Quantum Computing Stack Exchange is a question and answer site for engineers, scientists, programmers, and computing professionals interested in quantum computing. It only takes a minute to sign up.
Sign up to join this community
If I use E91 protocol for QKD, with n bits exchanged, what is the probability that you think there is an eavesdropper but there really isn't one or the opposite you think there is no eavesdropper but there really is one. Not counting any noise.
I would post this with tag e91 but I need more reputation apparently so rip.
E91 doesn't really deal in such strong absolutes as you're talking about (although it's often a helpful way to talk about the protocol the first time you meet it). Instead, you measure a value $S$, in a CHSH test, and compare it to the ideal value. Since you're doing a measurement with statistics, you will never get exactly $2\sqrt{2}$, which is the value that would "prove" you have no eavesdropper (and, even if you did, it might be that the true value is not $2\sqrt{2}$, and you've just had a statistical fluctuation).
Instead, based on the value of $S$ that you measure, you estimate the maximum amount of eavesdropping that you think might have occurred. There's still some probability distribution here thanks to the statistics, but so long as you've repeated your evaluation $n$ times, the probability of being significantly out in your estimates can be made to vanish exponentially in $n$ (at least, if you assume an eavesdropper acts independently on each round, because you can apply the Chernoff bound. It gets a bit more complicated if you want to allow the full range of attacks), so by taking even a modest value of $n$, that risk is negligible.
You have to be paranoid here. Any errors that occur due to imperfections in your devices, noise in the transmission of you qubits etc, all has to be ascribed to the eavesdropper. So, in that sense, even if there is no eavesdropper, you will always detect some eavesdropping.
Once you have your bound, derived from the value $S$, of how much eavesdropping has occurred, you apply privacy amplification to the derived keys. This makes them shorter, but guarantees that any eavesdropper who has no more information than you've estimated has essentially no information about the final key (again, you have a parameter that you control so you can bound how much the eavesdropper knows, and can drive to towards a negligible limit).
So, by the end, you have a threshold value $S_c$. Provided your $S>S_c$, you get an essentially perfect key. You've had control of parameters that let you send the probability of an eavesdropper being successful to 0. Your only failure mode (which might be interpreted as "detecting an eavesdropper") is if $S<S_c$. How likely this is to happen with a particular bit of hardware depends on the performance of that hardware. How likely is an eavesdropper who is operating at the level $S<S_c$ to fool you into thinking $S>S_c$? That's one of those statistical fluctuation bits that you've already pushed to essentially 0 by performing enough tests.
The beauty of this protocol of E91, which is sending perfectly entagled photons, is that by measuring, Alice and Bob are 100% synchronized, and perfectly know each other state.
What fhey have to do after they finish getting the bits, is Bell enquality test.
