BB84 Quantum Key Distribution: Difference between revisions

Jump to navigation Jump to search
no edit summary
No edit summary
Line 1: Line 1:


The BB84 protocol implements the task of [[Quantum Key Distribution]] (QKD). The protocol enables two parties, Sender and Receiver, to establish a classical secret key by preparing and measuring qubits. The output of the protocol is a classical secret key which is completely unknown to any third party, namely an eavesdropper.  
The BB84 protocol implements the task of [[Quantum Key Distribution]] (QKD). The protocol enables two parties, Alice and Bob, to establish a classical secret key by preparing and measuring qubits. The output of the protocol is a classical secret key which is completely unknown to any third party, namely an eavesdropper.  


'''Tags:''' [[:Category:Two Party Protocols|Two Party]], [[:Category:Quantum Enhanced Classical Functionality|Quantum Enhanced Classical Functionality]], [[:Category:Specific Task|Specific Task]],[[Quantum Key Distribution]], [[Device Independent Quantum Key Distribution|Device Independent QKD]], [[Category:Multi Party Protocols]] [[Category:Quantum Enhanced Classical Functionality]][[Category:Specific Task]][[Category:Prepare and Measure Network Stage]]
'''Tags:''' [[:Category:Two Party Protocols|Two Party]], [[:Category:Quantum Enhanced Classical Functionality|Quantum Enhanced Classical Functionality]], [[:Category:Specific Task|Specific Task]],[[Quantum Key Distribution]], [[Device Independent Quantum Key Distribution|Device Independent QKD]], [[Category:Multi Party Protocols]] [[Category:Quantum Enhanced Classical Functionality]][[Category:Specific Task]][[Category:Prepare and Measure Network Stage]]
Line 8: Line 8:
* We assume security from [[coherent attacks]]
* We assume security from [[coherent attacks]]
==Outline==
==Outline==
The protocol shares a classical between two parties, sender and receiver.
The protocol shares a classical between two parties, Alice and Bob.
The BB84 quantum key distribution protocol is composed by the following steps:
The BB84 quantum key distribution protocol is composed by the following steps:
*'''Distribution:''' This step involves preparation, exchange and measurement of quantum states. For each round of the distribution phase, Sender randomly chooses a basis (a pair of orthogonal states) out of two available bases (X and Z). She then randomly chooses one of the two states and prepares the corresponding quantum state in the chosen basis. She sends the prepared state to Receiver. Upon receiving the state, Receiver announces that he received the state and randomly chooses to measure in the either of the two available bases (X or Z). The outcomes of the measurements give Receiver a string of classical bits. The two parties repeat the above procedure <math>n</math> times so that at the end of the distribution phase each of them holds an <math>n</math>-bit string.
*'''Distribution:''' This step involves preparation, exchange and measurement of quantum states. For each round of the distribution phase, Alice randomly chooses a basis (a pair of orthogonal states) out of two available bases (X and Z). She then randomly chooses one of the two states and prepares the corresponding quantum state in the chosen basis. She sends the prepared state to Bob. Upon receiving the state, Bob announces that he received the state and randomly chooses to measure in the either of the two available bases (X or Z). The outcomes of the measurements give Bob a string of classical bits. The two parties repeat the above procedure <math>n</math> times so that at the end of the distribution phase each of them holds an <math>n</math>-bit string.
*'''Sifting:''' Both parties publicly announce their choices of basis and compare them. They discard the rounds in which Receiver measured in a different basis than the one prepared by Sender.
*'''Sifting:''' Both parties publicly announce their choices of basis and compare them. They discard the rounds in which Bob measured in a different basis than the one prepared by Alice.
*'''Parameter estimation:'''  Both parties use a fraction of the remaining rounds (in which both measured in the same basis) in order to estimate the [[quantum bit error rate]] (QBER).
*'''Parameter estimation:'''  Both parties use a fraction of the remaining rounds (in which both measured in the same basis) in order to estimate the [[quantum bit error rate]] (QBER).
*'''Error correction:''' Both together, choose a classical error correcting code and publicly communicate in order to correct their string of bits. At the end of this phase both parties hold the same bit-string.
*'''Error correction:''' Both together, choose a classical error correcting code and publicly communicate in order to correct their string of bits. At the end of this phase both parties hold the same bit-string.
Line 27: Line 27:
*<math>n</math> number of total rounds of the protocol.
*<math>n</math> number of total rounds of the protocol.
*<math>\ell</math> size of the secret key.
*<math>\ell</math> size of the secret key.
*<math>X_i, Y_i</math> bits of input of Sender and Receiver, respectively, that define the measurement basis.
*<math>X_i, Y_i</math> bits of input of Alice and Bob, respectively, that define the measurement basis.
*<math>A_i,B_i</math> bits of output of Sender and Receiver, respectively.
*<math>A_i,B_i</math> bits of output of Alice and Bob, respectively.
*<math>K_A,K_B</math> final key of Sender and Receiver, respectively.
*<math>K_A,K_B</math> final key of Alice and Bob, respectively.
*<math>Q_X</math> is the quantum bit error rate QBER in the <math>X</math> basis.
*<math>Q_X</math> is the quantum bit error rate QBER in the <math>X</math> basis.
*<math>Q_Z</math> is the quantum bit error rate QBER in the <math>Z</math> basis estimated prior to the protocol.
*<math>Q_Z</math> is the quantum bit error rate QBER in the <math>Z</math> basis estimated prior to the protocol.
*<math>H</math> is the Hadamard gate. <math>H^{0} = I, H^{1} = H</math>.
*<math>H</math> is the Hadamard gate. <math>H^{0} = I, H^{1} = H</math>.
*<math>\gamma</math> is the probability that Sender (Receiver) prepares (measures) a qubit in the <math>X</math> basis.
*<math>\gamma</math> is the probability that Alice (Bob) prepares (measures) a qubit in the <math>X</math> basis.
*<math>\epsilon_{\rm EC}</math>, <math>\epsilon'_{\rm EC}</math> are the error probabilities of the error correction protocol.
*<math>\epsilon_{\rm EC}</math>, <math>\epsilon'_{\rm EC}</math> are the error probabilities of the error correction protocol.
*<math>\epsilon_{\rm PA}</math> is the error probability of the privacy amplification protocol.
*<math>\epsilon_{\rm PA}</math> is the error probability of the privacy amplification protocol.
Line 50: Line 50:
and <math>h(\cdot)</math> is the [[binary entropy function]].  
and <math>h(\cdot)</math> is the [[binary entropy function]].  


In the above equation for key length, the parameters <math>\epsilon_{\rm EC}</math> and <math>\epsilon'_{\rm EC}</math> are error probabilities of the classical error correction subroutine. At the end of the error correction step, if the protocol does not abort, then Sender and Receiver share equal strings of bits with probability at least <math>1-\epsilon_{\rm EC}</math>. The parameter <math>\epsilon'_{\rm EC}</math> is related with the completeness of the error correction subroutine, namely that for an honest implementation, the error correction protocol aborts with probability at most <math>\epsilon'_{\rm EC}+\epsilon_{\rm EC}</math>.  
In the above equation for key length, the parameters <math>\epsilon_{\rm EC}</math> and <math>\epsilon'_{\rm EC}</math> are error probabilities of the classical error correction subroutine. At the end of the error correction step, if the protocol does not abort, then Alice and Bob share equal strings of bits with probability at least <math>1-\epsilon_{\rm EC}</math>. The parameter <math>\epsilon'_{\rm EC}</math> is related with the completeness of the error correction subroutine, namely that for an honest implementation, the error correction protocol aborts with probability at most <math>\epsilon'_{\rm EC}+\epsilon_{\rm EC}</math>.  
The parameter <math>\epsilon_{\rm PA}</math> is the error probability of the privacy amplification subroutine and <math>\epsilon_{\rm PE}</math> is the error probability of the parameter estimation subroutine used to estimate <math>Q_X</math>.  
The parameter <math>\epsilon_{\rm PA}</math> is the error probability of the privacy amplification subroutine and <math>\epsilon_{\rm PE}</math> is the error probability of the parameter estimation subroutine used to estimate <math>Q_X</math>.  
(See [[Quantum Key Distribution]] for the precise security definition)
(See [[Quantum Key Distribution]] for the precise security definition)
Line 59: Line 59:
<u>'''Stage 1'''</u> Distribution and measurement
<u>'''Stage 1'''</u> Distribution and measurement
#For i=1,2,...,n
#For i=1,2,...,n
##  Sender chooses random bits <math>X_i\epsilon\{0,1\}</math> and <math>A_i\epsilon_R\{0,1\}</math> such that <math>P(X_i=1)=\gamma</math>
##  Alice chooses random bits <math>X_i\epsilon\{0,1\}</math> and <math>A_i\epsilon_R\{0,1\}</math> such that <math>P(X_i=1)=\gamma</math>
##  Sender prepares <math>H^{X_i}|A_i\rangle</math> and sends it to Receiver
##  Alice prepares <math>H^{X_i}|A_i\rangle</math> and sends it to Bob
##  Receiver announces receiving a state
##  Bob announces receiving a state
##  Receiver chooses bit <math>Y_i\in_R\{0,1\}</math> such that <math>P(Y_i=1)=\gamma</math>
##  Bob chooses bit <math>Y_i\in_R\{0,1\}</math> such that <math>P(Y_i=1)=\gamma</math>
##  Receiver measures <math>H^{X_i}|A_i\rangle</math> in basis <math>\{H^{Y_i}|0\rangle, H^{Y_i}|1\rangle\}</math> with outcome <math>B_i</math>
##  Bob measures <math>H^{X_i}|A_i\rangle</math> in basis <math>\{H^{Y_i}|0\rangle, H^{Y_i}|1\rangle\}</math> with outcome <math>B_i</math>
    
    
*At this stage Sender holds strings <math>X_1^n, A_1^n</math> and Receiver <math>Y_1^n, B_1^n</math>, all of length <math>n</math>
*At this stage Alice holds strings <math>X_1^n, A_1^n</math> and Bob <math>Y_1^n, B_1^n</math>, all of length <math>n</math>
<u>'''Stage 2'''</u> Sifting   
<u>'''Stage 2'''</u> Sifting   
#Alice and Bob publicly announce <math>X_1^n, Y_1^n</math>
#Alice and Bob publicly announce <math>X_1^n, Y_1^n</math>
Line 74: Line 74:
### <math>X_1^{n'} = X_1^{n'}.</math>append<math>(X_i)</math>
### <math>X_1^{n'} = X_1^{n'}.</math>append<math>(X_i)</math>
### <math>Y_1^{n'} = Y_1^{n'}.</math>append<math>(Y_i)</math>
### <math>Y_1^{n'} = Y_1^{n'}.</math>append<math>(Y_i)</math>
*Now Sender holds strings <math>X_1^{n'}, A_1^{n'}</math> and Receiver <math>Y_1^{n'}, B_1^{n'}</math>, all of length <math>n'\leq n</math>
*Now Alice holds strings <math>X_1^{n'}, A_1^{n'}</math> and Bob <math>Y_1^{n'}, B_1^{n'}</math>, all of length <math>n'\leq n</math>
<u>'''Stage 3'''</u> Parameter estimation
<u>'''Stage 3'''</u> Parameter estimation
#For <math>i=1,...,n</math>
#For <math>i=1,...,n</math>
## size<math>Q</math> = 0
## size<math>Q</math> = 0
## If{<math>X_i = Y_i = 1</math>
## If{<math>X_i = Y_i = 1</math>
### Sender and Receiver publicly announce <math>A_i, B_i</math>
### Alice and Bob publicly announce <math>A_i, B_i</math>
### Sender and Receiver compute <math>Q_i = 1 - \delta_{A_iB_i}</math>, where <math>\delta_{A_iB_i}</math> is the Kronecker delta
### Alice and Bob compute <math>Q_i = 1 - \delta_{A_iB_i}</math>, where <math>\delta_{A_iB_i}</math> is the Kronecker delta
## size<math>Q</math> += 1\;
## size<math>Q</math> += 1\;


*Both Sender and Receiver, each, compute <math>Q_X = \frac{1}{\text{size}Q} \sum_{i=1}^{n'}Q_i</math></br>
*Both Alice and Bob, each, compute <math>Q_X = \frac{1}{\text{size}Q} \sum_{i=1}^{n'}Q_i</math></br>
<u>'''Stage 4'''</u> Error correction
<u>'''Stage 4'''</u> Error correction
*''<math>C(\cdot,\cdot)</math> is an error correction subroutine determined by the previously estimated value of <math>Q_Z</math> and with error parameters  <math>\epsilon'_{\rm EC}</math> and <math>\epsilon_{\rm EC}</math>
*''<math>C(\cdot,\cdot)</math> is an error correction subroutine determined by the previously estimated value of <math>Q_Z</math> and with error parameters  <math>\epsilon'_{\rm EC}</math> and <math>\epsilon_{\rm EC}</math>
#Both Sender and Receiver run <math>C(A_1^{n'},B_1^{n'})</math>''.  
#Both Alice and Bob run <math>C(A_1^{n'},B_1^{n'})</math>''.  
#Receiver obtains <math>\tilde{B}_1^{n'}</math>
#Bob obtains <math>\tilde{B}_1^{n'}</math>
<u>'''Stage 5'''</u> Privacy amplification
<u>'''Stage 5'''</u> Privacy amplification
*''<math>PA(\cdot,\cdot)</math> is a privacy amplification subroutine determined by the size <math>\ell</math>, computed from equation for key length <math>\ell</math> (see [[Quantum Key Distribution#Properties|Properties]]), and  with secrecy parameter <math>\epsilon_{\rm PA}</math>''
*''<math>PA(\cdot,\cdot)</math> is a privacy amplification subroutine determined by the size <math>\ell</math>, computed from equation for key length <math>\ell</math> (see [[Quantum Key Distribution#Properties|Properties]]), and  with secrecy parameter <math>\epsilon_{\rm PA}</math>''
#Sender and Receiver run <math>PA(A_1^{n'},\tilde{B}_1^{n'})</math> and obtain secret keys <math>K_A, K_B</math>\;
#Alice and Bob run <math>PA(A_1^{n'},\tilde{B}_1^{n'})</math> and obtain secret keys <math>K_A, K_B</math>\;


==Further Information==
==Further Information==
Write
262

edits

Navigation menu