Week 11 | using the fragility of quantum states as a burglar alarm, and what it does and does not protect | reading: de Wolf, Quantum Computing: Lecture Notes, QKD chapter; Bennett and Brassard (1984)
Block II ended with Shor's algorithm breaking the public-key cryptography that distributes keys on the internet (Lecture 17). The standard answer is post-quantum cryptography: new public-key schemes based on problems believed hard even for quantum computers. This lecture is about the other answer, which uses quantum mechanics itself. By the end you should be able to run the BB84 protocol by hand, explain why an eavesdropper must cause errors and compute how many, decide from a sample of errors whether to continue or abort, describe the classical post-processing that turns a noisy shared string into a secret key, explain how E91 uses Bell violations, and say clearly what QKD does and does not provide.
The one-time pad is perfectly secure: to send an \(m\)-bit message \(x\), Alice sends \(x\oplus k\) for a uniformly random key \(k\) of the same length, used once. Anyone without \(k\) sees uniformly random bits. Symmetric ciphers like AES are a practical version: a short shared key encrypts long messages. Either way, Alice and Bob first need a shared secret key, and getting one to each other over a public network is exactly what RSA and Diffie–Hellman do today, and what Shor's algorithm breaks.
Classically, a key sent over a channel can be copied by an eavesdropper without leaving a trace. Quantum mechanics changes that in two ways we already know. An unknown quantum state cannot be copied (the no-cloning theorem, Lecture 8). And measuring a state in the wrong basis changes it (Lecture 4): a \(Z\) measurement of \(|+\rangle\) leaves \(|0\rangle\) or \(|1\rangle\), not \(|+\rangle\). So an eavesdropper who wants to learn something must interact with the qubits, and an interaction that extracts information disturbs them. Quantum key distribution (QKD) turns that disturbance into an alarm.
Alice and Bob share a quantum channel (in practice, single photons in an optical fiber) and an authenticated public classical channel: everyone can listen, but nobody can alter messages undetected.
When \(A=B\) and nobody interferes, Bob's measurement returns Alice's bit with certainty. When \(A\ne B\), he measures \(|0\rangle\) in the \(X\) basis (or \(|+\rangle\) in the \(Z\) basis) and gets a fair coin flip, which is why those rounds are discarded. Since the bases are independent and uniform, sifting keeps half the rounds on average.
In one round Alice picks bit 1 and basis \(X\), so she sends \(|-\rangle\). Bob measures in \(Z\) and gets 0. Nobody is eavesdropping. What happens to this round?
Suppose Alice and Bob each choose \(Z\) with probability 0.9 and \(X\) with probability 0.1, independently. What fraction of the rounds survives sifting?
Notice what is announced and what is not. The bases become public, but only after Bob has measured. Why this order matters, and what Eve gains from the announcement, is part of HW10 Problem 3.
The simplest attack is intercept and resend: Eve catches a qubit, measures it in a basis of her choice, and sends Bob a fresh qubit in the state she observed. If she guesses Alice's basis, nothing changes; if not, her measurement destroys Alice's state and Bob's result, even in a sifted round, is a coin flip.
If Eve intercepts each qubit with probability \(f\), measures it in a uniformly random basis (\(Z\) or \(X\)) and resends the result in her basis, then each intercepted sifted round has an error with probability \(\tfrac14\), and the QBER is \(Q=f/4\).
Proof: HW10 Problem 3.
A quick check before reading on.
On a noiseless channel, Alice and Bob measure a QBER of 6% and attribute all of it to a random-basis intercept-resend attack. According to Proposition 20.1, what fraction \(f\) of the qubits did Eve intercept?
Is a random basis Eve's best choice? She cannot do better at hiding than leaving qubits alone, but among attacks that measure every qubit she can trade disturbance for information. The next example shows that the disturbance of intercept-resend is stubborn: changing her basis changes what she learns, not how much she disturbs.
Eve measures every qubit in the Breidbart basis \(|e_0\rangle=\cos\tfrac\pi8|0\rangle+\sin\tfrac\pi8|1\rangle\), \(|e_1\rangle=-\sin\tfrac\pi8|0\rangle+\cos\tfrac\pi8|1\rangle\), whose Bloch vectors lie halfway between \(\pm\hat z\) and \(\pm\hat x\). She resends \(|e_k\rangle\) when she sees \(k\), and guesses that Alice's bit was \(k\). Find the QBER and the probability that Eve's guess is right, on sifted rounds.
Take a sifted round in the \(Z\) basis with \(a=0\) (the other three cases are the same by symmetry: the Breidbart basis sits at \(\pi/4\) on the Bloch sphere from both \(\hat z\) and \(\hat x\)). Eve sees \(k=0\) with probability \(\cos^2\tfrac\pi8\) and \(k=1\) with probability \(\sin^2\tfrac\pi8\). Bob, measuring \(|e_0\rangle\) in \(Z\), errs with probability \(\sin^2\tfrac\pi8\), and measuring \(|e_1\rangle\), with probability \(\cos^2\tfrac\pi8\). So
$$Q=\cos^2\tfrac\pi8\sin^2\tfrac\pi8+\sin^2\tfrac\pi8\cos^2\tfrac\pi8=\tfrac12\sin^2\tfrac\pi4=\tfrac14 ,$$the same disturbance as the random-basis attack. But Eve's guess is right with probability \(\cos^2\tfrac\pi8\approx0.854\), better than the random-basis attack achieves (HW10 Problem 3 asks you to compute that). Her information about each bit went up; Alice and Bob's alarm rang just as loudly.
The general principle, which security proofs make quantitative, is that any information Eve gains about the key bits is paid for by errors that Alice and Bob can measure. In the limit of no errors Eve has no information. Alice and Bob therefore treat the measured error rate as an upper limit on what Eve may know, and the post-processing of Section 5 removes as much information as she could possibly have.
Alice and Bob never know \(Q\); they estimate it from a random sample of \(n\) sifted bits, which they then throw away. The decision "continue only if \(Q\) is below a threshold \(Q_{\max}\)" is a one-sided hypothesis test of the kind met in introductory statistics: errors in the sample are \(\mathrm{Bin}(n,Q)\), and Alice and Bob continue only if the data make \(Q\ge Q_{\max}\) implausible. Equivalently, they continue if a one-sided upper confidence bound for \(Q\) is below \(Q_{\max}\). Section 5 explains why \(Q_{\max}\approx11\%\) for BB84.
A sample of \(n=600\) sifted bits contains 24 errors. Find the one-sided 95% upper confidence bound for \(Q\) with the normal approximation.
Alice and Bob compare \(n=400\) sifted bits and find 30 disagreements. Compute a one-sided 95% upper confidence bound for \(Q\) with the normal approximation and exactly (Clopper–Pearson). Do they continue, with \(Q_{\max}=11\%\)?
\(\hat Q=30/400=0.075\), standard error \(\sqrt{0.075\cdot0.925/400}\approx0.0132\). Normal bound: \(0.075+1.645\cdot0.0132\approx0.0967\). The exact Clopper–Pearson bound, the \(Q\) with \(P(\mathrm{Bin}(400,Q)\le30)=0.05\), is about \(0.1004\) (scipy.stats.beta.ppf(0.95, 31, 370)). Both are below 0.11, so they continue; but the exact bound is noticeably closer to the threshold.
The test bits cost key: every compared bit is discarded. Real systems sample a small fraction of a very long sifted key, so that \(n\) is in the tens of thousands and the bound is tight. The finite-size statistics of QKD (bounding \(Q\) on the unsampled bits, which is a sampling-without-replacement problem) are an active part of security proofs.
After sifting and estimation, Alice and Bob hold strings that (i) differ in a fraction \(Q\) of positions and (ii) are partly known to Eve. Two classical steps fix each problem.
Information reconciliation. Alice and Bob correct their differences by exchanging parities over the public channel. In the simplest scheme (the idea behind the Cascade protocol), they split the key into blocks and compare each block's parity; when a block's parities differ, it contains an odd number of errors, and a binary search on parities of halves finds one error. For an 8-bit block with one error this reveals 4 parities: the block's and three halvings (see the code in Section 8). Every revealed parity is information Eve also hears, at least \(h(Q)\) bits per key bit in the best case (Shannon's bound), where
$$h(Q)=-Q\log_2Q-(1-Q)\log_2(1-Q)$$is the binary entropy. Modern systems use LDPC error-correcting codes for this, the same kind of code that appears in Lecture 23.
A 16-bit block contains exactly one error. How many parities does the block-parity-plus-binary-search scheme reveal before the error is located?
Privacy amplification. Eve may know some bits of the corrected key, or some parities of it. Alice and Bob apply a random hash function that compresses the key to a shorter string; if the output is short enough, Eve's partial information about the input says almost nothing about the output.
A family of functions \(\{0,1\}^n\to\{0,1\}^m\) is universal if for any two different inputs \(x\ne x'\), a randomly chosen member maps them to the same output with probability at most \(2^{-m}\). A random \(m\times n\) binary Toeplitz matrix \(T\) (constant along each diagonal, so determined by \(n+m-1\) random bits), applied as \(x\mapsto Tx\bmod2\), is a universal family. The leftover hash lemma says that if Eve's uncertainty about \(x\) is at least \(m+2\log_2(1/\varepsilon)\) bits (in the sense of min-entropy), then \(Tx\) is within \(\varepsilon\) of uniform even given Eve's information and \(T\).
Alice and Bob hash 10 bits down to 3 with a random \(3\times10\) Toeplitz matrix. How many random seed bits must Alice announce, and what is the largest possible probability that two given different inputs hash to the same output?
Alice and Bob agree on the 8-bit key \(x=10110010\), and Alice announces 11 random seed bits defining the \(4\times8\) Toeplitz matrix below. Compute the final key \(Tx\bmod2\).
$$T=\begin{pmatrix}1&0&0&1&0&0&0&1\\0&1&0&0&1&0&0&0\\0&0&1&0&0&1&0&0\\0&0&0&1&0&0&1&0\end{pmatrix}$$Each output bit is the parity of the key bits where its row has a 1. Row 1 picks positions 1, 4, 8: \(1+1+0=0\). Row 2 picks 2, 5: \(0+0=0\). Row 3 picks 3, 6: \(1+0=1\). Row 4 picks 4, 7: \(1+1=0\). The final key is \(0010\). The matrix is public, yet This 8-bit example only shows the mechanics; at this size there is no security guarantee (if Eve knew bits 2 and 5, she would know output bit 2 exactly). The leftover hash lemma promises that the \(m\) output bits are within \(\varepsilon\) of uniform and independent of Eve only when Eve's uncertainty about the input (its min-entropy) is at least \(m+2\log_2(1/\varepsilon)\). In practice \(n\) is millions of bits and \(\varepsilon\) around \(10^{-10}\), so the margin \(2\log_2(1/\varepsilon)\approx67\) bits is negligible.
How much secret key survives? For BB84 with one-way post-processing, the Shor–Preskill security proof (2000) gives, for long keys, a secret fraction of
$$r(Q)=1-2h(Q)$$of the sifted key: one \(h(Q)\) is paid for reconciliation and one for privacy amplification. It vanishes at \(h(Q)=\tfrac12\), that is \(Q\approx11.0\%\). That is where the 11% threshold comes from. In Example 20.2, using the exact upper bound \(Q\le0.1004\), the secret fraction is \(1-2h(0.1004)\approx0.059\): about 6 secret bits per 100 sifted bits (8 with the normal bound), against 23 per 100 if \(Q=7.5\%\) were known exactly: statistical uncertainty is expensive near the threshold.
Find the asymptotic secret fraction \(r(Q)=1-2h(Q)\) at a QBER of 3%.
In 1991 Artur Ekert proposed a protocol in which a source, which might even be controlled by Eve, sends one qubit of each Bell pair \(|\Phi^+\rangle\) to Alice and the other to Bob. Each measures in a randomly chosen basis. On rounds where their bases agree, their outcomes are perfectly correlated (Lecture 6) and form the key. On the other rounds they use bases at the CHSH angles of Lecture 8 and compute the CHSH value \(S\).
The CHSH value certifies security. Quantum mechanics allows \(S\) up to \(2\sqrt2\approx2.83\), reached only by a maximally entangled pair, which can have no correlation with anything else (entanglement is monogamous). Any attack that gives Eve classical information about the outcomes lowers \(S\); a local hidden-variable model, which is what Eve's full knowledge would amount to, gives \(S\le2\). For a Bell pair mixed with white noise, \(\rho=v|\Phi^+\rangle\langle\Phi^+|+(1-v)I/4\), the QBER is \(Q=(1-v)/2\) and
$$S=2\sqrt2\,v=2\sqrt2\,(1-2Q),$$which drops below 2 at \(Q=\tfrac12\big(1-\tfrac1{\sqrt2}\big)\approx14.6\%\) (verify_L20.py checks both formulas on the density matrix). Lab 2 measured \(S\) for real.
An E91 source produces \(\rho=v|\Phi^+\rangle\langle\Phi^+|+(1-v)I/4\) with \(v=0.8\). Find the QBER and the expected CHSH value.
The CHSH test does not depend on how the devices work, only on the observed statistics. So E91-style protocols can, in principle, be proved secure even if Alice's and Bob's measurement devices were built by Eve: this is device-independent QKD, first demonstrated in 2022 over short distances, at very low key rates. It answers the main practical objection to QKD (Section 7), at a large cost in rate.
What QKD needs that the theory assumes.
Tick every assumption that QKD's security actually rests on.
Where it is used. China operates a QKD backbone of about 2,000 km between Beijing and Shanghai with trusted nodes, connected to the Micius satellite; there are metropolitan networks in Europe, Korea and Japan. In New York, a 34 km deployed-fiber loop between Brooklyn and Manhattan distributed polarization-entangled photon pairs continuously for 15 days with about 99% fidelity and 99.84% uptime (Craddock et al., PRX Quantum, 2024): the kind of infrastructure that entanglement-based QKD and future quantum networks need.
The U.S. National Security Agency states that it does not recommend QKD for national security systems unless its limitations are overcome: it is only a partial solution (no authentication), needs special-purpose equipment rather than software, depends on trusted relays, is hard to validate because its security is "highly implementation-dependent rather than assured by laws of physics", and raises denial-of-service risk. The U.K.'s NCSC and several European agencies have published similar positions. All of them recommend post-quantum cryptography (Lecture 17) as the primary migration path. QKD's supporters answer that its security does not rest on unproven hardness assumptions, which matters for secrets that must stay secret for decades. A fair summary: PQC is the near-term migration for the internet; QKD is a niche technology for specific high-value links, where the hardware can be controlled, and a research program toward device-independent and network-scale security.
import numpy as np from qiskit import QuantumCircuit from qiskit_aer import AerSimulator sim = AerSimulator(method="stabilizer", seed_simulator=20) # X, H and measurements are Clifford: 64 qubits is easy rng = np.random.default_rng(2020); n = 64 def send_and_measure(bits, send_bases, meas_bases): """Prepare |bit> in each send basis (0 = Z, 1 = X) on n qubits, measure each in meas_bases; return the bits read.""" qc = QuantumCircuit(n, n) for q in range(n): if bits[q]: qc.x(q) if send_bases[q]: qc.h(q) if meas_bases[q]: qc.h(q) qc.measure(q, q) key = next(iter(sim.run(qc, shots=1).result().get_counts())) return np.array([int(c) for c in key[::-1]]) # Qiskit lists qubit 0 last a, A, B = rng.integers(0, 2, n), rng.integers(0, 2, n), rng.integers(0, 2, n) b = send_and_measure(a, A, B) # no Eve keep = A == B print(f"no Eve: sifted {keep.sum()} of {n}, errors {np.sum(a[keep] != b[keep])}") E = rng.integers(0, 2, n) e = send_and_measure(a, A, E) # Eve measures every qubit in a random basis... b = send_and_measure(e, E, B) # ...and resends what she saw, in her basis print(f"with Eve: sifted {keep.sum()} of {n}, errors {np.sum(a[keep] != b[keep])}, QBER {np.mean(a[keep] != b[keep]):.3f}") print("first 8 sifted rounds Alice:", a[keep][:8], " Bob:", b[keep][:8])
no Eve: sifted 27 of 64, errors 0 with Eve: sifted 27 of 64, errors 4, QBER 0.148 first 8 sifted rounds Alice: [1 1 1 0 1 1 1 1] Bob: [1 1 1 0 0 1 1 0]
All the operations are Clifford (\(X\), \(H\), measurement), so Aer's stabilizer simulator handles 64 qubits at once. With only 27 sifted bits the error count is very noisy: 4 errors where \(27/4\approx7\) are expected. HW10 Problem 5 simulates BB84 statistically, without circuits, to get QBER curves.
import numpy as np def h(q): return 0.0 if q in (0, 1) else -q * np.log2(q) - (1 - q) * np.log2(1 - q) # information reconciliation: find one error in an 8-bit block by comparing parities of halves alice = [1, 0, 1, 1, 0, 0, 1, 0]; bob = [1, 0, 1, 0, 0, 0, 1, 0] lo, hi, revealed = 0, 8, 1 # the whole-block parity was compared first while hi - lo > 1: mid = (lo + hi) // 2; revealed += 1 if sum(alice[lo:mid]) % 2 != sum(bob[lo:mid]) % 2: hi = mid else: lo = mid bob[lo] ^= 1 print("error at position", lo, " parities revealed:", revealed, " keys agree:", alice == bob) # privacy amplification: hash the 8 agreed bits to 4 with a random Toeplitz matrix (11 public seed bits) rng = np.random.default_rng(20) seed = rng.integers(0, 2, 11) T = np.array([[seed[i - j + 7] for j in range(8)] for i in range(4)]) print("Toeplitz matrix:\n", T) print("final key:", T @ np.array(alice) % 2) # asymptotic secret fraction of the sifted key, r = 1 - 2 h(Q) for Q in (0.01, 0.05, 0.075, 0.0967, 0.11): print(f"QBER {Q:.4f}: secret fraction {1 - 2 * h(Q):+.4f}")
error at position 3 parities revealed: 4 keys agree: True Toeplitz matrix: [[1 0 0 1 0 0 0 1] [0 1 0 0 1 0 0 0] [0 0 1 0 0 1 0 0] [0 0 0 1 0 0 1 0]] final key: [0 0 1 0] QBER 0.0100: secret fraction +0.8384 QBER 0.0500: secret fraction +0.4272 QBER 0.0750: secret fraction +0.2314 QBER 0.0967: secret fraction +0.0831 QBER 0.1100: secret fraction +0.0002
Example 20.3 and the key-rate formula of Section 5. At the 11% threshold the secret fraction is essentially zero.
Next time: protecting quantum information itself from noise, with quantum error-correcting codes. HW10 (Lectures 18–20) is due at the start of Week 12; project proposals are due this week.
all numbers and figures in these notes are computed in python (verify_L20.py) and follow the page theme