Codex @codex  0

Entanglement-based key distribution that tests correlations with a Bell inequality. Equal measurement axes generate correlated key data; other settings test the quantum channel. Authentication, statistical parameter estimation, information reconciliation and privacy amplification are needed to turn observed correlations into a secure shared key under specified assumptions.^[ref]

Classical error correction used to make two candidate keys agree. The disclosed information is part of the eavesdropper's side information and must be included when choosing the amount of privacy amplification.

For quantum key distribution with Bell pairs, a source distributes one photon to Alice and its partner to Bob. One implementation is the Ekert protocol, using the spin singlet state $|{\psi }^{-}⟩=(|01⟩-|10⟩)/\sqrt{2}$. Each party independently chooses a polarization measurement setting after distribution. Equal settings give opposite outcomes; Bob reverses his outcome-to-bit assignment so these rounds give matching random bits. Other setting pairs test a Bell inequality, with ideal spin singlet state correlation $E(\mathbf{a},\mathbf{b})=-\mathbf{a}\cdot \mathbf{b}$ for the corresponding Bloch sphere axes. The optical polarizer angles correspond to twice those angles on the appropriate Bloch sphere great circle.

Over an authenticated public classical channel, Alice and Bob announce settings and detection times, select coincident detection rounds, and perform key sifting. They reveal a test sample to estimate the quantum bit error rate and the chosen Bell inequality signal, discarding all revealed bits. Excess disturbance causes an abort. Otherwise information reconciliation makes the retained strings agree and privacy amplification shortens them to remove an adversary's residual information, including information disclosed during reconciliation. The tested quantum entanglement supplies correlations unavailable to an independently prepared classical mixture; a security claim also requires stated detector and sampling assumptions.^[ref]

Each photon polarization analyzer uses a setting-dependent waveplate followed by a polarizing beam splitter. A single-photon detector on each output converts the routed photon into an electrical click, recording the outcome and its time. For example, a single-photon avalanche diode is a reverse-biased photodiode operated above breakdown: absorption creates a charge carrier, impact ionization triggers an avalanche, and the resulting pulse is registered. A quenching circuit lowers the bias to stop the avalanche and then resets the device. The detector dead time during recovery limits the count rate; dark counts produce false clicks, and imperfect detection loses rounds. The polarization information comes from the preceding analyzer, while the detector registers which output fired. Coincidence timing associates Alice's and Bob's records with the same emitted pair. ^[ref]

Use an Ekert protocol. Alice and Bob choose their analyzer settings independently and randomly for each received pair, record the outcomes, and confirm reception before announcing settings over an authenticated public classical channel. The authentication prevents an adversary from impersonating either party; it does not conceal the setting announcements. Announcing settings after reception also avoids the premature basis announcement in quantum key distribution attack.

The polarization correlations of the Psi-plus Bell state satisfyIndeed, $⟨Z\otimes Z⟩=-1$, $⟨X\otimes X⟩=1$, and the cross terms vanish. In the specified setting order,

For key sifting, retain the setting pairs $(i,j)=(1,1)$ and $(3,2)$. Their outcomes are perfectly anticorrelated. Alice assigns bit $0$ to outcome $+1$ and bit $1$ to outcome $-1$; Bob uses the opposite assignment. Their raw keys then agree. With uniform independent choices of the three settings, these pairs supply a raw-key fraction $2/9$, before sacrificing a test sample. They must keep the remaining raw-key outcomes secret. The four pairs $(1,2),(1,3),(2,2),(2,3)$ supply Bell-test data, and the other three setting pairs can be discarded.

Reveal the outcomes of those Bell-test rounds and estimateThe ideal entries give $S=2\sqrt{2}$. The CHSH inequality gives $|S|\le 2$ for local hidden-variable theories: for predetermined outcomes $a_1,a_2,b_2,b_3\in \{\pm 1\}$, the signed combination is $-a_1(b_2+b_3)-a_2(b_2-b_3)$. One bracket is zero and the other is $\pm 2$, so averaging cannot exceed two in magnitude. The Tsirelson bound limits quantum correlations to $2\sqrt{2}$.

For the specified, trusted Pauli operators, the maximal CHSH witness for a fixed Bell state makes the ideal security statement precise. Its operator isIts largest eigenvalue $2\sqrt{2}$ has the unique eigenvector $|{\Psi }^{+}⟩$. Exact attainment therefore fixes the shared density matrix to this pure state. Since purity decouples a subsystem from its purification, Eve cannot hold information correlated with that pair. This rules out information-gaining eavesdropping in the ideal model, rather than proving that no observer exists. More generally, CHSH self-testing identifies the entangled qubit pair up to local changes of representation under its own assumptions.

A quantum measurement that reads Eve's chosen polarization generally disturbs correlations in an incompatible basis. The no-cloning theorem also prevents copying arbitrary unknown photon polarizations and retaining a perfect copy while forwarding an unchanged original. The Bell test checks several incompatible settings, so observing perfect correlation in only one key basis is insufficient.

Alice and Bob also reveal a randomly chosen sample of their raw keys to estimate the quantum bit error rate, then discard that sample. Information reconciliation corrects discrepancies, and privacy amplification removes residual information, including leakage from the public transcript. With finite data they need statistical bounds and a security analysis appropriate to their devices and noise. A measured violation $S>2$ alone does not assert zero information for Eve; the exact ideal argument above uses the maximal value.^[ref]

Encode $0$ by phase zero and $1$ by phase $\pi$. Alice and Bob choose their bits independently and keep their choices private. Bob announces the trial numbers with a D0 click over an authenticated public channel. For each retained trial, c guarantees that their bits agree. In the ideal symmetric setup, the two equal-phase cases $00$ and $11$ give the same click probability, so announcing success does not itself reveal which shared bit was used.

The matching-phase cases occur with probability $1/2$, and a matching case succeeds with probability $1/16$. ThereforeFor independent ideal trials, the raw-key length has a binomial distribution with standard deviation $\sqrt{31N}/32$. These are bits before sacrificing test positions or performing privacy amplification.

A missing click does not certify unequal phases: the same phases also fail to click with probability $15/16$. With uniform choices,Thus a no-click trial supplies neither a known equal bit nor a known complemented bit. This is why it cannot be retained by the direct error-free sifting rule. The source's “cannot use” should be understood in this sense: the events are not statistically independent, so an absolute claim that they contain no information would be false.

To obtain a secret final key, reveal and discard a random subset of retained bits to test the observed error rate, then apply reconciliation and privacy amplification as required by a security analysis of the actual implementation. Resolving which time path a photon took removes the accepted histories' quantum coherence and can turn destructive interference into false D0 clicks, providing a simple disturbance test. Equal-phase click correlations alone are not a proof of security against every attack, particularly in the presence of losses and device imperfections. The supplied ideal model fixes the sifted rate $N/32$; it does not fix a positive secure final length without an adversary model and observed parameters.

The normalized ray produces a secure key; the literal printed vector is not normalized. The squared norm of the coefficients in the PDF is $8/9+1/81=73/81$. Thus the physical pure state on that ray has normalized coefficients $6\sqrt{2}/\sqrt{73}$ and $1/\sqrt{73}$. This is a genuine entangled state with two nonzero Schmidt coefficients, and Eve is independent of it by purity decouples a subsystem from its purification.

For an explicit way to obtain uniform key bits, Alice applies a two-outcome local measurement in quantum mechanics with Kraus operatorsTheir squared products sum to the identity. The successful unnormalized state is $(|00⟩+|11⟩)/\sqrt{73}$, soAlice announces only success or failure. Success leaves an exact Bell pair, yielding one uniform secret bit; failure leaves $|00⟩$ and is discarded. With many copies the successful fraction is positive. Alternatively, direct computational basis measurements give a shared biased bit with probabilities $72/73$ and $1/73$, from which privacy amplification can extract uniform secret bits. The coefficient $1/9$ has not been silently replaced by $1/3$.

Use the BB84 protocol to establish a secret random key, then encrypt the actual message with a one-time pad. Alice chooses independent random bits and independently chooses between the computational orthonormal basis $\{|0⟩,|1⟩\}$ and the diagonal basis $\{|+⟩,|-⟩\}$, where $|\pm ⟩=(|0⟩\pm |1⟩)/\sqrt{2}$. She sends one photon or other qubit in each corresponding state. Bob independently chooses one of the two bases for each measurement.

Over an authenticated public classical channel, they announce their bases but not their bit values. They retain only positions where their bases match; absent disturbance these sifted bits agree. They disclose and discard a randomly selected test sample to estimate the error rate. If it is too large they abort. Otherwise they perform information reconciliation and privacy amplification to produce a shared key about which an eavesdropper has negligible information. Authentication is essential: without it, an active attacker can impersonate the two parties. It may use a previously shared short authentication key, subsequently replenished from the new secret key.

The no-cloning theorem prevents an attacker from copying an unknown nonorthogonal state perfectly: preservation of inner products would require $⟨\psi |\varphi ⟩=⟨\psi |\varphi {⟩}^2$, impossible when its modulus is strictly between zero and one. In a simple intercept-and-resend attack, Eve chooses the wrong basis with probability $1/2$, and then introduces a wrong sifted bit with probability $1/2$. Thus the test error rate is $1/4$, and the probability that $m$ independent tested bits show no error is $(3/4{)}^m$. More general attacks are handled by bounding Eve's information from the observed statistics and shortening the reconciled key through privacy amplification.

Finally Alice sends $C=M\oplus K$, using a uniform independent key of the message's length exactly once. The one-time pad makes the ciphertext independent of the message. The security claim is secrecy with arbitrarily small failure probability after testing and privacy amplification, not that a finite quantum transmission can never be disturbed or intercepted. The scheme assumes trusted devices and an authenticated classical channel; it does not rely on a computational hardness assumption.

Quantum cryptography includes quantum key distribution, which establishes a shared secret key rather than transmitting an arbitrary plaintext directly. In BB84, Alice randomly prepares one of the two computational-basis or two complementary-basis qubit states; Bob randomly measures in either basis. They announce bases over an authenticated classical channel and retain the positions where their choices agree, about half in the ideal unbiased case. They test a subset for errors, reconcile the remaining strings, and apply privacy amplification to remove a bounded eavesdropper's information. A protocol can abort when the observed data do not support a secret key.^[ref]

Nonorthogonal states cannot be perfectly copied by a state-independent device, by the no-cloning theorem. An intercept-resend attacker who measures each signal in a random BB84 basis chooses the wrong basis half the time. On those sifted positions Bob has a one-half error probability, giving the ideal BB84 intercept-resend error rate $1/4$. This simple calculation demonstrates detectable disturbance for that attack; it is not a complete security proof for arbitrary attacks.

Authentication is essential: otherwise an adversary can impersonate both participants. Error correction reveals information that must be included in the privacy budget, and losses, finite sample sizes, multiphoton emission and detector behavior belong in the security model. Entanglement-based variants can use Bell correlations, but observing some entanglement or a Bell violation alone does not replace a quantitatively specified key-distillation protocol. The final key can subsequently be used in a suitable classical encryption scheme.

Quantum cryptography includes quantum key distribution, which uses quantum transmissions and authenticated public discussion to establish a secret random key. In BB84, the sender independently chooses a random bit and either the computational or Hadamard basis, sending one of $|0⟩,|1⟩,|+⟩,|-⟩$. A receiver independently chooses one of those two bases. They announce bases after receipt, retain matching-basis positions and reveal a random sample of those bits to estimate noise or eavesdropping. Ideal uniform independent basis choices retain about half of the detected signals before testing and further processing.^[ref]

The no-cloning theorem prevents an adversary from copying arbitrary unknown nonorthogonal signal states perfectly. In a simple intercept–resend attack, the adversary chooses a random protocol basis. On half of the sifted positions it is the wrong basis, and the resent state then yields an erroneous receiver bit with probability one half. Thus the BB84 intercept-resend error rate isif every signal is intercepted, or $Q=q/4$ when an independently selected fraction $q$ is attacked this way. This is an illustrative attack calculation, not a security proof against all possible quantum attacks.

After parameter estimation, classical error reconciliation aligns the remaining keys; privacy amplification compresses them to remove the adversary's bounded information, including information leaked during public reconciliation. The classical channel requires message authentication, otherwise an attacker could impersonate each party to the other. Real sources, losses, multiphoton pulses and detector behavior must fit the security model. A low observed error rate alone is insufficient to certify arbitrary hardware. Finally the protocol distributes a key; encrypting a later message is a separate step.

This is an entanglement-based quantum key distribution scheme of the type proposed by Artur K. Ekert.^[ref] The measurements generate correlated random data; Alice does not choose a message by choosing their random outcomes.

After the measurements, Alice and Bob announce their basis choices over an authenticated public channel. They retain the pairs with equal axes, here $({\mathbf{a}}_2,{\mathbf{b}}_1)$ and $({\mathbf{a}}_3,{\mathbf{b}}_2)$, and Bob flips his outcome signs to match Alice's bits. They sacrifice a random subset for error estimation and use the appropriate other setting combinations to estimate $S$. In the ideal source the same-axis bits match after the flip and $S=-2\sqrt{2}$; the specified intercept-resend attack cannot reproduce that value.

A practical protocol includes information reconciliation, an accounting of information leaked publicly, and privacy amplification. It must abort when its statistical security conditions fail. Authentication is essential: a completely unauthenticated public channel permits a man-in-the-middle attack. A Bell-violation observation alone, without sampling, device and adversary assumptions and a finite-key analysis, is not a proof that Eve knows no key bits.

With a sufficiently uniform secret shared key $k$ of the required length, Alice can send $c=m\oplus k$ publicly using a one-time pad; Bob recovers $m=c\oplus k$. The pad must be secret, as long as the protected message, and never reused. A complete security proof makes the probability or distinguishing advantage of failure small under stated assumptions. The ideal exam correlations diagnose the stated attack; they do not provide an unconditional guarantee against every attack or implementation fault.

Privacy amplification compresses a partially secret random string into a shorter key by a publicly selected hash function, reducing an adversary's information about the final key. In the BB84 protocol it follows parameter estimation and error correction, and accounts for information leaked in the public reconciliation transcript. Authentication of the public channel remains necessary.

The disagreement probability of Alice's and Bob's sifted bits under their agreed outcome-to-bit maps. A finite test sample estimates this probability; the estimate and its uncertainty enter parameter estimation before information reconciliation and privacy amplification.

Quantum key distribution uses a quantum channel and an authenticated public classical channel to establish matching random keys for two parties while limiting an eavesdropper's information. The public transcript is included in the adversary's information. In an ideal successful protocol, a key of length $\ell$ is uniform and independent of that information. Actual protocols allow small disagreement and secrecy errors and may abort. Measurement in quantum mechanics disturbance provides parameter tests, while privacy amplification removes residual knowledge after classical reconciliation. The BB84 protocol and entanglement-based protocols are examples.