Unconditional security of differential phase shift quantum key distributionBasic idea of DPS-QKDSecurity against eavesdroppingUnconditional security proofModel of DPS-QKDPreparation of the initial stateDescription of eavesdroppingBob’s sideDetectionError rates and channel efficienciesSecurityOptimization ProblemOptimization RangeAnalytical Result for [1,n] DPS-QKDMultiple-photon cases[2,8] DPS-QKD ResultDifficulties and Further ResearchUnconditional security of differential phase shift quantum key distributionKai Wen, Yoshihisa YamamotoGinzton Lab and Dept of Electrical EngineeringStanford UniversityBasic idea of DPS-QKDK. Inoue, E. Waks and Y. Yamamoto, Phys. Rev. A 68, 022317 (2003)Protocol1. Alice generates a sequence of attenuated pulses, e.g. the average photon number per pulse is 0.2. The number of pulses is N+1.2. Alice picks a random N-bit key, encodes each bit into the phase difference between two consecutive pulses (DPSK).3. Bob employs an unbalanced interferometer which delays the pulse sequence by 1 bit on one arm. He then measure the outcome by the interferometer to determine the phase shift and thus the encoded key.4. On average, Alice and Bob can share 0.2 x N bits of the random key.5. Finally, Alice and Bob apply error correction and privacy amplification to obtain a correct and secure key.Security against eavesdropping• Quantum uncertainty principle and non-cloning theorem• Channel bit error rate and channel efficiency binds Eve’s capability of eavesdropping.• Against intercept-and-resend attack:– Eve measures the pulse sequence similar to Bob.– Once she obtain one result, she reconstructs the two consecutivepulses with the resulting phase shift.– In these two pulses, Bob has 1/4 chances get an error.• Against beam-splitting attack:– Eve uses a beam-splitter to split the pulses into two parts. She sends one part to Bob and keeps the other part. She then measures the other part similar to Bob to obtain a part of Alice’s random key.– Bound by the channel efficiency η, Eve can only keep 0.2N(1-η) photons.– Because the pulses are attenuated, there is still significant chance that Bob obtains the phase shifts in timeslots in which Eve doesn’t get.Unconditional security proof• Suppose Eve has ultimate computation power and techniques allowed by physics.• Find the capability of Eve’s eavesdropping, given bit error rate and channel efficiency.• Apply theoretical bound of error correction and privacy amplification to make sure Eve’s mutual information is exponentially small with a security parameter.Model of DPS-QKD• Pulse block– Contains n pulses and m photons.– Alice encodes (n-1)-bit random key inside a block.– In the worst case, each photon is of the same quantum state (m copies of the state).– Due to high channel loss, at most 1 photon can arrive at Bob’s side. Actually, Bob can count the photon number of each block arriving at his side and discard those with more than 1 photons.– We call it [m, n] DPS-QKDPreparation of the initial state• Pulses in a block represents an n-dimensional Hilbert space in quantum mechanics.– Each pulse is one base vector– Encode the (n-1)-bit key into the pulse state of each photon– Prepare the initial entangled state• The state labeled with A is the state of n-1 2-dim qubits• Example [2,3] DPS-QKD〉−−−1|)1(1nnj〉− 2|)1(2j〉− 1|)1(1j〉0|LPhoton 1:〉−−−1|)1(1nnj〉− 2|)1(2j〉− 1|)1(1j〉0|LPhoton 2:〉−−−1|)1(1nnj〉− 2|)1(2j〉− 1|)1(1j〉0|LPhoton m:M10,)00100(|T1−==〉−−niiiniL43421L43421L212111)(|)1(0|1|jjjjknnnnkjBjkL−−−==⎟⎠⎞⎜⎝⎛〉−+〉=〉∑φ()∑−=⊗−−−〉⊗〉=〉1201111||21|njmBjAnnjjφφLTATA)10(1|,)01(0| =〉=〉() ()() ()⎪⎭⎪⎬⎫⎥⎦⎤⎢⎣⎡〉〉−〉−⊗〉+⎥⎦⎤⎢⎣⎡〉〉+〉−⊗〉+⎥⎦⎤⎢⎣⎡〉〉−〉+⊗〉⎪⎩⎪⎨⎧+⎥⎦⎤⎢⎣⎡〉〉+〉+⊗〉=〉⊗⊗⊗⊗2222]3,2[2|1|0|3111|2|1|0|3110|2|1|0|3101|2|1|0|3100|21|BABABABAφDescription of eavesdropping• When Alice sends the photons labeled with B to Bob through the quantum channel, Eve can measure, transform or do other operations allowed by physics.• In general, we can treat that the channel is totally controlled by Eve.• Any Eve’s operation can be described as a POVM (Positive Operator Valued Measure), in the following matrix form:where every matrix element aijis an arbitrary complex number and |aij| <= 1.• In quantum mechanics, the final state through the channel is())()(,mmnnjiEaM×=()∑−=⊗−−−−〉⊗〉=〉⊗=〉120111211||21|)('|nnjmBjEAnnEMjjMIφφφLBob’s side• Measure only 1 photon in each block by channel loss or discarding multiple-photon blocks– Partial trace– Symmetry -> Bob measure the first photon• The 1-bit delayed interferometer is described by an (2(n+1) x n)-dimensional matrix MDPS• The final state arrives before Bob’s detectors:〉'|Tr2φmBB L()0,21,21,21,21,1,,22,12,2,12)())1(2(,===−===∀=++−×+jijjjjjjjjnnjiDPSbotherwisebbbbnjbML〉⊗=〉−'|)(''|212φφmnBBDPSTrMILDetection• After the interferometer, the pulses in a block are split into 2(n+1) pulses in n+1 timeslots, namely, l=0,…,n. Each timeslot has two pulses, representing the two values of one key bit. • Only the results in the middle 2(n-1) timeslots are conclusive. Otherwise, Bob should discard the results of the timeslot 0 and timeslot n.• After Bob reports the timeslot l, if l>1, Alice should apply the following operation to her qubits labeled A, so that Alice and Bob can obtain the same bit value.– The resulting state is()43421L43421LlnljiIIIIcllCNOTnn−−−×⊗⊗⊗⎟⎟⎟⎟⎟⎠⎞⎜⎜⎜⎜⎜⎝⎛⊗⊗⊗==−−−12222222,0100100000100001),1(11〉⊗−=〉 ''|)),1((|φφmIllCNOTlError rates and channel efficiencies• In quantum mechanics, there are two different types of errors– Bit error rate of timeslot 0 < l < n– Total bit error rate in a block– Phase error rate of timeslot 0 < l < n– Total phase error rate in a block• Channel efficiency of timeslot 0 < l < n– Total channel efficiency in a