Secure device-independent quantum key distribution with causally independent measurement devices.

Abstract

Device-independent quantum key distribution (QKD) aims to provide key distribution schemes, the security of which is based on the laws of quantum physics, but which does not require any assumptions about the internal working of the devices used in the protocol. This strong form of security is possible only when using correlations that violate a Bell inequality. Here, we provide a general security proof for a large class of protocols in a model in which the raw key is generated by independent measurements. This independence condition may be justifiable in several implementations and is necessarily satisfied when the raw key is generated by N separate pairs of devices. Our work shows that device-independent QKD is possible with key rates comparable to those of standard schemes.

Full text

Page 1

Secure device-independent quantum key distribution
with causally independent measurement devices
Llu´ ıs Masanes1, Stefano Pironio2, Antonio Ac´ ın1,3
1ICFO–Institut de Ci` encies Fot` oniques, E–08860 Castelldefels, Barcelona, Spain
2Laboratoire d’Infomation Quantique, Universit´ e Libre de Bruxelles, 1050 Bruxelles, Belgium
3ICREA–Instituci´ o Catalana de Recerca i Estudis Avan¸ cats, E–08010 Barcelona, Spain
Abstract
Device-independent quantum key distribution aims to provide key distribution schemes
whose security is based on the laws of quantum physics but which does not require any as-
sumptions about the internal working of the quantum devices used in the protocol. This strong
form of security, unattainable with standard schemes, is possible only when using correlations
that violate a Bell inequality. We provide a general security proof valid for a large class of device-
independent quantum key distribution protocols in a model in which the raw key elements are
generated by causally independent measurement processes. The validity of this independence
condition may be justifiable in a variety of implementations and is necessarily satisfied in a
physical realization where the raw key is generated by N separate pairs of devices. Our work
shows that device-independent quantum key distribution is possible with key rates comparable
to those of standard schemes.
1 Introduction
A central problem in cryptography is the distribution among distant users of secret keys that can be
used, e.g., for the secure encryption of messages. This task is impossible in classical cryptography
unless assumptions are made on the computational power of the eavesdropper. Quantum key dis-
tribution (QKD), on the other hand, offers security against adversaries with unbounded computing
power [1].
The ultimate level of security provided by QKD was made possible thanks to a change of
paradigm. While in classical cryptography security relies on the hardness of certain mathematical
problems, in QKD it relies on the fundamental laws of quantum physics. A side-effect of this
change of paradigm, however, is that whereas the security of classical cryptography is based on the
mathematical properties of the key itself — how the key was actually generated in practice being,
in principle, irrelevant to the security of the scheme — in QKD, the security crucially depends on
the physical properties of the key generation process, e.g., on the fact that the key was produced
by measuring the polarization of a single-photon along well defined directions. But then, how can
one asses the level of security provided by a real-life implementation of QKD, which will inevitably
differs in inconspicuous ways from the idealized, theoretical description [2]? Errors in the encoding
of the signals of Alice [3], for instance, or features of the detectors not taken into account in the
theoretical analysis [4] can be exploited to break the security of real-life QKD schemes.
1
arXiv:1009.1567v2 [quant-ph] 18 Nov 2010

Page 2

Device-independent QKD (DIQKD) [5] aims at closing the gap between theoretical analyses
and practical realizations of QKD by designing protocols whose security does not require a detailed
characterization of the devices used to generate the secret key (such as, e.g., the dimension of
the Hilbert space of the quantum signals or the type of measurements performed on them) [5, 6,
7, 8]. This stronger form of cryptography is possible if it is based on the observation of a Bell
inequality violation, which guarantees that the data produced by the quantum devices possess
some amount of secrecy, independently of how exactly these data were generated [9, 10]. In some
sense, DIQKD combines the advantages of classical and quantum cryptography: security against
unbounded adversaries based on the law of quantum physics but which does not rely on the physical
details of the generation process. A fully device-independent demonstration of QKD, however, still
represents at present an experimental challenge [11].
In this work, we provide a general formalism for proving the security of DIQKD protocols.
The key element in our analysis is a bound on the min-entropy of the raw key as a function of
the observed Bell inequality violation. Compared to the security proof given in [5, 8, 12], which
is restricted to protocols based on the Clauser-Horne-Shimony-Holt (CHSH) inequality [13], our
approach is completely general and can be applied to protocols based on arbitrary Bell inequalities.
Furthermore, it is not limited to “collective attacks”, but is valid against the most general attacks
available to an eavesdropper.
The DIQKD model that we consider, however, is partly restricted as it supposes that the
measurement processes generating the different bits of the raw key are causally independent of each
other (though they could be arbitrarily correlated). This independence condition is necessarily
satisfied in a physical realization where the N bits of the raw key are generated by N separate
pairs of devices used in parallel. Our analysis therefore shows that secure fully device-independent
QKD is in principle possible. In a more practical realization in which a single pair of devices is
used sequentially to generate the raw key, our measurement independence condition is satisfied
if the devices have no internal memory, an assumption that may be justifiable in a variety of
implementations. Note that our measurement independence condition and the level of security
provided here is equivalent to the one considered in [14, 15, 16]. The difference with respect to
[14, 15, 16] is that our proof does not rely only on the no-signalling principle but also on the validity
of the quantum formalism. This results in much better key rates, comparable to those of standard
QKD.
2General structure of a DIQKD protocol
Let us start by presenting the class of protocols that we consider here, which are variations of Ekert’s
QKD protocol [9, 17]. Alice and Bob share a quantum channel that distributes entangled states
and they both have a quantum apparatus to measure their incoming particles. These apparatuses
take an input (the measurement setting) and produce an output (the measurement outcome). We
label the inputs and outputs x and a for Alice, and y and b for Bob, and assume that they take a
finite set of possible values.
The first step of the protocol consists in measuring the pairs of quantum systems distributed
to Alice and Bob. In most of the cases (say N), the inputs are set to fixed values xi= xrawand
yi= yrawand the corresponding outputs a = (a1,...aN) and b = (b1,...bN) constitute the two
versions of the raw key. In the remaining systems, which represent a small random subset of all
measured pairs (of size say Nest≈
√N), the inputs x,y are chosen uniformly at random. From
2

Page 3

these Nestpairs, Alice and Bob determine the relative frequencies q(ab|xy) with which the outputs
a and b are obtained when using inputs x and y. These relative frequencies quantify the degree of
non-local correlations between Alice and Bob’s system through the violation of the Bell inequality
associated to the DIQKD protocol. This Bell inequality is defined by a linear function g of the
input-output correlations q(ab|xy):
?
where gabxyare the coefficients defining the Bell inequality and glocis its local bound. A particular
example of a Bell inequality is the CHSH inequality [13]
?
g =
a,b,x,y
gabxyq(ab|xy) ≤ gloc, (1)
gchsh=
a,b,x,y
(−1)a+b+xyq(ab|xy) ≤ 2,(2)
where a,b,x,y ∈ {0,1}.
After this initial “measure and estimate” phase, the rest of the protocol is similar to any other
QKD protocol. Alice publishes an Npub-bit message about a, which is used by Bob to correct his
errors b → b?, such that b?= a with arbitrarily high probability. Alice and Bob then generate their
final secret key k by applying a 2-universal random function to a and b?, respectively [18].
3The DIQKD model
In the DIQKD approach, we do not assume that the devices behave according to predetermined
specifications. For instance, the state emitted by the source of particles may be modified by the
eavesdropper, or the implementation of the measuring devices may be imperfect. To analyze the
security of a DIQKD protocol, we must therefore first specify how we model the N pairs of systems
used to generate the raw key.
These N pairs of systems are eventually all measured using the inputs x = xrawand y = yraw,
but since they where initially selected at random and each of them could have been part of the
Nestpairs used to estimate the Bell violation, we must also consider what would have happened for
any other inputs x and y. Let therefore P(ab|xy) denote the prior probability to obtain outcomes
a and b if measurements x = (x1,...xN) and y = (y1,...yN) are made on these N pairs. This
unknown probability distribution characterizes the initial system at the beginning of the protocol.
In the theoretical model that we consider here, we view the N bits of the raw key as arising
from N commuting measurements on a joint quantum system ρAB. That is, we suppose that the
probabilities P(ab|xy) can be written as
P(ab|xy) = tr[ρAB
N
?
i=1
Ai(ai|xi)Bi(bi|yi)],(3)
where Ai(ai|xi) are operators describing the measurements made by Alice on her ithsystem if she
select input xi(they thus satisfy Ai(ai|xi) ≥ 0 and?
satisfy the commutation relations
[Ai(a|x),Bj(b|y)] = 0
aiAi(ai|xi) = 1 1), where, similarly, Bi(bi|yi)
are operators describing the measurements made by Bob, and where these measurement operators
(4)
3

Page 4

and
[Ai(a|x),Aj(a?|x?)] = [Bi(b|y),Bj(b?|y?)] = 0
Apart from the conditions (4) and (5), the state ρAB and the
operators Ai(ai|xi) and Bi(bi|yi) are arbitrary and unspecified. The only constraint on them is
that they should return measurement probabilities (3) compatible with the statistics of the Nest
randomly selected pairs, characterized by the observed Bell-inequality violation g.
In quantum theory, measurement operators that commute represent compatible measurements
that do not influence each other and which can be performed independently of each other. The
commutation relations (4) between the operators Ai(ai|xi) describing Alice’s measurement devices
and the operators Bi(bi|yi) describing Bob’s measurement devices are thus a necessary part of any
DIQKD model; security cannot be guaranteed without them.
The commutation relations (5) between the operators Ai(ai|xi) within Alice’s location, and the
commutation relations between the operators Bi(bi|yi) within Bob’s location, represent, on the other
hand, additional constraints specific to the DIQKD model considered here. These commutation
relations are satisfied in an implementation in which the N bits of the raw key are generated by N
separate and non-interacting pairs of devices used in parallel.
In the extreme adversarial scenario where the provider of the devices is not trusted (e.g., if the
provider is the eavesdropper itself), this independence condition can be guaranteed by shielding
the N devices in such a way that no communication between them occurs during the measurement
process. One could also consider a setup where the measurements performed by the N devices define
space-like separated events. However, even in a space-like separated configuration, the ability to
shield the devices is required if the provider of the devices is untrusted, as we cannot guarantee
through other means that the devices do not send directly unwanted information to the adversary.
But, then, the ability to shield the devices is already sufficient by itself to guarantee (5).
In a more practical implementation where the raw key is generated by repeatedly performing
measurements in sequence on a single pair of devices, the commutation relation (5) expresses the
condition that the functioning of the devices should not depend on any internal memory storing
the quantum states and measurement results obtained in previous rounds. In the most general
DIQKD model, the quantum devices could possess a quantum memory such that the state of the
system after the ithmeasurement is passed to the successive round i + 1 (this state could also
contain classical information about the measurement inputs and outputs of step i). If ρi
notes the state of the system before measurement i, the unormalised state passed to round i + 1
in the event that Alice and Bob use inputs xi and yi and obtain outputs ai and bi would then
be˜A†
ment operators describing Alice’s and Bob’s measurements and satisfying?
(5)
for all i,j and a,a?,b,b?,x,x?.
ABde-
i(ai|xi)˜B†
i(bi|yi)ρi
AB˜Ai(ai|xi)˜Bi(bi|yi) where˜Ai(a|x) and˜Bi(bi|xi) are generalized measure-
a˜Ai(a|x)˜A†
i(a|x) =
?
b˜Bi(b|y)˜B†
i(b|y) = I. In such a model, the probabilities P(ab|xy) are then given by
P(ab|xy) = tr[
1?
i=N
˜A†
i(ai|xi)˜B†
i(bi|yi)ρAB
N
?
i=1
˜Ai(ai|xi)˜Bi(bi|yi)], (6)
where ρABdenotes the initial state at the beginning of the protocol, and the order in the products
is relevant. Imposing commutation relations between all operators pertaining to different rounds
corresponds to neglect the causal order in (6) due to memory effects. We then recover a model of
the form (3) by defining Ai(a|x) =˜Ai(a|x)˜A†
i(a|x) and Bi(b|y) =˜Bi(b|y)˜B†
i(b|y).
4

Page 5

4Security Proof
We now establish a bound on the secret key rate that can be achieved against an unrestricted
eavesdropper Eve for a QKD protocol satisfying the description (3), (4), (5). The information
available to Eve can be represented by a quantum system that is correlated with the systems of
Alice and Bob. We denote by ρABEthe corresponding (2N +1)-partite state, with trEρABE= ρAB.
This state describes the 2N + 1 systems at the beginning of the protocol. After the N systems of
Alice have been measured, the joint state of Alice and Eve is described by the classical-quantum
state
ρAE=
a
?
P(a|xraw)|a??a| ⊗ ρE|a, (7)
where ρE|ais the reduced state of Eve conditioned on Alice having observed the outcomes a.
The length of the secret key k obtained by processing the raw key a with an error correct-
ing protocol and a 2-universal random function is, up to terms of order
Hmin(a|E) − Npub, where Hmin(a|E) is the min-entropy of a conditioned on Eve’s information for
the state (7) and Npubis the length of the message published by Alice in the error-correcting phase.
It is shown in [19] that the length of the public message necessary for correcting Bob’s errors is
Npub = NH(a|b), up to terms of order
entropy [19], defined by
H(a|b) =
a,b
where P(a,b) = 1/N?N
amounts to determine the min-entropy Hmin(a|E). We show in the following how to put a bound
on this quantity as a function of the estimated Bell violation g.
Intuitively, we want to understand how the observed Bell violation limits the predictability
of Alice’s outcomes a. We start by considering the simpler case of one pair of systems (N = 1)
uncorrelated to the adversary and characterized by the joint probabilities
√N, lower bounded by
√N. The quantity H(a|b) is the conditional Shannon
?
ai,biP(ai= a,bi= b) is the average probability with witch the pair of
outcomes a and b are observed. Computing the key rate of the DIQKD protocol, thus essentially
−P(a,b)log2P(a|b), (8)
i=1
?
P(ab|xy) = tr[ρA(a|x)B(b|y)] .(9)
If P(a|xraw) < 1 for all a, then the outcome of the measurement xrawcannot be perfectly predicted.
The degree of unpredictability of a can be quantified by the probability to correctly guess a [20].
This guessing probability is equal to
Pguess(a) = max
a
P(a|xraw),(10)
since the best guess that one can make about a is to output the most probable outcome.
Pguess(a) = 1 then the outcome of the measurement xraw can be predicted with certainty, while
lower values for Pguess(a) imply less predictability.
Let gexp=?
?
If
abxygabxyP(ab|xy) = tr[ρG] denote the expected quantum violation of the Bell
inequality (1) for the pair of systems described by (9), where
G =
a,b,x,y
gabxyA(a|x)B(b|y),(11)
5