Quantum Key Distribution
and de Finetti’s Theorem
Matthias Christandl
Institute for Theoretical Physics, ETH Zurich
June 2010
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Overview
Introduction to Quantum Key Distribution
Two tools for proving security:
De Finetti’s TheoremPost-Selection Technique
Summary
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Quantum Key Distribution
Alice und Bob want to communicate in secrecy, but theirphone is tapped.
Alice
Eve
Bobphone
If they share key (string of secret random numbers),
Alice Eve Bob message+key-------------- cipher cipher
- key-------------- message
cipher is random and message secure (Vernam, 1926)
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Quantum Key Distribution
Alice und Bob want to communicate in secrecy, but theirphone is tapped.
Alice
Eve
Bobphone
If they share key (string of secret random numbers),
Alice Eve Bob message+key-------------- cipher cipher
- key-------------- message
cipher is random and message secure (Vernam, 1926)
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Quantum Key Distribution
key is as long as the message
Shannon (1949): this is optimal /secret communication = key distribution
possible key distribution schemes:
Alice and Bob meet ⇒ impracticalWeaker level of security
assumptions on speed of Eve’s computer(public key cryptography)assumptions on size of Eve’s harddrive(bounded storage model)
Use quantum mechanical effects(Bennett & Brassard 1984, Ekert 1991)
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Quantum Key Distribution
key is as long as the message
Shannon (1949): this is optimal /secret communication = key distribution
possible key distribution schemes:
Alice and Bob meet ⇒ impracticalWeaker level of security
assumptions on speed of Eve’s computer(public key cryptography)assumptions on size of Eve’s harddrive(bounded storage model)
Use quantum mechanical effects(Bennett & Brassard 1984, Ekert 1991)
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Quantum Key Distribution
Quantum mechanics governs atoms and photons
Spin-12
system: points on the sphere
(cos θ
e iϕ sin θ
)= cos θ|0〉+ e iϕ sin θ|1〉 ∈ C2
unit of information, the quantum bit or ”qubit”
we measure a qubit along a basis
if basis is {|0〉, |1〉}, we obtain ’0’ with probability cos2 θ.
in general: express qubit in basis and consider|amplitude|2.
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Quantum Key Distribution
Quantum mechanics governs atoms and photons
Spin-12
system: points on the sphere
(cos θ
e iϕ sin θ
)= cos θ|0〉+ e iϕ sin θ|1〉 ∈ C2
unit of information, the quantum bit or ”qubit”
we measure a qubit along a basis
if basis is {|0〉, |1〉}, we obtain ’0’ with probability cos2 θ.
in general: express qubit in basis and consider|amplitude|2.
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Quantum Key Distribution
The state of two qubits: |ψ〉 ∈ C2 ⊗ C2, 〈ψ||ψ〉 = 1
|ψ〉 = ψ00|0〉 ⊗ |0〉+ ψ01|0〉 ⊗ |1〉+ ψ10|1〉 ⊗ |0〉+ ψ11|1〉 ⊗ |1〉= ψ00|0〉|0〉+ ψ01|0〉|1〉+ ψ10|1〉|0〉+ ψ11|1〉|1〉
each qubit is measured in basis {|0〉, |1〉}measurement basis {|0〉|0〉, |0〉|1〉, |1〉|0〉, |1〉|1〉}obtain ’ij ’ with probability |ψij |2.
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Quantum Key Distribution
Entangled state of two qubits 1√2(|0〉A|0〉B + |1〉A|1〉B)
New basis
|+〉 =1√2
(|0〉+ |1〉) |−〉 =1√2
(|0〉 − |1〉)
easy calculation
1√2
(|0〉A|0〉B + |1〉A|1〉B) =1√2
(|+〉A|+〉B + |−〉A|−〉B)
Alice and Bob measure in basis {|0〉, |1〉} ⇒ same resultAlice and Bob measure in basis {|+〉, |−〉} ⇒ same resultConverse is true, too:
same measurement result ⇒ they have state1√2
(|0〉A|0〉B + |1〉A|1〉B)
Alice and Bob can test whether or not they have thestate 1√
2(|0〉A|0〉B + |1〉A|1〉B)!
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Quantum Key Distribution
Entangled state of two qubits 1√2(|0〉A|0〉B + |1〉A|1〉B)
New basis
|+〉 =1√2
(|0〉+ |1〉) |−〉 =1√2
(|0〉 − |1〉)
easy calculation
1√2
(|0〉A|0〉B + |1〉A|1〉B) =1√2
(|+〉A|+〉B + |−〉A|−〉B)
Alice and Bob measure in basis {|0〉, |1〉} ⇒ same resultAlice and Bob measure in basis {|+〉, |−〉} ⇒ same resultConverse is true, too:
same measurement result ⇒ they have state1√2
(|0〉A|0〉B + |1〉A|1〉B)
Alice and Bob can test whether or not they have thestate 1√
2(|0〉A|0〉B + |1〉A|1〉B)!
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Quantum Key Distribution
Entangled state of two qubits 1√2(|0〉A|0〉B + |1〉A|1〉B)
New basis
|+〉 =1√2
(|0〉+ |1〉) |−〉 =1√2
(|0〉 − |1〉)
easy calculation
1√2
(|0〉A|0〉B + |1〉A|1〉B) =1√2
(|+〉A|+〉B + |−〉A|−〉B)
Alice and Bob measure in basis {|0〉, |1〉} ⇒ same resultAlice and Bob measure in basis {|+〉, |−〉} ⇒ same resultConverse is true, too:
same measurement result ⇒ they have state1√2
(|0〉A|0〉B + |1〉A|1〉B)
Alice and Bob can test whether or not they have thestate 1√
2(|0〉A|0〉B + |1〉A|1〉B)!
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Quantum Key Distribution
Assume that Alice and Bob have the state|φ〉AB = 1√
2(|0〉A|0〉B + |1〉A|1〉B)
and measure in the same basis.
Can someone else guess the result?
No! The measurement result is secure!
Total state of Alice, Bob and Eve
|ψ〉ABE = |φ〉AB ⊗ |φ〉E ,
because Alice and Bob have a pure stateEve is not at all correlated with Alice and Bob!Monogamy of entanglement
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Quantum Key Distribution
Assume that Alice and Bob have the state|φ〉AB = 1√
2(|0〉A|0〉B + |1〉A|1〉B)
and measure in the same basis.
Can someone else guess the result?
No! The measurement result is secure!
Total state of Alice, Bob and Eve
|ψ〉ABE = |φ〉AB ⊗ |φ〉E ,
because Alice and Bob have a pure stateEve is not at all correlated with Alice and Bob!Monogamy of entanglement
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Quantum Key Distribution
The Quantum Key Distribution Protocol
Distribution
AliceEve
Bobglass �bre
1
1 1
Distribution
AliceEve
Bobglass �bre
1 2
1 2 1 2
Distribution
AliceEve
Bobglass �bre
1 2 n
1 2 n 1 2 n
Measurement with {|0〉, |1〉} or {|+〉, |−〉}
0 1 1 0 0 1
����� ����� ����� ����� ����� �����
Error-free? |φ〉AB?= 1√
2(|0〉A|0〉B + |1〉A|1〉B)
phone
If YES: key. If NO: no key
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Quantum Key Distribution
The Quantum Key Distribution Protocol
Distribution
AliceEve
Bobglass �bre
1
1 1
Distribution
AliceEve
Bobglass �bre
1 2
1 2 1 2
Distribution
AliceEve
Bobglass �bre
1 2 n
1 2 n 1 2 n
Measurement with {|0〉, |1〉} or {|+〉, |−〉}
0 1 1 0 0 1
����� ����� ����� ����� ����� �����
Error-free? |φ〉AB?= 1√
2(|0〉A|0〉B + |1〉A|1〉B)
phone
If YES: key. If NO: no key
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Quantum Key Distribution
The Quantum Key Distribution Protocol
Distribution
AliceEve
Bobglass �bre
1
1 1
Distribution
AliceEve
Bobglass �bre
1 2
1 2 1 2
Distribution
AliceEve
Bobglass �bre
1 2 n
1 2 n 1 2 n
Measurement with {|0〉, |1〉} or {|+〉, |−〉}
0 1 1 0 0 1
����� ����� ����� ����� ����� �����
Error-free? |φ〉AB?= 1√
2(|0〉A|0〉B + |1〉A|1〉B)
phone
If YES: key. If NO: no key
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Quantum Key Distribution
The Quantum Key Distribution Protocol
Distribution
AliceEve
Bobglass �bre
1
1 1
Distribution
AliceEve
Bobglass �bre
1 2
1 2 1 2
Distribution
AliceEve
Bobglass �bre
1 2 n
1 2 n 1 2 n
Measurement with {|0〉, |1〉} or {|+〉, |−〉}
0 1 1 0 0 1
����� ����� ����� ����� ����� �����
Error-free? |φ〉AB?= 1√
2(|0〉A|0〉B + |1〉A|1〉B)
phone
If YES: key. If NO: no key
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Quantum Key Distribution
The Quantum Key Distribution Protocol
Distribution
AliceEve
Bobglass �bre
1
1 1
Distribution
AliceEve
Bobglass �bre
1 2
1 2 1 2
Distribution
AliceEve
Bobglass �bre
1 2 n
1 2 n 1 2 n
Measurement with {|0〉, |1〉} or {|+〉, |−〉}
0 1 1 0 0 1
����� ����� ����� ����� ����� �����
Error-free? |φ〉AB?= 1√
2(|0〉A|0〉B + |1〉A|1〉B)
phone
If YES: key. If NO: no key
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Quantum Key Distribution
The Quantum Key Distribution Protocol
Distribution
AliceEve
Bobglass �bre
1
1 1
Distribution
AliceEve
Bobglass �bre
1 2
1 2 1 2
Distribution
AliceEve
Bobglass �bre
1 2 n
1 2 n 1 2 n
Measurement with {|0〉, |1〉} or {|+〉, |−〉}
0 1 1 0 0 1
����� ����� ����� ����� ����� �����
Error-free? |φ〉AB?= 1√
2(|0〉A|0〉B + |1〉A|1〉B)
phone
If YES: key. If NO: no key
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Quantum Key Distribution
Proof works as long as |Ψ〉nABC = |ψ〉⊗nABE .
Alice Bob
But why should Eve prepare such a state?Why not the following?
Alice Bob
We can assume: π|Ψ〉nABC = |Ψ〉nABC for all π ∈ Sn.
Goal: two methods that reduce second to first case!
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Quantum Key Distribution
Proof works as long as |Ψ〉nABC = |ψ〉⊗nABE .
Alice Bob
But why should Eve prepare such a state?Why not the following?
Alice Bob
We can assume: π|Ψ〉nABC = |Ψ〉nABC for all π ∈ Sn.
Goal: two methods that reduce second to first case!
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Quantum Key Distribution
Proof works as long as |Ψ〉nABC = |ψ〉⊗nABE .
Alice Bob
But why should Eve prepare such a state?Why not the following?
Alice Bob
We can assume: π|Ψ〉nABC = |Ψ〉nABC for all π ∈ Sn.
Goal: two methods that reduce second to first case!
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
De Finetti’s Theorem
De Finetti’s Theorem (Diaconis and Freedman, 1980)
Drawing balls from an urn with or without replacement resultsin almost the same probability distribution.
If k are drawn out of n, then
||Pk −∑
i
piQ×ki ||1 ≤ const
k
n.
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
De Finetti’s Theorem
Quantum generalisations by Størmer, Hudson & Moody, andWerner et al.. (n =∞)
Quantum De Finetti TheoremChristandl, Konig, Mitchison, Renner, Comm. Math. Phys. 273, 473498 (2007)
Let |Ψ〉n be a permutation-invariant state: π|Ψ〉n = |Ψ〉n forall π ∈ Sn, then
||ρk −∑
i
pi |ψ〉〈ψ|⊗ki ||1 ≤ const
k
n
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
De Finetti’s Theorem
Alice and Bob select a random sample of pairs(after pairs have been distributed!)
Alice BobAlice BobQuantum de Finetti
⇒ can use proof from before (tensor product)⇒ proof of the security of Quantum Key Distribution!
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
De Finetti’s Theorem
Closer look: deviation from perfect key (due to quantumde Finetti theorem)
ε ≈ k/n
n: number of pairs that Eve distributed
k : number of bits of key
key rate r ≈ k/n ≈ ε ≈ 0 ⇒ not good enough
need replacement for de Finetti theorem
Renner’s exp. de Finetti theorem, involved, non-optimal
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
De Finetti’s Theorem
Closer look: deviation from perfect key (due to quantumde Finetti theorem)
ε ≈ k/n
n: number of pairs that Eve distributed
k : number of bits of key
key rate r ≈ k/n ≈ ε ≈ 0 ⇒ not good enough
need replacement for de Finetti theorem
Renner’s exp. de Finetti theorem, involved, non-optimal
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Post-Selection Technique
Statistical process Λ
Input: n-bit string
Output: success or failure
Lemma
If for any i.i.d. distribution
Prob[failure] ≤ ε,
thenProb[failure] ≤ (n + 1)ε
for any permutation-invariant distribution.
Typically, ε ≈ 2−αn, in information-theoretic tasks.
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Post-Selection Technique
Proof: P permutation-invariant distribution on n bits:
P =n∑
k=0
pkQk .
Qk equal probability for all strings with k zeros.Take P as n-fold i.i.d distribution, where ’0’ has probability r .
r*n k
p_k
Certainly, prn ≥ 1/(n + 1) ⇒ Qrn ≤ (n + 1)Pr .
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Post-Selection Technique
Qrn ≤ (n + 1)Pr .
Prob[failure]P =∑
k
pkProb[failure]Qk
≤∑
k
pk(n + 1)Prob[failure]Pk/n
≤ (n + 1)ε
2
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Post-Selection Technique
Quantum operation Λ
Input: n-qubit state
Output: success or failure (classical bit)
Post-selection TechniqueChristandl, Konig, Renner, Phys. Rev. Lett. 102, 020504 (2009)
For any input |Ψ〉n = |ψ〉⊗n
Prob[failure] ≤ ε,
thenProb[failure] ≤ n3ε
for any state permutation-invariant state |Ψ〉.
Typically, ε ≈ 2−αn, in information-theoretic tasks.Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Post-Selection Technique
The Quantum Key Distribution Protocol
Distribution |Ψ〉nABC = |ψ〉⊗nABE
AliceEve
Bobglass �bre
1 2 n
1 2 n 1 2 n
Measurement with {|0〉, |1〉} or {|+〉, |−〉}
0 1 1 0 0 1
����� ����� ����� ����� ����� �����
Error-free? phone
If YES: key. If NO: no key
By assumption: Prob[failure] ≤ ε
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Post-Selection Technique
The Quantum Key Distribution Protocol
Distribution |Ψ〉nABC permutation-invariant (or general)
AliceEve
Bobglass �bre
1 2 n
1 2 n 1 2 n
Measurement with {|0〉, |1〉} or {|+〉, |−〉}
0 1 1 0 0 1
����� ����� ����� ����� ����� �����
Error-free? phone
If YES: key. If NO: no key
Post-selection tech.: Prob[failure] ≤ poly(n)ε ≈ poly(n)2−δ2n
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Post-Selection Technique
security proof against the most general attacks
optimal security parameters
relevant in current experiments (since n ≈ 105)
Eve’s best attack |ΨnABE 〉 = |ψABE 〉⊗n
conceptual and technical simplification of security proofs
Other applications: Quantum Reverse Shannon TheoremBerta, Christandl and Renner, arXiv:0912.3805
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem
Summary
Quantum Key Distribution
Alice BobAlice BobQuantum de Finetti
De Finetti’s Theorem
Post-Selection Technique
optimal security parametersapplications outside quantum cryptography:quantum Shannon theory and quantum tomography
Matthias Christandl Quantum Key Distribution and de Finetti’s Theorem