Qkd and de finetti theorem

Quantum Key Distribution

and de Finetti’s Theorem

Matthias Christandl

Institute for Theoretical Physics, ETH Zurich

June 2010

Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem

Overview

Introduction to Quantum Key Distribution

Two tools for proving security:

De Finetti’s TheoremPost-Selection Technique

Summary



Alice und Bob want to communicate in secrecy, but theirphone is tapped.

Alice

Eve

Bobphone

If they share key (string of secret random numbers),

Alice Eve Bob message+key-------------- cipher cipher

- key-------------- message

cipher is random and message secure (Vernam, 1926)



key is as long as the message

Shannon (1949): this is optimal /secret communication = key distribution

possible key distribution schemes:

Alice and Bob meet ⇒ impracticalWeaker level of security

assumptions on speed of Eve’s computer(public key cryptography)assumptions on size of Eve’s harddrive(bounded storage model)

Use quantum mechanical effects(Bennett & Brassard 1984, Ekert 1991)



Quantum mechanics governs atoms and photons

Spin-12

system: points on the sphere

(cos θ

e iϕ sin θ

)= cos θ|0〉+ e iϕ sin θ|1〉 ∈ C2

unit of information, the quantum bit or ”qubit”

we measure a qubit along a basis

if basis is {|0〉, |1〉}, we obtain ’0’ with probability cos2 θ.

in general: express qubit in basis and consider|amplitude|2.



The state of two qubits: |ψ〉 ∈ C2 ⊗ C2, 〈ψ||ψ〉 = 1

|ψ〉 = ψ00|0〉 ⊗ |0〉+ ψ01|0〉 ⊗ |1〉+ ψ10|1〉 ⊗ |0〉+ ψ11|1〉 ⊗ |1〉= ψ00|0〉|0〉+ ψ01|0〉|1〉+ ψ10|1〉|0〉+ ψ11|1〉|1〉

each qubit is measured in basis {|0〉, |1〉}measurement basis {|0〉|0〉, |0〉|1〉, |1〉|0〉, |1〉|1〉}obtain ’ij ’ with probability |ψij |2.



Entangled state of two qubits 1√2(|0〉A|0〉B + |1〉A|1〉B)

New basis

|+〉 =1√2

(|0〉+ |1〉) |−〉 =1√2

(|0〉 − |1〉)

easy calculation

1√2

(|0〉A|0〉B + |1〉A|1〉B) =1√2

(|+〉A|+〉B + |−〉A|−〉B)

Alice and Bob measure in basis {|0〉, |1〉} ⇒ same resultAlice and Bob measure in basis {|+〉, |−〉} ⇒ same resultConverse is true, too:

same measurement result ⇒ they have state1√2

(|0〉A|0〉B + |1〉A|1〉B)

Alice and Bob can test whether or not they have thestate 1√

2(|0〉A|0〉B + |1〉A|1〉B)!



Assume that Alice and Bob have the state|φ〉AB = 1√

2(|0〉A|0〉B + |1〉A|1〉B)

and measure in the same basis.

Can someone else guess the result?

No! The measurement result is secure!

Total state of Alice, Bob and Eve

|ψ〉ABE = |φ〉AB ⊗ |φ〉E ,

because Alice and Bob have a pure stateEve is not at all correlated with Alice and Bob!Monogamy of entanglement



The Quantum Key Distribution Protocol

Distribution

AliceEve

Bobglass �bre

1

1 1

Distribution

AliceEve

Bobglass �bre

1 2

1 2 1 2

Distribution

AliceEve

Bobglass �bre

1 2 n

1 2 n 1 2 n

Measurement with {|0〉, |1〉} or {|+〉, |−〉}

0 1 1 0 0 1

��

Error-free? |φ〉AB?= 1√

2(|0〉A|0〉B + |1〉A|1〉B)

phone

If YES: key. If NO: no key




Distribution

AliceEve

Bobglass �bre

1

1 1

Distribution

AliceEve

Bobglass �bre

1 2

1 2 1 2

Distribution

AliceEve

Bobglass �bre

1 2 n

1 2 n 1 2 n


0 1 1 0 0 1

��


2(|0〉A|0〉B + |1〉A|1〉B)

phone





Distribution

AliceEve

Bobglass �bre

1

1 1

Distribution

AliceEve

Bobglass �bre

1 2

1 2 1 2

Distribution

AliceEve

Bobglass �bre

1 2 n

1 2 n 1 2 n


0 1 1 0 0 1

��


2(|0〉A|0〉B + |1〉A|1〉B)

phone





Distribution

AliceEve

Bobglass �bre

1

1 1

Distribution

AliceEve

Bobglass �bre

1 2

1 2 1 2

Distribution

AliceEve

Bobglass �bre

1 2 n

1 2 n 1 2 n


0 1 1 0 0 1

��


2(|0〉A|0〉B + |1〉A|1〉B)

phone





Distribution

AliceEve

Bobglass �bre

1

1 1

Distribution

AliceEve

Bobglass �bre

1 2

1 2 1 2

Distribution

AliceEve

Bobglass �bre

1 2 n

1 2 n 1 2 n


0 1 1 0 0 1

��


2(|0〉A|0〉B + |1〉A|1〉B)

phone





Distribution

AliceEve

Bobglass �bre

1

1 1

Distribution

AliceEve

Bobglass �bre

1 2

1 2 1 2

Distribution

AliceEve

Bobglass �bre

1 2 n

1 2 n 1 2 n


0 1 1 0 0 1

��


2(|0〉A|0〉B + |1〉A|1〉B)

phone




Proof works as long as |Ψ〉nABC = |ψ〉⊗nABE .

Alice Bob

But why should Eve prepare such a state?Why not the following?

Alice Bob

We can assume: π|Ψ〉nABC = |Ψ〉nABC for all π ∈ Sn.

Goal: two methods that reduce second to first case!


De Finetti’s Theorem

De Finetti’s Theorem (Diaconis and Freedman, 1980)

Drawing balls from an urn with or without replacement resultsin almost the same probability distribution.

If k are drawn out of n, then

||Pk −∑

i

piQ×ki ||1 ≤ const

k

n.



Quantum generalisations by Størmer, Hudson & Moody, andWerner et al.. (n =∞)

Quantum De Finetti TheoremChristandl, Konig, Mitchison, Renner, Comm. Math. Phys. 273, 473498 (2007)

Let |Ψ〉n be a permutation-invariant state: π|Ψ〉n = |Ψ〉n forall π ∈ Sn, then

||ρk −∑

i

pi |ψ〉〈ψ|⊗ki ||1 ≤ const

k

n



Alice and Bob select a random sample of pairs(after pairs have been distributed!)

Alice BobAlice BobQuantum de Finetti

⇒ can use proof from before (tensor product)⇒ proof of the security of Quantum Key Distribution!



Closer look: deviation from perfect key (due to quantumde Finetti theorem)

ε ≈ k/n

n: number of pairs that Eve distributed

k : number of bits of key

key rate r ≈ k/n ≈ ε ≈ 0 ⇒ not good enough

need replacement for de Finetti theorem

Renner’s exp. de Finetti theorem, involved, non-optimal


Post-Selection Technique

Statistical process Λ

Input: n-bit string

Output: success or failure

Lemma

If for any i.i.d. distribution

Prob[failure] ≤ ε,

thenProb[failure] ≤ (n + 1)ε

for any permutation-invariant distribution.

Typically, ε ≈ 2−αn, in information-theoretic tasks.



Proof: P permutation-invariant distribution on n bits:

P =n∑

k=0

pkQk .

Qk equal probability for all strings with k zeros.Take P as n-fold i.i.d distribution, where ’0’ has probability r .

r*n k

p_k

Certainly, prn ≥ 1/(n + 1) ⇒ Qrn ≤ (n + 1)Pr .



Qrn ≤ (n + 1)Pr .

Prob[failure]P =∑

k

pkProb[failure]Qk

≤∑

k

pk(n + 1)Prob[failure]Pk/n

≤ (n + 1)ε

2



Quantum operation Λ

Input: n-qubit state

Output: success or failure (classical bit)

Post-selection TechniqueChristandl, Konig, Renner, Phys. Rev. Lett. 102, 020504 (2009)

For any input |Ψ〉n = |ψ〉⊗n

Prob[failure] ≤ ε,

thenProb[failure] ≤ n3ε

for any state permutation-invariant state |Ψ〉.

Typically, ε ≈ 2−αn, in information-theoretic tasks.Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem



Distribution |Ψ〉nABC = |ψ〉⊗nABE

AliceEve

Bobglass �bre

1 2 n

1 2 n 1 2 n


0 1 1 0 0 1

��

Error-free? phone


By assumption: Prob[failure] ≤ ε




Distribution |Ψ〉nABC permutation-invariant (or general)

AliceEve

Bobglass �bre

1 2 n

1 2 n 1 2 n


0 1 1 0 0 1

��

Error-free? phone


Post-selection tech.: Prob[failure] ≤ poly(n)ε ≈ poly(n)2−δ2n



security proof against the most general attacks

optimal security parameters

relevant in current experiments (since n ≈ 105)

Eve’s best attack |ΨnABE 〉 = |ψABE 〉⊗n

conceptual and technical simplification of security proofs

Other applications: Quantum Reverse Shannon TheoremBerta, Christandl and Renner, arXiv:0912.3805


Summary


Alice BobAlice BobQuantum de Finetti



optimal security parametersapplications outside quantum cryptography:quantum Shannon theory and quantum tomography


Qkd and de finetti theorem

Technology

quantum key distribution

quantum key distribution

probability distribution

alice bob

cipher cipher key

finettis theorem diaconis

a1 b alice

finetti theorem christandl