Quantum cryptography has attracted much recent attention due to its potential for providing secret communications that cannot be decrypted by any amount of computational effort. This is the first analysis of the secrecy of a practical implementation of the BB84 protocol that simultaneously takes into account and presents the full set of analytical expressions for effects due to the presence of pulses containing multiple photons in the attenuated output of the laser, the finite length of individual blocks of key material, losses due to error correction, privacy amplification, and authentication, errors in polarization detection, the efficiency of the detectors, and attenuation processes in the transmission medium. The analysis addresses eavesdropping attacks on individual photons rather than collective attacks in general. Of particular importance is the first derivation of the necessary and sufficient amount of privacy amplification compression to ensure secrecy against the loss of key material which occurs when an eavesdropper makes optimized individual attacks on pulses containing multiple photons. It is shown that only a fraction of the information in the multiple photon pulses is actually lost to the eavesdropper.
Quantum cryptography has attracted much recent attention due to its potential for providing secret communications that cannot be decrypted by any amount of computational effort. This is the first analysis of the secrecy of a practical implementation of the BB84 protocol that simultaneously takes into account and presents the full set of analytical expressions for effects due to the presence of pulses containing multiple photons in the attenuated output of the laser, the finite length of individual blocks of key material, losses due to error correction, privacy amplification, and authentication, errors in polarization detection, the efficiency of the detectors, and attenuation processes in the transmission medium. The analysis addresses eavesdropping attacks on individual photons rather than collective attacks in general. Of particular importance is the first derivation of the necessary and sufficient amount of privacy amplification compression to ensure secrecy against the loss of key material which occurs when an eavesdropper makes optimized individual attacks on pulses containing multiple photons. It is shown that only a fraction of the information in the multiple photon pulses is actually lost to the eavesdropper.
We perform a comprehensive analysis of practical quantum cryptography (QC) systems implemented in actual physical environments via either free-space or fiber-optic cable quantum channels for ground-ground, ground-satellite, air-satellite and satellite-satellite links. (1) We obtain universal expressions for the effective secrecy capacity and rate for QC systems taking into account three important attacks on individual quantum bits, including explicit closed-form expressions for the requisite amount of privacy amplification. Our analysis also includes the explicit calculation in detail of the total cost in bits of continuous authentication, thereby obtaining new results for actual ciphers of finite length. (2) We perform for the first time a detailed, explicit analysis of all systems losses due to propagation, errors, noise, etc. as appropriate to both optical fiber cable- and satellite communications-based implementations of QC. (3) We calculate for the first time all system load costs associated to classical communication and computational constraints that are ancillary to, but essential for carrying out, the pure QC protocol itself. (4) We introduce an extended family of generalizations of the Bennett-Brassard (BB84) QC protocol that equally provide unconditional secrecy but allow for the possibility of optimizing throughput rates against specific cryptanalytic attacks. (5) We obtain universal predictions for maximal rates that can be achieved with practical system designs under realistic environmental conditions. (6) We propose a specific QC system design that includes the use of a novel method of high-speed photon detection that may be able to achieve very high throughput rates for actual implementations in realistic environments.
We perform a comprehensive analysis of practical quantum cryptography (QC) systems implemented in actual physical environments via either free-space or fiber-optic cable quantum channels for ground-ground, ground-satellite, air-satellite and satellite-satellite links. (1) We obtain the complete universal expressions for the effective secrecy capacity and rate for QC systems taking into account the most general attacks on individual quantum bits, including explicit closed-form expressions for the necessary and sufficient amount of privacy amplification. Our analysis also includes the explicit calculation in detail of the total cost in bits of continuous authentication, thereby obtaining new results for actual ciphers of finite length. (2) We perform for the first time a detailed, explicit analysis of all systems losses due to propagation, errors, noise, etc. as appropriate to both optical fiber cable- and satellite communications-based implementations of QC. (3) We calculate for the first time all system load costs associated to classical communication and computational constraints that are ancillary to, but essential for carrying out, the pure QC protocol itself. (4) We introduce an extended family of generalizations of the Bennett-Brassard (BB84) QC protocol that equally provide unconditional secrecy but allow for the possibility of optimizing throughput rates against specific cryptanalytic attacks. (5) We obtain universal predictions for maximal rates that can be achieved with practical system designs under realistic environmental conditions. (6) We propose a specific QC system design that includes the use of a novel method of high-speed photon detection that may be able to achieve very high throughput rates for actual implementations in realistic environments.
A number of questions associated with practical implementations of quantum cryptography systems having to do with unconditional secrecy, computational loads and effective secrecy rates in the presence of perfect and imperfect sources are discussed. The different types of unconditional secrecy, and their relationship to general communications security, are discussed in the context of quantum cryptography. In order to actually carry out a quantum cryptography protocol it is necessary that sufficient computational resources be available to perform the various processing steps, such as sifting, error correction, privacy amplification and authentication. We display the full computer machine instruction requirements needed to support a practical quantum cryptography implementation. We carry out a numerical comparison of system performance characteristics for implementations that make use of either weak coherent sources of light or perfect single photon sources, for eavesdroppers making individual attacks on the quantum channel characterized by different levels of technological capability. We find that, while in some circumstances it is best to employ perfect single photon sources, in other situations it is preferable to utilize weak coherent sources. In either case the secrecy level of the final shared cipher is identical, with the relevant distinguishing figure-of-merit being the effective throughput rate.
An attempt to eavesdrop on a quantum cryptographic channel reveals itself through errors it inevitably introduces into the transmission. We investigate the relationship between the induced error rate and the maximum amount of information the eavesdropper can extract, in both the two-state B92 [B92 refers to the work of C. H. Bennett, Phys. Rev. Lett. 68, 3121 (1992)] and the four-state BB84 [BB84 refers to the work of C. H. Bennett and G. Brassard, in Proceedings of the IEEE International Conference on Computers, Systems, and Signal Processing, Bangalore, India (IEEE, New York, 1984), pp. 175--179] quantum cryptographic protocols. In each case, the optimal eavesdropping method that on average yields the most information for a given error rate is explicitly constructed. Analysis is limited to eavesdropping strategies where each bit of the quantum transmission is attacked individually and independently from other bits. Subject to this restriction, however, we believe that all attacks not forbidden by physical laws are covered. Unlike previous work, the eavesdropper's advantage is measured in terms of Renyi (rather than Shannon) information, and with respect only to bits received error-free by Bob (rather than all bits). This alters both the maximum extractable information and the optimal eavesdropping attack. The result can be used directly at the privacy amplification stage of the protocol to accomplish secure communication over a noisy channel.
The first quantum cryptography protocol, proposed by Bennett and Brassard in 1984 (BB84), has been widely studied in recent years. This protocol uses four states (more precisely, two complementary bases) for the encoding of the classical bit. Recently, it has been noticed that by using the same four states, but a different encoding of information, one can define a protocol which is more robust in practical implementations, specifically when attenuated laser pulses are used instead of single-photon sources [V. Scarani et al., Phys. Rev. Lett. 92, 057901 (2004), referred to as the SARG04 protocol]. We present a detailed study of SARG04 in two different regimes. In the first part, we consider an implementation with a single-photon source: we derive bounds on the error rate Q for security against all possible attacks by the eavesdropper. The lower and the upper bound obtained for SARG04 ($Q\ensuremath{\lesssim}10.95%$ and $Q\ensuremath{\gtrsim}14.9%$, respectively) are close to those obtained for BB84 ($Q\ensuremath{\lesssim}12.4%$ and $Q\ensuremath{\gtrsim}14.6%$, respectively). In the second part, we consider a realistic source consisting of an attenuated laser and improve on previous analysis by allowing Alice to optimize the mean number of photons as a function of the distance. The SARG04 protocol is found to perform better than BB84, both in secret-key rate and in maximal achievable distance, for a wide class of Eve's attacks.
An attempt to eavesdrop a quantum cryptographic channel reveals itself through errors it inevitably introduces into the transmission. We investigate the relationship between the induced error rate and the maximum amount of information the eavesdropper can extract, both in the two-state B92 and the four-state BB84 quantum cryptographic protocols. In each case, the optimal eavesdropping method that on average yields the most information for a given error rate is explicitly constructed. Analysis is limited to eavesdropping strategies where each bit of the quantum transmission is attacked individually and independently form other bits. Subject to this restriction, however, we believe that all attacks not forbidden by physical laws are included. Unlike previous work, the eavesdropper's advantage is measured in terms of Renyi information, and with respect only to bits received error-free by Bob. This alters both the maximum extractable information and the optimal eavesdropping attack. The result can be used directly at the privacy amplification stage of the protocol to accomplish secure communication over a noisy channel.