3
$\begingroup$

In Simple Proof of Security of the BB84 Quantum Key Distribution Protocol, the description of the entanglement-based version of BB84 indicates that Alice and Bob perform a Hadamard transform on their entangled qubits (steps 2 and 7 on page 2). I understand that an eavesdropper Eve may not know the exact place of the qubit on which the Hadamard transform occurs. However, at the same time, as noted here, "applying a Hadamard gate on each qubit of the Bell state results in no change -- the resulting state is again the Bell state." So if we are to assume that Eve has unconditional power, then we can imagine the case where Eve is somehow waiting until Alice makes the announcement about the location of qubits where she applied Hadamard before Eve makes her own measurements.

I can see how applying Hadamard is useful if Eve is making measurements before Alice is making her announcement; however, Eve can potentially wait. Are we assuming that this case is impossible? Maybe this is addressed in the paper, but I could not find that. Any help in clarifying my question would be appreciated.

Improve this question
$\endgroup$

1 Answer 1

Reset to default
1
$\begingroup$

Eve can wait until Alice makes the announcement, but the announcement only happens once Bob has received the qubit, so in the simplest attack (where Eve just measures the qubit and then sends it on to Bob) she can't use the announcement to choose her measurement basis for the qubit because she no longer has it at that point. She has to choose without knowing, and hence has a high probability of picking the wrong basis and causing errors (which Alice and Bob will detect in the check bits if she does it often) by the measurement.

She could keep the original qubit to measure later, and secretly substitute her own in some arbitrary state to send on to Bob, but any such substituted qubit would again fail the checks a large proportion of the time so if she did it often she'd be detected.

She also can't make a perfect second copy of the qubit to keep and measure later because the no-cloning theorem forbids that.

She could do more complicated things - like entangling some qubits of hers with the transmitted qubit to extract a small amount of information later - but this will also raise the probability of errors, and as the paper you linked shows, the fraction of information she can extract via any method without being detected can be made arbitrarily small.

Improve this answer
$\endgroup$
5
  • $\begingroup$ What if Eve applies a photon number splitting attack? en.wikipedia.org/wiki/… "Eve stores these extra photons in a quantum memory until Bob detects the remaining single photon and Alice reveals the encoding basis. Eve can then measure her photons in the correct basis and obtain information on the key without introducing detectable errors." $\endgroup$
    – Josh
    Apr 3 at 21:58
  • $\begingroup$ PNS attacks can occur when you have an imperfect photonic setup in which Alice, while trying to transmit single photons, is actually transmitting more than one in the same state - it's a vulnerability in a possible real-world implementation, not in the underlying protcol. They aren't covered by the linked paper because it assumes a perfect setup (not necessarily photonic) in which only 1 qubit is sent at a time. (Although as the Wikipedia article note, you can defend against PNS attacks using decoy states). $\endgroup$
    – GotCarter
    Apr 3 at 22:03
  • $\begingroup$ Is there a rigorous proof of the security of BB84 for the imperfect case that addresses this problem? or do we just assume that decoy states are sufficient counter-measure and it would not require a more rigorous proof? $\endgroup$
    – Josh
    Apr 3 at 22:11
  • $\begingroup$ If the "imperfect case" includes any way the device could be not working as desired, then that's the problem of device-independent QKD. There are protocols which fulfill that, although they aren't equivalent to BB84. $\endgroup$
    – GotCarter
    Apr 3 at 22:21
  • $\begingroup$ (If it's just the imperfection of some probability of multiple photons, then decoy states provably suffice - see Lo and Ma) $\endgroup$
    – GotCarter
    Apr 3 at 23:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.