Optimal eavesdropping in quantum cryptography

We consider the Bennett-Brassard cryptographic scheme, which uses two conjugate quantum bases. An eavesdropper who attempts to obtain information on qubits sent in one of the bases causes a disturbance to qubits sent in the other basis. We derive an upper

Optimaleavesdroppinginquantumcryptography.I.

ChristopherA.Fuchs,1NicolasGisin,2RobertB.Gri ths,3

Chi-ShengNiu,3andAsherPeres4,

1NormanBridgeLaboratoryofPhysics12-33,CaliforniaInstituteofTechnology,

Pasadena,CA91125

2GroupofAppliedPhysics,UniversityofGeneva,CH1211Geneva4,Switzerland3

quant-ph/9701039 30 Jan 1997DepartmentofPhysics,Carnegie-MellonUniversity,Pittsburgh,PA152134InstituteforTheoreticalPhysics,UniversityofCalifornia,SantaBarbara,CA93106AbstractWeconsidertheBennett-Brassardcryptographicscheme,whichusestwoconjugatequantumbases.Aneavesdropperwhoattemptstoobtaininformationonqubitssentinoneofthebasescausesadisturbancetoqubitssentintheotherbasis.Wederiveanupperboundtotheaccessibleinformationinonebasis,foragivenerrorrateintheconjugatebasis.Independently xingtheerrorrateintheconjugatebases,weshowthatbothboundscanbeattainedsimultaneouslybyanoptimaleavesdroppingprobe,consistingoftwoqubits.Thequbits’interactionandtheirsubsequentmeasurementaredescribedexplicitly.Theseresultsarecombinedtogiveanexpressionfortheoptimalinformation

aneavesdroppercanobtainforagivenaveragedisturbancewhenherinteractionandmeasurementsareperformedsignalbysignal.Finally,therelationbetweenquantumcryptographyandviolationsofBell’sinequalitiesisdiscussed.

PACSnumber(s):03.65.-w,42.79.Sz,89.70.+c

Permanentaddress:DepartmentofPhysics,Technion—IsraelInstituteofTechnology,32000Haifa,Israel

We consider the Bennett-Brassard cryptographic scheme, which uses two conjugate quantum bases. An eavesdropper who attempts to obtain information on qubits sent in one of the bases causes a disturbance to qubits sent in the other basis. We derive an upper

I.INTRODUCTION

Inquantumcryptography,inpidualquantaarepreparedinnonorthogonalquantumstatestoencodeandcarryinformationaboutcryptographickeys.Inthisway,aneaves-droppercanacquireinformationaboutthekeyonlyattheriskofcausingadetectabledisturbance.Theoldestandbestknowncryptographicscheme,BB84,isduetoBennettandBrassardtheinformationsender,calledAlice,encodeseachlogicalbit,0or1,intothelinearpolarizationofasinglephoton,alongoneoftwoconjugatebasesofherchoice,asshowninFig.1.Thereceiver,Bob,measuresthepolarizationofthephotoninoneofthetwobases,eitherxyoruv,randomlychosenbyhim.Onlyafterthat,Alicerevealstohimthebasissheused.Thisinformationissentonapublicchannelthatcanbemonitored,butnotmodi ed,byanyoneelse.BobthenlikewisetellsAlicewhetherheusedthecorrectbasis.Ifhedid,AliceandBobknowonebit,thatnooneelseoughttoknow.

Afterthisprotocolhasbeenrepeatedmanytimes,AliceandBobsacri cesomeofthesesecretbitsbypubliclycomparingtheirvalues.Thisgivesthemanestimateofthenoiseonthechannel,whichmaybeduetoeithernaturalcausesortothepresenceofaneavesdropper(Eve).Inthelattercase,themaximalamountofinformationthatEvecouldhavegatheredis,inprinciple, xedbythelawsofquantummechanics.IfEve’sinformationissmallenoughcomparedtothenoiseshehasinduced,AliceandBobmaystillbeabletouseclassicalmethodsofprivacyampli cationinordertoreduceEve’sinformationtoanarbitrarilysmalllevel.ItisthereforeimportanttoestimatethemaximalamountofinformationthatEvemayhaveacquired,foragivenerrorrateobservedbyBob.

Therearemanypossiblestrategiesforeavesdropping,someofwhichhavebeenanalyzedbyotherauthors.EkertandHuttnerexaminedasimple“intercept-resend”method,whereEveperformsstandardvonNeumannmeasurements.L¨utkenhausconsideredtheuseofpositiveoperator-valuedmeasures(POVM)[6]undertherestrictionthatEveperformshermeasurementsbeforeAlicerevealsthebasis.Recently,GisinandHuttnerdeterminedtheoptimalstrategyforaneavesdropperrestrictedtoatwo-dimensionalprobe(asinglequbit)interactingonlinewitheachtransmittedsignal,withtheprobemeasuredafterthebasisisrevealed.Thesevariousresults,andtheoptimalonesobtainedinthe

We consider the Bennett-Brassard cryptographic scheme, which uses two conjugate quantum bases. An eavesdropper who attempts to obtain information on qubits sent in one of the bases causes a disturbance to qubits sent in the other basis. We derive an upper

presentarticle,areplottedinFig.2.

Thecommondenominatorofallthesestrategiesisthattheyarerestrictedtointer-actionsandmeasurementsoneachinpidualsignalsentfromAlicetoBob;thereareno“collective”interactionsormeasurementsonstringsofsignals,asmightbethecaseifEvewereableperformquantummeasurementsonsystemsofarbitrarysize.Furthermore,noneofthestrategiesallowEvetodelayhermeasurementsuntilthecompletionofAliceandBob’sprivacyampli cation,andnonetakeintoaccounttheinformationleakedtoherduringthepubliccommunicationphaseoftheprotocol.Thelatterkindofinforma-tiondependsuponwhichbitsareultimatelydiscardedanduponthespeci calgorithmusedintheprivacyampli cationprocess.Finally,evenwithintherestrictionssetbythisparadigm,noneoftheschemescanclaimoptimalityinthesenseofspecifyingthebestpossibleratiobetweenEve’sinformationgainandherinduceddisturbance.

Thepurposeofthisarticleistwofold.The rstistogiveaquantitativestatementofthephysicalprincipleresponsiblefortheoperationoftheBB84protocol:aneavesdropperwhoattemptstoobtaininformationinonebasiscausesadisturbancetotheconjugatebasis.Thesecond—morerelevanttopracticalquantumcryptography—istoderivetheabsolutebestachievableinformationaneavesdroppercanobtainaboutasinglequbit,foragivenaverageerrorratecausedtothesignals.Inboththesetasks,http://www.77cn.com.cnly,weassumethatEvemayinteractwithonlyonesignalatatimeandmayonlymakemeasurementsoneachinpidualprobe.Furthermore,shemaydothisafterAliceannouncesherbasis,butbeforetheexecutionofanyerrortestingorprivacyampli cationprotocols.

Fromthepointofviewofultimatesecurityincryptography,theserestrictionsmaybesevere.Ontheotherhand,withrespecttoexperimentalscience,theseass …… 此处隐藏：23761字，全部文档内容请下载后查看。喜欢就下载吧 ……