Ekert protocol
Entanglement in quantum systems, even when spatially separated, provides a unique resource for quantum communication. This phenomenon enables a new approach to securely distribute cryptographic keys.
The BB84 protocol (which I explained here) leverages the quantum properties of single photons to establish a fully secure key exchange.
The Ekert protocol utilizes pairs of entangled photons to simultaneously generate two identical keys which are preventing the creation of any third copy. As previously discussed here, the one-time pad cryptography method, proven to be absolutely secure.
Absolute security is guaranteed provided the message length does not exceed the key length, precluding code-breaking attempts based on statistical regularities. Consequently, after transmitting a cumulative message length equivalent to the key length, Alice and Bob must establish a new key.
In 1992, Artur Ekert introduced a protocol leveraging polarization-entangled photon pairs to simultaneously generate identical binary sequences at two remote locations. Building upon the principles of quantum measurement, it consider that for each polarizer, outcomes of +1 and -1 occur randomly with equal probability. However, when polarizers are aligned in the same direction, a perfect correlation emerges between the measurement results.
The polarization state of the photon pair is described by the entangled state:
| \boldsymbol \Psi \left( \nu_1, \nu_2 \right) \rangle = \frac{1}{\sqrt{2}} \left(| \mathbf x_1, \mathbf x_2\rangle + |\mathbf y_1, \mathbf y_2\rangle\right)
This correlation in the quantum measurement process produces identical random binary sequences at each location (we can simply consider 0 \equiv -1 to align with the standard cryptographic convention of 0 and 1). These correlated sequences can then serve as identical cryptographic keys for encoding and decoding information.
The Ekert protocol has inherent resistance to eavesdropping. Given the principles of quantum measurement and the projection postulate, the value of each bit in the key is determined only upon measurement of the photons.
Prior to measurement, the key, in essence, does not yet exist in a definite state, leaving no information to intercept in transit. Cryptographic security necessitates considering potential eavesdropping strategies and ensure that they are impossible.
Consider a scenario where an adversary, Eve, knows Bob’s polarizer direction, denoted as \mathbf b. Eve might attempt to intercept the photons en route to Bob and insert a polarizer oriented along \mathbf b. By measuring the photons and observing the outcomes (+1 or -1), Eve could then forward a photon polarized either along \mathbf b or perpendicular to \mathbf b, depending on the measurement result.
In this scenario, Eve effectively performs the initial measurement, collapsing the entangled state, potentially leading both Alice and Bob to obtain measurement results correlated with Eve’s. Superficially, this might suggest Eve can create a third copy of the key.
To counter similar interception attempts, a quantum property of single photons, also employed in the BB84 protocol, can be utilized: the polarization state of a photon cannot be determined without prior knowledge of the orthogonal axes along which polarization is expected.
Alice and Bob will then randomly select their polarizer orientations from a set of directions with relative angles of zero, \pi/8, or 3\pi/8, or other suitable orientations.
After completing a sequence of measurements, Alice and Bob communicate publicly to identify instances where their polarizer angles were zero, and instances where they were \pi/8, \pi/4 or 3\pi/8:
(\mathbf a, \mathbf b) \in \left\{0, \frac{\pi}{8}, \frac{\pi}{4}, \frac{3\pi}{8} \right\}
The data obtained when the angle difference was zero is used to generate identical cryptographic keys. The data from \pi/8 and 3\pi/8 angle differences allows Alice and Bob to verify that the observed correlations match those predicted for entangled pairs at the known polarizer angles:
\mathcal C(\mathbf a, \mathbf b) = \cos(2(\mathbf a, \mathbf b))
Then:
\begin{aligned} \mathcal C(\mathbf a, \mathbf b) & = \cos\left[2 \left(\frac{\pi}{8}, \frac{\pi}{8}\right)\right] = \cos\left[2 \left(\frac{3\pi}{8}, \frac{3\pi}{8}\right)\right] = 1 \\ & = \cos\left[2 \left(\frac{\pi}{8}, \frac{3\pi}{8}\right)\right] = \cos\left[2 \left(\frac{3\pi}{8}, \frac{\pi}{8}\right)\right] = 0 \end{aligned}
If an eavesdropper attempts to measure the photons along a direction different from Bob’s intended direction, the resulting correlations will deviate from the expected correlations. These deviations signal the presence of an eavesdropper, prompting Alice and Bob to discard the generated key and recognize a security breach.
It is important to note that the security of the Ekert protocol is not dependent on the precise correlations predicted by quantum mechanics; it relies on a more general approach, independent of specific correlation models, as it is just verifying Bell’s inequality:
\left| \mathcal C(\mathbf a, \mathbf b) - \mathcal C(\mathbf a, \mathbf b^\prime) + \mathcal C(\mathbf a^\prime, \mathbf b) + \mathcal C(\mathbf a^\prime, \mathbf b^\prime) \right| \le 2
With the above choice of angles, the correlation was already calculated here:
\left| \mathcal C(\mathbf a, \mathbf b) - \mathcal C(\mathbf a, \mathbf b^\prime) + \mathcal C(\mathbf a^\prime, \mathbf b) + \mathcal C(\mathbf a^\prime, \mathbf b^\prime) \right| = 2\sqrt{2} > 2
Observing a violation of Bell’s inequality is sufficient to establish that the observed correlations are genuinely quantum and cannot be explained by any classical eavesdropping strategy. This violation serves as an indicator of the security of the quantum channel, confirming the absence of eavesdropping.
The underlying reason lies in the effect of eavesdropping on the quantum state. In the Ekert protocol, the key is not determined until Alice and Bob perform their measurements.
However, if an eavesdropper, Eve, intercepts and measures the photons before Alice and Bob, Eve forces the entangled state to collapse into a factorized state. In this factorized state, each photon has a definite polarization. Consequently, the correlations observed by Bob, after Eve’s intervention, will obey Bell’s inequalities.
This is because Eve’s measurement effectively transforms the quantum correlations into a form that is describable by local hidden variable theories, which are the theories constrained by Bell’s inequalities. Mathematically, the correlations in the presence of an eavesdropper become analogous to a convex sum of products of terms associated with each polarizer, which is the general form for local hidden variable models.
Therefore, if Eve is present, Alice and Bob’s measurements will yield a value for Bell’s parameter that does not violate Bell’s inequalities. On the other hand, if Alice and Bob observe correlations that do violate Bell’s inequalities, they can be certain that the correlations are genuinely quantum and cannot be explained by any local hidden variable model, which includes eavesdropping strategies that force the system into a local hidden variable-like state.
This is why violating Bell’s inequality serves as an unconditional security test; it doesn’t rely on specific predicted correlations but rather on the fundamental distinction between quantum and classical correlations.
Regarding the angle chosen, they are known to lead to a strong violation of Bell’s inequality for entangled states. However, any set of orientations \mathbf a, \mathbf a^\prime, \mathbf b, \mathbf b^\prime that leads to a violation of Bell’s inequality is sufficient to guarantee the absence of an eavesdropper and thus the security of the key.
Proof
Let’s demonstrate that Eve’s measurement effectively transforms the quantum correlations into a form that is describable by local hidden variable theories, which are the theories constrained by Bell’s inequalities.
We start from a polarization state of the photon pair which is described by the entangled state:
| \boldsymbol \Psi \left( \nu_1, \nu_2 \right) \rangle = \frac{1}{\sqrt{2}} \left(| \mathbf x_1, \mathbf x_2\rangle + |\mathbf y_1, \mathbf y_2\rangle\right)
where, for the standard basis (horizontal/vertical), we can write:
|\mathbf x\rangle = \begin{bmatrix} 1 \\ 0 \end{bmatrix}, \quad |\mathbf y\rangle = \begin{bmatrix} 0 \\ 1 \end{bmatrix}
We let the eavesdropper Eve to measure each incoming photon in a polarization basis \{|\mathbf d \rangle, |\mathbf d_\perp \rangle\} at angle \theta, with measurement result e \in \{ + 1, -1 \}:
|\mathbf d\rangle = \begin{bmatrix} \cos(\theta) \\ \sin(\theta) \end{bmatrix}, \quad |\mathbf d_\perp\rangle = \begin{bmatrix} -\sin(\theta) \\ \cos(\theta) \end{bmatrix}
The measurement operators are:
\begin{aligned} & |\mathbf d\rangle\langle\mathbf d| = \begin{bmatrix} \cos^2(\theta) & \cos(\theta)\sin(\theta) \\ \cos(\theta)\sin(\theta) & \sin^2(\theta) \end{bmatrix} \\ & |\mathbf d_\perp\rangle\langle\mathbf d_\perp| = \begin{bmatrix} \sin^2(\theta) & -\cos(\theta)\sin(\theta) \\ -\cos(\theta)\sin(\theta) & \cos^2(\theta) \end{bmatrix} \end{aligned}
The measurement operator observable is:
\boldsymbol \sigma(\mathbf d) = |\mathbf d\rangle\langle\mathbf d| - |\mathbf d_\perp\rangle\langle\mathbf d_\perp| = \begin{bmatrix} \cos(2\theta) & \sin(2\theta) \\ \sin(2\theta) & -\cos(2\theta) \end{bmatrix}
We denote the result by \lambda = (e_1,e_2) for the photon pair. After Eve’s measurement, the overall state becomes:
\rho = \int \mathrm d\lambda \,\rho(\lambda)\, |\boldsymbol \lambda\rangle \langle \boldsymbol \lambda|
and \rho(\lambda) is the classical probability that Eve’s outcome is \lambda.
After Eve’s measurement, the state for Alice-Bob becomes:
\rho_{AB} = \mathrm{Tr}_E(\rho) = \sum_{\lambda} \rho(\lambda)\,|\boldsymbol\lambda\rangle_{AB}\langle \boldsymbol\lambda|
where |\boldsymbol\lambda\rangle_{AB} is the post-measurement state of Alice and Bob when Eve obtains outcome \lambda with probability \rho(\lambda).
The index \lambda then plays the role of a hidden variable: Alice-Bob correlations are given by deterministic functions A(\mathbf a,\lambda) and B(\mathbf b,\lambda) which completing the local hidden variable description.
For any local measurement directions \mathbf a and \mathbf b, we define:
A(\mathbf a,\lambda) = \pm 1,\quad B(\mathbf b,\lambda) = \pm 1
by assigning deterministic \pm 1 outcomes to each eigenstate | \mathbf e_i\rangle for the measurement along \mathbf a or \mathbf b. As a consequence, Alice-Bob correlation is:
\mathcal C(\mathbf a,\mathbf b) = \mathrm{Tr}\left(\rho \boldsymbol \sigma(\mathbf a)\otimes \boldsymbol \sigma(\mathbf b)\right) = \int \mathrm d\lambda \,\rho(\lambda)\,A(\mathbf a,\lambda)\,B(\mathbf b,\lambda)
which is the local hidden variable form. We already calculated here that the quantity:
\begin{aligned} | S | = & | A(\lambda, \mathbf a) B(\lambda, \mathbf b) - A(\lambda, \mathbf a) B(\lambda, \mathbf b^\prime) \\ & + A(\lambda, \mathbf a^\prime) B(\lambda, \mathbf b) + A(\lambda, \mathbf a^\prime) B(\lambda, \mathbf b^\prime)| \le 2 \end{aligned}
Therefore this quantity satisfies systematically Bell’s inequalities, which is what we wanted to prove.