QKD - Does BB84 Protocol rely on a prearranged code?

Question

First of all, sorry if the title is not that clear, I'll provide an in-depth explanation behind my question.

So, basically, I was reading about quantum cryptography and came across BB84. The protocol uses photon pulses composed of polarized photons, which spin in a specified direction. That may be rectilinear spin (i.e. horizontal/vertical) or diagonal spin (i.e. left-diagonal/right-diagonal).

If performed correctly, this is in theory, unbreakable. Because quantum mechanics laws don't allow measurements to be done without damaging the photons used in the communication.

Here's how it works:

1. Alice sends Bob a sequence of photon pulses, each one randomly polarized in one of the four possible directions (listed above).
2. Bob measures the pulses by setting his polarization detector in one of the two possible spin types (rectilinear or diagonal), randomly. He cannot measure both, because quantum mechanics doesn't allow this. If the detector is not correctly set, he will get a random measurement. *(Note: Remember that the rectilinear polarization detector will detect both horizontal and vertical spinning photons, and vice versa the diagonal detector will detect both left-diagonal and right diagonal spinning photons) *.
3. After the measurement is done, Bob will send Alice the detector configuration he used (ex. the first photon was measured with a diagonal detector, the second was measured with a rectilinear, etc.) over a public channel.
4. Alice responds, in the public channel, to Bob. By saying which of the configurations were correctly set. (ex. the first was diagonal and correct, the second rectilinear and incorrect, etc.)
5. Bob and Alice then take the correct configurations, and they convert those to a prearranged code, which could be, as an example, that a correctly guessed diagonal detector is 0, and a correctly guessed rectilinear detector is 1. This way an encryption key will be composed.

This is how I understood the algorithm, so it may very probably be not entirely correct. Please correct me at any point if needed!

Anyway, after explaining how I see the algorithm, my question is: **does this basically rely on a shared secret? ** I mean, the prearranged code to convert the polarization measurements to bits should be, as the name says, prearranged. If Eve listens on the public channel and gets both Bob's measurements and Alice's response, which lists the correct polarizations, and she knows that a diagonal pol. converts to a 0 while a rectilinear pol. converts to a 1, she can reconstruct the key without interfering with the quantum channel.

If this is true, why would we go for quantum key distribution? If we need a secretly prearranged code to make it work? That would have to be kept secret to prevent keys from recovering right?

Answer 1

5. Bob and Alice then take the correct configurations, and they convert those to a prearranged code, which could be, as an example, that a correctly guessed diagonal detector is 0, and a correctly guessed rectilinear detector is 1. This way an encryption key will be composed.

I believe that's where you got it a bit off. A correctly guessed rectilinear detection is not a consistent 1; instead, they might have the convention that a horizontal polarization is 0 and a vertical polarization is 1; similarly, a 45 degree polarization might be 0 and a 135 degree polarization might be 1.

If Eve listens on the public channel, and gets both Bob's measurements...

Eve most certainly does not get Bob's measurements. Bob does tell the world (well, Alice, but we can assume Eve is listening in) what he set his detector to (whether it was on the horizontal/vertical setting, or whether it was diagonal), but Bob certain doesn't tell what the detector actually measured.

So, suppose Alice sends a rectilinearly polarized photon to Bob. If Bob set his detector to rectilinear, he'll tell that to Alice (after the photon has been detected); Alice will tell Bob that his guess was correct. Alice knows what polarization she sent, and Bob knows he measured it correctly; they both know whether it was a horizontal photon (a 0), or a vertical photon (a 1). Which is it? Well, neither Alice or Bob are telling. Someone in the middle can't be sure (unless they tried to measure it themselves; in that case, there's a chance that they got the polarization wrong when they re-emitted the photon, and hence will introduce detectable errors).

My opinion: I don't personally think this QKD stuff is actually practical (that is, it doesn't solve any problem that can't be better solved using more traditional methods), however it can work.

Answer 2

YES, Quantum Key Distribution requires an initial shared secret key (or code). Given that, it allows transmission of a wider secret key by relying on laws of quantum physic, rather than by relying on different assumptions made in classical cryptography (intractability of some problem considering the adversary's computing power).

By contrast, given an initial shared uniformly random secret of $k$ bits, classical cryptography can only either

• transmit a secret key or message of at most $k$ bit, with demonstrable security (that's what the One Time Pad does);
• transmit a secret key or message of arbitrary length, in a manner conjectured (but only fully demonstrated) secure with residual odds of failure $2^{-r}$ for an adversary capable of less than $2^{k-r}$ operations (that's what symmetric-key cryptography does).

Non-quantum asymmetric cryptography (invented in the 1970's) can transmit information with no shared secret, and conjectured security; it however requires an initial secret on the receiver side, and matching trusted non-secret data on the sender side. Most Quantum Key Distribution systems (including the one in the question) have no such asymmetry in the initial knowledge of sender and receiver, and it is easy to show ad absurdum (as follows) that they require a shared secret to reach security against an active eavesdropper.

Assume some system allowing secret communication between Alice and Bob over unsecured optical fiber, using equipment of public design, and no secret on either side. Eve chooses a location close enough to both Alice and Bob that she can have laid two optical fibers, one between Alice's and Eve's locations, and another between Eve's and Bob's locations, both with characteristics (length..) similar to the optical fiber allegedly (but not really) laid between Alice's and Bob's place. Eve terminates the fiber linking her to Alice (resp. Bob) with equipment built according to the public design of Bob's (resp. Alice's) equipment. Any message Alice tries to send to Bob will reach Eve, and Eve can keep a copy and forward it to Bob. If the links are bi-directional, Eve can similarly copy and forward to Alice any message she receives from Bob.

Addition: In the simplified description of BB84 in the question, the shared secret indeed lies in the prearranged way of measuring photon polarity. In an actual system (having to deal with errors and synchronization) there are many successive photon transmissions, using prearrangements of photon polarity that vary from photon to photon, initially according to the shared secret key. If the error rate is low enough, BB84 can transmit more secret bits than it consumes, and part of this new secret can be spared to allow continuous operation. All this makes heavy use of error-correcting code, which has mathematically provable security (like the OTP, only using more complex reasoning), contrary to cryptography (which at some level relies on assumptions that are not rigorously proven true, even though nobody really doubts that they are).

Note: the security of a cryptographic system also relies on assumptions on the equipment used (including but not limited to: it has no spurious RF emission compromising the secrets manipulated). In the case of QKD, some of these assumptions are particularly complex, and have repeatedly turned out wrong, allowing practical attacks.