So far, the knowledge of Eve has been modeled by a classical random variable. The aim of this chapter is first to discuss how the previous results apply to QKD, where Eve's action may not necessarily be classically described by the random variable Z . Then, we explain the equivalence between BB84 and so-called entanglement purification protocols as a tool to encompass general eavesdropping strategies. Finally, we apply this equivalence to the case of the coherent-state protocol GG02. Eavesdropping strategies and secret-key distillation In Chapters 10 and 11, I analyzed the security of the protocols with regard to individual eavesdropping strategies only. In this particular case, the result of Alice's, Bob's and Eve's measurements can be described classically and the results of Section 6.4 apply. Let us review other kinds of eavesdropping strategies and discuss how the concepts of Chapter 6 can be applied. Note that the individual eavesdropping strategy, the simplest class of strategies, is still technologically very challenging to achieve today in an optimal way. Nevertheless, we do not want the security of quantum cryptography to rely only on technological barriers. By considering more general eavesdropping strategies, we make sure quantum cryptography lies on strong grounds. Following Gisin et al. [64], we divide the possible eavesdropping strategies into three categories: individual attacks, collective attacks and joint attacks .
So far, the knowledge of Eve has been modeled by a classical random variable. The aim of this chapter is first to discuss how the previous results apply to QKD, where Eve's action may not necessarily be classically described by the random variable Z . Then, we explain the equivalence between BB84 and so-called entanglement purification protocols as a tool to encompass general eavesdropping strategies. Finally, we apply this equivalence to the case of the coherent-state protocol GG02. Eavesdropping strategies and secret-key distillation In Chapters 10 and 11, I analyzed the security of the protocols with regard to individual eavesdropping strategies only. In this particular case, the result of Alice's, Bob's and Eve's measurements can be described classically and the results of Section 6.4 apply. Let us review other kinds of eavesdropping strategies and discuss how the concepts of Chapter 6 can be applied. Note that the individual eavesdropping strategy, the simplest class of strategies, is still technologically very challenging to achieve today in an optimal way. Nevertheless, we do not want the security of quantum cryptography to rely only on technological barriers. By considering more general eavesdropping strategies, we make sure quantum cryptography lies on strong grounds. Following Gisin et al. [64], we divide the possible eavesdropping strategies into three categories: individual attacks, collective attacks and joint attacks .
Quantum cryptography, or, more precisely, quantum key distribution (QKD) allows two distant parties, Alice and Bob, to expand a previously shared secret key by sending quantum states through a quantum channel. The goal here is for Alice and Bob to communicate securely in the presence of an eavesdropper, Eve. The most well-known QKD protocol is the Bennett-Brassard 1984 (BB84) protocol, which has been proved unconditionally secure against any attacks allowed by quantum mechanics. The main advantage of QKD over conventional cryptography is its absolute security. Thus, it is imperative to evaluate the security and performance of QKD protocols and realistic QKD systems. In this thesis, we study the security and performance aspects of QKD in four parts. In the first part, we study the Scarani-Acin-Ribordy-Gisin 2004 (SARG04) protocol. This protocol differs from the BB84 protocol only in the classical post-processing step and uses the same four quantum states as the BB84 protocol. We compared these two protocols and showed that in typical situations, the classical post-processing software for BB84 should be used in order to have a higher performance. In the second part, we prove the security of a three-state protocol. This protocol is similar to the BB84 protocol in that they share the same three qubit states. In the third part, we consider a practical Trojan horse attack on practical QKD systems implementing the BB84 protocol. The attack works by taking advantage of the finite response time of practical phase modulators to remap the states sent out by the legitimate user, Alice. We showed that if Alice and Bob are unaware of our attack, the final key shared between them can be compromised in some situations. In the fourth part, we consider another type of Trojan horse attack, which is based on mismatch between detection efficiencies of detectors. Practical detectors in QKD systems usually do not have identical efficiencies and an eavesdropper Eve may be able to exploit this efficiency mismatch to steal information about the final secret key. We analyze the security of the attack and show that it is possible for Eve to acquire some information on the final secret key if Alice and Bob are unaware of this attack.
In this paper, we discuss security of the six-state quantum key distribution protocol against intercept/resend attacks and collective attacks. For the intercept/resend attacks, we evaluate a probability that the legitimate users, Alice and Bob, do not notice interference caused by the eavesdropper Eve and a probability that Eve obtains a secret bit sent by Alice. For the collective attacks, we estimate not only the above two probabilities but also Eve's Shannon information. In the assessment of the security against the collective attacks, imposing looser constraints upon Eve's strategies than Bechmann-Pasquinucci and Gisin, we reach substantially the same result as their study. In other words, although we let Eve's strategies satisfy lower symmetry than Bechmann-Pasquinucci and Gisin, both their work and ours attain the same conclusion, i.e. the identical, unique, and optimum strategy. This implies that we obtain Eve's best tactic by applying simpler conditions to it than Bechmann-Pasquinucci and Gisin, so that this result is novel. Finally, we consider a relation between the six-state protocol and the E91 scheme. We show that the intercept/resend attacks can always be described by hidden variable models. In contrast, we demonstrate that we cannot regard the collective attacks as the hidden variable theories if the disturbance is smaller than 1/3.
Quantum cryptography uses quantum mechanics to guarantee secure communication. BB84 is a widely used quantum key distribution that provides a way for two parties, a sender, Alice, and a receiver, Bob, to share an unconditionally secure key in the presence of an eavesdropper, Eve. Three different criteria can be assumed to study the BB84 protocol. They are the efficiency of the protocol, the probability that Eve remains undetected, and the amount of knowledge Eve has about Alice's bit sequence. In a previous approach, we only considered the probability that Eve remains undetected. We viewed this protocol as a three player static game in which Alice and Bob were two cooperative players and Eve was a competitive one. In our game model, Alice's and Bob's objective was to maximize the probability of detecting Eve, while Eve's objective was to minimize this probability. In this paper, our previous effort is extended and we also consider the other two criteria, i.e. the efficiency of the protocol and the amount of knowledge Eve has about Alice's bit sequence. Using these models, we show how game theory can be used to find the strategies for Alice, Bob and Eve.
In this thesis we develop practical tools for quantum key distribution (QKD) security proofs. We apply the tools to provide security proofs for several protocols, ranging from discrete variable protocols in high dimensions, protocols with realistic implementations, measurement device independent QKD and continuous-variable QKD. The security proofs are based on the Devetak-Winter security framework [I. Devetak and A. Winter, Proc. of the Roy. Soc. of London Series A, 461, 207 (2005); B. Kraus, N. Gisin, and R. Renner, Phys. Rev. Lett., 95 080501 (2005)]. \n \nIn the key rate calculation, it is often convenient to assume that the optimal attack is symmetric. \nUnder the assumption that the parameter estimation is based on coarse-grained observations, we show that the optimal attack is symmetric, if the protocol and the postselection have sufficient symmetries. \nAs an example we calculate the key rates of protocols using 2, d and d+1 mutually unbiased bases in d-dimensional Hilbert spaces. \n \nWe investigate the connection between the optimal collective eavesdropping attack and the optimal cloning attack, in which the eavesdropper employs an optimal cloner to attack the protocol. \nWe find that, in general, it does not hold that the optimal attack is an optimal cloner. However, there are classes of protocols, for which we can identify the optimal attack by an optimal cloner. \nWe analyze protocols with mutually unbiased bases in d dimensions, and show that for the protocols with 2 and d+1 mutually unbiased bases the optimal attack is an optimal cloner, but for the protocols with d mutually unbiased bases, it is not. \n \nIn optical implementations of the phase-encoded BB84 protocol, the bit information is usually encoded in the phase of two consecutive photon pulses generated in a Mach-Zehnder interferometer. In the actual experimental realization, the loss in the arms of the Mach-Zehnder interferometer is not balanced, for example because only one arm contains a lossy phase modulator. \nSince the imbalance changes the structure of the signals states and measurements, the BB84 security analysis no longer applies in this scenario. \nWe provide a security proof for the unbalanced phase-encoded BB84. The loss does lower the key rate compared to a protocol without loss. However, for a realistic parameter regime, the same key rate is found by applying the original BB84 security analysis. \n \nRecently, the security of a measurement device-independent QKD setup with BB84 signal states was proven in Refs. [H.-K. Lo, M. Curty, and B. Qi, Phys. Rev. Lett., 108 (2012); S. L. Braunstein and S. Pirandola, Phys. Rev. Lett., 108 (2012)]. In this setup Alice and Bob send quantum states to an intermediate node, which performs the measurement, and is assumed to be controlled by Eve. \nWe analyze the security of a measurement device-independent QKD protocol with B92 signal states, and calculate the key rates numerically for a realistic implementation. \nBased on our security proof we were able to prove the security of the strong reference pulse B92 protocol. \n \nWe analyze the security of continuous-variable protocols using the entropic uncertainty relations established in Ref. [M. Berta, M. Christandl, R. Colbeck, J. M. Renes, and R. Renner, Nature Physics 6, 659 (2010)] to provide an estimate of the key rate based on the observed first and second moments. We analyze a protocol with squeezed coherent states and the 2-state protocol with two coherent states with opposite phases.
Quantum key distribution (QKD), another name for quantum cryptography, is the most advanced subfield of quantum information and communication technology (QICT). The first QKD protocol was proposed in 1984, and since then, more protocols have been proposed. It uses quantum mechanics to enable secure exchange of cryptographic keys. In order to have high confidence in the security of the QKD protocols, such protocols must be proven to be secure against any arbitrary attacks. In this chapter, we discuss and demonstrate security proofs for QKD protocols. Security analysis of QKD protocols can be categorised into two techniques, namely infinite-key and finite-key analyses. Finite-key analysis offers more realistic results than the infinite-key one, while infinite-key analysis provides more simplicity. We briefly provide the background of QKD and also define the basic notion of security in QKD protocols. The cryptographic key is shared between Alice and Bob. Since the key is random and unknown to an eavesdropper, Eve, she is unable to learn anything about the message simply by intercepting the ciphertext. This phenomenon is beyond the ability of classical information processing. We then study some tools that are used in the derivation of security proofs for the infinite- and finite-length key limits.
Quantum Key Distribution (QKD) provides a method for securely sharing a secret key between two distant parties, Alice and Bob, by leveraging the principles of quantum mechanics. This thesis focuses on Continuous-Variable (CV) QKD, a variant of QKD where information is encoded in the quadrature components of coherent light states, allowing for efficient and cost-effective detection using homodyne or heterodyne receivers. The thesis is divided into three main parts: an introduction to quantum cryptography concepts, the presentation of a CV-QKD protocol, and a detailed security proof of the protocol against different types of attacks. The security proof considers both finite and infinite symbol transmission and tackles various eavesdropping attacks, including individual, collective, and coherent attacks. The use of Gaussian states and operations provides a promising approach to enhance QKD security, particularly in the context of practical quantum cryptography. The final sections provide a mathematical framework for the optimization of secure key rates and strategies for addressing the photon-number cutoff assumption in practical implementations.