Accardi L., Freudenberg W., Obya M. (Eds.) Quantum Bio-informatics IV: From Quantum Information to Bio-informatics
Подождите немного. Документ загружается.
400
(2)
-(
(PSK)
A* e e N
(3N
)
I p
;,
A,
B,
a(PSK)'
(PSK)
1
_(
(OOK)
A* e e N
(3N
)
?:
p
;,
A,
B,
a(OOK)'
(OOK)'
References
1.
Accardi, L.,
and
Ohya, M.,
Compound
channels,
transition
expectation
and
liftings, Appl.
Math,
Optim.,
39
, 33-59 (1999).
2.
Accardi
,
L.
, Ohya, M.
and
Watanab
e, N.,
Dynamical
e
ntropy
through
quan-
tum
Markov
chain,
Op
en
System
and
Information
Dynamics,
4,
71-87,
(1997) .
3. Accardi, L.,
Ohya, M.
and
Watanab
e,
W.,
Note
on
quantum
dynamical
en-
tropies
, Rep.
Math.
Phys.,
38,
457-469, (1996).
4. Alicki, R.
and
Fannes, M. , Defining
quantum
dynamical
entropy
,
Lett
.
Math.
Physic
s,
32
, 75-82, (1994).
5.
Araki
, H.,
Relative
entropy
for
states
of von
Neumann
algebras,
Publ.
RIMS
Kyoto
Univ.
11,
809-833, 1976.
6.
Benatti,
F.,
Deterministic Chaos in Infinite Quantum Systems, Springer,
Berlin, (1993).
7.
Choda,
M.,
Entropy
for extensions
of
Bernoulli shifts,
Ergodic
Theory
Dy-
nam.
Syst
ems, 16, No.6, 1197-1206 (1996).
8.
Connes, A., Narnhoffer, H.
and
Thirring,
W.,
Dynamical
entropy
of
C*alge
bras
and
von
Neumann
algebras,
Commun.
Math.
Phys.,
112,
691-
719, (1987).
9.
Connes, A.
and
Storm
er,
E.
,
Entrop
y for
automorphisms
of
von Ne
umann
algebra
s,
Acta
Math.
,
134
, 289-306, (1975).
10.
Emch
, G.G.,
Positivity
of
the
K-e
ntropy
on
non-abelian
K-fiows,
Z.
Wahrscheinlichkeitsth
eo
ry
verw. G
eb
iete,
29,
241 (1974).
11.
Fichtn
er, K.H.,
Freudenberg,
W.,
and
Liebscher, V.,
Beam
splittings
and
tim
e evolutions
of
Boson systems,
Fakultat
fur
Mathematik
und
Informatik,
Math
/
Inf/96/
39, Je
na
, 105 (1996).
12.
Hud
etz,
T.,
Topological e
ntropy
for
appropriately
approximated
C*-algebras,
J.
Math
.
Phys.
35, No
.8,
4303-4333 (1994).
13.
Ingard
en, R.S., Kossakowski, A.,
and
Ohya, M., Information Dynamics and
Open
Systems, Kluwer, (1997).
14. Kolmogorov, A.N.,
Theory
of
transmission
of
information,
Amer.
Math.
Soc.
Transl
ation, Ser. 2,
33,
291 (1963).
15. Kossakowski, A.,
Ohya
, M.
and
Watanabe,
N.,
Quantum
dynamical
e
ntropy
for
completely
positive
map,
Infinite
Dimensional
Analysis,
Quantum
Prob-
ability
and
Related
Topics, 2, No.2, 267-282, (1999)
16.
Muraki
, N.
and
Ohya, M.,
Entropy
functionals
of
Kolmogorov Sinai
type
and
their
limit
theorems
,
Letter
in
Math
e
matical
Physics.,
36
, 327-335, (1996).
401
17.
von
Neumann,
J.,
Die
Mathematischen
Grundlagen der Quantenmechanik,
Springer-Berlin, (1932).
18.
Ohya,
M.,
Quantum
ergodic
channels
in
operator
algebras,
J.
Math.
Anal.
Appl.,
84,
318-328, (1981).
19.
Ohya,
M.,
On
compound
state
and
mutual
information
in
quantum
informa-
tion
theory,
IEEE
Trans.
Information
Theory,
29,
770-774 (1983).
20.
Ohya,
M.,
Note
on
quantum
probability,
L. Nuovo
Cimento,
38,
402-404,
(1983) .
21.
Ohya,
M.,
Some
aspects
of
quantum
information
theory
and
their
applica-
tions
to
irreversible processes,
Rep.
Math.
Phys.
27,
19-47,
(1989).
22.
Ohya,
M.,
Information
dynamics
and
its
applications
to
optical
communica-
tion
processes,
Springer
Lecture
Note
in
Physics,
378,
81-92, (1991).
23.
Ohya,
M.,
and
Petz,
D.,
Quantum
Entropy
and its
Use,
Springer, Berlin,
(1993) .
24.
Ohya,
M.,
Petz,
D.,
and
Watanabe,
N.,
On
capacity
of
quantum
channels,
Probability
and
Mathematical
Statistics,
17,
179-196 (1997).
25.
Ohya,
M.,
Petz,
D.,
and
Watanabe,
N.,
Numerical
computation
of
quantum
capacity,
International
Journal
of
Theoretical
Physics,
37,
No.1, 507-510
(1998).
26.
Ohya,
M.,
and
Watanabe,
N.,
Construction
and
analysis
of
a
mathematical
model
in
quantum
communication
processes,
Electronics
and
Communica-
tions
in
Japan,
Part
1,
68,
No.2, 29-34 (1985).
27.
Ohya,
M.,
and
Watanabe,
N., Foundations
of
Quantum
Communication
The-
ory
(in
Japanese),
Makino
Pub.
Co., (1998).
28.
Ohya,
M.,
and
Watanabe,
N.,
Quantum
capacity
of noisy
quantum
channel,
Quantum
Communication
and
Measurement,
3,
213-220 (1997).
29.
Park,
Y.M.,
Dynamical
entropy
of
generalized
quantum
Markov
chains,
Lett.
Math.
Phys.
32,
63-74, (1994)
30.
Schatten,
R.,
Norm
Ideals
of
Completely
Continuous
Operators, Springer-
Verlag,
(1970).
31. Umegaki, H.,
Conditional
expectations
in
an
operator
algebra
IV
(entropy
and
information),
Kodai
Math.
Sem. Rep.,
14,
59-85 (1962).
32.
Uhlmann,
A.,
Relative
entropy
and
the
Wigner-Yanase-Dyson-Lieb
concavity
in
interpolation
theory,
Commun.
Math.
Phys.,
54,
21-32, 1977.
33. Voiculescu, D.,
Dynamical
approximation
entropies
and
topological
entropy
in
operator
algebras,
Comm.
Math.
Phys.,
170,
249, (1995)
34.
Watanabe,
N., Some
Aspects
of
Complexities
for
Quantum
Processes,
Open
Systems
and
Information
Dynamics,
16,
No.2&3, 293-304, (2009).
This page intentionally left blankThis page intentionally left blank
Quantum
Bio-Informatics
IV
eds. L.
Accardi,
W. Freudenberg
and
M.
Ohya
© 2011
World
Scientific
Publishing
Co.
(pp.
403-412)
A
FAIR
SAMPLING
TEST FOR
EKERT
PROTOCOL
GUILLAUME
ADENIER*
and
NOBORU
WATANABE
Tokyo
University
of
Science,
2641
Yamazaki,
Noda, Chiba 278-8510,
Japan
*
E-mail:
adenier@rs.noda.tus.ac.jp
Andrei
Yu.
Khrennikov
Linnaeus
University,
Vejdes plats
7,
SE-351
95
Viixjo,
Sweden
We
propose
a
local
scheme
to
enhance
the
security
of
quantum
key
distribution
in
Ekert
protocol
(E91).
Our
proposal
is a fair
sampling
test
meant
to
detect
an
eavesdropping
attempt
that
would
use
a
biased
sample
to
mimic
an
apparent
viola-
tion
of
Bell
inequalities.
The
test
is local
and
non
disruptive:
it
can
be
unilaterally
performed
at
any
time
by
either
Alice
or
Bob
during
the
production
of
the
key,
and
together
with
the
Bell
inequality
test.
Keywords:
Ekert
protocol,
Entangled
states,
Fair
sampling.
1.
Introduction
Ekert
protocoP-3
uses
entangled
states
to
guarantee
the
secrecy
of
a key
distributed
to
two
parties
(Alice
and
Bob)
that
wished
to
communicate
secretly
through
a public channel. Identical
measurements
performed
on
a
maximally
entangled
state
yield perfect correlation, which
can
be
used
to
produce
a
shared
key.
The
secrecy
of
the
key
can
be
guaranteed
by
the
violation
of
Bell inequalities
measured
for non-identical
measurements.
An
unconditional
violation
of
Bell inequalities would
guarantee
that
no
local
(hidden) variables exist
that
an
eavesdropper (Eve) could exploit.
It
would
mean
unconditional
privacy: Eve could have full control of
the
detectors
and
the
source,
more
advanced
theory
and
technology,
it
would still
be
secure.
2
However,
actual
implementations
of
Ekert
protocol
presently require
the
use
of
photons,
because a key
distribution
protocol
is useful only if Alice
403
404
and
Bob
can
be
separated
by
macroscopic distances
4,
which makes pho-
tons
the
only
practical
solution.
The
downside is
that
the
type
of
photons
is limited
in
practice
by
the
pair
creation process
(parametric
down conver-
sion)
and
by
the
optical
components
that
are
used (fiber optics, polarizing
beamsplitters)
to
wavelength
at
which
standard
photon
counters
hav
e a
poor
detection
efficiency 5,
6.
It
means
that
optical
implementations
of
Ek-
ert
protocols
cannot
avoid a
rather
heavy postselection: Alice
and
Bob
must
discard all
measurements
for which
either
of
them
failed
to
register a click.
The
trouble
is
that
th
e validation
of
a violation
of
Bell inequalities observed
in
such a
post
selection protocol requires
an
extra
assumption
:
the
sample
of
detected
pairs
must
represent fairly
the
population
of
emitted
pairs (fair
sampling assumption).
It
has
long
been
known
that
a breakdown
of
this
assumption
allows local hidden-variable models
to
reproduce exactly
the
predictions
of
Quantum
Mechanics
on
the
subset
of
detected
pairs
7,
unless
the
detection
efficiency is higher
than
83% 8 ,
9,10
,
11.
In
the
context
of
experiments
on
the
foundations
of
Quantum
Mechan-
ics,
the
fair sampling
assumption
is usually considered reasonable,
with
the
idea
that
Nature
is
not
conspiratory.
In
Quantum
Key
Distribution
how-
ever, Eve is
expected
to
conspire
12,
so
that
Alice
and
Bob
must
assume
that
Eve is
actually
attempting
to
bias
their
sample. a
Naturally,
this
issue becomes critical if Eve
manufactured
the
detectors,
which means
that
Alice
and
Bob
should
thoroughly
check
that
their
detec-
tors
are
functioning according
to
specifications
2.
We will argue here
that
photomultipliers
or
avalanche
photo
diodes
can
in principle
be
subjected
to
such a bias sampling
attack,
by
exploiting
the
thresholds
of
these
detectors,
in
particular
if
they
exhibit nonlinearities.
2.
A
biased-sampling
attack
on
Ekert
protocol
The
motivation
for
the
possibility
of
a biased-sampling
attack
is
that
avalanche
photo
diodes
and
photomultipliers
are
fundamentally
threshold
detectors.
They
are
sometim
es referred
to
as such because
they
cannot
dis-
tinguish between
the
absorption
of
one
or
of several photons,
but
it
should
also
be
pointed
out
that
the
principle
of
detection
itself relies
on
thresholds,
and
that
these
thresholds
are
essential
to
the
proper
functioning
of
these
aThis
possibility
should
not
be
underestimated.
A successful
quantum
hacking
has
al-
ready
be
en
successfully
implement
ed
experimentally
with
a
time-shifting
attack
13.
The
attack
essentially
introduced
a
hidden-variable
in
the
protocol
(th
e
time-shift)
to
influ-
e
nce
th
e
probability
for Alice
and
Bob
to
get
either
a 0
or
a 1.
405
ipB
Figure
1.
Standard
Ekert
protocol.
Alice
and
Bob
randomly
switch
their
measurement
settings.
Pairs
associated
with
identical
measurement
settings
(if
A =
if
B)
are
used
to
produce
a
correlated
key, while
those
associated
to
non-identical
measurement
settings
(if
A
i=
if
B)
are
used
to
check
the
violation
of
Bell
inequality
(and
the
security
of
the
key).
detectors.
At
the
input,
the
energy
must
be
higher
than
the
band
gap
to
trigger
an
avalanche
or
a photoelectron; while
at
the
output,
the
current
must
be
higher
than
a
discriminator
value
to
be
counted
as a click
14.
This
combined
threshold
could
be
exploited
by
Eve
to
obtain
an
apparent
vi-
olation
of Bell inequalities
on
the
detected
sample
using only local
states
entangled
state
15
.
The
idea
of
the
attack
would
be
to
replace
the
genuine source
of
en-
tangled
photons
with
a source
of
near
threshold
pulses
correlated
in
polar-
ization.
These
pulses would lead
to
a
probability
of
generating
a click
in
either
output
channel
that
would
depend
on
the
characteristics
of
the
pulse
and
the
measurement
settings. Consider a
near-threshold
pulse linearly
polarized along
>-
impinging
on
a polarizer
set
at
a
measurement
angle
cp.
It
would have a significantly
greater
chance
to
produce
a click
when
the
angle difference
0:
between
these
two variables is
0:
=
1>-
-
cpl
~
k1r
/2
(par-
allelor
orthogonal)
than
when
0:
~
k1r/2 + 7f/4 (diagonal). Indeed,
in
the
first case
most
of
the
energy
of
the
pulse would go
in
one specific chan-
nel,
retaining
enough
energy
in
this
channel
to
remain
above
the
threshold,
while
in
the
other
case
the
energy
of
the
pulse would
be
split
between
both
channels,
in
principle below
the
threshold.
In
the
context
of low efficiency
of detection,
it
would
bias
the
sampling
of
the
pulses
with
the
effect
of
artificially increasing
the
visibility
of
the
coincidence counts,
thus
leading
to
an
apparent
violation
of
Bell inequalities
15.
406
In principle, Eve could even
obtain
an
apparent
violation
of
Bell in-
equalities
reproducing
exactly
the
predictions
of
Quantum
Mechanics
on
the
detected
sample,
by
reproducing
the
asymmetrical
detection
pattern
of
a Larsson-Gisin
model
10,11.
For
this
purpose, Eve would have
to
send
pairs
of
correlated
pulses
with
energy
Eo
=
2<I>
and
polarization
A,
with
A being a
random
variable uniformly
distributed
on
the
interval [-Jr
/2,
Jr
/2].
On
one
side,
Eve
would have
to
send
pulses
to
which
the
detectors
react
with
a very
steep
rising
detection
probability
at
the
threshold
(ideal
threshold),
while
on
the
other
side, Eve would have
to
send
pulses
to
which
the
detectors
react
with
a
detection
probability
rising linearly
at
the
threshold
(linear
threshold).
With
the
condition
Eo
=
2<I>,
what
happens
is
that
Malus'
Law
is
cut
by
the
bottom
precisely
at
the
intersection
of
the
two channels
(at
I'P
-
AI
=
Jr
/4).
Consequently, Alice would always records a click
in
exactly
one channel:
channell
if
I'PA
-
AI
<
Jr/4,
channel
0 otherwise; whereas
on
Bob's
side
the
probability
to
get a click
in
the
channel 1 would
vary
with
cos2('PB -
A)
when
I'PB
-
AI
<
Jr/4,
and
with
sin2('PB -
A)
when
I
'P
B - A I >
Jr
/ 4
in
channel
O.
The
crucial
feature
of
the
resulting
detection
pattern
is
that
the
probability
to
obtain
a click
in
either
channel
on
Bob's
side
depends
explicitly
on
A:
it
is
maximum
for
I'PB
-
AI
= 0,
and
decreases
down
to
zero for
I'PB
-
AI
=
Jr
/4.
The
sampling
is
thus
unfair,
or
biased,
and
leads
to
an
apparent
violation
of
Bell inequalities
on
the
detected
sample
10,11,15
Note
that
if
instead
of
scanning
the
full correlation, Alice
and
Bob
are
only checking a few
points
of
the
correlation
predicted
by
Quantum
Mechanics,
as
is
the
case in
Ekert
protocol, Eve would
not
need
to
aim
at
reproducing
the
full
correlation
and
could therefore
implement
her
attack
with
a
symmetrical
design, inducing
the
same
detection
pattern
for Alice
and
Bob.
However, if each pulse
contains
at
most
one
photon
the
biased
sampling
described
here
would
be
ineffective, because
the
energy
seen
at
a
detector
would always
be
the
same
regardless
of
the
measurement
settings
(when
this
photon
does reach a
detector).
Eve would therefore have
to
produce
near-
threshold
pulses consisting of several
photons
of
lower frequencies. In
order
for
her
attack
to
work however, she needs
that
the
probability
that
a pulse
produces
a click
in
either
channel
be
close
to
zero for angle differences close
to
diagonals,
that
is for angle differences close
to
a =
I'P
-
AI
=
Jr
/ 4 +
kJr
/2,
while
it
should
be
non
zero,
and
significantly
greater
than
the
probability
of
a
dark
count, for
other
angles differences,
in
particular
for a =
I'P
-
AI
=
k7r
/2.
407
3.
Countermeasures
In
order
to
prevent
Ev
e from using
this
bias sampling
attack,
Alice
and
Bob
can
in principle use several countermeasures.
The
first countermeasure consists in increasing
the
efficiency
to
reach
83%. However,
this
proves difficult
with
threshold detectors. Decreasing
the
band
gap
threshold does increase
the
efficiency of
the
detectors,
but
only
at
the
cost of higher
dark
count rates. Unless special detectors
operating
near
absolute zero
temperature
are used, such as Transition-Edge Sensors
(which are
too
cumbersome
and
slow
to
be
practical solution
to
QKD),
this
can
be
considered a general rule
that
applies
to
any detectors,
and
fundamentally limits
their
efficiencies, so
that
this
desirable solution
can
be
considered unrealistic in a
quantum
key
distribution
framework.
The
second countermeasure would
be
to
guarantee
that
Alice's
and
Bob's
detectors are
not
susceptible
to
nonlinearities
at
any
frequency.
The
probability
that
a
photon
produces a click in a
detector
should remain
the
same
regardless of
the
circumstances, in
particular
it should not
depend
on
the
number
of
other
photons reaching
the
detector simultaneously.
If
this
can
be guaranteed,
then
Eve
cannot
exploit
the
threshold because each pho-
ton
sees
the
threshold independently of
the
presence of
other
photons,
and
is
therefore e
ither
above
the
threshold
or
below, regardless of
the
instru-
ment
settings.
In
practic
e,
it
might be difficult
to
guarantee
that
detectors
do not exhibit nonlinearities
at
any
frequency,
and
as much as
this
ques-
tion
has been
studied
experimentally,
the
result is
that
detectors do exhibit
nonlinearities
16.
A
third
countermeasure would consist in using filters
to
prevent Eve
from using lower frequency photons.
This
would however come
at
the
ex-
panse of a lower overall
quantum
efficiency.
The
narrower
the
bandwidth
of
the
filter,
the
lower
the
quantum
efficiency.
With
photon
detectors
that
have significant
amount
of
dark
count,
this
would
mean
an
increased of
the
quantum
bit
error rate.
The
imperfections of
the
filters could also become
the
target
of Eve's
attack.
If
for instance
the
filter does
not
provide a com-
plete extinction
at
a frequency usable for
an
attack,
Eve would only have
to
send brighter pulses
to
allow enough of these photons
to
go
through
and
perform
the
bias sampling
attack.
In
principle, any of
the
three
above countermeasure would
be
enough
to
prevent Eve's
attack,
but
they
can
be very difficult
or
impractical
to
implement.
This
leads us
to
suggest a
fourth
possibility, which is
to
test
the
fairness of
the
sampling.
408
Figure
2.
Fair
Sampling
test
on
Alice's side.
The
detector
Al
is
replaced
by
a
polarime-
ter
with
two
detectors
At
and
A
1
,
whereas
the
detector
Ao is
replaced
by a
polarimeter
with
two
detectors
At
and
Ail.
Ekert
protocol
is
unaltered
by
our
test
if all
detec-
tors
have
the
same
efficiency
"I):
the
light
green
area
is
equivalent
to
detector
Al
with
efficiency
"I),
whereas
the
light
red
area
is
equivalent
to
detector
Ao
with
efficiency
"I).
For
this
purpose, we propose
to
analyzing
the
output
channels of
the
polarizing beamsplitters, instead of simply feeding detectors
with
them. We
keep
the
standard
design of
Ekert
protocol,
with
two polarizing beamsplit-
ters
on
each side (Alice
and
Bob) projecting
the
incoming pulses on
random
bases
rp
A
and
rp
B,
as depicted on Fig.
1,
but
we replace each detectors by a
polarimeter: a polarizing
beamsplitter
followed by a detector
at
each out-
put.
Consider Alice's side (see Fig. 2). We label
the
additional
PBS
in
channell
by
its
orientation e
A,
,
and
the
one in channel 0 by
its
orientation
e
Ao.
A click in
any
of
the
two detectors following e
A,
is
counted as
aI,
whereas a click in any of
the
two detectors following e Ao is counted as a
o.
Bob proceeds similarly
with
two polarimeters labeled e
B,
and
e
Bo.
From
the
point
of view of
Ekert
protocol
and
of a genuine source of en-
tangled photons,
nothing
is changed. Consider Alice's
channell.
The
setup
constituted
by
the
PBS
e
A,
and
its
corresponding detectors
can
be seen as
one big single
detector
in
channell,
in which
the
orientation e
A,
has no
influence
on the
result,
that
is, if
we
assume a balanced
quantum
efficiencies
409
TJ
of
the
detectors
at
the
two
outputs.
A
photon
exiting
the
PBS
oriented
along
r.p
A
through
channell
will
be
detected
in
either
output
channel
after
()
Al
with
a probability
TJ.
Similarly,
the
setup
constituted
by
the
()
Ao
and
its
corresponding
detectors
can
be
seen as one single
detector
in
channell,
where
the
orientation
()
Ao
plays no role whatsoever,
and
the
same
goes for
Bob's
setup. As long as all
the
detectors
have
the
same
efficiency
TJ,
each
polarimeter
can
then
be
considered as one
detector
with
quantum
efficiency
TJ·
The
polarimeter
()
Al
can
be
seen as one single
detector
in
channell,
in
which
the
orientation
()
Al
has
no
influence
on
the
result: a
photon
exiting
the
PBS
r.p
A
through
channel 1 will
be
detected
in
either
output
channel
of
polarimeter
()
Al
with
a probability
TJ.
Similarly,
polarimeter
()
Ao
can
be
seen as one single
detector
in
channel 0, where
the
orientation
()
Ao
plays no
role whatsoever,
and
the
same
goes for
Bob's
setup.
The
production
of
the
key
and
the
verification
of
the
violation of Bell
inequalities is
thus
unaltered
by
our
fair sampling
test
setup
in
case of a
genuine source
of
entangled photons, because
the
additional
measurement
settings
()
AI'
() A
o
, ()
BI
and
()
BI
controlled by Alice
and
Bob
have no influence
on
the
measured
results.
However,
they
have a
strong
influence
on
the
result in
the
case
of
a
biased sample
attack
by Eve. Let us consider
the
simpler case
of
an
ideal
threshold
detector.
By
ideal
threshold
detector,
we
mean
a
detector
that
produces a click
with
certainty
if
an
only if
the
pulse impinging
on
the
detector
carries
an
energy
Eo
greater
than
the
detector
threshold
<I>.
Eve sends pairs
of
correlated
pulses
with
energy
Eo
and
polarization
.x,
where
.x
is a
random
variable uniformly
distributed
on
the
interval
[0,271"[.
By
Malus law,
the
energy
of
the
pulse reaching Alice's
At
detector
is
(1)
Starting
from a uniform
distribution
of
the
polarization
.x
of
pulses
on
the
circle, we
write
that
!PAdAI
=
IF
A
+
(E
A+
)dE
A+
I,
so
that
the
probability
III
to
get
an
energy between E A +
and
E A + +
dE
A + in
the
A + channel is given
1 I I
by
(2)
where
Emax
=
Eo
cos
2
(r.p
A -
()
AI)
is
the
maximum
energy reaching
the
detector
(by
Malus'
law).