0
$\begingroup$

In Quantum Key distribution, it is my understanding that when Eve tries to intercept photons being sent from Alice to Bob, she has a 50% chance of using the correct polarization filter, and so 50% chance of getting the correct bit information. Let's just say hypothetically that she somehow gets all the photons she intercepted using the correct filter (and hence correct bit information), and re emits them so that they're all exactly the same photons as Alice had intended them to be.

Doesn't this mean that during the error reconciliation between Alice and Bob, they'll detect no errors and hence conclude that the distribution of the key was secure, but in reality, Eve has perfect information about the "secret" key? Doesn't this violate the proof that QKD is "provably secure"?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
2
$\begingroup$

You are right and you are wrong. Indeed, in the scenario that you describe Eve would perfectly break the system (in a certain way). She would learn information about the secret key without being caught. Note, however, that this only has any chance of success for a small amount of bits. The chance of success when measuring $x$ qubits is $2^{-x}$ (in this idealized setting ignoring all the implementation attacks). That's why you cannot use the the plain exchanged bit string. Instead, you have to use privacy amplification. There are different methods for this. The main idea is that you use some function to turn a long bit string of which Eve possibly knows some bits into a short bit string about which Eve has no information as long as she did not know a lot of the input bits. Choosing parameters right, you can that way ensure that as long as Eve does not learn more than e.g. $128$ bits of the original bit string the output string (used as secret key later) has e.g. $128$ bits of entropy.

Improve this answer
$\endgroup$
10
  • $\begingroup$ Just to make sure I comprehended your answer correctly: 1. When you say that you cannot use the plain exchanged bit string, are you saying that the qubits which Alice sent to Bob cannot be used as the key? And that instead, we convert what Alice sent into another bit string, which is then used as the secret key? If this is what you meant, could you please redirect me to where I could learn more about this? $\endgroup$
    – lal lal
    Sep 5, 2017 at 9:21
  • $\begingroup$ 2. Also, I don't really follow your argument because I am not sure why we can keep saying things like "as long as Eve does not learn more than e.g. 128 bits of the original bit string" when we assumed in my question the hypothetical situation of Eve learning correctly about every single photon which Alice sent to Bob. Could you clarify this a bit further? $\endgroup$
    – lal lal
    Sep 5, 2017 at 9:25
  • 1
    $\begingroup$ Well, you can use the plain exchanged string but your security guarantees are significantly weakened (again just in the idealized model we are talking about, without considering implementation attacks). $\endgroup$
    – mephisto
    Sep 5, 2017 at 9:25
  • $\begingroup$ 2. An event that occurs with probability $2^{-128}$ can safely be assumed to never happen. It is like correctly guessing the right atom out of all atoms in the universe after someone marked a random one (just to give you a dimension). $\endgroup$
    – mephisto
    Sep 5, 2017 at 9:28
  • $\begingroup$ But these are just example numbers. However, if you assume that this overwhelmingly unlikely event occurs, then Eve obviously still broke the system. No way to prevent that. $\endgroup$
    – mephisto
    Sep 5, 2017 at 9:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.