Editing Quantum key distribution (section)

== Quantum key exchange ==
Quantum communication involves encoding information in quantum states, or [[qubit]]s, as opposed to classical communication's use of [[bit]]s. Usually, [[photons]] are used for these quantum states. Quantum key distribution exploits certain properties of these quantum states to ensure its security. There are several different approaches to quantum key distribution, but they can be divided into two main categories depending on which property they exploit.

; Prepare-and-measure protocols : In contrast to classical physics, the act of measurement is an integral part of quantum mechanics. In general, measuring an unknown quantum state changes that state in some way. This is a consequence of [[quantum indeterminacy]] and can be exploited in order to detect any eavesdropping on communication (which necessarily involves measurement) and, more importantly, to calculate the amount of information that has been intercepted.

; Entanglement-based protocols : The quantum states of two (or more) separate objects can become linked together in such a way that they must be described by a combined quantum state, not as individual objects. This is known as [[Quantum entanglement|entanglement]] and means that, for example, performing a measurement on one object affects the other. If an entangled pair of objects is shared between two parties, anyone intercepting either object alters the overall system, revealing the presence of the third party (and the amount of information they have gained).

These two approaches can each be further divided into three families of protocols: discrete variable, continuous variable and distributed phase reference coding. Discrete variable protocols were the first to be invented, and they remain the most widely implemented. The other two families are mainly concerned with overcoming practical limitations of experiments. The two protocols described below both use discrete variable coding.

=== BB84 protocol: Charles H. Bennett and Gilles Brassard (1984) ===
{{Main|BB84}}
This protocol, known as [[BB84]] after its inventors and year of publication, was originally described using [[photon polarization]] states to transmit the information.<ref>{{cite book|first1=C. H. |last1=Bennett |first2=G. |last2=Brassard |chapter=Quantum cryptography: Public key distribution and coin tossing |title=Proceedings of the International Conference on Computers, Systems & Signal Processing, Bangalore, India |volume=1 |pages=175–179 |publisher=IEEE |year=1984 |location=New York }} Reprinted as {{cite journal|first1=C. H. |last1=Bennett |first2=G. |last2=Brassard |title=Quantum cryptography: Public key distribution and coin tossing |journal=Theoretical Computer Science |series=Theoretical Aspects of Quantum Cryptography – celebrating 30 years of BB84 |volume=560 |number=1 |date=4 December 2014 |pages=7–11 |doi=10.1016/j.tcs.2014.05.025 |doi-access=free|arxiv=2003.06557 }}</ref> However, any two pairs of [[Conjugate variables|conjugate]] states can be used for the protocol, and many [[optical fibre|optical-fibre]]-based implementations described as BB84 use phase encoded states. The sender (traditionally referred to as [[Alice and Bob|Alice]]) and the receiver (Bob) are connected by a [[quantum communication channel]] which allows [[quantum states]] to be transmitted. In the case of photons this channel is generally either an optical fibre or simply [[free space]]. In addition they communicate via a public classical channel, for example using broadcast radio or the internet. The protocol is designed with the assumption that an [[eavesdropper]] (referred to as Eve) can interfere in any way with the quantum channel, while the classical channel needs to be [[authenticated]].<ref>{{cite journal |title=A largely self-contained and complete security proof for quantum key distribution |first1=Marco |last1=Tomamichel |first2=Anthony |last2=Leverrier |date=2017 |arxiv=1506.08458 |doi=10.22331/q-2017-07-14-14 |journal=Quantum |volume=1 |pages=14|bibcode=2017Quant...1...14T |s2cid=56465385 }}</ref><ref>{{cite arXiv |title=Cryptographic security of quantum key distribution |first1=Christopher |last1=Portmann |first2=Renato |last2=Renner |eprint=1409.3525|year=2014 |class=quant-ph }}</ref>

The security of the protocol comes from encoding the information in [[Orthogonality|non-orthogonal states]]. [[Quantum indeterminacy]] means that these states cannot in general be measured without disturbing the original state (see ''[[No-cloning theorem]]''). BB84 uses two pairs of states, with each pair [[Conjugate variables|conjugate]] to the other pair, and the two states within a pair orthogonal to each other. Pairs of orthogonal states are referred to as a [[Basis (linear algebra)|basis]]. The usual polarization state pairs used are either the [[linear polarization|rectilinear basis]] of vertical (0°) and horizontal (90°), the [[linear polarization|diagonal basis]] of 45° and 135° or the [[circular polarization|circular basis]] of left- and right-handedness. Any two of these bases are conjugate to each other, and so any two can be used in the protocol. Below the rectilinear and diagonal bases are used.

{| class="wikitable" style="float:left; text-align:center;"
|-
 ! Basis
 ! 0
 ! 1
|-
 | [[File:PlusCM128.svg|15x15px]]
 | [[File:Arrow north.svg|20x20px]]
 | [[File:Arrow east.svg|20x20px]]
|-
 | [[File:Multiplication Sign.svg|15x15px]]
 | [[File:Arrow northeast.svg|15x15px]]
 | [[File:Arrow southeast.svg|15x15px]]
|}

The first step in BB84 is quantum transmission. Alice creates a random [[bit]] (0 or 1) and then randomly selects one of her two bases (rectilinear or diagonal in this case) to transmit it in. She then prepares a photon polarization state depending both on the bit value and basis, as shown in the adjacent table. So for example a 0 is encoded in the rectilinear basis (+) as a vertical polarization state, and a 1 is encoded in the diagonal basis (x) as a 135° state. Alice then transmits a single photon in the state specified to Bob, using the quantum channel. This process is then repeated from the random bit stage, with Alice recording the state, basis and time of each photon sent.

According to quantum mechanics (particularly quantum indeterminacy), no possible measurement distinguishes between the 4 different polarization states, as they are not all orthogonal. The only possible measurement is between any two orthogonal states (an orthonormal basis). So, for example, measuring in the rectilinear basis gives a result of horizontal or vertical. If the photon was created as horizontal or vertical (as a rectilinear [[eigenstate]]) then this measures the correct state, but if it was created as 45° or 135° (diagonal eigenstates) then the rectilinear measurement instead returns either horizontal or vertical at random. Furthermore, after this measurement the photon is polarized in the state it was measured in (horizontal or vertical), with all information about its initial polarization lost.

As Bob does not know the basis the photons were encoded in, all he can do is to select a basis at random to measure in, either rectilinear or diagonal. He does this for each photon he receives, recording the time, measurement basis used and measurement result. After Bob has measured all the photons, he communicates with Alice over the public classical channel. Alice broadcasts the basis each photon was sent in, and Bob the basis each was measured in. They both discard photon measurements (bits) where Bob used a different basis, which is half on average, leaving half the bits as a shared key.

{| class="wikitable" style="width:75%; text-align: center; margin: 1em auto 1em auto"
|-
 ! Alice's random bit
 | style="width:40pt;"| 0 || style="width:40pt;"| 1 || style="width:40pt;"| 1 || style="width:40pt;"| 0 || style="width:40pt;"| 1 || style="width:40pt;"| 0 || style="width:40pt;"| 0 || style="width:40pt;"| 1
|-
 ! Alice's random sending basis
 | style="width:40pt;"| [[File:PlusCM128.svg|15x15px]] || style="width:40pt;" | [[File:PlusCM128.svg|15x15px]] || style="width:40pt;" | [[File:Multiplication Sign.svg|15x15px]] || style="width:40pt;" | [[File:PlusCM128.svg|15x15px]] || style="width:40pt;" | [[File:Multiplication Sign.svg|15x15px]] || style="width:40pt;" | [[File:Multiplication Sign.svg|15x15px]] || style="width:40pt;" | [[File:Multiplication Sign.svg|15x15px]] || style="width:40pt;" | [[File:PlusCM128.svg|15x15px]]
|-
 ! Photon polarization Alice sends
 | style="width:40pt;"| [[File:Arrow north.svg|20x20px]] || style="width:40pt;" | [[File:Arrow east.svg|20x20px]] || style="width:40pt;" | [[File:Arrow southeast.svg|15x15px]] || style="width:40pt;" | [[File:Arrow north.svg|20x20px]] || style="width:40pt;" | [[File:Arrow southeast.svg|15x15px]] || style="width:40pt;" | [[File:Arrow northeast.svg|15x15px]] || style="width:40pt;" | [[File:Arrow northeast.svg|15x15px]] || style="width:40pt;" | [[File:Arrow east.svg|20x20px]]
|-
 ! Bob's random measuring basis
 | style="width:40pt;"| [[File:PlusCM128.svg|15x15px]] || style="width:40pt;" | [[File:Multiplication Sign.svg|15x15px]] || style="width:40pt;" | [[File:Multiplication Sign.svg|15x15px]] || style="width:40pt;" | [[File:Multiplication Sign.svg|15x15px]] || style="width:40pt;" | [[File:PlusCM128.svg|15x15px]] || style="width:40pt;" | [[File:Multiplication Sign.svg|15x15px]] || style="width:40pt;" | [[File:PlusCM128.svg|15x15px]] || style="width:40pt;" | [[File:PlusCM128.svg|15x15px]]
|-
 ! Photon polarization Bob measures
 | style="width:40pt;"| [[File:Arrow north.svg|20x20px]] || style="width:40pt;" | [[File:Arrow northeast.svg|15x15px]] || style="width:40pt;" | [[File:Arrow southeast.svg|15x15px]] || style="width:40pt;" | [[File:Arrow northeast.svg|15x15px]] || style="width:40pt;" | [[File:Arrow east.svg|20x20px]] || style="width:40pt;" | [[File:Arrow northeast.svg|15x15px]] || style="width:40pt;" | [[File:Arrow east.svg|20x20px]] || style="width:40pt;" | [[File:Arrow east.svg|20x20px]]
|-
 ! PUBLIC DISCUSSION OF BASIS
 | colspan=8 |

|-
 ! Shared secret key
 | style="width:40pt;"| 0 ||  || style="width:40pt;"| 1 ||  ||  || style="width:40pt;"| 0 ||  || style="width:40pt;"| 1
|-
|}

To check for the presence of an eavesdropper, Alice and Bob now compare a predetermined subset of their remaining bit strings. If a third party (usually referred to as Eve, for "eavesdropper") has gained any information about the photons' polarization, this introduces errors in Bob's measurements. Other environmental conditions can cause errors in a similar fashion. If more than <math>p</math> bits differ they abort the key and try again, possibly with a different quantum channel, as the security of the key cannot be guaranteed. <math>p</math> is chosen so that if the number of bits known to Eve is less than this, [[privacy amplification]] can be used to reduce Eve's knowledge of the key to an arbitrarily small amount at the cost of reducing the length of the key.

=== E91 protocol: Artur Ekert (1991) ===

[[Artur Ekert]]'s scheme<ref name=":0">{{cite journal |last1=Ekert |first1=Artur K. |title=Quantum cryptography based on Bell's theorem |journal=Physical Review Letters |date=5 August 1991 |volume=67 |issue=6 |pages=661–663 |doi=10.1103/PhysRevLett.67.661 |pmid=10044956 |bibcode=1991PhRvL..67..661E |s2cid=27683254 }}</ref> uses entangled pairs of photons. These can be created by Alice, by Bob, or by some source separate from both of them, including eavesdropper Eve. The photons are distributed so that Alice and Bob each end up with one photon from each pair.

The scheme relies on two properties of entanglement. First, the entangled states are perfectly correlated in the sense that if Alice and Bob both measure whether their particles have vertical or horizontal polarizations, they always get the same answer with 100% probability. The same is true if they both measure any other pair of complementary (orthogonal) polarizations. This necessitates that the two distant parties have exact directionality synchronization. However, the particular results are completely random; it is impossible for Alice to predict if she (and thus Bob) will get vertical polarization or horizontal polarization. Second, any attempt at eavesdropping by Eve destroys these correlations in a way that Alice and Bob can detect.

Similarly to [[BB84]], the protocol involves a private measurement protocol before detecting the presence of Eve. The measurement stage involves Alice measuring each photon she receives using some basis from the set <math> Z_{0}, Z_{\frac{\pi}{8}}, Z_{\frac{\pi}{4}}</math> while Bob chooses from  <math> Z_{0}, Z_{\frac{\pi}{8}}, Z_{-\frac{\pi}{8}}</math> where <math>Z_{\theta}</math> is the <math>\{|{\uparrow}\rangle, \; |{\rightarrow}\rangle\}</math> basis rotated by <math>\theta</math>. They keep their series of basis choices private until measurements are completed. Two groups of photons are made: the first consists of photons measured using the same basis by Alice and Bob while the second contains all other photons. To detect eavesdropping, they can compute the test statistic <math>S</math> using the correlation coefficients between Alice's bases and Bob's similar to that shown in the [[Bell test experiments]]. Maximally entangled photons would result in <math>|S|=2\sqrt{2}</math>. If this were not the case, then Alice and Bob can conclude Eve has introduced local realism to the system, violating [[Bell's theorem]]. If the protocol is successful, the first group can be used to generate keys since those photons are completely anti-aligned between Alice and Bob.

=== Device-independent quantum key distribution ===
In traditional QKD, the quantum devices used must be perfectly calibrated, trustworthy, and working exactly as they are expected to.<ref name=":1">{{Cite journal |last1=Nadlinger |first1=D. P. |last2=Drmota |first2=P. |last3=Nichol |first3=B. C. |last4=Araneda |first4=G. |last5=Main |first5=D. |last6=Srinivas |first6=R. |last7=Lucas |first7=D. M. |last8=Ballance |first8=C. J. |last9=Ivanov |first9=K. |last10=Tan |first10=E. Y.-Z. |last11=Sekatski |first11=P. |last12=Urbanke |first12=R. L. |last13=Renner |first13=R. |last14=Sangouard |first14=N. |last15=Bancal |first15=J.-D. |date=July 2022 |title=Experimental quantum key distribution certified by Bell's theorem |url=https://www.nature.com/articles/s41586-022-04941-5 |journal=Nature |language=en |volume=607 |issue=7920 |pages=682–686 |doi=10.1038/s41586-022-04941-5 |pmid=35896644 |issn=1476-4687|arxiv=2109.14600 |bibcode=2022Natur.607..682N |s2cid=251131731 }}</ref> Deviations from expected measurements can be extremely hard to detect, which leaves the entire system vulnerable. A new protocol called device independent QKD (DIQKD) or measurement [[device-independent quantum key distribution|device independent QKD]] (MDIQKD) allows for the use of uncharacterized or untrusted devices, and for deviations from expected measurements to be included in the overall system.<ref name=":1" /><ref name=":2">{{Cite journal |last1=Zhang |first1=Wei |last2=van Leent |first2=Tim |last3=Redeker |first3=Kai |last4=Garthoff |first4=Robert |last5=Schwonnek |first5=René |last6=Fertig |first6=Florian |last7=Eppelt |first7=Sebastian |last8=Rosenfeld |first8=Wenjamin |last9=Scarani |first9=Valerio |last10=Lim |first10=Charles C.-W. |last11=Weinfurter |first11=Harald |date=July 2022 |title=A device-independent quantum key distribution system for distant users |journal=Nature |language=en |volume=607 |issue=7920 |pages=687–691 |doi=10.1038/s41586-022-04891-y |pmid=35896650 |pmc=9329124 |arxiv=2110.00575 |bibcode=2022Natur.607..687Z |issn=1476-4687|doi-access=free }}</ref> These deviations will cause the protocol to abort when detected, rather than resulting in incorrect data.<ref name=":1" />

DIQKD was first proposed by Mayers and Yao,<ref>{{Cite arXiv|last1=Mayers |first1=Dominic |last2=Yao |first2=Andrew |date=1998-09-14 |title=Quantum Cryptography with Imperfect Apparatus  |eprint=quant-ph/9809039  }}</ref> building off of the BB84 protocol. They presented that in DIQKD, the quantum device, which they refer to as the photon source, be manufactured to come with tests that can be run by Alice and Bob to "self-check" if their device is working properly. Such a test would only need to consider the classical inputs and outputs in order to determine how much information is at risk of being intercepted by Eve. A self checking, or "ideal" source would not have to be characterized,<ref name=":2" /><ref>{{Cite journal |last1=Schwonnek |first1=René |last2=Goh |first2=Koon Tong |last3=Primaatmaja |first3=Ignatius W. |last4=Tan |first4=Ernest Y.-Z. |last5=Wolf |first5=Ramona |last6=Scarani |first6=Valerio |last7=Lim |first7=Charles C.-W. |date=2021-05-17 |title=Device-independent quantum key distribution with random key basis |journal=Nature Communications |language=en |volume=12 |issue=1 |pages=2880 |doi=10.1038/s41467-021-23147-3 |pmid=34001885 |pmc=8128898 |arxiv=2005.02691 |bibcode=2021NatCo..12.2880S |issn=2041-1723|doi-access=free }}</ref> and would therefore not be susceptible to implementation flaws.<ref name=":2" />

Recent research has proposed using a Bell test to check that a device is working properly.<ref name=":1" /> Bell's theorem ensures that a device can create two outcomes that are exclusively correlated, meaning that Eve could not intercept the results, without making any assumptions about said device. This requires highly entangled states, and a low quantum bit error rate.<ref name=":2" /> DIQKD presents difficulties in creating qubits that are in such high quality entangled states, which makes it a challenge to realize experimentally.<ref name=":1" />

=== Twin fields quantum key distribution ===
Twin fields quantum key distribution (TFQKD) was introduced in 2018, and is a version of DIQKD designed to overcome the fundamental rate-distance limit of traditional quantum key distribution.<ref name=":3">{{Cite journal |last1=Lucamarini |first1=M. |last2=Yuan |first2=Z. L. |last3=Dynes |first3=J. F. |last4=Shields |first4=A. J. |date=May 2018 |title=Overcoming the rate–distance limit of quantum key distribution without quantum repeaters |url=https://www.nature.com/articles/s41586-018-0066-6 |journal=Nature |language=en |volume=557 |issue=7705 |pages=400–403 |doi=10.1038/s41586-018-0066-6 |pmid=29720656 |issn=1476-4687|arxiv=1811.06826 |bibcode=2018Natur.557..400L |s2cid=256768464 }}</ref> The rate-distance limit, also known as the rate-loss trade off, describes how as distance increases between Alice and Bob, the rate of key generation decreases exponentially.<ref name=":4">{{Cite journal |last1=Takeoka |first1=Masahiro |last2=Guha |first2=Saikat |last3=Wilde |first3=Mark M. |date=2014-10-24 |title=Fundamental rate-loss tradeoff for optical quantum key distribution |journal=Nature Communications |language=en |volume=5 |issue=1 |pages=5235 |doi=10.1038/ncomms6235 |pmid=25341406 |arxiv=1504.06390 |bibcode=2014NatCo...5.5235T |issn=2041-1723|doi-access=free }}</ref> In traditional QKD protocols, this decay has been eliminated via the addition of physically secured relay nodes, which can be placed along the quantum link with the intention of dividing it up into several low-loss sections. Researchers have also recommended the use of quantum repeaters, which when added to the relay nodes make it so that they no longer need to be physically secured.<ref name=":4" /> Quantum repeaters, however, are difficult to create and have yet to be implemented on a useful scale.<ref name=":3" /> TFQKD aims to bypass the rate-distance limit without the use of quantum repeaters or relay nodes, creating manageable levels of noise and a process that can be repeated much more easily with today's existing technology.<ref name=":3" />

The original protocol for TFQKD is as follows: Alice and Bob each have a light source and one arm on an interferometer in their laboratories. The light sources create two dim optical pulses with a randomly phase ''p''<sub>a</sub> or ''p''<sub>b</sub> in the interval {{nowrap|[0, 2π)}} and an encoding phase ''γ''<sub>a</sub> or ''γ''<sub>b</sub>. The pulses are sent along a quantum to Charlie, a third party who can be malicious or not. Charlie uses a beam splitter to overlap the two pulses and perform a measurement. He has two detectors in his own lab, one of which will light up if the bits are equal (00) or (11), and the other when they are different (10, 01). Charlie will announce to Alice and Bob which of the detectors lit up, at which point they publicly reveal the phases ''p'' and ''γ''.<ref name=":3" /> This is different from traditional QKD, in which the phases used are never revealed.<ref name=":5">{{Cite journal |last1=Wang |first1=Shuang |last2=Yin |first2=Zhen-Qiang |last3=He |first3=De-Yong |last4=Chen |first4=Wei |last5=Wang |first5=Rui-Qiang |last6=Ye |first6=Peng |last7=Zhou |first7=Yao |last8=Fan-Yuan |first8=Guan-Jie |last9=Wang |first9=Fang-Xiang |last10=Chen |first10=Wei |last11=Zhu |first11=Yong-Gang |last12=Morozov |first12=Pavel V. |last13=Divochiy |first13=Alexander V. |last14=Zhou |first14=Zheng |last15=Guo |first15=Guang-Can |date=February 2022 |title=Twin-field quantum key distribution over 830-km fibre |url=https://www.nature.com/articles/s41566-021-00928-2 |journal=Nature Photonics |language=en |volume=16 |issue=2 |pages=154–161 |doi=10.1038/s41566-021-00928-2 |bibcode=2022NaPho..16..154W |s2cid=117167883 |issn=1749-4893}}</ref>