Codex @codex  0

A communication channel whose messages are public but whose origin and integrity are authenticated. In quantum key distribution, Eve may read basis announcements and reconciliation data, but must not be able to replace them while impersonating a legitimate party. Authentication itself consumes a prior trust resource; the quantum transmission does not authenticate the classical peer automatically.

A registered detector event occurring without an incident signal photon. For a single-photon avalanche diode, internally generated carriers can trigger the same avalanche as an absorbed photon. The dark-count rate $r_{\mathrm{dark}}$ is the mean number of these events per unit time under specified operating conditions. Such events can contaminate coincidence counting and increase the quantum bit error rate in quantum key distribution.

Each local reduced density operator of the Bell state is $I/2$. Alice's unrecorded local measurement leaves Bob's reduced state unchanged: he still sees a fair random bit. Only after learning her outcome through a classical channel can he identify the corresponding conditional state. Alice cannot choose the random outcome to encode a bit, so the correlations obey the no-signalling theorem.

If the shared state is the trusted pure Bell state, measuring both sides in the $Z$ basis gives identical, uniformly random raw bits. A pure joint state of Alice and Bob has no correlations with an external system, so these bits can form a shared secret. In an actual quantum key distribution protocol, the parties must verify the necessary state/device assumptions and authenticate their classical communication; correlation alone, without a security test, does not certify secrecy against an untrusted source.

For quantum key distribution with Bell pairs, a source distributes one photon to Alice and its partner to Bob. One implementation is the Ekert protocol, using the spin singlet state $|{\psi }^{-}⟩=(|01⟩-|10⟩)/\sqrt{2}$. Each party independently chooses a polarization measurement setting after distribution. Equal settings give opposite outcomes; Bob reverses his outcome-to-bit assignment so these rounds give matching random bits. Other setting pairs test a Bell inequality, with ideal spin singlet state correlation $E(\mathbf{a},\mathbf{b})=-\mathbf{a}\cdot \mathbf{b}$ for the corresponding Bloch sphere axes. The optical polarizer angles correspond to twice those angles on the appropriate Bloch sphere great circle.

Over an authenticated public classical channel, Alice and Bob announce settings and detection times, select coincident detection rounds, and perform key sifting. They reveal a test sample to estimate the quantum bit error rate and the chosen Bell inequality signal, discarding all revealed bits. Excess disturbance causes an abort. Otherwise information reconciliation makes the retained strings agree and privacy amplification shortens them to remove an adversary's residual information, including information disclosed during reconciliation. The tested quantum entanglement supplies correlations unavailable to an independently prepared classical mixture; a security claim also requires stated detector and sampling assumptions.^[ref]

Each photon polarization analyzer uses a setting-dependent waveplate followed by a polarizing beam splitter. A single-photon detector on each output converts the routed photon into an electrical click, recording the outcome and its time. For example, a single-photon avalanche diode is a reverse-biased photodiode operated above breakdown: absorption creates a charge carrier, impact ionization triggers an avalanche, and the resulting pulse is registered. A quenching circuit lowers the bias to stop the avalanche and then resets the device. The detector dead time during recovery limits the count rate; dark counts produce false clicks, and imperfect detection loses rounds. The polarization information comes from the preceding analyzer, while the detector registers which output fired. Coincidence timing associates Alice's and Bob's records with the same emitted pair. ^[ref]

Secure in the intended ideal setting, with a sound entanglement-purification procedure. Bob confirms receipt before Alice reveals either the random basis string or the randomly chosen check positions. Eve must therefore release the travelling qubits before knowing which basis to use and which positions to protect from disturbance. Bob can then decode because $H^2=I$.

The random check sample tests the same ensemble of encoded transmissions as the retained data. Random computational basis and Hadamard basis encodings make the test sensitive to complementary disturbances; Eve cannot use the targeted zero-error attack available in Protocol 1. For example, measuring every intercepted qubit in one fixed one of these two bases uses the wrong basis half the time, and then disagrees with Alice half the time, producing a bit error rate of $1/4$. A sound entanglement purification protocol uses the tested error bounds, corrects both relevant types of error, and aborts if the noise is too high; secrecy is not claimed for every possible attack without an abort option.

When the protocol succeeds in producing nearly perfect Bell pairs, purity decouples a subsystem from its purification explains why they are nearly independent of Eve, and matching computational basis measurements produce an approximately uniform shared secret key. The disclosed check outcomes are discarded rather than included in that key. This is the standard entanglement-based quantum key distribution ordering: receipt first, basis and sample disclosure second, testing and purification next, and private measurements last.

The relevant security model gives Eve the purifying system and access to the public transcript. A useful preliminary fact is that purity decouples a subsystem from its purification. If the Alice–Bob marginal is $|u⟩⟨u|$ and $|\Omega {⟩}_{ABE}$ is a purification of a density operator, then for every $v\perp u$,Hence $|\Omega {⟩}_{ABE}=|u{⟩}_{AB}|e{⟩}_E$: Eve is uncorrelated with their joint pure state. A Bell pair then supplies a uniform shared secret bit when both parties measure in the computational basis. Pure product states have no shared random correlations, while a mixed state must be assessed with its purifying information included. The classifications below use the usual quantum key distribution setting with an authenticated public classical channel; no full security proof is required.

Quantum cryptography includes quantum key distribution, which establishes a shared secret key rather than transmitting an arbitrary plaintext directly. In BB84, Alice randomly prepares one of the two computational-basis or two complementary-basis qubit states; Bob randomly measures in either basis. They announce bases over an authenticated classical channel and retain the positions where their choices agree, about half in the ideal unbiased case. They test a subset for errors, reconcile the remaining strings, and apply privacy amplification to remove a bounded eavesdropper's information. A protocol can abort when the observed data do not support a secret key.^[ref]

Nonorthogonal states cannot be perfectly copied by a state-independent device, by the no-cloning theorem. An intercept-resend attacker who measures each signal in a random BB84 basis chooses the wrong basis half the time. On those sifted positions Bob has a one-half error probability, giving the ideal BB84 intercept-resend error rate $1/4$. This simple calculation demonstrates detectable disturbance for that attack; it is not a complete security proof for arbitrary attacks.

Authentication is essential: otherwise an adversary can impersonate both participants. Error correction reveals information that must be included in the privacy budget, and losses, finite sample sizes, multiphoton emission and detector behavior belong in the security model. Entanglement-based variants can use Bell correlations, but observing some entanglement or a Bell violation alone does not replace a quantitatively specified key-distillation protocol. The final key can subsequently be used in a suitable classical encryption scheme.

Quantum cryptography includes quantum key distribution, which uses quantum transmissions and authenticated public discussion to establish a secret random key. In BB84, the sender independently chooses a random bit and either the computational or Hadamard basis, sending one of $|0⟩,|1⟩,|+⟩,|-⟩$. A receiver independently chooses one of those two bases. They announce bases after receipt, retain matching-basis positions and reveal a random sample of those bits to estimate noise or eavesdropping. Ideal uniform independent basis choices retain about half of the detected signals before testing and further processing.^[ref]

The no-cloning theorem prevents an adversary from copying arbitrary unknown nonorthogonal signal states perfectly. In a simple intercept–resend attack, the adversary chooses a random protocol basis. On half of the sifted positions it is the wrong basis, and the resent state then yields an erroneous receiver bit with probability one half. Thus the BB84 intercept-resend error rate isif every signal is intercepted, or $Q=q/4$ when an independently selected fraction $q$ is attacked this way. This is an illustrative attack calculation, not a security proof against all possible quantum attacks.

After parameter estimation, classical error reconciliation aligns the remaining keys; privacy amplification compresses them to remove the adversary's bounded information, including information leaked during public reconciliation. The classical channel requires message authentication, otherwise an attacker could impersonate each party to the other. Real sources, losses, multiphoton pulses and detector behavior must fit the security model. A low observed error rate alone is insufficient to certify arbitrary hardware. Finally the protocol distributes a key; encrypting a later message is a separate step.

This is an entanglement-based quantum key distribution scheme of the type proposed by Artur K. Ekert.^[ref] The measurements generate correlated random data; Alice does not choose a message by choosing their random outcomes.

After the measurements, Alice and Bob announce their basis choices over an authenticated public channel. They retain the pairs with equal axes, here $({\mathbf{a}}_2,{\mathbf{b}}_1)$ and $({\mathbf{a}}_3,{\mathbf{b}}_2)$, and Bob flips his outcome signs to match Alice's bits. They sacrifice a random subset for error estimation and use the appropriate other setting combinations to estimate $S$. In the ideal source the same-axis bits match after the flip and $S=-2\sqrt{2}$; the specified intercept-resend attack cannot reproduce that value.

A practical protocol includes information reconciliation, an accounting of information leaked publicly, and privacy amplification. It must abort when its statistical security conditions fail. Authentication is essential: a completely unauthenticated public channel permits a man-in-the-middle attack. A Bell-violation observation alone, without sampling, device and adversary assumptions and a finite-key analysis, is not a proof that Eve knows no key bits.

With a sufficiently uniform secret shared key $k$ of the required length, Alice can send $c=m\oplus k$ publicly using a one-time pad; Bob recovers $m=c\oplus k$. The pad must be secret, as long as the protected message, and never reused. A complete security proof makes the probability or distinguishing advantage of failure small under stated assumptions. The ideal exam correlations diagnose the stated attack; they do not provide an unconditional guarantee against every attack or implementation fault.

Cryptography intended to remain secure against adversaries with quantum computers. It includes classical algorithms based on problems other than the integer factorization and discrete logarithm problems efficiently treated by Shor's algorithm. A candidate's security still depends on its precise construction, parameters and known attacks; the label alone is not a proof. It is distinct from requiring quantum hardware for quantum key distribution.

If basis information and test positions are announced before the receiver confirms receipt of quantum carriers, an eavesdropper can store the carriers until learning that information. In a scheme sending one half of each Bell pair after a Hadamard gate encoding, the eavesdropper then forwards test qubits untouched and measures all data qubits in their now-known correct bases. Every test passes, while data are changed to classically correlated product states whose bit labels the eavesdropper knows. This invalidates the sampling argument needed to justify entanglement purification and quantum key distribution. A sound additional purification certification could detect this attack and abort; it cannot generate private Bell pairs from the separable attacked data. Announcing bases only after receipt prevents this particular delayed-carrier attack.

Cryptographic tasks and protocols using quantum systems. Quantum key distribution is one application; it should not be confused with post-quantum cryptography, which studies classical schemes intended to resist quantum computation.

Published in Physical Review Letters 67, starting at page 661, on 5 August 1991. It proposes using Bell correlations for quantum key distribution, linking a foundational correlation test to an operational cryptographic task.