The security of quantum key distribution against undetected eavesdropping depends on the key-sharing parties (Alice and Bob) making a probabilistic estimate of the ignorance of a maximally adept eavesdropper (Eve) concerning sifted, error-free bits from which Alice and Bob distill a key. For individual attacks on the BB84 protocol, we show how to generalize the defense function and the defense frontier of Slutsky et al. to take advantage of Cachin’s analysis of Renyi entropy of arbitrary order R, here called R-entropy. For a special case of an attack uniform over all bits, an optimum defense frontier is displayed. Evidence is discussed for the conjecture that this defense frontier in terms of R-entropy holds good not just for uniform attacks but for all individual attacks on BB84. We also show how the entropy estimate fits in to the full suite of key-distillation protocols in a QKD system, in particular how it relates to privacy amplification. After privacy amplification, Eve will have, with high probability, no information about the remaining bits. By choosing the optimal Rényi order R, we can distill secure bits in the presence of a significantly higher error rate.
The security of quantum key distribution against undetected eavesdropping depends on the key-sharing parties (Alice and Bob) making a probabilistic estimate of the ignorance of a maximally adept eavesdropper (Eve) concerning sifted, error-free bits from which Alice and Bob distill a key. For individual attacks on the BB84 protocol, we show how to generalize the defense function and the defense frontier of Slutsky et al. to take advantage of Cachin’s analysis of Renyi entropy of arbitrary order R, here called R-entropy. For a special case of an attack uniform over all bits, an optimum defense frontier is displayed. Evidence is discussed for the conjecture that this defense frontier in terms of R-entropy holds good not just for uniform attacks but for all individual attacks on BB84. We also show how the entropy estimate fits in to the full suite of key-distillation protocols in a QKD system, in particular how it relates to privacy amplification. After privacy amplification, Eve will have, with high probability, no information about the remaining bits. By choosing the optimal Rényi order R, we can distill secure bits in the presence of a significantly higher error rate.
When a quantum cryptographic system operates in the presence of background noise, security of the key can be recovered by a procedure called key distillation. A key-distillation scheme effective against so-called individual (bitwise-independent) eavesdropping attacks involves sacrifice of some of the data through privacy amplification. We derive the amount of data sacrifice sufficient to defend against individual eavesdropping attacks in both BB84 and B92 protocols and show in what sense the communication becomes secure as a result. We also compare the secrecy capacity of various quantum cryptosystems, taking into account data sacrifice during key distillation, and conclude that the BB84 protocol may offer better performance characteristics than the B92.
An attempt to eavesdrop a quantum cryptographic channel reveals itself through errors it inevitably introduces into the transmission. We investigate the relationship between the induced error rate and the maximum amount of information the eavesdropper can extract, both in the two-state B92 and the four-state BB84 quantum cryptographic protocols. In each case, the optimal eavesdropping method that on average yields the most information for a given error rate is explicitly constructed. Analysis is limited to eavesdropping strategies where each bit of the quantum transmission is attacked individually and independently form other bits. Subject to this restriction, however, we believe that all attacks not forbidden by physical laws are included. Unlike previous work, the eavesdropper's advantage is measured in terms of Renyi information, and with respect only to bits received error-free by Bob. This alters both the maximum extractable information and the optimal eavesdropping attack. The result can be used directly at the privacy amplification stage of the protocol to accomplish secure communication over a noisy channel.
An attempt to eavesdrop on a quantum cryptographic channel reveals itself through errors it inevitably introduces into the transmission. We investigate the relationship between the induced error rate and the maximum amount of information the eavesdropper can extract, in both the two-state B92 [B92 refers to the work of C. H. Bennett, Phys. Rev. Lett. 68, 3121 (1992)] and the four-state BB84 [BB84 refers to the work of C. H. Bennett and G. Brassard, in Proceedings of the IEEE International Conference on Computers, Systems, and Signal Processing, Bangalore, India (IEEE, New York, 1984), pp. 175--179] quantum cryptographic protocols. In each case, the optimal eavesdropping method that on average yields the most information for a given error rate is explicitly constructed. Analysis is limited to eavesdropping strategies where each bit of the quantum transmission is attacked individually and independently from other bits. Subject to this restriction, however, we believe that all attacks not forbidden by physical laws are covered. Unlike previous work, the eavesdropper's advantage is measured in terms of Renyi (rather than Shannon) information, and with respect only to bits received error-free by Bob (rather than all bits). This alters both the maximum extractable information and the optimal eavesdropping attack. The result can be used directly at the privacy amplification stage of the protocol to accomplish secure communication over a noisy channel.
Users of a quantum cryptographic system face a problem of deciding on the ignorance of a maximally adroit eavesdropper concerning their key material. It is known that there can be no sure, positive, lower bound on any plausible measure of ignorance, and for this reason we characterize the problem as the making of an informed guess, meaning a guess that employs a rule that can be shown to work except in unlikely cases. As the measure of an eavesdropper's ignorance concerning n bits of sifted key material less some number k of bits found in error and discarded, we analyze Renyi entropy of arbitrary order R, for 1 ≤ R ≤ 2. We offer a rule for deciding on Renyi entropy based on a tighter bound on the relevant probability distributions than has been available. To this end, we employ a recently derived approximation to the cumulative binomial distribution which is uniformly accurate over a larger domain than previously available approximations. This results in a longer distilled key than that obtained from looser bounds, as well as generalizing the order R. Some numerical examples are presented.
So far, the knowledge of Eve has been modeled by a classical random variable. The aim of this chapter is first to discuss how the previous results apply to QKD, where Eve's action may not necessarily be classically described by the random variable Z . Then, we explain the equivalence between BB84 and so-called entanglement purification protocols as a tool to encompass general eavesdropping strategies. Finally, we apply this equivalence to the case of the coherent-state protocol GG02. Eavesdropping strategies and secret-key distillation In Chapters 10 and 11, I analyzed the security of the protocols with regard to individual eavesdropping strategies only. In this particular case, the result of Alice's, Bob's and Eve's measurements can be described classically and the results of Section 6.4 apply. Let us review other kinds of eavesdropping strategies and discuss how the concepts of Chapter 6 can be applied. Note that the individual eavesdropping strategy, the simplest class of strategies, is still technologically very challenging to achieve today in an optimal way. Nevertheless, we do not want the security of quantum cryptography to rely only on technological barriers. By considering more general eavesdropping strategies, we make sure quantum cryptography lies on strong grounds. Following Gisin et al. [64], we divide the possible eavesdropping strategies into three categories: individual attacks, collective attacks and joint attacks .
The information-disturbance tradeoff lies at the heart of quantum key distribution (QKD), allowing a sender and a receiver to monitor eavesdropping in the communication channel by checking for errors in the transmission. Even so, here we show that for a class of QKD protocols based on the principle of interaction-free measurement, an eavesdropper Eve can obtain partial information noiselessly, i.e., in such a way that the disturbance produced does not show up during the error checking. The proposed attack is shown to be the optimal individual noiseless attack. An implication of the noiselessness is that even though error correction is not required, privacy amplification (PA) is necessary. For example, in the case of the protocol of [T.-G. Noh, PRL 103, 230501 (2009)], the compression factor of PA is 0.68 in the case of an individual, noiseless attack. For the noisy generalization of the above attack, where Eve introduces noise into the communication channel without adding noise to the eavesdropping channel, the security requirement entails a lower bound on the noise threshold of about 11%, assuming that the transmitted particles are single photons.