I would like to compare the security of these two QKD protocols which both use entangled photons that are distributed between the users Alice and Bob. In the case of E91, the photon is measured randomly in 3 different bases which allows to violate a Bell inequality.

In BBM92, only measurements in two mutually unbiased bases are performed. This allows not to violate a CHSH inequality (S=2).

Does the violation of the Bell inequality lead to a higher security and therefore smaller assumptions needed to trust the source?

Can you give me a toy-model example that the source can use to deceive in the case of BBM92 but does not work in the case of E91?

  • 3
    $\begingroup$ I see you don't have an account at Quantum Computing. Although your question is fully on topic here, you may want to migrate it there - especially if you don't get an answer here. Please do not cross post though, post on either one of the sites and delete the question on the other site. $\endgroup$
    – Maarten Bodewes
    Sep 24, 2018 at 14:11

1 Answer 1


The answer is both yes and no, as I explain below.

1. No, BBM92 is better (or at least, we initially thought so)

E91 was the initial idea which led to the more rigorous BBM92. In the E91 paper, there is not actual security proof, ant the attack is not really specified: if the CHSH inequality is violated by only a few percents (say $S=2.05$), how many secret bits can Alice and Bob still share? With the techniques known in the early 1990’s there were no way to answer this kind of question. BBM92 was essentially a way to replace the Bell inequality with a more tractable entanglement witness, and to transfer the security proofs of BB84 to entangled state protocols. So in term of security, and practicality, BBM92 is much better than the E91 which is badly specified. And in practice, when a physicist says “E91”, he often actually means “BBM92”...

2. Yes E91 turns out to be better (because it is device independent)

To my knowledge, the first QKD paper actually using Bell inequality violation as an actual security parameter for QKD is the Barett, Hardy Kent paper of 2004 (arXiv/PRL). This was initially seen as a way to to perform QKD even if one does not trust quantum mechanics. This kind of protocols has now expanded to the domain of device-independent quantum cryptography, when one does not need to trust your devices to perform QKD. In this sense, variants of E91 can indeed be safer than BBM92.

Artur Ekert actually said of the latter development that it was “a very good example of when your ideas are more clever than yourself”.

  • $\begingroup$ Thanks a lot for your answer! Can you explain a little bit more by what you mean by "device independence"? I think so far there has been no demonstration of an actual device-independent QKD implementation, and it probably is not relevant for the near future since the losses of any long-distance experiment will prevent from closing the fair-sampling loophole. But is a bell violation that does not close all known loopholes still an extra security benefit? $\endgroup$
    – Mechanix
    Sep 25, 2018 at 19:12
  • $\begingroup$ how much trust has to be placed into the source in both cases? Does a Bell violation (without closing all known loopholes) imply that i don't have to trust the source? $\endgroup$
    – Mechanix
    Sep 25, 2018 at 19:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.