Table Of Content

Quantum key distribution with 2-bit quantum codes Xiang-Bin Wang ∗ Imai Quantum Computation and Information project, ERATO, Japan Sci. and Tech. Corp. Daini Hongo White Bldg. 201, 5-28-3,Hongo, Bunkyo, Tokyo 113-0033,Japan 0 i We propose a prepare-and-measure scheme for quantum (cid:18) i −0 (cid:19). These operators represent for a bit flip er- key distribution with 2-bit quantum codes. The protocol is ror only, a phase flip error only and both error, re- unconditionallysecureunderwhatevertypeofintercept-and- spectively. The detected bit (or phase) flip error rate resend attack. Given the symmetric and independent errors is the summation of σ (or σ ) error rate and σ er- x z y tothetransmittedqubits,ourschemecantolerateabiterror ror rate. The Z,X,Y basis are defined by the basis of rate up to 26% in 4-state protocol and 30% in 6-state proto- 4 0 , 1 , 0 1 , 0 i1 , respectively. col, respectively. These values are higher than all currently {| i | i} {| i±| i} {| i± | i} 0 Main idea. We proposearevised2-EPPschemewhichis known threshold values for the prepare-and-measure proto- 0 unconditionallysecureandwhichcanfurtherincreasethe cols. Moreover, we give a practically implementable linear 2 thresholds of error rates given the independent channel optics realization for our scheme. n Introduction. Quantum key distribution (QKD) is dif- errors. We propose to let Alice send Bob the quantum a states randomly chosenfrom 1 (00 + 11 ), 1 (00 J ferent from classical cryptography in that an unknown {√2 | i | i √2 | i− quantum state is in principle not known unless it is dis- 11 ), 00 , 11 . Asweshallsee,thesestatesarejustthe 4 | i | i | i} turbed,ratherthanthe conjectureddifficultyofcomput- quantumphase-fliperror-rejection(QPFER)codeforthe ing certain functions. The first published protocol, pro- BB84 state 0 , 1 , 1 (0 + 1 ), 1 (0 1 ) . 3 {| i | i √2 | i | i √2 | i−| i } v posed in 1984 [1], is called BB84 (C. H. Bennett and G. In our 4-state protocol, the tolerable channel bit-flip 7 Brassard.) For a history of the subject, one may see e.g. and phase-flip rate is raised to 26% for the symmetric 5 [2]. Since then, studies on QKD are extensive. Strict channel with independent noise. (A symmetric channel 0 mathematical proofs for the unconditional security have is defined as the one with equal distribution of errors of 8 been given already [3–5]. It is greatly simplified if one σ ,σ ,σ .) Notethatthetheoreticalupperboundof25% 0 x z y connects this with the quantum entanglement purifica- [11]onlyholdsforthose4-stateschemeswhereAliceand 3 tion protocol (EPP) [3,6–10]. Very recently, motivated Bob only test the error rate before any error removing 0 / for higher bit error rate tolerance and higher efficiency, steps. However, this is not true with the delay of error h Gottesman and Lo [11] studied the classicalization of test. Considering the standard purification protocol [7] p EPP with two way communications (2-EPP).Their pro- with symmetric channel, one may distill the maximally - t tocolhasincreasedthe tolerablebiterrorrateofchannel entangledstatesoutoftherawpairswhoseinitialbit-flip n to 18.9% and 26.4% for 4-state QKD and 6-state QKD, errorand phase-fliperrorare 33.3%. In our 4-state pro- a u respectively. Very recently, these values have been up- tocol, we delay the error test by one step of purification q graded to 20% and 27.4% by Chau [12]. with 2-bit QPFER code. This raises the tolerable chan- : Thetypeofprepare-and-measureQKDschemesispar- nel flipping rates. v i ticularly interesting because it does not need the very The QPFER code. We shall use the following QPFER X difficult technique of quantum storage. In this paper, code: r we propose a new prepare-and-measurescheme with the a assistance of2-bit quantum codes. The linear opticalre- 0 0 (00 + 11 )/√2 | i| i−→ | i | i alizationisshowninFig.(1,2). Inourscheme,Aliceshall 1 0 (00 11 )/√2. (1) send both qubits of the quantum codes to Bob, there- | i| i−→ | i−| i fore they do not need any quantum storage. Bob will Here the second qubit in the left side of the arrow is first check the parity of the two qubits by the polarizing the ancilla for the encoding. This code is not assumed beamsplitter (PBS)andthen decodethe code withpost to reduce the errors in all cases. But in the case that selection. The 2-bit code is produced by the SPDC pro- the channel noise is uncorrelatedor nearly uncorrelated, cess [13], see in Fig.(1). it works effectively. Consider an arbitrary state α0 + 1 | i 1 β 1 1(qubit1)andanancillastate 0 2(qubit2). Taking We shall use the representation of 0 = ; 1 = | i | i | i (cid:18)0(cid:19) | i unitary transformation of Eq(1) we obtain the following 0 0 1 1 0 un-normalized state: . We denote σ = ,σ = ,σ = (cid:18)1(cid:19) x (cid:18)1 0 (cid:19) z (cid:18)0 1(cid:19) y − α(0 1 0 2+ 1 1 1 2)+β(0 1 0 2 1 1 1 2) (2) | i | i | i | i | i | i −| i | i This can be regarded as the encoded state for α0 + 1 | i β 1 . Alice then sends both qubits to Bob. In receiving 1 ∗email: [email protected] th|emi , Bob first takes a parity check, i.e. he compares the bit values of the two qubits in Z basis. Note that 1 this collective measurement does not destroy the code and to see whether formula (3) indeed holds, based on state itself. Specifically, the parity check operation can our prior knowledge of physical channel noise. be done by the PBS in Fig.(2): there, states 0 , 1 are Our protocol with linear optical realization. In the BB84 | i | i forhorizontalandverticalpolarizationphotonstates,re- protocol, there are only four different states. Therefore spectively. Since a PBS transmits 0 and reflects 1 , Alice may directly prepare random states from the set if incident beams (beam 1 and 2) o|f tihe PBS are b|otih of 1 (00 + 11 ), 1 (00 11 ), 00 , 11 and sends {√2 | i | i √2 | i−| i | i | i} horizontally polarizedor vertically polarized, there must them to Bob. This is equivalent to first preparing the be one photon on each output beams (beam 1’ and 2’); BB84 states and then encoding them by eq.(1). We pro- if the polarizations of two incident beams are one hori- pose the following 4-state protocol with implementation zontalandonevertical,oneoftheoutputbeamsmustbe of linear optics in Fig(1) and Fig(2): empty. After the parity check, if bit values are different, 1 Alice prepares N 2-qubit quantum codes with N/4 of Bob discards the whole 2-qubit code, if they are same, them being prepared in 00 or 11 with equal probabil- Bob decodes the code. In decoding, he measures qubit 1 ity and 3N/4 of them be|ingi pre|paried in 1 (00 11 ) inX basis,ifheobtains + ,hetakesaHadamardtrans- √2 | i±| i with equal probability. All codes are put in randomly | i 1 1 formation H = 1 to qubit 2; if he obtains order. She records the the “preparation basis” as X √2(cid:18)1 1(cid:19) basis for code 00 or 11 ; and as Z basis for code − for qubit 1, he takes the Hadamard transformation 1 (00 11 ).|Anidshe|reciordsthebitvalueof0forthe t|−oiqubit 2 and then flips qubit 2 in Z basis. Suppose √2 | i±| i code 00 or 1 (00 + 11 ); bit value 1 for the code 11 the original channel error rates of σx,σy,σz types are | i √2 | i | i | i p ,p ,p , respectively. Let p =1 p p p . or 1 (00 11 ). She sends each 2-qubit code to Bob. x0 y0 z0 I0 − x0− y0− z0 √2 | i−| i One may easily verify the probability distribution and In Fig.(1), any of the above four states can be produced error type for the survived and decoded states (qubit 2) from the nonlinear crystal by appropriately setting the in following table polarizationofthepumplight[15]. 2Bobchecksthepar- ityofeach2-qubitcodeinZbasis. Hediscardsthecodes JCE probability decoded state error type whenever the 2 bits have different values and he takes I I p2 α0 +β 1 I ⊗ I0 | i | i the following measurement if they have same values: he I σz 2pI0pz0 α1 +β 0 σx measuresqubit1inXbasisandqubit2ineitherXbasis { ⊗ } | i | i σz ⊗σz p2z0 α|0i+β|1i I or Z basis with equal probability. If Bob has measured σy ⊗σy p2y0 α|0i−β|1i σz qubit 2 in X (or ) Z basis, he records the “measurement σx⊗σx p2x0 α|0i−β|1i σz basis”asZ (or)Xbasis[16]andweshallsimply callthe σx σy 2px0py0 α1 β 0 σy qubit as Z-bit (or X-bit) latter on. If he obtains + + , { ⊗ } | i− | i | i| i + 0 , or 0 , he records bit value 0 for that The first column lists the various types of joint channel | i| i |−i|−i |−i| i code; if he obtains + , 1 , + or + 1 , he errors(JCE)before decoding. α β denotes both α |−i| i |−i| i | i|−i | i| i { ⊗ } ⊗ records bit value 1 for that code. In our linear optical β and β α. According to this table, the error rate realization, Bob’s detections are done by post selection ⊗ distribution for the survived raw pairs after decoding is: inFig.(2): Ifbeam1’andbeam2’eachcontainsonepho- ton, beam 1 and beam 2 must have the same bit values. p2 +p2 p = I0 z0 , Otherwise, their bit values must be different. This re-  I (pI0+pz0)2+(px0+py0)2 quires Bob to only accept the events of two fold clicking  pz = (pI0+pzp022x)p20++p(pp2yx00+py0)2, (3) woaclfbiitcoehkvveeedonnmtdseeemnctteluiiccostkntoeerbddefrdcdoeoimtsrecrcea{tsroDpdro3end,fDrd.o4iMmn,Dgo{5rreD,uDol1ve6,,eD}r.t,2o}aActachllonordosdetihtnahegcerctetooyptphttheeedesr x0 y0 events,clickingofD3orD4meansmeasurementinZba- p = ,  pxy = ((ppII00++ppzz002))22pI++0p((zpp0xx00++ppyy00))22. satT(oDilshs2oebt,,oDectabw3lmie)coakcm2ifon’or,g2lrd’ceo,osfcpcrDorloiercn5rskdpeoissnorpngtDoodn6oibndfmigitn(egDtvaoat1nol,s“uDZ“em6Xo)eb,fab(asD0asui;s1sri”,tesDw”mf3oofe)orn,fr(othDhlidini2ss,cXDrrleei5cccb)kooairrsnoddigsr;. With this formula, the phase flip error to the decoded of (D2,D6),(D2,D4), (D1,D5) or (D1,D3) corresponds to states is obviously reduced. Note that this formula does bit value 1. 3 Bob announces which codes have been not hold for the correlated channel errors. Even though discarded. Alice and Bob compare the “preparation ba- the noise of the physical channel is uncorrelated, in car- sis” and “measurement basis” of each bits decoded from rying out the QKD task, we should not use this formula thesurvivedcodesbyclassicalcommunication. Theydis- to deduce the flipping rates of the decoded qubits based cardthosebitswhose“measurementbasis”disagreewith on our knowledge of the physical channel noise, i.e., the “preparation basis”. Bob announces the bit value of all values of p ,p ,p ,p . But we can choose to directly I0 x0 y0 z0 X-bits. He also randomly chooses the same number of test the error rate of the survived and decoded qubits 2 Z bits andannounces their values. If toomany ofthem Theaboveprotocolistotallyequivalenttotheonebased − disagree with Alice’s record, they abort the protocol. 4 on entanglement purification therefore it is uncondition- Now they regard the tested error rates on Z-bits as the ally secure [14]. Here we give a simple security proof. bit-flip rate and the tested error rate on X-bits as phase flip rate. They reduce the bit flip rate in the following NC u1 1 2’ way: they randomly group all their unchecked bits with each group containing 2 bits. They compare the parity p PBS of each group. If the results are different, they discard 2 1’ both bits. If the results are same, they discard one bit Alice u2 Bob and keep the other. They repeatedly do so for a number of rounds until they believe that both bit flip rate and phase flip rate can be reduced to less than 5% with the FIG.1. QKDschemewith 2-bitquantumcodes. PBS:po- next step being taken. 5 They then randomly group the larizing beam splitter. NC: nonlinear crystals used in SPDC remained bits with each group containing r bits. They process,p: pumplightinhorizontalpolarization,u1: unitary use the parity ofeachgroupas the new bits. 6 They use rotator, u2: phase shifter. u1 takes the value of 0, π/2, π/4 the classical CSS code [6] to distill the final key. toproduceemissionstate|11i,|00i,|φ+i,respectively. u2can Notethatinthisprotocol,Sinceformula(3)isnotuncon- beeither I or σz ditionally true, Alice and Bob check the bit errorsafter decodingthe 2-bitquantumcodes. Ifthe detected errors are significantly larger than the expected values calcu- D6 D5 D4 D3 lated from eq.(3), they will abort the protocol. That is to say, if formula (3) really works, they continue, if it BS does not work, they abort it. After any round of bit flip RPBS errorrejectioninstep4,theerrorratewillbeiteratedby PBS 1 2’ equation(1) in ref.[12]. After the phase errorcorrection instep5,thenewerrorratesatisfiestheinequalityoffor- PBS mula (3) of ref. [12] provided that pI > 1/2. The above 2 1’ steps to removethe bit-flip errorandphase-fliperrorare unconditionallytruesinceAlice andBobhavepairedthe D2 D1 qubitsrandomly. Eventhoughtheerrorsofthedecoded RPBS qubits are arbitrarily correlated, the above steps always work as theoretically expected. FIG.2. Bob’s action in QKD scheme of figure(1). RPBS: Given p ,p ,p , if there exits a finite number k, after x y z Rotated polarizing beam splitter which transmits the state k rounds ofbit-fliperror-rejection,we canfind ar which |+i and reflects state |−i). BS: 50:50 beam splitter. D rep- satisfy resentsforaphotondetector. WithRPBS,onemaymeasure theincident beam in {|+i,|−i} basis. r(p +p ) 5% x y ≤ e−2r(0.5−pz−py)2 5%, (4) Security proof. Consider two protocols, protocol P0 ≤ and protocol P. In protocol P0, Alice directly sends Bob onecanthenobtaintheunconditionallysecureandfaith- eachindividual qubits. In protocol P, Alice first encodes ful final key with a classical CSS code [6]. each individual qubits by a certain error rejection code Inthe4-stateprotocol,wedon’tdetecttheσ errorfor y and then sends each quantum codes to Bob. We denote the states decodedfromthe survivedcodes,therefore we encoding operation as Eˆ and parity check and decoding have to assume py = 0 after the quantum parity check operation by Dˆ. Bob will first check parity of each code and decoding. But we do not have to assume p = 0, y0 and decode the survived codes. After decoding, Alice actually Alice and Bob never test any error rate before and Bob continue the protocol. Suppose except for the decoding in the protocol. However, if the channel noise operationsofDˆ andEˆ everythingelseinprotocolP0and is symmetric and uncorrelated, after the quantum de- protocol P is identical and operation Dˆ or Eˆ do not re- coding,bothσ error(p )andσ error(p )arereduced, z z y y quireanyinformationoftheoriginalqubititself,thenwe i.e., the detectable phase error rate has been reduced in have the following theorem: If protocol P0 is secure a rate as it should be i.e., eq.(3). We then start from with arbitrary lossy channel, then protocol P is the un-symmetricerrorratewithassumptionpy =0and also secure. The proof of this theorem is very simple. p ,p being thedetectedbit-fliprateandphase-fliprate, x z SupposePisinsecure. ThenEve. mustbeabletoattack respectively. After the calculation, we find that the tol- the final key by certain operation. Denote Eve’s attack erable error rate of bit flip or phase flip is 26% for the during the period that all codes are transmitted from 4-state protocol. Moreover, in the case that the channel Alice to Bob as Aˆ. Eve may obtain significant informa- errordistributionitselfispy0 =0;px0 =pz0,thetolerable tion to final key with operation Aˆ and other operations channel errorrate for our protocolis p =p 21.7%. x0 z0 ≤ 3 (Qˆ) after Bob receives the qubits. If this is true, then in attackmustnotaffecttheerrorratesdetectedonthede- protocol P0, Eve may take the operation of DÂÊˆ in the codedqubitsifshewantstohideherpresence. Thatisto same period and then send the decoded states to Bob, say, if Eve hides her presence, all results about the final withallotheroperationsidenticaltothoseinprotocolP. key of our protocol can be correctly estimated based on (The time orderis fromrightto left.) To Alice andBob, the known properties of the physical channel, no mat- it looks like that they are carrying out protocol P0 with ter what type of attack she has used. Given a physical a lossy channel now, because Eve will have to discard channel with its noise being un-correlated and symmetric some of the 2-bit quantum codes after the parity check and higher than the thresholds of all other prepare-and- in decoding. All final results from protocol P0 with at- measureprotocols butlowerthanthat ofourprotocol, our tack QˆDÂÊˆ must be identical to protocolP with attack protocol is the only one that works. In practice, one may QÂˆ, since everything there with the two protocols are simply separate the 2 qubits of the quantum code sub- now the same. This completes our proof of the theorem. stantially to guaranteethe un-correlationof the physical OurQKDprotocolinprevioussectionisjustthemodified channel noise. This is to say, the error threshold advan- Chau protocol [12] with encoding and decoding added. tage of our protocol is actually unconditional in practice. We can regard our protocol as P and Chau protocol as Looseends in practice. Multi-pairemissioninSPDCand P0 in applying our theorem. Since Gottesman-Lo pro- darkcountingofdetectorshavenotbeenconsidered. We tocol [11] or Chau protocol [12] are all unconditionally believetheseissuescanberesolvedalongthesimilarlines securewitharbitrarylossychannel,weconcludethatour in the case of BB84 implemented with a weak coherent protocol must be also unconditionally secure. light source. 6-state protocol. Ourprotocolcanobviouslybeextended Acknowledgement: I thank Prof Imai H for support. tothe6-stateprotocol[17]. Indoingso,Alicejustchange The extended version of this work has been submitted the initially random codes by adding N/4 codes from toQIT-EQISworkshop(Kyoto)[14]. I thank the anony- 1[(00 + 11 ) i(00 11 )] . This is equivalent to mous referees of the workshop for their comments and {12(| 00i |i1i1 )±. S|heir−eg|ardis a}ll this type codes as Y- suggestions. I thank Dr B. S. Shi for discussions on the √2 {| i∓ | i } source design. bits. In decoding the codes, Bob’s “measurement basis” israndomlychosenfrom3basis,X,YandZ.Alldecoded X-bits, Y-bits and the same number of randomly cho- sen decoded Z will be used as the check bits. Since the Hadamard transform switches the two eigenstates of σ , y after decoding, whenever Bob measures qubit 2 in Y basis, he needs to flip the measurementoutcome so that to [1] C.H.BennettandG.Brassard,Proceedings of IEEEIn- obtain everything the same as that in the 2-EPP with ternational Conference on Computers, Systems and Sig- quantum storages [14]. In such a way, if the channel nal Processing, Bangalore, India, 1984, (IEEE Press, is symmetric, Bob will find p = 0. And he will know y 6 1984), pp.175–179; C.H.BennettandG.Brassard, IBM px,py,pz exactly instead of assuming py = 0. This will Technical Disclosure Bulletin 28, 3153–3163 (1985). increase the tolerable error rate accordingly. In the case [2] N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Re- symmetric physical channel, our 6-state protocol toler- views of Modern Physics, vol. 74, pp. 145-195. ates the flipping rate up to 30%. [3] H.-K. Lo and H.F. Chau, Science, 283, 2050(1999) Subtlety of the “conditional advantage”. un-symmetric [4] D. Mayers, Journal of ACM, 48,351. effective channel. Although the advantage of a higher [5] E. Biham, M. Boyer, P. O. Boykin, T. Mor, and V. threshold is conditional, the security of our protocol is Roychowdhury, Proceedings of the Thirty-Second An- unconditional. That is to say, whenever our protocol nual ACM Symposium on Theory of Computing(STOC) produces any final key, Eve’s information to that key (ACM Press, New York,2000), p. 715. must be exponentially close to zero, no matter whether [6] P. W. Shor and J. Preskill, Phys. Rev. Lett., Eve uses coherent attack or individual attack. Our pro- 85,441(2000). tocol is totally different from the almost useless proto- [7] C. H. Bennett, D. P. DiVincenzo, J. A. Smolin, and W. col which is only secure with uncorrelated channel noise. K. Wootters, Phys.Rev.A54, 3824(1996) There are two conditions for the error threshold advan- [8] D. Deutsch, A. Ekert, R. Jozsa, C. Macchiavello, S. Popescu, and A. Sanpera, Phys. Rev. Lett., 77, tage: 2818(1996); Erratum Phys. Rev.Lett. 80, 2022 (1998). (1) The noise of physical channel should be the type [9] D. Gottesman and J. Preskill, Phys. where eq.(3) holds; (2) Eve. is not detected in the error Rev.A63,22309(2001). test, i.e., the result of error test must be in agreement [10] A. R. Calderbank and P. Shor, Phys. Rev. A54, with the expected result given by eq.(3). 1098(1996), A. M. Steane, Proc. R. Soc. London A452, Bothconditions here are verifiableby the protocolitself. 2551(1996). The second condition is a condition for any QKD proto- [11] D. Gottesman and H.-K. Lo, IEEE Transactions on In- col. Thefirstconditionisontheknownphysicalchannel formation Theory,49, 457(2003). ratherthanEve’schannelinQKD.Inourprotocol,Eve’s [12] H. F. Chau, Phys. Rev.A66, 060302(R) (2002). 4 [13] P. G. Kwiat, K. Mattle, H. Weinfurter, A. Zeilinger, A.V. Sergienko, and Y. H. Shih, Phys. Rev. Lett. 75, 4337(1995). [14] Onemay see details in X.B. Wang, quant-ph/0306156. [15] P.G. Kwiat et al, Phys.Rev.A60, R773(1999). [16] Here Bob has omitted the Hadamard transformation as appeared in theEPP. [17] D.Bruss, Phys.Rev. Lett.81, 3018(1998). 5