BB84 Quantum Key Distribution: Difference between revisions

From Quantum Protocol Zoo
Jump to navigation Jump to search
(Created page with " == Functionality Description== The BB84 protocol implements the task of Quantum Key Distribution (QKD). The protocol enables two parties, Alice and Bob, to establish a c...")
 
 
(56 intermediate revisions by 6 users not shown)
Line 1: Line 1:


== Functionality Description==
This [https://core.ac.uk/download/pdf/82447194.pdf example protocol] implements the task of [[Quantum Key Distribution]] (QKD). The protocol enables two parties to establish a classical secret key by preparing and measuring qubits. The output of the protocol is a classical secret key which is completely unknown to any third party, namely an eavesdropper.  
The BB84 protocol implements the task of [[Quantum Key Distribution]] (QKD). The protocol enables two parties, Alice and Bob, to establish a classical secret key by preparing and measuring qubits. The output of the protocol is a classical secret key which is completely unknown to any third party, namely an eavesdropper.  


'''Tags:''' [[:Category:Two Party Protocols|Two Party]], [[:Category:Quantum Enhanced Classical Functionality|Quantum Enhanced Classical Functionality]], [[:Category:Specific Task|Specific Task]], [[Device Independent Quantum Key Distribution|Device Independent QKD]], [[Six State QKD]]
'''Tags:''' [[:Category:Two Party Protocols|Two Party]], [[:Category:Quantum Enhanced Classical Functionality|Quantum Enhanced Classical Functionality]], [[:Category:Specific Task|Specific Task]],[[Quantum Key Distribution]], [[Device Independent Quantum Key Distribution|Device Independent QKD]], [[Category:Multi Party Protocols]] [[Category:Quantum Enhanced Classical Functionality]][[Category:Specific Task]][[Category:Prepare and Measure Network Stage]]
[[Category:Multi Party Protocols]] [[Category:Quantum Enhanced Classical Functionality]][[Category:Specific Task]][[Category:Prepare and Measure Network Stage]]
==Assumptions==
== Requirements ==
* '''Network:''' we assume the existence of an authenticated public classical channel between Alice and Bob.
* '''Timing:''' we assume that the network is synchronous.
* '''Adversarial model:''' [[coherent attacks]].
 
==Outline==
The protocol shares a classical key between two parties, Alice and Bob.
The BB84 quantum key distribution protocol consists of the following steps:
*'''Distribution:''' This step involves preparation, exchange and measurement of quantum states. For each round of the distribution phase, Alice randomly chooses a basis (a pair of orthogonal states) out of two available bases (X and Z). She then randomly chooses one of the two states and prepares the corresponding quantum state in the chosen basis. She sends the prepared state to Bob. Upon receiving the state, Bob announces that he received the state and randomly chooses to measure in the either of the two available bases (X or Z). The outcomes of the measurements give Bob a string of classical bits. The two parties repeat the above procedure <math>n</math> times so that at the end of the distribution phase each of them holds an <math>n</math>-bit string.
*'''Sifting:''' Alice and Bob publicly announce their choices of basis and compare them. They discard the rounds in which Bob measured in a different basis than the one prepared by Alice.
*'''Parameter estimation:'''  Alice and Bob use a fraction of the remaining rounds (in which both measured in the same basis) in order to estimate the [[quantum bit error rate]] (QBER).
*'''Error correction:''' Alice and Bob choose a classical error correcting code and publicly communicate in order to correct their string of bits. At the end of this phase Alice and Bob hold the same bit-string.
*'''Privacy amplification:''' Alice and Bob use an [[extractor]] on the previously established string to generate a smaller but completely secret string of bits, which is the final key.
 
==Requirements ==
*'''Network Stage:''' [[:Category:Prepare and Measure Network Stage|Prepare and Measure]]
*'''Network Stage:''' [[:Category:Prepare and Measure Network Stage|Prepare and Measure]]
*'''Relevant Network Parameters:''' <math>\epsilon_T, \epsilon_M</math> (see [[:Category:Prepare and Measure Network Stage|Prepare and Measure]])
*'''Relevant Network Parameters:''' transmission error <math>\epsilon_T</math>, measurement error <math>\epsilon_M</math> (see [[:Category:Prepare and Measure Network Stage|Prepare and Measure]])
*'''Benchmark values:'''
*'''Benchmark values:'''
**Minimum number of rounds ranging from <math>\mathcal{O}(10^2)$ to $\mathcal{O}(10^5)</math> depending on the network parameters, for commonly used secure parameters.
**Minimum number of rounds ranging from <math>\mathcal{O}(10^2)</math> to <math>\mathcal{O}(10^5)</math> depending on the network parameters <math>\epsilon_T,\epsilon_M</math>, for commonly used security parameters.
**<math>QBER \leq 0.11</math>, taking a depolarizing model as benchmark. Parameters satisfying <math> \epsilon_T+\epsilon_M\leq 0.11</math> are sufficient.
**<math>QBER \leq 0.11</math>, taking a depolarizing model as benchmark. Parameters satisfying <math> \epsilon_T+\epsilon_M\leq 0.11</math> are sufficient to asymptotically get positive secret key rate.
*requires Authenticated classical channel, Random number generator}.
*requires [[random number generator]].


==Example:==  
==Knowledge Graph==
===Outline===
----
The protocol shares a classical between two parties, sender (Alice) and receiver (Bob).
The BB84 quantum key distribution protocol is composed by the following steps:
*'''Distribution:''' This step involves preparation, exchange and measurement of quantum states. For each round of the distribution phase, Sender randomly chooses a basis (a pair of orthogonal states) out of two available bases (X and Z). She then randomly chooses one of the two states and prepares the corresponding quantum state in the chosen basis. She sends the prepared state to Bob. Upon receiving the state, Receiver announces that he received the state and randomly chooses to measure in the either of the two available bases (X or Z). The outcomes of the measurements give Bob a string of classical bits. The two parties repeat the above procedure <math>n</math> times so that at the end of the distribution phase each of them holds an <math>n</math>-bit string.
*'''Sifting:''' Both parties publicly announce their choices of basis and compare them. They discard the rounds in which Receiver measured in a different basis than the one prepared by Sender.
*'''Parameter estimation:'''  Both parties use a fraction of the remaining rounds (in which both measured in the same basis) in order to estimate the [[quantum bit error rate]] (QBER).
*'''Error correction:''' Both together, choose a classical error correcting code and publicly communicate in order to correct their string of bits. At the end of this phase both parties hold the same bit-string.
*'''Privacy amplification:''' Both use an [[extractor]] on the previously established string to generate a smaller but completely secret string of bits, which is the final key.


===Properties===
{{graph}}
----
*'''Notations Used:'''
**<math>n</math> number of total rounds of the protocol.
**<math>\ell</math> size of the secret key.
**<math>X_i, Y_i</math> bits of input of Sender and Receiver, respectively, that define the measurement basis.
**<math>A_i,B_i</math> bits of output of Sender and Receiver, respectively.
**<math>K_A,K_B</math> final key of Sender and Receiver, respectively.
**<math>Q_X</math> is the quantum bit error rate QBER in the <math>X</math> basis.
**<math>Q_Z</math> is the quantum bit error rate QBER in the <math>Z</math> basis estimated prior to the protocol.
**<math>H</math> is the Hadamard gate. <math>H^{0} = \mathds{1}, H^{1} = H</math>.
**<math>\gamma</math> is the probability that Alice (Bob) prepares (measures) a qubit in the <math>X</math> basis.
**<math>\epsilon_{\rm EC}</math>, <math>\epsilon'_{\rm EC}</math> are the error probabilities of the error correction protocol.
**<math>\epsilon_{\rm PA}</math> is the error probability of the privacy amplification protocol.
**<math>\epsilon_{\rm PE}</math> is the error probability of the parameter estimation.


*'''The protocol-'''
==Notation==
**is Information-theoretically secure
*<math>n</math> number of total rounds of the protocol.
** requires [[synchronous network]], [[authenticated]] public classical channel, secure from [[coherent attacks]]
*<math>\ell</math> size of the secret key.
** implements <math>(n,\epsilon_{\rm corr},\epsilon_{\rm sec},\ell)</math>-QKD, which means that it generates an <math>\epsilon_{\rm corr}</math>-correct, <math>\epsilon_{\rm sec}</math>-secret key of length <math>\ell</math> in <math>n</math> rounds. The security parameters of this protocol are give by
*<math>X_i, Y_i</math> bits of input of Alice and Bob, respectively, that define the measurement basis.
<math>\epsilon_{\rm corr}&=\epsilon_{\rm EC},</br>
*<math>A_i,B_i</math> bits of output of Alice and Bob, respectively.
\epsilon_{\rm sec}&= \epsilon_{\rm PA}+\epsilon_{\rm PE},
*<math>Z_1^n</math> is a shorthand notation for the string <math>Z_1,\ldots, Z_n</math>.
</math>
*<math>K_A,K_B</math> final key of Alice and Bob, respectively.
and the amount of key <math>\ell</math> that is generated is given by
*<math>Q_X</math> is the quantum bit error rate QBER in the <math>X</math> basis.
<math>\ell\geq & (1-\gamma)^2n \de{ 1-h(Q_X+\nu) -h(Q_Z)}</br>
*<math>Q_Z</math> is the quantum bit error rate QBER in the <math>Z</math> basis estimated prior to the protocol.
&\;\;\; -\sqrt{(1-\gamma)^2n}\de{4\log\de{2\sqrt{2}+1} \de{\sqrt{\log\frac{2}{\epsilon_{\rm PE}^2}}+ \sqrt{\log \frac{8}{{\epsilon'}_{\rm EC}^2}}}}</br>
*<math>H</math> is the Hadamard gate. <math>H^{0} = I, H^{1} = H</math>.
&\;\;\; -\log\de{\frac{8}{{\epsilon'}_{\rm EC}^2}+\frac{2}{2-\epsilon'_{\rm EC}} }-\log \de{\frac{1}{\epsilon_{\rm EC}}}- 2\log\de{\frac{1}{2\epsilon_{\rm PA}}}</math>
*<math>\gamma</math> is the probability that Alice (Bob) prepares (measures) a qubit in the <math>X</math> basis.
where
*<math>\epsilon_{\rm EC}</math>, <math>\epsilon'_{\rm EC}</math> are the error probabilities of the error correction protocol.
<math>
*<math>\epsilon_{\rm PA}</math> is the error probability of the privacy amplification protocol.
\nu = \sqrt{ \frac{(1+\gamma^2n)((1-\gamma)^2+\gamma^2)}{(1-\gamma)^2\gamma^4n^2}\log\de{\frac{1}{\epsilon_{\rm PE}}}}</math>
*<math>\epsilon_{\rm PE}</math> is the error probability of the parameter estimation.
 
==Properties==
The protocol implements <math>(n,\epsilon_{\rm corr},\epsilon_{\rm sec},\ell)</math>-QKD, which means that it generates an <math>\epsilon_{\rm corr}</math>-correct, <math>\epsilon_{\rm sec}</math>-secret key of length <math>\ell</math> in <math>n</math> rounds. The security parameters of this protocol are given by
<math>\epsilon_{\rm corr}=\epsilon_{\rm EC},\
\epsilon_{\rm sec}= \epsilon_{\rm PA}+\epsilon_{\rm PE},</math>
and the amount of key <math>\ell</math> that is generated is given by</br>
<math> \begin{align}
\ell \geq & (1-\gamma)^2n (1-h(Q_X+\nu) -h(Q_Z)) \\ &-\sqrt{(1-\gamma)^2n}\big(4\log(2\sqrt{2}+1)(\sqrt{\log\frac{2}{\epsilon_{\rm PE}^2}}+ \sqrt{\log \frac{8}{{\epsilon'}_{\rm EC}^2}})) \\& -\log(\frac{8}{{\epsilon'}_{\rm EC}^2}+\frac{2}{2-\epsilon'_{\rm EC}})-\log (\frac{1}{\epsilon_{\rm EC}})- 2\log(\frac{1}{2\epsilon_{\rm PA}})
\end{align}
</math>  
</br>where <math>\nu = \sqrt{ \frac{(1+\gamma^2n)((1-\gamma)^2+\gamma^2)}{(1-\gamma)^2\gamma^4n^2}\log(\frac{1}{\epsilon_{\rm PE}}})</math>
and <math>h(\cdot)</math> is the [[binary entropy function]].  
and <math>h(\cdot)</math> is the [[binary entropy function]].  


In Eq.~\eqref{eq:keylength}, the parameters $\epsilon_{\rm EC}$ and $\epsilon'_{\rm EC}$ are error probabilities of the classical error correction subroutine. At the end of the error correction step, if the protocol does not abort, then Alice and Bob share equal strings of bits with probability at least $1-\epsilon_{\rm EC}$. The parameter $\epsilon'_{\rm EC}$ is related with the completeness of the error correction subroutine, namely that for an honest implementation, the error correction protocol aborts with probability at most $\epsilon'_{\rm EC}+\epsilon_{\rm EC}$.  
In the above equation for key length, the parameters <math>\epsilon_{\rm EC}</math> and <math>\epsilon'_{\rm EC}</math> are error probabilities of the classical error correction subroutine. At the end of the error correction step, if the protocol does not abort, then Alice and Bob share equal strings of bits with probability at least <math>1-\epsilon_{\rm EC}</math>. The parameter <math>\epsilon'_{\rm EC}</math> is related with the completeness of the error correction subroutine, namely that for an honest implementation, the error correction protocol aborts with probability at most <math>\epsilon'_{\rm EC}+\epsilon_{\rm EC}</math>.  
The parameter $\epsilon_{\rm PA}$ is the error probability of the privacy amplification subroutine and $\epsilon_{\rm PE}$ is the error probability of the parameter estimation subroutine used to estimate $Q_X$.
The parameter <math>\epsilon_{\rm PA}</math> is the error probability of the privacy amplification subroutine and <math>\epsilon_{\rm PE}</math> is the error probability of the parameter estimation subroutine used to estimate <math>Q_X</math>
(See [[Quantum Key Distribution]] for the precise security definition)
(see [[Quantum Key Distribution]] for the precise security definition).
===Pseudo Code===
----


==Protocol Description==
*'''Input:'''<math>n, \gamma, \epsilon_{\rm PA},\epsilon_{\rm PE},\epsilon_{\rm EC},\epsilon'_{\rm EC},Q_Z</math>
*'''Input:'''<math>n, \gamma, \epsilon_{\rm PA},\epsilon_{\rm PE},\epsilon_{\rm EC},\epsilon'_{\rm EC},Q_Z</math>
*'''Output:'''<math>K_A, K_B</math>
*'''Output:'''<math>K_A, K_B</math>
<u>'''Stage 1'''</u> Distribution and measurement
'''1.''' Distribution and measurement
#For i=1,2,...,n
#For <math>i=1,...,n</math>
##  Sender chooses random bits <math>X_i\in\{0,1\}</math> and <math>A_i\in_R\{0,1\}</math> such that <math>P(X_i=1)=\gamma</math>
##  Alice chooses random bits <math>X_i\in\{0,1\}</math> and <math>A_i\in_R\{0,1\}</math> such that <math>P(X_i=1)=\gamma</math>
##  Sender prepares <math>H^{X_i}\ket{A_i}</math> and sends it to Bob
##  Alice prepares <math>H^{X_i}|A_i\rangle</math> and sends it to Bob
##  Receiver announces receiving a state
##  Bob announces receiving a state
##  Receiver chooses bit <math>Y_i\in_R\{0,1\}</math> such that <math>P(Y_i=1)=\gamma</math>
##  Bob chooses bit <math>Y_i\in_R\{0,1\}</math> such that <math>P(Y_i=1)=\gamma</math>
##  Receiver measures <math>H^{X_i}\ket{A_i}</math> in basis <math>\{H^{Y_i}\ket{0}, H^{Y_i}\ket{1}\}</math> with outcome <math>B_i</math>
##  Bob measures <math>H^{X_i}|A_i\rangle</math> in basis <math>\{H^{Y_i}|0\rangle, H^{Y_i}|1\rangle\}</math> with outcome <math>B_i</math>
 
''At this stage Alice holds strings <math>X_1^n, A_1^n</math> and Bob <math>Y_1^n, B_1^n</math>, all of length <math>n</math>.''
*At this stage Sender holds strings <math>X_1^n, A_1^n</math> and Receiver <math>Y_1^n, B_1^n</math>, all of length <math>n</math>
 
<u>'''Stage 2'''</u> Sifting   
'''2.''' Sifting   
#Alice and Bob publicly announce <math>X_1^n, Y_1^n</math>
#Alice and Bob publicly announce <math>X_1^n, Y_1^n</math>
#For i=1,2,....,n
#For <math>i=1,...,n</math>
## If <math>X_i=Y_i</math>
## If <math>X_i=Y_i</math>
### <math>A_1^{n'} = A_1^{n'}.\tn{append}(A_i)</math>
### <math>A_1^{n'} = A_1^{n'}.</math>append<math>(A_i)</math>
### <math>B_1^{n'} = B_1^{n'}.\tn{append}(B_i)</math>
### <math>B_1^{n'} = B_1^{n'}.</math>append<math>(B_i)</math>
### <math>X_1^{n'} = X_1^{n'}.\tn{append}(X_i)</math>
### <math>X_1^{n'} = X_1^{n'}.</math>append<math>(X_i)</math>
### <math>Y_1^{n'} = Y_1^{n'}.\tn{append}(Y_i)</math>
### <math>Y_1^{n'} = Y_1^{n'}.</math>append<math>(Y_i)</math>
*Now Sender holds strings <math>X_1^{n'}, A_1^{n'}</math> and Receiver <math>Y_1^{n'}, B_1^{n'}</math>, all of length <math>n'\leq n</math>
''Now Alice holds strings <math>X_1^{n'}, A_1^{n'}</math> and Bob <math>Y_1^{n'}, B_1^{n'}</math>, all of length <math>n'\leq n</math>.''
<u>'''Stage 3'''</u> Parameter estimation
 
#For <math>i=1,...,n</math>
'''3.''' Parameter estimation
## size<math>Q</math> = 0
# Set size<math>Q</math> = 0
## If{<math>X_i = Y_i = 1</math>
#For <math>i=1,...,n'</math>
### Sender and Receiver publicly announce $A_i, B_i$\;
## If <math>X_i = Y_i = 1</math>
### Sender and Receiver compute <math>Q_i = 1 - \delta_{A_iB_i}</math>, where <math>\delta_{A_iB_i}</math> is the Kronecker delta
### Alice and Bob publicly announce <math>A_i, B_i</math>
## size<math>Q</math> += 1\;
### Alice and Bob compute <math>Q_i = 1 - \delta_{A_iB_i}</math>, where <math>\delta_{A_iB_i}</math> is the Kronecker delta
## size<math>Q</math> += 1;
#Both Alice and Bob, each, compute <math>Q_X = \frac{1}{\text{size}Q} \sum_{i=1}^{n'}Q_i</math></br>
'''4.''' Error correction
 
''<math>C(\cdot,\cdot)</math> is an error correction subroutine (see [[BB84 Quantum Key Distribution #References| [9]]]) determined by the previously estimated value of <math>Q_Z</math> and with error parameters  <math>\epsilon'_{\rm EC}</math> and <math>\epsilon_{\rm EC}</math>
#Both Alice and Bob run <math>C(A_1^{n'},B_1^{n'})</math>''.
#Bob obtains <math>\tilde{B}_1^{n'}</math>
'''5.''' Privacy amplification
 
''<math>PA(\cdot,\cdot)</math> is a privacy amplification subroutine (see [[BB84 Quantum Key Distribution #References| [10]]]) determined by the size <math>\ell</math>, computed from equation for key length <math>\ell</math> (see [[Quantum Key Distribution#Properties|Properties]]), and  with secrecy parameter <math>\epsilon_{\rm PA}</math>''
#Alice and Bob run <math>PA(A_1^{n'},\tilde{B}_1^{n'})</math> and obtain secret keys <math>K_A, K_B</math>;
 
==Simulation and benchmark==
A simulation code for benchmarking the QKD protocol is available [https://github.com/LiaoChinTe/netsquid-simulation/tree/main/QKD/BB84 here].
Hardware parameter analysis can be found in the following [https://cloud.veriqloud.fr/index.php/s/iiw1SxU4D22FyQ7 preprint]
 
==Further Information==
# [https://core.ac.uk/download/pdf/82447194.pdf BB(1984)] introduces the BB84 protocol, as the name says, by Charles Bennett and Gilles Brassard.
# [https://quantum-journal.org/papers/q-2017-07-14-14/ TL(2017)] The derivation of the key length in [[BB84 Quantum Key Distribution#Properties|Properties]], combines the techniques developed in this article and minimum leakage error correcting codes.
# [https://tspace.library.utoronto.ca/bitstream/1807/10010/1/Lo_6438_2610.pdf GL03] gives an extended analysis of the BB84 in the finite regime.
# Sifting: the BB84 protocol can also be described in a symmetric way. This means that the inputs <math>0</math> and <math>1</math> are chosen with the same probability. In that case only <math>1/2</math> of the generated bits are discarded during the sifting process. Indeed, in the symmetric protocol, Alice and Bob measure in the same basis in about half of the rounds.
# [https://dl.acm.org/citation.cfm?id=1058094 LCA05] the asymmetric protocol was introduced to make this more efficient protocol presented in this article.
# A post-processing of the key using 2-way classical communication, denoted [[Advantage distillation]], can increase the QBER tolerance  up to <math>18.9\%</math> (3).
# We remark that in [[BB84 Quantum Key Distribution#Pseudo Code|Pseudo Code]], the QBER in the <math>Z</math> basis is not estimated during the protocol. Instead Alice and Bob make use of a previous estimate for the value of <math>Q_Z</math> and the error correction step, Step 4 in the pseudo-code, will make sure that this estimation is correct. Indeed, if the real QBER is higher than the estimated value <math>Q_Z</math>, [[BB84 Quantum Key Distribution#Pseudo Code|Pseudo Code]] will abort in the Step 4 with very high probability.
# The BB84 can be equivalently implemented by distributing [[EPR pairs]] and Alice and Bob making measurements in the <math>Z</math> and <math>X</math> basis, however this required a [[entanglement distribution]] network stage.
#[https://doi.org/10.1007/3-540-48285-7_35 Secret-Key Reconciliation by Public Discussion]
#[https://arxiv.org/abs/quant-ph/0512258 Security of Quantum Key Distribution]


Both Sender and Receiver, each, compute <math>Q_X = \frac{1}{\tn{size}Q} \sum_{i=1}^{n'}Q_i</math>
<div style='text-align: right;'>''contributed by Bas Dirke, Victoria Lipinska, Gláucia Murta and Jérémy Ribeiro''</div>
<u>'''Stage 4'''</u> Error correction
<math>C(\cdot,\cdot)</math> is an error correction subroutine determined by the previously estimated value of <math>Q_Z</math> and with error parameters  <math>\epsilon'_{\rm EC}</math> and <math>\epsilon_{\rm EC}</math>
Both Sender and Receiver run <math>C(A_1^{n'},B_1^{n'})</math>. Receiver obtains <math>\tilde{B}_1^{n'}</math>
<u>'''Stage 5'''</u> Privacy amplification
<math>PA(\cdot,\cdot)</math> is a privacy amplification subroutine determined by the size <math>\ell</math>, computed from Eq.(3), and with secrecy parameter <math>\epsilon_{\rm PA}</math>
Sender and Receiver run $PA(A_1^{n'},\tilde{B}_1^{n'})$ and obtain secret keys $K_A, K_B$\;
==Relevant Papers==

Latest revision as of 12:53, 15 June 2022

This example protocol implements the task of Quantum Key Distribution (QKD). The protocol enables two parties to establish a classical secret key by preparing and measuring qubits. The output of the protocol is a classical secret key which is completely unknown to any third party, namely an eavesdropper.

Tags: Two Party, Quantum Enhanced Classical Functionality, Specific Task,Quantum Key Distribution, Device Independent QKD,

Assumptions[edit]

  • Network: we assume the existence of an authenticated public classical channel between Alice and Bob.
  • Timing: we assume that the network is synchronous.
  • Adversarial model: coherent attacks.

Outline[edit]

The protocol shares a classical key between two parties, Alice and Bob. The BB84 quantum key distribution protocol consists of the following steps:

  • Distribution: This step involves preparation, exchange and measurement of quantum states. For each round of the distribution phase, Alice randomly chooses a basis (a pair of orthogonal states) out of two available bases (X and Z). She then randomly chooses one of the two states and prepares the corresponding quantum state in the chosen basis. She sends the prepared state to Bob. Upon receiving the state, Bob announces that he received the state and randomly chooses to measure in the either of the two available bases (X or Z). The outcomes of the measurements give Bob a string of classical bits. The two parties repeat the above procedure Failed to parse (SVG (MathML can be enabled via browser plugin): Invalid response ("Math extension cannot connect to Restbase.") from server "https://wikimedia.org/api/rest_v1/":): {\displaystyle n} times so that at the end of the distribution phase each of them holds an -bit string.
  • Sifting: Alice and Bob publicly announce their choices of basis and compare them. They discard the rounds in which Bob measured in a different basis than the one prepared by Alice.
  • Parameter estimation: Alice and Bob use a fraction of the remaining rounds (in which both measured in the same basis) in order to estimate the quantum bit error rate (QBER).
  • Error correction: Alice and Bob choose a classical error correcting code and publicly communicate in order to correct their string of bits. At the end of this phase Alice and Bob hold the same bit-string.
  • Privacy amplification: Alice and Bob use an extractor on the previously established string to generate a smaller but completely secret string of bits, which is the final key.

Requirements[edit]

  • Network Stage: Prepare and Measure
  • Relevant Network Parameters: transmission error , measurement error (see Prepare and Measure)
  • Benchmark values:
    • Minimum number of rounds ranging from to depending on the network parameters , for commonly used security parameters.
    • , taking a depolarizing model as benchmark. Parameters satisfying are sufficient to asymptotically get positive secret key rate.
  • requires random number generator.

Knowledge Graph[edit]

Notation[edit]

  • number of total rounds of the protocol.
  • size of the secret key.
  • bits of input of Alice and Bob, respectively, that define the measurement basis.
  • bits of output of Alice and Bob, respectively.
  • is a shorthand notation for the string .
  • final key of Alice and Bob, respectively.
  • is the quantum bit error rate QBER in the basis.
  • is the quantum bit error rate QBER in the basis estimated prior to the protocol.
  • is the Hadamard gate. .
  • is the probability that Alice (Bob) prepares (measures) a qubit in the basis.
  • , are the error probabilities of the error correction protocol.
  • is the error probability of the privacy amplification protocol.
  • is the error probability of the parameter estimation.

Properties[edit]

The protocol implements -QKD, which means that it generates an -correct, -secret key of length in rounds. The security parameters of this protocol are given by and the amount of key that is generated is given by

where and is the binary entropy function.

In the above equation for key length, the parameters and are error probabilities of the classical error correction subroutine. At the end of the error correction step, if the protocol does not abort, then Alice and Bob share equal strings of bits with probability at least . The parameter is related with the completeness of the error correction subroutine, namely that for an honest implementation, the error correction protocol aborts with probability at most . The parameter is the error probability of the privacy amplification subroutine and is the error probability of the parameter estimation subroutine used to estimate (see Quantum Key Distribution for the precise security definition).

Protocol Description[edit]

  • Input:
  • Output:

1. Distribution and measurement

  1. For
    1. Alice chooses random bits and such that
    2. Alice prepares and sends it to Bob
    3. Bob announces receiving a state
    4. Bob chooses bit such that
    5. Bob measures in basis with outcome

At this stage Alice holds strings and Bob , all of length .

2. Sifting

  1. Alice and Bob publicly announce
  2. For
    1. If
      1. append
      2. append
      3. append
      4. append

Now Alice holds strings and Bob , all of length .

3. Parameter estimation

  1. Set size = 0
  2. For
    1. If
      1. Alice and Bob publicly announce
      2. Alice and Bob compute , where is the Kronecker delta
    2. size += 1;
  3. Both Alice and Bob, each, compute

4. Error correction

is an error correction subroutine (see [9]) determined by the previously estimated value of and with error parameters and

  1. Both Alice and Bob run .
  2. Bob obtains

5. Privacy amplification

is a privacy amplification subroutine (see [10]) determined by the size , computed from equation for key length (see Properties), and with secrecy parameter

  1. Alice and Bob run and obtain secret keys ;

Simulation and benchmark[edit]

A simulation code for benchmarking the QKD protocol is available here. Hardware parameter analysis can be found in the following preprint

Further Information[edit]

  1. BB(1984) introduces the BB84 protocol, as the name says, by Charles Bennett and Gilles Brassard.
  2. TL(2017) The derivation of the key length in Properties, combines the techniques developed in this article and minimum leakage error correcting codes.
  3. GL03 gives an extended analysis of the BB84 in the finite regime.
  4. Sifting: the BB84 protocol can also be described in a symmetric way. This means that the inputs and are chosen with the same probability. In that case only of the generated bits are discarded during the sifting process. Indeed, in the symmetric protocol, Alice and Bob measure in the same basis in about half of the rounds.
  5. LCA05 the asymmetric protocol was introduced to make this more efficient protocol presented in this article.
  6. A post-processing of the key using 2-way classical communication, denoted Advantage distillation, can increase the QBER tolerance up to (3).
  7. We remark that in Pseudo Code, the QBER in the basis is not estimated during the protocol. Instead Alice and Bob make use of a previous estimate for the value of and the error correction step, Step 4 in the pseudo-code, will make sure that this estimation is correct. Indeed, if the real QBER is higher than the estimated value , Pseudo Code will abort in the Step 4 with very high probability.
  8. The BB84 can be equivalently implemented by distributing EPR pairs and Alice and Bob making measurements in the and basis, however this required a entanglement distribution network stage.
  9. Secret-Key Reconciliation by Public Discussion
  10. Security of Quantum Key Distribution
contributed by Bas Dirke, Victoria Lipinska, Gláucia Murta and Jérémy Ribeiro