Zero-error attacks and detection statistics in the coherent one-way protocol for quantum cryptography

Quantum Information and Computation

Volumn 7, Issue 7, 2007, Pages 639-664

  Branciard, Cyril ^a   Gisin, Nicolas ^a   Lütkenhaus, Norbert ^b   Scarani, Valerio ^a  

^a UNIVERSITY OF GENEVA   (Switzerland)

^b UNIVERSITY OF WATERLOO   (Canada)

Author keywords

Eavesdropping; Quantum cryptography; Quantum key distribution

Indexed keywords

ERROR STATISTICS;

BEAM SPLITTING; DETECTION STATISTIC; EAVESDROPPING; EXPERIMENTAL SCHEME; STATISTICAL PARAMETERS; UNAMBIGUOUS STATE DISCRIMINATION; ZERO ERRORS;

QUANTUM CRYPTOGRAPHY;

EID: 34547535907     PISSN: 15337146     EISSN: None     Source Type: Journal    
DOI: None     Document Type: Article

References (39)

1. C. H. Bennett, G. Brassard, in Proceedings IEEE Int. Conf. on Computers, Systems and Signal Processing, Bangalore, India (IEEE, New York, 1984), pp. 175-179.
2. N. Gisin, G. Ribordy, W. Tittel, H. Zbinden, Rev. Mod. Phys 74, 145 (2002)
3. K. Inoue, E. Waks, Y. Yamamoto, Phys. Rev. A 68, 022317 (2003)
4. N. Gisin, G. Ribordy, H. Zbinden, D. Stucki, N. Brunner, V. Scarani, quant-ph/0411022 (2004)
5. D. Stucki, N. Brunner, N. Gisin, V. Scarani, H. Zbinden, Appl. Phys. Lett. 87, 194108 (2005)
6. C.H. Bennett, Phys. Rev. Lett. 68, 3121 (1992)
7. P.W. Shor, J. Preskill, Phys. Rev. Lett. 85, 441 (2000)
8. R. Renner, Security of Quantum Key Distribution, PhD thesis, quant-ph/0512258
9. B. Kraus, N. Gisin and R. Renner, Phys. Rev. Lett. 95, 080501 (2005); R. Renner, N. Gisin, B. Kraus, Phys. Rev. A 72, 012332 (2005)
10. H. Inamori, N.Lütkenhaus, D. Mayers, quant-ph/0107017
11. D. Gottesman, H.-K. Lo, N. Lütkenhaus, J. Preskill, Quant. Inf. Comput. 4, 325 (2004)
12. B. Kraus, C. Branciard, R. Renner, Phys. Rev. A 75, 012316 (2007)
13. E. Waks, H. Takesue, Y. Yamamoto, quant-ph/0508112
14. N. Lütkenhaus, Phys. Rev. A 61, 052304 (2000);
15. G. Brassard, N. Lütkenhaus, T. Mor, B.C. Sanders, Phys. Rev. Lett. 85, 1330 (2000)
16. K. Inoue, T. Honjo, Phys. Rev. A 71, 042305 (2005)
17. Attacks based on unambiguous state discrimination were first invented against BB84 and similar protocols: M. Dušek, M. Jahma, N. Lǔtkenhaus, Phys. Rev. A 62, 022306 (2000).
18. They were generalized in: P. Raynal, N. Lütkenhaus, S.J. van Enk, Phys. Rev. A 68, 022308 (2003).
19. A. Chefies, Phys. Lett. A 239, 339 (1998)
20. Usually, when speaking of USD measurements, the goal is to discriminate all the n possible states. Therefore the measurement has n+1 outcomes, which either identify the state unambiguously, or say that the discrimination was inconclusive, Such are in particular the USD attacks as defined in [16].
21. The inconclusive result is a projection onto a subspace. If in this subspace there are still pulse sequences that are linearly independent from all the others (as is the case in particular for the USD attacks under study in this paper), each of these sequences could then in turn be unambiguously discriminated with some probability.
22. Note that this attack is not possible on the differential phase shift protocol [3] because there no empty pulses are used. But other USD attacks are possible, as studied in: M. Curty, L.-L. Zhang, H.-K. Lo, N. Lütkenhaus, Quant. Inf. Comput. 7, 665 (2007)
23. If Bob's detectors have a dead time, the analysis of USD4a is more subtle, because the first non-empty pulse can be detected with the probability we have written in the main text; but the following pulse can be detected only if the first one has not been detected. This may introduce an asymmetry: the logical bit 1 may be detected more often than the logical bit 0. In the extreme case of bright pulses, the first non-empty pulse always triggers the detector, therefore only the logical bit 1 is detected. In the other extreme case, where Eve sends out a single photon, there is no asymmetry, because only one detection can take place.
24. Of course, the fact that Eve forwards always a single photon can be verified by the absence of the expected coincidence counts in two or three of Bob's detectors. But this is not a serious concern: the probability of coincidence is small, and we can easily suppose that Eve sends sometimes a brighter pulse when she has a conclusive result in USD3. If she does so, she can reproduce the coincidence rates. Alice and Bob could still detect this attack by checking if the cases of coincidences are equally distributed among all possible bit and decoy sequences; but it is pointless to make such a detailed analysis here. Finally note that it may be advantageous for Eve to send other states that a single-photon state, for instance vacuum-substracted coherent states.
25. I. Csiszár, J. Körner, IEEE Trans. Inf. Theory 24, 339 (1978);
26. R. Ahlswede, I. Csiszár, IEEE Trans. Inf. Theory 39, 1121 (1993).
27. T. Moroder, M. Curty, N. Lütkenhaus, Phys. Rev. A 73, 012311 (2006)
28. In the absence of empty decoy sequences, it never happens that three consecutive pulses are empty; two additional interferometers, checking the coherence across two and three time slots respectively, would then be enough to make USD attacks impossible.
29. C.-H.F. Fung, H.-K. Lo, quant-ph/0607056
30. This is after Alice and Bob applied a random permutation on their qubit pairs and random bit-flip operations, and assuming they apply optimal error correction and privacy amplification. See [9] for details. Note that we don't consider here the possible classical "preprocessing" A' → A.
31. I. Devetak and A. Winter, Proc. R. Soc. Lond. A 461, 207 (2005)
32. M. Curty, N.Lütkenhaus, Phys. Rev. A, 69, 042321 (2004)
33. For untrusted-device scenario, see Ref. [14]; for the trusted-device scenario: A. Niederberger, V. Scarani, N. Gisin, Phys. Rev. A 71, 042316 (2005)
34. C. W. Helstrom, Quantum Detection and Estimation Theory (Academic Press, New York, 1976)
35. A.S. Holevo, Probl. Inf. Transm. 9, 177 (1973)
36. The Holevo bound is computed here for the task of bitwise distinguishing the states. One can check that the Holevo bound remains the same if Eve tried to get information on longer strings of bits.
37. W.-Y. Hwang, Phys. Rev. Lett. 91, 057901 (2003);
38. X.-B. Wang, Phys. Rev. Lett. 94, 230503 (2005);
39. H.-K. Lo, X. Ma, K. Chen, Phys. Rev. Lett. 94, 230504 (2005).