3.1 The Origins of Security
37
piece of written paper) described by orthogonal quantum states. As the proof showed,
quantum mechanics does not prevent to build a machine which clones orthogonal
quantum states.
Considered that Eve cannot copy non-orthogonal transmitted states, at least she
would like to be able to partially distinguish them, without being noticed. However,
this is also forbidden by quantum mechanics.
Proposition 3.1 (Information gain entails disturbance [3]) In the attempt to distinguish non-orthogonal quantum states in a quantum signal, any information gain is
accompanied by a disturbance of the signal.
Proof Let |ψ and |φ be two non-orthogonal quantum states in the quantum signal
sent by Alice to Bob. Eve’s action on the signal is represented by a generic quantum
operation, which can be viewed as a unitary acting on a larger Hilbert space (c.f.
Sect. 2.5). In particular, the unitary acts on the state |ψ (or |φ) and on an ancilla
|u. We assume that Eve’s action leaves the signal states unchanged:
U (|ψ ⊗ |u) = |ψ ⊗ |v
(3.4)
U (|φ ⊗ |u) = |φ ⊗ |v
.
(3.5)
Eve would like |v and |v
to be different states, so she could partially distinguish the
corresponding signal states. However, by computing the inner product of equations
(3.4) and (3.5) we obtain that:
φ|ψ = =φ|ψv
|v,
(3.6)
implying that |v = |v
. Thus, distinguishing two non-orthogonal states implies the
disturbance of at least one of them.
The above results suggest how quantum mechanical properties can be exploited in
a key distribution scheme. Alice can encode the key bits in non-orthogonal quantum
states and send them to Bob. By checking the disturbance of the signal, the parties
can quantitatively upper bound Eve’s knowledge on the exchanged key.
3.2 The BB84 Protocol
The BB84 protocol [5], named after its inventors Bennett and Brassard, is commonly
considered to be the first ever QKD protocol, but it is also the simplest and variations
of it are investigated and implemented even today. For the protocol’s description, we
follow the references [6, 7].
Suppose Alice possesses a source of single photons, whose spectral properties are
well defined so that the only remaining degree of freedom is the photon’s polarization.
Alice and Bob align their polarizers and agree to employ two polarization bases, one
37
piece of written paper) described by orthogonal quantum states. As the proof showed,
quantum mechanics does not prevent to build a machine which clones orthogonal
quantum states.
Considered that Eve cannot copy non-orthogonal transmitted states, at least she
would like to be able to partially distinguish them, without being noticed. However,
this is also forbidden by quantum mechanics.
Proposition 3.1 (Information gain entails disturbance [3]) In the attempt to distinguish non-orthogonal quantum states in a quantum signal, any information gain is
accompanied by a disturbance of the signal.
Proof Let |ψ and |φ be two non-orthogonal quantum states in the quantum signal
sent by Alice to Bob. Eve’s action on the signal is represented by a generic quantum
operation, which can be viewed as a unitary acting on a larger Hilbert space (c.f.
Sect. 2.5). In particular, the unitary acts on the state |ψ (or |φ) and on an ancilla
|u. We assume that Eve’s action leaves the signal states unchanged:
U (|ψ ⊗ |u) = |ψ ⊗ |v
(3.4)
U (|φ ⊗ |u) = |φ ⊗ |v
.
(3.5)
Eve would like |v and |v
to be different states, so she could partially distinguish the
corresponding signal states. However, by computing the inner product of equations
(3.4) and (3.5) we obtain that:
φ|ψ = =φ|ψv
|v,
(3.6)
implying that |v = |v
. Thus, distinguishing two non-orthogonal states implies the
disturbance of at least one of them.
The above results suggest how quantum mechanical properties can be exploited in
a key distribution scheme. Alice can encode the key bits in non-orthogonal quantum
states and send them to Bob. By checking the disturbance of the signal, the parties
can quantitatively upper bound Eve’s knowledge on the exchanged key.
3.2 The BB84 Protocol
The BB84 protocol [5], named after its inventors Bennett and Brassard, is commonly
considered to be the first ever QKD protocol, but it is also the simplest and variations
of it are investigated and implemented even today. For the protocol’s description, we
follow the references [6, 7].
Suppose Alice possesses a source of single photons, whose spectral properties are
well defined so that the only remaining degree of freedom is the photon’s polarization.
Alice and Bob align their polarizers and agree to employ two polarization bases, one