Quantum key distribution (QKD) is a secure communication method that implements a cryptographic protocol based on the laws of quantum mechanics, specifically quantum entanglement, the measurement-disturbance principle, and the no-cloning theorem. The goal of QKD is to enable two parties to produce a shared random secret key known only to them, which then can be used to encrypt and decrypt messages. This means, when QKD is correctly implemented, one would need to violate fundamental physical principles to break a quantum protocol. The QKD process should not be confused with quantum cryptography in general.
An important and unique property of QKD is the ability of the two communicating users to detect the presence of any third party trying to gain knowledge of the key. This results from a fundamental aspect of quantum mechanics: the process of measuring a quantum system in general disturbs the system. This means, a third party attempting to eavesdrop on the key must in some way measure it, thus introducing detectable anomalies, thereby revealing the presence of the eavesdropper. This unique property ensures that the distributed keys remain secure, as any attempt at interception will be immediately apparent and will invalidate the exchanged key. By using quantum superpositions or quantum entanglement and transmitting information in quantum states, a communication system can be implemented that detects eavesdropping. If the level of eavesdropping is below a certain threshold, a key can be produced that is guaranteed to be secure (i.e., the eavesdropper has no information about it). Otherwise no secure key is possible, and communication is aborted.
The security of encryption that uses quantum key distribution relies on the foundations of quantum mechanics, in contrast to traditional public key cryptography, which relies on the computational difficulty of certain mathematical functions, which although conjectured to be strong has not to date been formally proved. In contrast, QKD has provable security based on information theory, and forward secrecy.
The main drawback of quantum-key distribution is that it usually relies on having an authenticated classical channel of communication. In modern cryptography, having an authenticated classical channel means that one already has exchanged either a symmetric key of sufficient length or public keys of sufficient security level. With such information already available, in practice one can achieve authenticated and sufficiently secure communication without using QKD, such as by using the Galois/Counter Mode of the Advanced Encryption Standard. Thus QKD does the work of a stream cipher at many times the cost.
Quantum key distribution is used to produce and distribute only a key, not to transmit any message data. This key can then be used with any chosen encryption algorithm to encrypt (and decrypt) a message, which can then be transmitted over a standard communication channel. The algorithm most commonly associated with QKD is the one-time pad, as it is provably secure when used with a secret, random key. In real-world situations, it is often also used with encryption using symmetric key algorithms like the Advanced Encryption Standard algorithm.
Quantum key exchange Quantum communication involves encoding information in quantum states, or qubits, as opposed to classical communication's use of bits. Usually, photons are used for these quantum states. Quantum key distribution exploits certain properties of these quantum states to ensure its security. There are several different approaches to quantum key distribution, but they can be divided into two main categories depending on which property they exploit.
Prepare-and-measure protocols A prepare-and-measure protocol is a fundamental technique used to establish a secure cryptographic key between two parties, commonly referred to as Alice and Bob. The parties exploit two communication channels: an insecure quantum channel and an authenticated classical channel. The quantum channel transmits signal states, which an eavesdropper usually has complete control over. As such, Alice prepares quantum states according to her basis and sends them through a quantum channel to Bob, who measures them to retrieve information from the transmitted state which they use to create a shared secret key. Later, Alice and Bob reveal a small sample of their data, and verify that Bob's measurement outcomes are indeed compatible or correlated with those prepared by Alice. If the measurements are compatible, it means the quantum states were undisturbed. However, if the measurements are not compatible, this suggests the presence of an eavesdropper and, depending on the level of error, the parties may abort the protocol. It is important to emphasize that the classical channel is authenticated. This allows Alice and Bob to be sure that they are talking only to each other and are not being impersonated. As such the eavesdropper can only listen to the communication but cannot modify the messages being sent between Alice and Bob. Examples of prepare-and-measure protocols include the BB84, B92 and SARG04 protocols.
Entanglement-based protocols Entanglement-based schemes leverage the properties of quantum entangled quantum states to securely share cryptographic keys between two parties, Alice and Bob. In an entanglement-based scheme, Alice and Bob share pairs of entangled photons. This means the state of one photon is inherently linked to the state of the other, no matter the distance between them. This is known as entanglement and means that, for example, performing a measurement on one object affects the other. If an entangled pair of objects is shared between two parties, anyone intercepting either object alters the overall system, revealing the presence of the third party (and the amount of information they have gained). This property is important to ensuring security. In this scheme, a source prepares and distributes a maximally entangled quantum state where one system is sent to Alice and another to Bob. Alice measures her half of the entangled pair, randomly choosing between different measurement bases. Bob then measures his half using the same or different bases. On measurement, Alice and Bob obtain perfectly correlated outcomes which are completely random. The results of their measurements, when compared, can be used to establish a shared secret key. Examples of entanglement-based protocols include the E91, BBM92 protocols. The quantum states of two (or more) separate objects can become linked together in such a way that they must be described by a combined quantum state, not as individual objects.
These two approaches can each be further divided into three families of protocols: discrete variable, continuous variable and distributed phase reference coding. Discrete variable protocols were the first to be invented, and they remain the most widely implemented. The other two families are mainly concerned with overcoming practical limitations of experiments. The two protocols described below both use discrete variable coding.
BB84 protocol: Charles H. Bennett and Gilles Brassard (1984)
This protocol, known as BB84 after its inventors and year of publication, was originally described using photon polarization states to transmit the information. Reprinted as However, any two pairs of conjugate states can be used for the protocol, and many optical-fibre-based implementations described as BB84 use phase encoded states. The sender (traditionally referred to as Alice) and the receiver (Bob) are connected by a quantum communication channel which allows quantum states to be transmitted. In the case of photons this channel is generally either an optical fibre or simply free space. In addition they communicate via a public classical channel, for example using broadcast radio or the internet. The protocol is designed with the assumption that an eavesdropper (referred to as Eve) can interfere in any way with the quantum channel, while the classical channel needs to be authenticated.
The security of the protocol comes from encoding the information in non-orthogonal states. Quantum indeterminacy means that these states cannot in general be measured without disturbing the original state (see No-cloning theorem). BB84 uses two pairs of states, with each pair conjugate to the other pair, and the two states within a pair orthogonal to each other. Pairs of orthogonal states are referred to as a basis. The usual polarization state pairs used are either the rectilinear basis of vertical (0°) and horizontal (90°), the diagonal basis of 45° and 135° or the circular basis of left- and right-handedness. Any two of these bases are conjugate to each other, and so any two can be used in the protocol. Below the rectilinear and diagonal bases are used.
Basis 0 1
The first step in BB84 is quantum transmission. Alice creates a random bit (0 or 1) and then randomly selects one of her two bases (rectilinear or diagonal in this case) to transmit it in. She then prepares a photon polarization state depending both on the bit value and basis, as shown in the adjacent table. So for example a 0 is encoded in the rectilinear basis (+) as a vertical polarization state, and a 1 is encoded in the diagonal basis (x) as a 135° state. Alice then transmits a single photon in the state specified to Bob, using the quantum channel. This process is then repeated from the random bit stage, with Alice recording the state, basis and time of each photon sent.
According to quantum mechanics (particularly quantum indeterminacy), no possible measurement distinguishes between the 4 different polarization states, as they are not all orthogonal. The only possible measurement is between any two orthogonal states (an orthonormal basis). So, for example, measuring in the rectilinear basis gives a result of horizontal or vertical. If the photon was created as horizontal or vertical (as a rectilinear eigenstate) then this measures the correct state, but if it was created as 45° or 135° (diagonal eigenstates) then the rectilinear measurement instead returns either horizontal or vertical at random. Furthermore, after this measurement the photon is polarized in the state it was measured in (horizontal or vertical), with all information about its initial polarization lost.
As Bob does not know the basis the photons were encoded in, all he can do is to select a basis at random to measure in, either rectilinear or diagonal. He does this for each photon he receives, recording the time, measurement basis used and measurement result. After Bob has measured all the photons, he communicates with Alice over the public classical channel. Alice broadcasts the basis each photon was sent in, and Bob the basis each was measured in. They both discard photon measurements (bits) where Bob used a different basis, which is half on average, leaving half the bits as a shared key.
Alice's random bit 0 1 1 0 1 0 0 1 Alice's random sending basis Photon polarization Alice sends Bob's random measuring basis Photon polarization Bob measures PUBLIC DISCUSSION OF BASIS Shared secret key 0 1 0 1
To check for the presence of an eavesdropper, Alice and Bob now compare a predetermined subset of their remaining bit strings. If a third party (usually referred to as Eve, for "eavesdropper") has gained any information about the photons' polarization, this introduces errors in Bob's measurements. Other environmental conditions can cause errors in a similar fashion. If more than bits differ they abort the key and try again, possibly with a different quantum channel, as the security of the key cannot be guaranteed. is chosen so that if the number of bits known to Eve is less than this, privacy amplification can be used to reduce Eve's knowledge of the key to an arbitrarily small amount at the cost of reducing the length of the key.