Quantum key distribution

Quantum key distribution uses a quantum channel and an authenticated public classical channel to establish matching random keys for two parties while limiting an eavesdropper's information. The public transcript is included in the adversary's information. In an ideal successful protocol, a key of length $\ell$ is uniform and independent of that information. Actual protocols allow small disagreement and secrecy errors and may abort. Measurement in quantum mechanics disturbance provides parameter tests, while privacy amplification removes residual knowledge after classical reconciliation. The BB84 protocol and entanglement-based protocols are examples.

The disagreement probability of Alice's and Bob's sifted bits under their agreed outcome-to-bit maps. A finite test sample estimates this probability; the estimate and its uncertainty enter parameter estimation before information reconciliation and privacy amplification.

Classical error correction used to make two candidate keys agree. The disclosed information is part of the eavesdropper's side information and must be included when choosing the amount of privacy amplification.

Selecting the raw key rounds from announced measurement settings and other public acceptance data. Outcomes revealed for parameter estimation must be excluded from the secret raw key. Basis announcements follow receipt of the quantum systems; premature basis announcement in quantum key distribution can permit a memory attack.

A communication channel whose messages are public but whose origin and integrity are authenticated. In quantum key distribution, Eve may read basis announcements and reconciliation data, but must not be able to replace them while impersonating a legitimate party. Authentication itself consumes a prior trust resource; the quantum transmission does not authenticate the classical peer automatically.

Entanglement-based key distribution that tests correlations with a Bell inequality. Equal measurement axes generate correlated key data; other settings test the quantum channel. Authentication, statistical parameter estimation, information reconciliation and privacy amplification are needed to turn observed correlations into a secure shared key under specified assumptions.^[ref]

An eavesdropper measures quantum carriers and forwards states consistent with the outcomes. The resulting disturbance is tested statistically by the legitimate users. For a singlet measured by Eve on both sides along ${\mathbf{n}}_a,{\mathbf{n}}_b$, the forwarded correlation is $-(\mathbf{a}\cdot {\mathbf{n}}_a)({\mathbf{n}}_a\cdot {\mathbf{n}}_b)(\mathbf{b}\cdot {\mathbf{n}}_b)$. It follows by averaging the product of the conditional local outcome means over Eve's correlated outcomes. This model does not cover every general quantum attack.

Measuring the transmitted qubit in the computational basis and forwarding its measured state produces a dephasing channel for users who do not know the outcome. For a Bell state $|{\Psi }^{+}⟩$, the reduced state becomes $(|01⟩⟨01|+|10⟩⟨10|)/2$. It retains perfect $Z$ anticorrelation while destroying $X$ correlation. Thus a single perfectly correlated key basis need not reveal an intercept-resend attack; incompatible-basis correlation tests can.

Use Alice's CHSH axes $\hat{x},\hat{y}$ and Bob's $(\hat{x}+\hat{y})/\sqrt{2},(-\hat{x}+\hat{y})/\sqrt{2}$, with sign pattern $S=C_{11}-C_{13}+C_{31}+C_{33}$. If Eve measures both singlet particles along planar angles $\alpha ,\beta$, the intercept-resend attack correlation gives $S=-\sqrt{2}{\cos }^2(\alpha -\beta )$. Consequently $-\sqrt{2}\le S\le 0$. Randomly mixing axes independently of the users' secret settings preserves this interval by averaging. The bound is specific to these settings and this attack, rather than a general security theorem.

If basis information and test positions are announced before the receiver confirms receipt of quantum carriers, an eavesdropper can store the carriers until learning that information. In a scheme sending one half of each Bell pair after a Hadamard gate encoding, the eavesdropper then forwards test qubits untouched and measures all data qubits in their now-known correct bases. Every test passes, while data are changed to classically correlated product states whose bit labels the eavesdropper knows. This invalidates the sampling argument needed to justify entanglement purification and quantum key distribution. A sound additional purification certification could detect this attack and abort; it cannot generate private Bell pairs from the separable attacked data. Announcing bases only after receipt prevents this particular delayed-carrier attack.