Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:quant-ph/9807041 · Physical Review A

Incoherent and coherent eavesdropping in the six-state protocol of quantum cryptography

Helle Bechmann-Pasquinucci, Nicolas Gisin

Published Jun 1, 1999• 371 citations
arXivHTMLPDF

Abstract

All incoherent as well as 2- and 3-qubit coherent eavesdropping strategies on the six-state protocol of quantum cryptography are classified. For a disturbance of $1/6$, the optimal incoherent eavesdropping strategy reduces to the universal quantum cloning machine. Coherent eavesdropping cannot increase Eve's Shannon information, neither on the entire string of bits, nor on the set of bits received undisturbed by Bob. However, coherent eavesdropping can increase as well Eve's Renyi information as her probability of guessing correctly all bits. The case that Eve delays the measurement of her probe until after the public discussion on error correction and privacy amplification is also considered. It is argued that by doing so, Eve gains only negligibly small additional information.

DOI
10.1103/physreva.59.4238

Related papers

Another Look at Symmetric Incoherent Optimal Eavesdropping against BB84

Arpita Maitra, Goutam Paul

Abstract. The BB84 protocol is used by Alice (the sender) and Bob (the receiver) to settle on a secret classical bit-string by communicating qubits over an insecure quantum channel where Eve (the Eavesdropper) can have access. In this paper, we revisit a well known eavesdropping technique against BB84. We claim that there exist certain gaps in understanding the existing eavesdropping strategyin terms of cryptanalytic view and we try to bridge those gaps in this paper. First we refer to the result where it is shown that in the six-state variant of the BB84 protocol (Bruß, Phys. Rev. Lett., 1998), the mutual information between Alice (the sender) and Eve (the eavesdropper) is higher when two-bit probe is used compared to the one-bit probe and hencethetwo-bitprobeprovidesastrongereavesdroppingstrategy.However, from cryptanalytic point of view, we show that Eve has the same success probability in guessing the bit transmitted by Alice in both the cases of the two-bit and the one-bit probe. Thus, we point out that having higher mutual information may not directly lead to obtaining higher probability in guessing the key bit. It is also explained in the work of Bruß that the six-state variant of the BB84 protocol is more secure than the traditional four-state BB84. We look into this point in more detail and identify that this advantage is only achieved at the expense of communicating more qubits in the sixstate protocol. In fact, we present different scenarios, where given the same number of qubits communicated, the security comparison of the four and six-state protocols is evaluated carefully.

•Jan 1, 2012•0 citations

Security of quantum cryptography against individual attacks

Boris A. Slutsky, Ramesh R. Rao, Pang-Chen Sun +1 more

An attempt to eavesdrop on a quantum cryptographic channel reveals itself through errors it inevitably introduces into the transmission. We investigate the relationship between the induced error rate and the maximum amount of information the eavesdropper can extract, in both the two-state B92 [B92 refers to the work of C. H. Bennett, Phys. Rev. Lett. 68, 3121 (1992)] and the four-state BB84 [BB84 refers to the work of C. H. Bennett and G. Brassard, in Proceedings of the IEEE International Conference on Computers, Systems, and Signal Processing, Bangalore, India (IEEE, New York, 1984), pp. 175--179] quantum cryptographic protocols. In each case, the optimal eavesdropping method that on average yields the most information for a given error rate is explicitly constructed. Analysis is limited to eavesdropping strategies where each bit of the quantum transmission is attacked individually and independently from other bits. Subject to this restriction, however, we believe that all attacks not forbidden by physical laws are covered. Unlike previous work, the eavesdropper's advantage is measured in terms of Renyi (rather than Shannon) information, and with respect only to bits received error-free by Bob (rather than all bits). This alters both the maximum extractable information and the optimal eavesdropping attack. The result can be used directly at the privacy amplification stage of the protocol to accomplish secure communication over a noisy channel.

Physical Review A•Apr 1, 1998•115 citations

Security of quantum cryptography against individual attacks

Boris A. Slutsky, Ramesh R. Rao, Pang-Chen Sun +1 more

An attempt to eavesdrop a quantum cryptographic channel reveals itself through errors it inevitably introduces into the transmission. We investigate the relationship between the induced error rate and the maximum amount of information the eavesdropper can extract, both in the two-state B92 and the four-state BB84 quantum cryptographic protocols. In each case, the optimal eavesdropping method that on average yields the most information for a given error rate is explicitly constructed. Analysis is limited to eavesdropping strategies where each bit of the quantum transmission is attacked individually and independently form other bits. Subject to this restriction, however, we believe that all attacks not forbidden by physical laws are included. Unlike previous work, the eavesdropper's advantage is measured in terms of Renyi information, and with respect only to bits received error-free by Bob. This alters both the maximum extractable information and the optimal eavesdropping attack. The result can be used directly at the privacy amplification stage of the protocol to accomplish secure communication over a noisy channel.

Proceedings of SPIE, the International Society for Optical Engineering/Proceedings of SPIE•Feb 1, 1998•0 citations

Optimal eavesdropping on quantum key distribution without quantum memory

Aurélien Bocquet, Romain Alléaume, Anthony Leverrier

We consider the security of the BB84 (Bennett and Brassard 1984 Proc. IEEE Int. Conf. on Computers, Systems, and Signal Processing pp 175–9), six-state (Bruß 1998 Phys. Rev. Lett. 81 3018 ) and SARG04 (Scarani et al 2004 Phys. Rev. Lett. 92 057901 ) quantum key distribution protocols when the eavesdropper does not have access to a quantum memory. In this case, Eve’s most general strategy is to measure her ancilla with an appropriate positive operator-valued measure designed to take advantage of the post-measurement information that will be released during the sifting phase of the protocol. After an optimization on all the parameters accessible to Eve, our method provides us with new bounds for the security of six-state and SARG04 against a memoryless adversary. In particular, for the six-state protocol we show that the maximum quantum bit error ratio for which a secure key can be extracted is increased from 12.6% (for collective attacks) to 20.4% with the memoryless assumption.

arXiv:1106.0329•Journal of Physics A Mathematical and Theoretical•Dec 9, 2011•7 citations

OPTIMAL EAVESDROPPING ON NOISY STATES IN QUANTUM KEY DISTRIBUTION

Z. SHADMAN, H. KAMPERMANN, T. MEYER +1 more

We study eavesdropping in quantum key distribution with the six state protocol, when the signal states are mixed with white noise. This situation may arise either when Alice deliberately adds noise to the signal states before they leave her lab, or in a realistic scenario where Eve cannot replace the noisy quantum channel by a noiseless one. We find Eve's optimal mutual information with Alice, for individual attacks, as a function of the qubit error rate. Our result is that added quantum noise reduces Eve's mutual information more than Bob's.

arXiv:0804.0587•International Journal of Quantum Information•Feb 1, 2009•20 citations

The intercept/resend attack and the collective attack on the six-state protocol of the quantum key distribution

Hiroo Azuma, Masashi Ban

In this paper, we discuss security of the six-state quantum key distribution protocol against intercept/resend attacks and collective attacks. For the intercept/resend attacks, we evaluate a probability that the legitimate users, Alice and Bob, do not notice interference caused by the eavesdropper Eve and a probability that Eve obtains a secret bit sent by Alice. For the collective attacks, we estimate not only the above two probabilities but also Eve's Shannon information. In the assessment of the security against the collective attacks, imposing looser constraints upon Eve's strategies than Bechmann-Pasquinucci and Gisin, we reach substantially the same result as their study. In other words, although we let Eve's strategies satisfy lower symmetry than Bechmann-Pasquinucci and Gisin, both their work and ours attain the same conclusion, i.e. the identical, unique, and optimum strategy. This implies that we obtain Eve's best tactic by applying simpler conditions to it than Bechmann-Pasquinucci and Gisin, so that this result is novel. Finally, we consider a relation between the six-state protocol and the E91 scheme. We show that the intercept/resend attacks can always be described by hidden variable models. In contrast, we demonstrate that we cannot regard the collective attacks as the hidden variable theories if the disturbance is smaller than $1/3$.

•Nov 30, 2019•2 citations
All incoherent as well as 2- and 3-qubit coherent eavesdropping strategies on the six-state protocol of quantum cryptography are classified. For a disturbance of 1/61/61/6, the optimal incoherent eavesdropping strategy reduces to the universal quantum cloning machine. Coherent eavesdropping cannot increase Eve's Shannon information, neither on the entire string of bits, nor on the set of bits received undisturbed by Bob. However, coherent eavesdropping can increase as well Eve's Renyi information as her probability of guessing correctly all bits. The case that Eve delays the measurement of her probe until after the public discussion on error correction and privacy amplification is also considered. It is argued that by doing so, Eve gains only negligibly small additional information.
Abstract. The BB84 protocol is used by Alice (the sender) and Bob (the receiver) to settle on a secret classical bit-string by communicating qubits over an insecure quantum channel where Eve (the Eavesdropper) can have access. In this paper, we revisit a well known eavesdropping technique against BB84. We claim that there exist certain gaps in understanding the existing eavesdropping strategyin terms of cryptanalytic view and we try to bridge those gaps in this paper. First we refer to the result where it is shown that in the six-state variant of the BB84 protocol (Bruß, Phys. Rev. Lett., 1998), the mutual information between Alice (the sender) and Eve (the eavesdropper) is higher when two-bit probe is used compared to the one-bit probe and hencethetwo-bitprobeprovidesastrongereavesdroppingstrategy.However, from cryptanalytic point of view, we show that Eve has the same success probability in guessing the bit transmitted by Alice in both the cases of the two-bit and the one-bit probe. Thus, we point out that having higher mutual information may not directly lead to obtaining higher probability in guessing the key bit. It is also explained in the work of Bruß that the six-state variant of the BB84 protocol is more secure than the traditional four-state BB84. We look into this point in more detail and identify that this advantage is only achieved at the expense of communicating more qubits in the sixstate protocol. In fact, we present different scenarios, where given the same number of qubits communicated, the security comparison of the four and six-state protocols is evaluated carefully.
An attempt to eavesdrop on a quantum cryptographic channel reveals itself through errors it inevitably introduces into the transmission. We investigate the relationship between the induced error rate and the maximum amount of information the eavesdropper can extract, in both the two-state B92 [B92 refers to the work of C. H. Bennett, Phys. Rev. Lett. 68, 3121 (1992)] and the four-state BB84 [BB84 refers to the work of C. H. Bennett and G. Brassard, in Proceedings of the IEEE International Conference on Computers, Systems, and Signal Processing, Bangalore, India (IEEE, New York, 1984), pp. 175--179] quantum cryptographic protocols. In each case, the optimal eavesdropping method that on average yields the most information for a given error rate is explicitly constructed. Analysis is limited to eavesdropping strategies where each bit of the quantum transmission is attacked individually and independently from other bits. Subject to this restriction, however, we believe that all attacks not forbidden by physical laws are covered. Unlike previous work, the eavesdropper's advantage is measured in terms of Renyi (rather than Shannon) information, and with respect only to bits received error-free by Bob (rather than all bits). This alters both the maximum extractable information and the optimal eavesdropping attack. The result can be used directly at the privacy amplification stage of the protocol to accomplish secure communication over a noisy channel.
An attempt to eavesdrop a quantum cryptographic channel reveals itself through errors it inevitably introduces into the transmission. We investigate the relationship between the induced error rate and the maximum amount of information the eavesdropper can extract, both in the two-state B92 and the four-state BB84 quantum cryptographic protocols. In each case, the optimal eavesdropping method that on average yields the most information for a given error rate is explicitly constructed. Analysis is limited to eavesdropping strategies where each bit of the quantum transmission is attacked individually and independently form other bits. Subject to this restriction, however, we believe that all attacks not forbidden by physical laws are included. Unlike previous work, the eavesdropper's advantage is measured in terms of Renyi information, and with respect only to bits received error-free by Bob. This alters both the maximum extractable information and the optimal eavesdropping attack. The result can be used directly at the privacy amplification stage of the protocol to accomplish secure communication over a noisy channel.
We consider the security of the BB84 (Bennett and Brassard 1984 Proc. IEEE Int. Conf. on Computers, Systems, and Signal Processing pp 175–9), six-state (Bruß 1998 Phys. Rev. Lett. 81 3018 ) and SARG04 (Scarani et al 2004 Phys. Rev. Lett. 92 057901 ) quantum key distribution protocols when the eavesdropper does not have access to a quantum memory. In this case, Eve’s most general strategy is to measure her ancilla with an appropriate positive operator-valued measure designed to take advantage of the post-measurement information that will be released during the sifting phase of the protocol. After an optimization on all the parameters accessible to Eve, our method provides us with new bounds for the security of six-state and SARG04 against a memoryless adversary. In particular, for the six-state protocol we show that the maximum quantum bit error ratio for which a secure key can be extracted is increased from 12.6% (for collective attacks) to 20.4% with the memoryless assumption.
We study eavesdropping in quantum key distribution with the six state protocol, when the signal states are mixed with white noise. This situation may arise either when Alice deliberately adds noise to the signal states before they leave her lab, or in a realistic scenario where Eve cannot replace the noisy quantum channel by a noiseless one. We find Eve's optimal mutual information with Alice, for individual attacks, as a function of the qubit error rate. Our result is that added quantum noise reduces Eve's mutual information more than Bob's.
In this paper, we discuss security of the six-state quantum key distribution protocol against intercept/resend attacks and collective attacks. For the intercept/resend attacks, we evaluate a probability that the legitimate users, Alice and Bob, do not notice interference caused by the eavesdropper Eve and a probability that Eve obtains a secret bit sent by Alice. For the collective attacks, we estimate not only the above two probabilities but also Eve's Shannon information. In the assessment of the security against the collective attacks, imposing looser constraints upon Eve's strategies than Bechmann-Pasquinucci and Gisin, we reach substantially the same result as their study. In other words, although we let Eve's strategies satisfy lower symmetry than Bechmann-Pasquinucci and Gisin, both their work and ours attain the same conclusion, i.e. the identical, unique, and optimum strategy. This implies that we obtain Eve's best tactic by applying simpler conditions to it than Bechmann-Pasquinucci and Gisin, so that this result is novel. Finally, we consider a relation between the six-state protocol and the E91 scheme. We show that the intercept/resend attacks can always be described by hidden variable models. In contrast, we demonstrate that we cannot regard the collective attacks as the hidden variable theories if the disturbance is smaller than 1/31/31/3.