2
$\begingroup$

Since both rely on Bell inequalities to maintain security, does the Ekert protocol rely on trustworthiness of the devices?

$\endgroup$
2
  • $\begingroup$ Both? E91 and which protocol else? $\endgroup$ Commented May 23 at 3:55
  • $\begingroup$ By both, I mean the entanglement based E91 and device -independent protocols $\endgroup$
    – ibtissam
    Commented May 23 at 12:10

2 Answers 2

2
$\begingroup$

Ekert's original protocol was never specified in a device independent way but, as you suggest, it's very close by virtue of the reliance on Bell inequalities. (He has commented to me that, with hindsight, it could have been constructed to be device independent at the time, it just wasn't on the agenda.) There are a few more details you have to take care of, being very clear about assumptions (particularly your source of randomness), a slight change in analysis etc., but it can certainly be made into a device independent protocol without any fundamental changes.

$\endgroup$
1
$\begingroup$

I think you can safely say that E91 was the beginning of device-independent protocols. It has all the basic ideas in there and the intuition for why device-independent security holds is there too. However, it is a very early work and it wouldn't necessarily be considered a completely device-independent protocol by today's standards. For example, the protocol description it says

They discard all measurements in which either or both of them failed to register a particle at all.

which is a trust assumption on the measurement devices. In particular we are implicitly assuming that the measurement devices will not just decide to abort the round based on their input. It is known that if we allow for that then there are very simple ways to "trick" a Bell-inequality violation. Consider the CHSH game where we win if $a \oplus b = xy$ with inputs $x,y \in \{0,1\}$ and outputs $a,b \in \{0,1\}$. Suppose Bob's device when it receives $y=1$ will always abort the round. Then we only ever actually play the game on the questions $(x,y) \in \{(0,0), (1,0)\}$ rather than the full set. But this subgame can be always won classically by the devices just always outputting $0$. Thus if we were just counting the "rounds won" then we would conclude we did better than quantum theory would even predict.

The protocol itself is also not really written as a device-independent protocol. For example, the protocol specifies that Alice and Bob each round will choose to measure in some angle chosen randomly from some predetermined set and the source produces a singlet state. In the modern device-independent protocols this would be considered to be a description of the "honest" implementation of the protocol. The actual protocol would specify how the honest users would interact with their devices assuming that they are ignorant of their inner workings, e.g. each round Alice and Bob choose randomly an input $\{0,1\}$ which they give to their device (rather than choosing a measurement angle).

Additionally and naturally for the time, there is no security proof in the paper. There is some analysis that shows when Eve attacks then the honest users cannot achieve the Tsirelson bound for CHSH but a full security proof is not there. However, given the tools now it would not be too difficult to write down a formal protocol description and security proof that would be considered "fully" device-independent by the current standards.

I think together with Mayers and Yao, Quantum cryptography with imperfect apparatus these papers really formed the basis for the area we now consider device-independent cryptography.

$\endgroup$
1
  • $\begingroup$ Thank you so much for your clear response $\endgroup$
    – ibtissam
    Commented May 26 at 13:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.