Consistency of shared reference frames should be reexamined

0.09 MB·English

by  Fei Gao

APS/123-QED
Consistency of shared reference frames should be reexamined
Fei Gao1,2∗, Fen-Zhuo Guo1, Qiao-Yan Wen1, and Fu-Chen Zhu3
1State key Laboratory of Networking and Switching Technology, Beijing University of
Posts and Telecommunications, Beijing 100876, China
2School of Science, Beijing University of Posts and Telecommunications, Beijing 100876, China
3National Laboratory for Modern Communications, P.O.Box 810, Chengdu 610041, China
In a recent Letter [G. Chiribella et al., Phys. Rev. Lett. 98, 120501 (2007)], four protocols
were proposed to secretly transmit a reference frame. Here We point out that in these protocols
an eavesdropper can change the transmitted reference frame without being detected, which means
the consistency of the shared reference frames should be reexamined. The way to check the above
consistency is discussed. It is shown that this problem is quite different from that in previous
8 protocols of quantum cryptography.
0
0 PACSnumbers: 03.67.Dd,03.67.Hk,03.65.Ud
2

n z
a As we know, reference frame (RF) [1] is a kind of un-
z
J speakableinformationandconsequentlysharingofanRF A

5 isgenerallymoredifficultthanthatofastringofkeybits
1 as performed in a quantum key distribution (QKD) pro- θz Eve
tocol [2]. In a recent Letter, Chiribella et al. proposed Ue
] four quantum-cryptographic protocols to secretly com- θx θy
h y Alice Bob
p municate anRF [3]. Theseprotocolsaresubtly designed U−1
e
- sothattheeavesdropper(sayEve)cannotobtainanyin-
t
n formation about the RF when it is transmitted between x
(a) (b)
a theusers(sayAliceandBob). Here,fromadifferentper-
u spective of security, we consider a special threat which
q FIG.1: (a)ThewaytoestimatethedirectionofAlice’szaxis
[ wniacsatnioont,cothnececronnesdisitnenRceyf.o[f3]t.heThRaFt iAs,liaceftesrentthewcitohmtmhaut- zA. The three angles satisfy cos2θx +cos2θy +cos2θz = 1.
(b) Eve’s additional strategy to avoid a general prepare-and-
1 Bob receivedis still not assured. We will show that by a
measure detection.
v special attack Eve can destroy this consistency without
1 introducing any detectable disturbance.
0
Let us take the first protocol in Ref. [3] as our exam- tent). However, Eve can take a special strategy to at-
3
2 ple, where Alice can transmit a secret direction (z axis) tack. That is, she performs a unitary operation Ue on
. to Bobwith the help of a string ofsecretkey bits shared eachtransmittedparticletorotatethespins byacertain
1 1
betweenthem. Alicesendsasequenceofspin- particles angle. Evedoesnotknowthevalueofthisanglebecause
0 2
to Bob, whose particular states, i.e. spin up or down, she does not know what on earth the operator U is in
8 e
0 are determined by the shared key bits 0 or 1, respec- Alice’s representation (therefore the choice of Ue are at
: tively. After receiving this sequence, Bob measures the random). Butsheneednotknowit. Herethe purposeof
v
particles alternately along his own x, y, and z axes and Eveistodestroythecommunicationinsteadoftoextract
i
X compares the measurement results with the shared key informationofthetransmitteddirection(Infact,without
r bits. Bycalculatingtheerrorratesassociatetothe three thekeybitssharedbetweenAliceandBob,Evecannever
a
measurementdirections,Bobcanestimatethe anglesθ , elicitanyinformationaboutthetransmitteddirectionby
x
θ , θ between his three axes x, y, z and Alice’s z axis measurements on these qubits, which is very similar to
y z
[see Fig.1(a)]. Then Bob obtains the direction of Alice’s that in one-time pad). Since the role of this attack is
z axis with a certain accuracy. To detect eavesdropping, just rotate the spins by a same angle, Bob will obtain a
Bobcheckswhether the sumofthe threeangles’squared changed direction of Alice’s z axis and, more seriously,
cosines differs from 1 by more than an allowable error. he cannot detect the presence of Eve (obviously for any
Indeed, if Eve stays in the quantum channel and per- direction, the three angles ηx, ηy, ηz between it and the
forms blindly some measurements on the transmitted three axes x, y, z satisfy cos2ηx+cos2ηy+cos2ηz =1).
particles to extract information of Alice’s z axis, her Similar risk exists in other three protocols in Ref. [3],
eavesdropping would result in a depolarization of the where Alice would transmit a Cartesian frame to Bob
spins and it follows that she would be detected by Bob secretly. Consider any state ψ Alice will send to Bob.
| i
(the three angles recovered by Bob would be inconsis- Since ψ isgeneratedbyAliceaccordingtoherCartesian
| i
frame, from Bob’s point of view all spins are rotated by
a certain rotation g SU(2) which connects his axes
∈
with that of Alice. Therefore, Bob’s aim is to infer g by
∗Email: gaofei [email protected] [email protected] measurements on all the states Alice sent to him. This
2
is the main idea of the three protocols. Here Eve can tialstateandthemeasurementresultinpublic. However,
also perform a unitary operation U on each particle (or this strategy would not work if Eve does an additional
e
a collective rotation U⊗N). Again, Eve just chooses a trick. Thatis,Eveperformsthe unitary operationU on
e e
unitaryoperationatrandomanddoesnotknowthevalue allthequbits fromAlice toBobandanotheroneU−1 on
e
ofereferringtoAlice’sCartesianframe. Thus,aftersome all the qubits from Bob to Alice [see Fig.1(b)]. As dis-
measurements,Bob’sinferredparameter,whichconnects cussed in above paragraphs, the difference of Alice and
AliceandBob’saxes,wouldbeegbutnotg. Apparently, Bob’s RFs is just U (under the above attack). As a re-
e
it looks like that the parameter Alice sent is indeed eg sult, under Eve’s operations U and U−1, the prepared
e e
insteadofg,whichistheonlydifferencewhenthisattack statebyAlice(Bob)andthemeasuredstatebyBob(Al-
happens. So,everythinggoesnaturally. Asaresult,Bob ice)wouldexhibitthe samephysicalfeaturesreferringto
obtains a Cartesianframe different from Alice’s and Eve theirrespectiveRFs. Thus,noerrorswouldappearwhen
would not be detected. Alice and Bob do their comparison.
It can be seen that this special attack causes a severe Inviewofthe aboveanalysis,to exposethe specialat-
effect, that is, the RF cannot be successfully shared be- tack, the check qubits should not be transmitted in the
tweenAliceandBobastheyintended. Moreseriously,in communication channel. A possible way is to use some
theendoftheprotocol,whenAliceandBobarecongrat- states which are previously shared between Alice and
ulated for the successful sharing of the Cartesian frame, Bob. For example, Alice and Bob share some entangled
they even do not know they have been cheated by Eve. pairsinthespinsingletstate Ψ− =(01 10 )/√2be-
| i | i−| i
When Alice and Bob utilize the different RFs to dis- fore the communicationof RF(that is, for eachpair,Al-
tribute secret key bits [4], remarkable errors would ap- ice holds one photonandBobcontrolsthe other). When
pear. Butatthattimetheystilldonotknowwhetherthe a certain RF has been transmitted Alice and Bob mea-
RFsareinconsistentoraneavesdropperexistsinthepro- sure the spins of each shared singlet state referring to
cessofkeydistribution,whichisareallyintractablebusi- their respective RFs (the RF Alice sentandthe one Bob
ness. Consequently, this problem must be overcome in a received). Afterwardstheycomparethemeasurementre-
realimplementation. Infact,theaboveattackisaspecial sultspublicly. IftwoRFsareidenticalthe resultsshould
kind of denial-of-service attack, and it is also forbidden be determinately anti-correlated. By this way, Alice and
in a quantum secure direct communication(QSDC) pro- Bobcanassurethe consistencyofthetwoRFs(withcer-
tocol [5, 6]. tain accuracy) when the error rate of this comparison is
To communicate something secretly, as generally re- low enough. However, there is a problem in this detec-
quired in quantum cryptography, we have to take all tion. That is, the requirement of shared singlet pairs is
thinkableattackstrategiesintoconsideration. Otherwise too strong, with which Alice and Bob can even achieve
the intended communications may be attacked success- the whole transmission of a private RF [13]. Obviously,
fully (for instances, see Refs. [6, 7, 8, 9, 10, 11, 12]). In if Alice measures the spins of her photons in the shared
Ref.[3]themainattentionispaidtoforbidEvetoextract singlet pairs referring to her RF and announces the re-
informationofthetransmittedRF,whiletheconsistency sults,Bobcanobtainthe RF bythe technique similarto
of the two RFs is overlooked. that in the first protocol in Ref. [3].
Now consider how to detect this special attack. Dif- One may argue that Eve can do the same sort of at-
ferentfrom a generalprotocolofquantum cryptography, tackinmanyothersituations(forexample,one-timepad,
Alice and Bob have not a shared RF before the com- QKD, and QSDC) and consequently it is not so mean-
munication. Therefore, the ability of their possible ways ingful to discuss this problem further here. However, it
to check eavesdropping is limited. For example, as de- is not the fact for the case of RF sharing. As far as
scribed in Ref. [3], they can only check the uniqueness this attack is concerned, the transmission of an RF and
of the transmitted direction or frame, or employ the ro- that of a classical or quantum message are quite differ-
tationally invariant subsystems of the test qubits to de- ent. More specifically, when a message is transmitted,
tect. Butboth ofthem are useless forthe specialattack. this kind of attack can be easily avoided by the man-
Another immediate manner to detect is to compare the ners of message authentication, error correction code, or
consistency of Alice and Bob’s RFs at the end of the directly sampling some random transmitted bits/qubits
communication. In a QKD protocol Alice and Bob can to check eavesdropping [6]. But all these manners are
sample some of the key bits to check if the two keys are useless for the transmission of an RF. From the above
identicalpublicly. However,thisstrategycannotbeused analysis we can see that this problem is intractable and
herebecausethetransmittedobjectisunspeakableinfor- farfrombeing totallyresolved. It isurgenttofind anef-
mation which cannot be discussed directly in a classical fectivewaytodetectthisattack(orchecktheconsistency
channel. of the shared RFs) in the transmission of an RF. As a
Analternativewaytodetectthespecialattackisusing result,thoughthisproblemcanbeacceptedasinevitable
the general prepare-and-measure model. In particular, in previous cryptographic models such as one-time pad,
Alice (Bob) prepares a certain state and sends it to Bob QKD, and QSDC, it should be paid more attention in
(Alice). After the measurement of Bob (Alice), they can the case of RF sharing.
judge the consistency of their RFs by comparing the ini- Inconclusion,wepresentaspecialattacktotheproto-
3
cols of secret communication of RF, by which an eaves- HighTechnologyResearchandDevelopmentProgramof
dropper can change the transmitted RF without being China, Grant No. 2006AA01Z419; the National Natu-
detected. It means that the obtained RF should be re- ral Science Foundation of China, Grant Nos. 90604023,
examined in such protocols. Furthermore, the way to 60373059;theNationalResearchFoundationfortheDoc-
checkthe consistencyofthe twoRFs isdiscussedthough toral Program of Higher Education of China, Grant No.
it needs more further study. Note that the communi- 20040013007;the NationalLaboratoryfor ModernCom-
cation of RF is a new topic and it may interest many munications Science Foundation of China, Grant No.
scholars. We hope that the special attack is noticed and 9140C1101010601; the Natural Science Foundation of
taken into account in the following research. Beijing, Grant No. 4072020; and the ISN Open Foun-
We are grateful to the anonymous reviewer for help- dation.
ful comments. This work is supported by the National
[1] S. D. Bartlett, T. Rudolph, and R. W. Spekkens, Rev. [9] F. Gao, F. Z. Guo, Q. Y. Wen, et al., Phys. Rev. A 72,
Mod. Phys. 79, 555 (2007). 036302 (2005).
[2] N.Gisin, G.Ribordy,W.Tittel, et al.,Rev.Mod. Phys. [10] F. Gao, F. Z. Guo, Q. Y. Wen, et al., Phys. Rev. A 72,
74, 145 (2002). 066301 (2005).
[3] G. Chiribella, L. Maccone, and P. Perinotti, Phys. Rev. [11] F. G. Deng, X. H. Li, H. Y. Zhou, et al., Phys. Rev. A
Lett.98, 120501 (2007). 72, 044302 (2005).
[4] S. D. Bartlett, T. Rudolph, and R. W. Spekkens, Phys. [12] F. Gao, Q. Y. Wen, and F. C. Zhu, Phys. Lett. A 360,
Rev.A 70, 032307 (2004). 748 (2007).
[5] K. Bostr¨om, and T. Felbinger, Phys. Rev. Lett. 89, [13] Inthediscussion,L.Macconepointedoutthat“checking
187902 (2002). theconsistencyoftheRFstoacertaindegreeofaccuracy
[6] Q.Y. Cai, Phys. Rev.Lett. 91, 109801 (2003). consumesexactlythesamenumberofentangledpairsas
[7] Y.S.Zhang, C. F.Li, and G. C. Guo, Phys.Rev.A 63, exchanging an RF to the same degree of accuracy”, and
036301 (2001). the details would appear on thequant-pharchive.
[8] A.W´ojcik, Phys.Rev. A 71, 016301 (2005).