Search

Passive side-channel attacks in quantum key distribution (QKD) aim at obtaining information about the quantum signals without disturbing them and hence compromise real-world QKD security. Currently, there are no reliable tools for the assessment of QKD signal generation imperfections. In this work we propose a generic experimental method which allows to upper-bound QKD light-source imperfections and directly integrate them into the modern security proofs. The method relies on Hong-Ou-Mandel interference between different emitted signals: the maximum interference visibility reveals overall signal distinguishability that could lead to passive side-channel information leakage. We apply it for the standard decoy-state BB84 protocol and calculate a lower bound on the secret key rate for realistic values of interference visibility. The method can be readily implemented in practical QKD setups and is especially relevant for multiple-laser QKD systems such as the one installed on the Micius satellite.

Optical homodyne detection has been widely used in continuous-variable (CV) quantum information processing for measuring field quadrature. In this paper we explore the possibility of operating a conjugate homodyne detection system in ``photon counting'' mode to implement discrete-variable (DV) quantum key distribution (QKD). A conjugate homodyne detection system, which consists of a beam splitter followed by two optical homodyne detectors, can simultaneously measure a pair of conjugate quadratures $X$ and $P$ of the incoming quantum state. In classical electrodynamics, ${X}^{2}+{P}^{2}$ is proportional to the energy (the photon number) of the input light. In quantum optics, $X$ and $P$ do not commute and thus the above photon-number measurement is intrinsically noisy. This implies that a blind application of standard security proofs of QKD could result in pessimistic performance. We overcome this obstacle by taking advantage of two special features of the proposed detection scheme. First, the fundamental detection noise associated with vacuum fluctuations cannot be manipulated by an external adversary. Second, the ability to reconstruct the photon number distribution at the receiver's end can place additional constraints on possible attacks from the adversary. As an example, we study the security of the BB84 QKD using conjugate homodyne detection and evaluate its performance through numerical simulations. This study may open the door to a family of QKD protocols, complementary to the well-established DV-QKD based on single-photon detection and CV-QKD based on coherent detection.

All phase-encoded BB84 implementations have signal states with unbalanced amplitudes in practice. Thus, the original security analyses a priori do not apply to them. Previous security proofs use signal tagging of multi-photon pulses to recover the behaviour of regular BB84. This is overly conservative, as for unbalanced signals, the photon-number splitting attack does not leak full information to Eve. In this work, we exploit the flag-state squashing model to preserve some parts of the multi-photon generated private information in our analysis. Using a numerical proof technique, we obtain significantly higher key rates compared with previously published results in the low-loss regime. It turns out that the usual scenario of untrusted dark counts runs into conceptual difficulties in some parameter regime. Thus, we discuss the trusted dark count scenario in this paper as well. We also report a gain in key rates when part of the total loss is known to be induced by a trusted device. We highlight that all these key rate improvements can be achieved without modification of the experimental setup., 17 pages, 6 figures

In this paper we consider the Liouville equation that describes the quantum nonunitary dynamics of quantum states in optical fiber. We consider a particular case of thermalization aiming to applications related to various quantum information protocols; however, the model can be generalized in various ways taking into account more features (external pump, nonlinear interactions, continuous spectra, free space propagation, etc.). In order to obtain the appropriate evolution models for states in the channel we use the $\text{su}(1,1)$ algebra formalism in the Liouville representation. The developed model is applied in cases of two different initial states as an example. The first is single- and multifrequency-mode (e.g., wavelength-division-multiplexed) weak coherent states in quantum notation as a rather simple but useful example. This particular example is of interest since weak coherent states are a commonly used tool in various fields of optics, e.g., optical communication, quantum key distribution, etc. Results for coherent states are well agreed upon with classical theories; however, in order to highlight quantum features of developed theory we also consider the case of nonclassical light, in particular, Fock states. Considered implementation of the model takes into account dichroism, retardance, thermalization, dispersion, and decoherence in the polarization domain. We derive expressions of evolved states, mean photon number, and estimate the Stokes parameters as well as the degree of polarization. Considered examples explicitly demonstrate all the features and effects of the developed approach. The described approach allows one to connect the information properties of quantum channels with its physical ones. In order to illustrate this statement we consider BB84 quantum key distribution protocol and investigate the behavior of the quantum bit error rate affected by considered physical phenomena in an optical fiber.

In this paper we propose a practical quantum key distribution protocol based on geometrically uniform states and a standard decoy state technique. The protocol extends the ideas used in SARG04 to the limit where the core quantum communication is secure against unambiguous state discrimination and provides some level of inherent resistance to photon number splitting attacks. Additional decoy state overlay ensures its conformity to the conventional security requirements. The protocol security is analyzed by an explicit construction of the most optimal unitary attack, which is known to reach the tight security bound in the case of BB84., 7 pages, 3 figures

Self-calibrating quantum state tomography aims at reconstructing the unknown quantum state and certain properties of the measurement devices from the same data. Since the estimates of the state and device parameters come from the same data, one should employ a joint estimation scheme, including the construction and reporting of joint state-device error regions to quantify uncertainty. We explain how to do this naturally within the framework of optimal error regions. As an illustrative example, we apply our procedure to the double-crosshair measurement of the BB84 scenario in quantum cryptography and so reconstruct the state and estimate the detection efficiencies simultaneously and reliably. We also discuss the practical situation of a satellite-based quantum key distribution scheme, for which self-calibration and proper treatment of the data are necessities., Comment: 10 pages, 7 figures, 2 tables

Semi-quantum key distribution protocols are designed to allow two parties to establish a shared secret key, secure against an all-powerful adversary, even when one of the users is restricted to measuring and preparing quantum states in one single basis. While interesting from a theoretical standpoint, these protocols have the disadvantage that a two-way quantum communication channel is necessary which generally limits their theoretical efficiency and noise tolerance. In this paper, we construct a new semi-quantum key distribution (SQKD) protocol which actually takes advantage of this necessary two-way channel, and, after performing an information theoretic security analysis against collective attacks, we show it is able to tolerate a channel noise level higher than any prior SQKD protocol to-date. We also compare the noise tolerance of our protocol to other two-way fully quantum protocols, along with BB84 with Classical Advantage Distillation (CAD). We also comment on some practical issues involving semi-quantum key distribution (in particular, concerning the potential complexity in physical implementation of our protocol as compared with other standard QKD protocols). Finally, we develop techniques that can be applied to the security analysis of other (S)QKD protocols reliant on a two-way quantum communication channel.

In this work we consider the Liouville equation; it describes the dynamics of the photon density matrix in the Schr\"odinger representation based on the Markov approximation in the channel without dispersion. The equation contains a relaxation superoperator dependent on the phenomenological parameters of the optical fiber. These parameters allow one to take into account the phenomena of birefringence and optical activity, isotropic absorption, and dichroism. We also present in our work that these parameters affect not only the polarization of the states but the length of the Stokes vector. Hence the developed technique describes the decoherence process in the polarization domain in the quantum case and allows one to analyze the dynamics of single-photon states in the quantum (depolarizing) channel more properly. We also present a visual illustration of polarization states' evolution in the polarization-coded quantum key distribution BB84 protocol as an example. We estimate quantum bit error rates' dependence on channel length. Also we examine maximal allowed channel length, dependent on various configurations of channel parameters.

Combining the differential-quadrature-phase-shift (DQPS) quantum key distribution (QKD) protocol and the recently proposed round-robin-differential-phase-shift (RRDPS), the round-robin-differential-quadrature-phase-shift (RRDQPS) protocol has been proposed. However, a security proof of the RRDQPS QKD protocol is still missing and its advantage over the original RRDPS protocol is also unknown. Here, we give the security proof of single-photon RRDQPS protocol, by which we clearly show that, if a single photon source is applied, RRDQPS protocol will overwhelm the original RRDPS protocol in terms of tolerable error rate. More interestingly, our proof gives a unified theory covering the well-known Bennett-Brassard 1984 (BB84) protocol and RRDQPS protocol. Thus, it is confirmed that BB84 protocol is indeed a special case of the RRDQPS protocol.

The key piece of knowledge which quantum eavesdroppers can access is the correlation between prior and future events, i.e., the postselected results of the legitimate preparations and measurements. We present a method for optimizing eavesdropping strategies which is closely related to the two-time state formalism, the natural way to analyze such scenarios; it converts the task of optimization into an eigenvalue problem. Our framework is applied to the familiar BB84 and B92 protocols as well as to the largely unexplored three-state scheme, which has a remarkable feature: the best eavesdropping strategy does not extract any information about the sent state.

The security of quantum key distribution (QKD) has been proven for different protocols, in particular for the BB84 protocol. It has been shown that this scheme is robust against eventual imperfections in the state preparation, and sending only three different states delivers the same secret key rate achievable with four states. In this work, we prove in a finite-key scenario that the security of this protocol can be maintained even with fewer measurement operators on the receiver. This allows us to implement a time-bin encoding scheme with a minimum amount of resources.

The discrete-variable quantum key distribution protocols based on the 1984 protocol of Bennett and Brassard (BB84) are known to be secure against an eavesdropper, Eve, intercepting the flying qubits and performing any quantum operation on them. However, these protocols may still be vulnerable to side-channel attacks. We investigate the Trojan-horse side-channel attack where Eve sends her own state into Alice's apparatus and measures the reflected state to estimate the key. We prove that the separable coherent state is optimal for Eve among the class of multimode Gaussian attack states, even in the presence of thermal noise. We then provide a bound on the secret key rate in the case where Eve may use any separable state.

Decoy state method closes source security loophole in quantum key distribution (QKD) using laser source. In this method, accurate estimates of the detection rates of vacuum and single photon events plus the error rate of single photon events are needed to give a good enough lower bound of the secret key rate. Nonetheless, the current estimation method for these detection and error rates, which uses three types of photon intensities, is accurate up to about 1% relative error. Here I report an experimentally feasible way that greatly improves these estimates and hence increases the one-way key rate of the BB84 QKD protocol with unbiased bases selection by at least 20% on average in realistic settings. The major tricks are the use of more than three types of photon intensities plus the fact that estimating bounds of the above detection and error rates is numerically stable although these bounds are related to the inversion of a high condition number matrix., Extensively revised and corrected. Main conclusions stay. 6 pages with 1 long table. Accepted by PRA Rapid Communication

Quantum key distribution (QKD) offers a way for establishing information-theoretically secure communications. An important part of QKD technology is a high-quality random number generator (RNG) for quantum states preparation and for post-processing procedures. In the present work, we consider a novel class of prepare-and-measure QKD protocols, utilizing additional pseudorandomness in the preparation of quantum states. We study one of such protocols and analyze its security against the intercept-resend attack. We demonstrate that, for single-photon sources, the considered protocol gives better secret key rates than the BB84 and the asymmetric BB84 protocol. However, the protocol strongly requires single-photon sources., Comment: 16 pages, 4 figures; comments are welcome

An essential step in quantum key distribution is the estimation of parameters related to the leaked amount of information, which is usually done by sampling of the communication data. When the data size is finite, the final key rate depends on how the estimation process handles statistical fluctuations. Many of the present security analyses are based on the method with simple random sampling, where hypergeometric distribution or its known bounds are used for the estimation. Here we propose a concise method based on Bernoulli sampling, which is related to binomial distribution. Our method is suitable for the BB84 protocol with weak coherent pulses, reducing the number of estimated parameters to achieve a higher key generation rate compared to the method with simple random sampling. We also applied the method to prove the security of the differential-quadrature-phase-shift (DQPS) protocol in the finite-key regime. The result indicates that, the advantage of the DQPS protocol over the phase-encoding BB84 protocol in terms of the key rate, which was previously confirmed in the asymptotic regime, persists in the finite-key regime., 13 pages, 5 figures

The discrete variables (DV) time-frequency (TF) quantum key distribution (QKD) protocol is a BB84 like protocol, which utilizes time and frequency as complementary bases. As orthogonal modulations, pulse position modulation (PPM) and frequency shift keying (FSK) are capable of transmitting several bits per symbol, i.e. per photon. However, unlike traditional binary polarization shift keying, PPM and FSK do not allow perfectly complementary bases. So information is not completely deleted when the wrong-basis filters are applied. Since a general security proof does not yet exist, we numerically assess DV-TF-QKD. We show that the secret key rate increases with a higher number of symbols per basis. Further we identify the optimal pulse relations in the two bases in terms of key rate and resistance against eavesdropping attacks., 9 Pages, 4 Figures

It is known that measurement-device-independent quantum key distribution (MDI-QKD) provides ultimate security from all types of side-channel attack on detectors at the expense of low key rate. In the present study, we propose MDI-QKD using three-dimensional quantum states and show that the protocol improves the secret key rate under the analysis of mismatched-basis statistics. Specifically, we analyze security of the $3d$-MDI-QKD protocol with askew aligned sources, meaning that the original sources contain unwanted states instead of the expected one. We evaluate the secret key rate of the protocol and identify the regime in which the key rate is higher than the protocol with the qubit MDI-QKD.

Quantum position verification (QPV) is the art of verifying the geographical location of an untrusted party. Recently, it has been shown that the widely studied Bennett & Brassard 1984 (BB84) QPV protocol is insecure after the 3 dB loss point assuming local operations and classical communication (LOCC) adversaries. Here, we propose a time-reversed entanglement swapping QPV protocol (based on measurement-device-independent quantum cryptography) that is highly robust against quantum channel loss. First, assuming ideal qubit sources, we show that the protocol is secure against LOCC adversaries for any quantum channel loss, thereby overcoming the 3 dB loss limit. Then, we analyze the security of the protocol in a more practical setting involving weak laser sources and linear optics. In this setting, we find that the security only degrades by an additive constant and the protocol is able to verify positions up to 47 dB channel loss., 11 pages, 3 figures. Partially based on an earlier work in arXiv:1510.04891

One of the simplest methods for implementing quantum key distribution over fiber-optic communication is the Bennett-Brassard 1984 protocol with phase encoding (PE-BB84 protocol), in which the sender uses phase modulation over double pulses from a laser and the receiver uses a passive delayed interferometer. Using essentially the same setup and by regarding a train of many pulses as a single block, one can carry out the so-called differential quadrature phase shift (DQPS) protocol, which is a variant of differential phase shift (DPS) protocols. Here we prove the security of the DQPS protocol based on an adaptation of proof techniques for the BB84 protocol, which inherits the advantages arising from the simplicity of the protocol, such as accommodating the use of threshold detectors and simple off-line calibration methods for the light source. We show that the secure key rate of the DQPS protocol in the proof is eight thirds as high as the rate of the PE-BB84 protocol., Comment: Citation of the Fig.1 in the text corrected

Recently, Lucamarini et al. proposed the device-independent entanglement-based Bennett 1992 protocol [Phys. Rev. A 86, 032325 (2012)]. By exploiting the results in device-independent quantum key distribution with the Clauser-Horne-Shimony-Holt inequality, they claimed the security of their protocol. We will show, however, the way of encoding and the process for the latent eavesdropper to obtain the illegal information are different in these two protocols. Thus the security of their protocol cannot rely on Bell's theorem only.

We present a scheme for realizing passive quantum key distribution with heralded single-photon sources. In this scheme, the idler light from the parametric down-conversion process is split into two parts and sent into two local detectors individually. Then all the clicking and nonclicking events are used to herald the arrival and nonarrival of the signal light. As a result, a precise estimation of the behavior of the single-photon pulses can be achieved without changing the light intensity. Furthermore, we compare our scheme with other existing methods with the Bennett-Brassard 1984 (BB84) protocol through numerical simulations. Our simulations demonstrate that the performance of our scheme can greatly overcome other existing practical methods and approach very close to the asymptotic case of using infinite-decoy-state methods.

The decoy-state method allows the use of weak coherent pulses in quantum cryptography, and to date, various strategies for the decoy state have been proposed. Here, we experimentally compare the secret key generation rates between the one-decoy and two-decoy implementations of the Bennett-Brassard 1984 (BB84) quantum key distribution protocol through a 3.1-km optical fiber at 780 nm. Once the parameters of the experimental setup are optimized for the maximal secret key generation rate for each implementation, it is found that the two-decoy implementation outperforms the one-decoy implementation.

Recently some alternatives to the measurement-device-independent (MDI) quantum key distribution (QKD) based on the single-photon Bell-state measurement (SBSM) were proposed. Although these alternatives are not precisely as secure as the MDI QKD, they possess the advantage of a high key rate of the traditional BB84-like protocol and avoid the technical complexity of two-photon interference required in the MDI QKD. However, the setups of these proposed schemes are rather complicated compared to commonly used BB84 systems. Here we propose a simple implementation of SBSM-based QKD that is directly built on the existing realization of the BB84 QKD. Our proposal exhibits the hidden connection between the SBSM-based QKD and traditional phase-encoding QKD protocols. This finding discloses the physics behind these two different types of QKD protocols. In addition, we experimentally demonstrate the feasibility of our protocol.

Universal blind quantum computation (UBQC) is a new secure quantum computing protocol which allows a user Alice who does not have any sophisticated quantum technology to delegate her computing to a server Bob without leaking any privacy. Using the features of UBQC, we propose a protocol to achieve symmetrically private information retrieval, which allows a quantum limited Alice to query an item from Bob with a fully fledged quantum computer; meanwhile, the privacy of both parties is preserved. The security of our protocol is based on the assumption that malicious Alice has no quantum computer, which avoids the impossibility proof of Lo. For the honest Alice, she is almost classical and only requires minimal quantum resources to carry out the proposed protocol. Therefore, she does not need any expensive laboratory which can maintain the coherence of complicated quantum experimental setups.

Measurement-device-independent quantum key distribution (MDI-QKD) protocol has been demonstrated as a viable solution to detector side-channel attacks. One of the main advantages of MDI-QKD is that the security can be proved without making any assumptions about how the measurement device works. The price to pay is the relatively low secure key rate comparing with conventional quantum key distribution (QKD), such as the decoy-state BB84 protocol. Recently a new QKD protocol, aiming at bridging the strong security of MDI-QKD with the high efficiency of conventional QKD, has been proposed. In this protocol, the legitimate receiver employs a trusted linear optics network to encode information on photons received from an insecure quantum channel, and then performs a Bell state measurement (BSM) using untrusted detectors. One crucial assumption made in most of these studies is that the untrusted BSM located inside the receiver's laboratory cannot send any unwanted information to the outside. Here, we show that if the BSM is completely untrusted, a simple scheme would allow the BSM to send information to the outside. Combined with Trojan horse attacks, this scheme could allow Eve to gain information of the quantum key without being detected. To prevent the above attack, either countermeasures to Trojan horse attacks or some trustworthiness to the "untrusted" BSM device is required., Comment: 6 pages, 2 figures

In this paper, we present schemes on implementing the single-photon-added coherent source in quantum key distributions. We apply this source in either the standard BB84 protocol or the recently proposed measurement-device-independent quantum key distribution, comparing their performance with the cases of using other existing sources, e.g., the weak coherent source or the heralded single-photon source, and giving out corresponding numerical simulations. Our simulation results show that in both protocols the single-photon-added coherent source can greatly exceed all other existing sources. Moreover, even when taking statistical fluctuation into account, a high key generation rate can still be achieved at long distance by applying this source.

Local randomization is a preprocessing procedure in which one of the legitimate parties of a quantum key distribution (QKD) scheme adds noise to their version of the key and was found by Kraus et al. [Phys. Rev. Lett. 95, 080501 (2005)] to improve the security of certain QKD protocols. In this article, the improvement yielded by local randomization is derived for an imperfect implementation of the Bennett-Brassard 1984 (BB84) QKD protocol, in which the source emits four given but arbitrary pure states and the detector performs arbitrarily aligned measurements. Specifically, this is achieved by modifying an approach to analyzing the security of imperfect variants of the BB84 protocol against collective attacks, introduced in [Phys. Rev. A 88, 012331 (2013)], to include the additional preprocessing step. The previously known improvement to the threshold channel noise, from 11% to 12.41%, is recovered in the special case of an ideal BB84 implementation and becomes more pronounced in the case of a nonideal source. Finally, the bound derived for the asymptotic key rate, both with and without local randomization, is shown to be tight with the particular source characterization used. This is demonstrated by the explicit construction of a family of source states and optimal attacks for which the key-rate bound is attained with equality.

Quantum steering is the ability to remotely prepare different quantum states by using entangled pairs as a resource. Very recently, the concept of steering has been quantified with the use of inequalities, leading to substantial applications in quantum information and communication science. Here, we highlight that there exists a natural temporal analogue of the steering inequality when considering measurements on a single object at different times. We give non-trivial operational meaning to violations of this temporal inequality by showing that it is connected to the security bound in the BB84 protocol and thus may have applications in quantum communication., Comment: 8 pages, 5 figures, to appear in PRA

In this article I present a protocol for quantum cryptography which is secure against attacks on individual signals. It is based on the Bennett-Brassard protocol of 1984 (BB84). The security proof is complete as far as the use of single photons as signal states is concerned. Emphasis is given to the practicability of the resulting protocol. For each run of the quantum key distribution the security statement gives the probability of a successful key generation and the probability for an eavesdropper's knowledge, measured as change in Shannon entropy, to be below a specified maximal value., Authentication scheme corrected. Other improvements of presentation

It is demonstrated that the eavesdropping optimization obtained recently by Slutsky et al. [Phys. Rev. A 57, 2383 (1998)] for Bennett's two-state protocol of key distribution in quantum cryptography holds, not only for the case in which an ordinary von Neumann projective measure is implemented by the legitimate receiver, but also for the case in which a positive operator-valued measure is implemented, as in Brandt et al. [Phys. Rev. A 56, 4456 (1997)]. In both cases, identical expressions hold for both the Renyi information gained by the eavesdropper and for the error rate induced by the eavesdropper in terms of the parameters characterizing the key distribution system and the eavesdropper's probe.

An attempt to eavesdrop on a quantum cryptographic channel reveals itself through errors it inevitably introduces into the transmission. We investigate the relationship between the induced error rate and the maximum amount of information the eavesdropper can extract, in both the two-state B92 [B92 refers to the work of C. H. Bennett, Phys. Rev. Lett. 68, 3121 (1992)] and the four-state BB84 [BB84 refers to the work of C. H. Bennett and G. Brassard, in Proceedings of the IEEE International Conference on Computers, Systems, and Signal Processing, Bangalore, India (IEEE, New York, 1984), pp. 175--179] quantum cryptographic protocols. In each case, the optimal eavesdropping method that on average yields the most information for a given error rate is explicitly constructed. Analysis is limited to eavesdropping strategies where each bit of the quantum transmission is attacked individually and independently from other bits. Subject to this restriction, however, we believe that all attacks not forbidden by physical laws are covered. Unlike previous work, the eavesdropper's advantage is measured in terms of Renyi (rather than Shannon) information, and with respect only to bits received error-free by Bob (rather than all bits). This alters both the maximum extractable information and the optimal eavesdropping attack. The result can be used directly at the privacy amplification stage of the protocol to accomplish secure communication over a noisy channel.

We propose a simple quantum cryptographic scheme involving truly two orthogonal states. The security of the protocol is based on splitting the transfer of one-bit information into two steps, ensuring that only a fraction of the bit information is transmitted at a time. A particular implementation with an asymmetric interferometer is presented, which does not require the random timing of the packet sending as was used by Goldenberg and Vaidman [Phys. Rev. Lett. 75, 1239 (1995)].

We propose a family of sifting-less quantum-key-distribution protocols which use reverse-reconciliation, and are based on weak coherent pulses (WCPs) polarized along m different directions. When m=4, the physical part of the protocol is identical to most experimental implementations of BB84 and SARG04 protocols and they differ only in classical communications and data processing. We compute their total keyrate as function of the channel transmission T, using general information theoretical arguments and we show that they have a higher keyrate than the more standard protocols, both for fixed and optimized average photon number of the WCPs. When no decoy-state protocols (DSPs) are applied, the scaling of the keyrate with transmission is improved from T² for BB84 to T^(1+1/(m-2)). If a DSP is applied, we show how the keyrates scale linearly with T, with an improvement of the prefactor by 75.96 % for m=4. High values of $ m $ allow to asymptotically approach the keyrate obtained with ideal single photon pulses. The fact that the keyrates of these sifting-less protocols are higher compared to those of the aforementioned more standard protocols show that the latter are not optimal, since they do not extract all the available secret key from the experimental correlations.

The ideal Bennett-Brassard 1984 (BB84) quantum-key-distribution protocol is based on the preparation and measurement of qubits in two alternative bases differing by an angle of π/2. Any real implementation of the protocol, though, will inevitably introduce misalignments in the preparation of the states and in the alignment of the measurement bases with respect to this ideal situation. Various security proofs take into account (at least partially) such errors, i.e., show how Alice and Bob can still distill a secure key in the presence of these imperfections. Here, we consider the complementary problem: How can Eve exploit misalignments to obtain more information about the key than would be possible in an ideal implementation? Specifically, we investigate the effects of misalignment errors on the security of the BB84 protocol in the case of individual attacks, where necessary and sufficient conditions for security are known. Though the effects of these errors are small for expected deviations from the perfect situation, our results nevertheless show that Alice and Bob can incorrectly conclude that they have established a secure key if the inevitable experimental errors in the state preparation and in the alignment of the measurements are not taken into account. This gives further weight to the idea that the formulation and security analysis of any quantum cryptography protocol should be based on realistic assumptions about the properties of the apparatus used. Additionally, we note that BB84 seems more robust against alignment imperfections if both the x and z bases are used to generate the key. © 2013 American Physical Society.

How to remove detector side channel attacks has been a notoriously hard problem in quantum cryptography. Here, we propose a simple solution to this problem---*measurement* device independent quantum key distribution. It not only removes all detector side channels, but also doubles the secure distance with conventional lasers. Our proposal can be implemented with standard optical components with low detection efficiency and highly lossy channels. In contrast to the previous solution of full device independent QKD, the realization of our idea does not require detectors of near unity detection efficiency in combination with a qubit amplifier (based on teleportation) or a quantum non-demolition measurement of the number of photons in a pulse. Furthermore, its key generation rate is many orders of magnitude higher than that based on full device independent QKD. The results show that long-distance quantum cryptography over say 200km will remain secure even with seriously flawed detectors., Comment: 7 pages, two-column format, 4 figures in total

We present a fair and optimistic quantum contract signing protocol between two clients that requires no communication with the third trusted party during the exchange phase. We discuss its fairness and show that it is possible to design such a protocol for which the probability of a dishonest client to cheat becomes negligible, and scales as N^{-1/2}, where N is the number of messages exchanged between the clients. Our protocol is not based on the exchange of signed messages: its fairness is based on the laws of quantum mechanics. Thus, it is abuse-free, and the clients do not have to generate new keys for each message during the Exchange phase. We discuss a real-life scenario when the measurement errors and qubit state corruption due to noisy channels occur and argue that for real, good enough measurement apparatus and transmission channels, our protocol would still be fair. Our protocol could be implemented by today's technology, as it requires in essence the same type of apparatus as the one needed for BB84 cryptographic protocol. Finally, we briefly discuss two alternative versions of the protocol, one that uses only two states (based on B92 protocol) and the other that uses entangled pairs, and show that it is possible to generalize our protocol to an arbitrary number of clients., 11 pages, 2 figures

The effect of scintillation, arising from propagation through atmospheric turbulence, on the sift and error probabilities of a quantum key distribution (QKD) system that uses the weak-laser-pulse version of the Bennett-Brassard 1984 (BB84) protocol is evaluated. Two earth-space scenarios are examined: satellite-to-ground and ground-to-satellite transmission. Both lie in the far-field power-transfer regime. This work complements previous analysis of turbulence effects in near-field terrestrial BB84 QKD [J. H. Shapiro, Phys. Rev. A 67, 022309 (2003)]. More importantly, it shows that scintillation has virtually no impact on the sift and error probabilities in earth-space BB84 QKD, something that has been implicitly assumed in prior analyses for that application. This result contrasts rather sharply with what is known for high-speed laser communications over such paths, in which deep, long-lived scintillation fades present a major challenge to high-reliability operation.

Several attacks have been proposed on quantum key distribution systems with gated single-photon detectors. The attacks involve triggering the detectors outside the center of the detector gate, and/or using bright illumination to exploit classical photodiode mode of the detectors. Hence a secure detection scheme requires two features: The detection events must take place in the middle of the gate, and the detector must be single-photon sensitive. Here we present a technique called bit-mapped gating, which is an elegant way to force the detections in the middle of the detector gate by coupling detection time and quantum bit error rate. We also discuss how to guarantee single-photon sensitivity by directly measuring detector parameters. Bit-mapped gating also provides a simple way to measure the detector blinding parameter in security proofs for quantum key distribution systems with detector efficiency mismatch, which up until now has remained a theoretical, unmeasurable quantity. Thus if single-photon sensitivity can be guaranteed within the gates, a detection scheme with bit-mapped gating satisfies the assumptions of the current security proofs., 7 pages, 3 figures

Secure two-party cryptography is possible if the adversary's quantum storage device suffers imperfections. For example, security can be achieved if the adversary can store strictly less then half of the qubits transmitted during the protocol. This special case is known as the bounded-storage model, and it has long been an open question whether security can still be achieved if the adversary's storage were any larger. Here, we answer this question positively and demonstrate a two-party protocol which is secure as long as the adversary cannot store even a small fraction of the transmitted pulses. We also show that security can be extended to a larger class of noisy quantum memories., 10 pages (revtex), 2 figures, v2: published version, minor changes

We show that monogamy of Bell's inequality violations, which is strictly weaker condition than no-signaling is enough to prove security of quantum key distribution. We derive our results for a whole class of monogamy constraints and generalize our results to any theory that communicating parties may have access to. Some of these theories do not respect no-signaling principle yet still allow for secure communication. This proves that no-signaling is only a sufficient condition for the possibility of secure communication, but not the necessary one. We also present some new qualitative results concerning the security of existing quantum key distribution protocols., Comment: 4 pages, 1 figure

We describe a quantum key distribution protocol based on pairs of entangled qubits that generates a secure key between two partners in an environment of unknown and slowly varying reference frame. A direction of particle delivery is required, but the phases between the computational basis states need not be known or fixed. The protocol can simplify the operation of existing setups and has immediate applications to emerging scenarios such as earth-to-satellite links and the use of integrated photonic waveguides. We compute the asymptotic secret key rate for a two-qubit source, which coincides with the rate of the six-state protocol for white noise. We give the generalization of the protocol to higher-dimensional systems and detail a scheme for physical implementation in the three dimensional qutrit case., Comment: 4 pages, 2 figures, comments welcome

One of the simplest security proofs of quantum key distribution is based on the so-called complementarity scenario, which involves the complementarity control of an actual protocol and a virtual protocol [M. Koashi, e-print arXiv:0704.3661 (2007)]. The existing virtual protocol has a limitation in classical postprocessing, i.e., the syndrome for the error-correction step has to be encrypted. In this paper, we remove this limitation by constructing a quantum circuit for the virtual protocol. Moreover, our circuit with a shield system gives an intuitive proof of why adding noise to the sifted key increases the bit error rate threshold in the general case in which one of the parties does not possess a qubit. Thus, our circuit bridges the simple proof and the use of wider classes of classical postprocessing.

The security of the decoherence-free version of the Bennett-Brassard 1984 (BB84) protocol [A. Cabello, Phys. Rev. A 75, 020301 (2007)] is analyzed and shown to be vulnerable under the intercept-resend attack. We propose two improved versions of this protocol. Both improvements remain the performance of robustness against collective noise and refuse the security flaw. Especially, the second improvement, which is called four-qubit decoherence-free (DF) BB84 protocol, not only remains all characteristics of the original protocol but also has a higher efficiency. We also give a detailed security proof of four-qubit DF BB84 protocol.

Recently Boyer et al. [Phys. Rev. Lett. 99, 140501 (2007)] suggested the idea of semiquantum key distribution (SQKD) in which Bob is classical and they also proposed a semiquantum key distribution protocol (BKM2007). To discuss the security of the BKM2007 protocol, they proved that their protocol is completely robust. This means that nonzero information acquired by Eve on the information string implies the nonzero probability that the legitimate participants can find errors on the bits tested by this protocol. The BKM2007 protocol uses four quantum states to distribute a secret key. In this paper, we simplify their protocol by using less than four quantum states. In detail, we present five different SQKD protocols in which Alice sends three quantum states, two quantum states, and one quantum state, respectively. Also, we prove that all the five protocols are completely robust. In particular, we invent two completely robust SQKD protocols in which Alice sends only one quantum state. Alice uses a register in one SQKD protocol, but she does not use any register in the other. The information bit proportion of the SQKD protocol in which Alice sends only one quantum state but uses a register is the double as that in the BKM2007 protocol. Furthermore, the information bit rate of the SQKD protocol in which Alice sends only one quantum state and does not use any register is not lower than that of the BKM2007 protocol.

This paper presents a quantum key distribution (QKD) protocol named differential-quadrature-phase-shift (DQPS) QKD. A transmitter sends a coherent pulse train in which each pulse is phase modulated by ${0,\ensuremath{\pi}}$ ${\ensuremath{\pi}/2,3\ensuremath{\pi}/2}$, and a receiver measures it with either one of two asymmetric Mach-Zehnder interferometers having phase biases of 0 and $\ensuremath{\pi}/2$, respectively. This scheme is devised such that the idea of the conventional Bennett-Brassard 1984 protocol (BB84) is introduced to differential-phase-shift (DPS) QKD. Simulations show that the proposed scheme is robust against a sequential attack that is crucial eavesdropping to DPS-QKD.

In this paper, we rigorously prove the intuition that in security proofs for the Bennett-Brassard 1984 (BB84) protocol, one may regard an incoming signal to Bob as a qubit state. From this result, it follows that all security proofs for BB84 protocol based on a virtual qubit entanglement distillation protocol, which was originally proposed by Lo and Chau [Science 283, 2050 (1999)] and by Shor and Preskill [Phys. Rev. Lett. 85, 441 (2000)], are all valid even if Bob's actual apparatus cannot distill a qubit state explicitly. As a consequence, especially, the well-known result that a higher bit error rate of 20% can be tolerated for BB84 protocol by using two-way classical communications is still valid even when Bob uses threshold detectors. Using the same technique, we also prove the security of Bennett-Brassard-Mermin 1992 (BBM92) protocol where Alice and Bob both use threshold detectors.

In a Letter, Cabello proposed a quantum key distribution (QKD) Protocol which attended to Holevo limit. In this comment, we show that Eve could use a simple plan to distinguish among quantum keys, without being detected by Alice and Bob. In following, we show that our approach is not restricted to Cabello Protocol. With attention to our Eavesdropping approach, it seems that Mor's arguments for no-cloning principal for orthogonal states is not general enough to avoid eavesdropping., REVTeX4, 1 page, no figure, A. Cabello Reply, Physical Review Letters 100, 018902 (2008)

For the Bennett-Brassard 1984 (BB84) quantum key distribution, longer distance and higher key generating rate is shown with a heralded single-photon source (HSPS) [Phys. Rev. A. 73, 032331 (2006)]. In this paper, the performance of the Scarani-Acin-Ribordy-Gisim (SARG) protocol utilizing the HSPS sources is considered and the numerical simulation turns out that still a significant improvement in secret key generating rate can also be observed. It is shown that the security distance for $\mathrm{HSPS}+\mathrm{SARG}$ is $120\phantom{\rule{0.3em}{0ex}}\mathrm{km}$. However, compared with the $\mathrm{HSPS}+\mathrm{BB}84$ protocols, the $\mathrm{HSPS}+\mathrm{SARG}$ protocol has a lower secret key rate and a shorter distance. Thus we show the $\mathrm{HSPS}+\mathrm{BB}84$ implementation is a preferable protocol for long distance transmittance.

We have used deterministic single-photon two qubit (SPTQ) quantum logic to implement the most powerful individual-photon attack against the Bennett-Brassard 1984 (BB84) quantum key distribution protocol. Our measurement results, including physical source and gate errors, are in good agreement with theoretical predictions for the Renyi information obtained by Eve as a function of the errors she imparts to Alice and Bob's sifted key bits. The current experiment is a physical simulation of a true attack, because Eve has access to Bob's physical receiver module. This experiment illustrates the utility of an efficient deterministic quantum logic for performing realistic physical simulations of quantum information processing functions.

Quantum key distribution (QKD) can be used to generate secret keys between two distant parties. Even though QKD has been proven unconditionally secure against eavesdroppers with unlimited computation power, practical implementations of QKD may contain loopholes that may lead to the generated secret keys being compromised. In this paper, we propose a phase-remapping attack targeting two practical bidirectional QKD systems (the "plug & play" system and the Sagnac system). We showed that if the users of the systems are unaware of our attack, the final key shared between them can be compromised in some situations. Specifically, we showed that, in the case of the Bennett-Brassard 1984 (BB84) protocol with ideal single-photon sources, when the quantum bit error rate (QBER) is between 14.6% and 20%, our attack renders the final key insecure, whereas the same range of QBER values has been proved secure if the two users are unaware of our attack; also, we demonstrated three situations with realistic devices where positive key rates are obtained without the consideration of Trojan horse attacks but in fact no key can be distilled. We remark that our attack is feasible with only current technology. Therefore, it is very important to be aware of our attack in order to ensure absolute security. In finding our attack, we minimize the QBER over individual measurements described by a general POVM, which has some similarity with the standard quantum state discrimination problem., 13 pages, 8 figures