]) determined by the size <math>\ell</math>, computed from equation for key length <math>\ell</math> (see [[Quantum Key Distribution#Properties|Properties]]), and  with secrecy parameter <math>\epsilon_{\rm PA}</math>''

#Alice and Bob run <math>PA(A_1^{n'},\tilde{B}_1^{n'})</math> and obtain secret keys <math>K_A, K_B</math>;

 

# A post-processing of the key using 2-way classical communication, denoted [[Advantage distillation]], can increase the QBER tolerance up to <math>18.9\%</math> (3).