Concepts

The Concise Oxford English Dictionary defines cryptography as “the art of writing or solving codes.” This is historically accurate, but it does not capture the current breadth of the field or its present-day scientific foundations. Cryptography is an essential part of everyday life, and its importance grows with each passing day — whether it is an online bank transaction, a chat on social media, or anything else online, we want our data secure from malicious activity. Even a nation’s security depends on the security of strategic information. Modern cryptography can be defined as the “study of mathematical techniques for securing digital information, systems, and distributed computations against adversarial attacks.” These schemes keep us secure in today’s digital life — but we are at the brink of change!

Modern cryptography can be broadly classified into two forms — private-key and public-key cryptography. In the former, the same key is used for encryption (locking) and decryption (unlocking) of a message, so the sender and receiver must hold the same key. In the latter, as the name suggests, the sender encrypts the message with a public key while the receiver decrypts it with a private (secret) key. Thus, in a public-key scheme, anyone can send an encrypted message, but only the intended recipient can decrypt it.

While modern cryptographic schemes serve us well, they have drawbacks. The security of private-key cryptography depends on the length of the key — the larger the key space, the more secure the scheme. With increasing computational power of classical computers, and the anticipated application of more efficient quantum search algorithms (e.g. Grover’s algorithm), the resource-oriented problem of secure key distribution has come to the fore. The security of public-key cryptography, on the other hand, depends on the complexity of the mathematical problems it is based on, making it vulnerable to efficient algorithms — for example, Shor’s algorithm can factorise in polynomial time, which makes the RSA cryptosystem vulnerable. With the impending dawn of quantum computation, public-key schemes may soon cease to be unbreakable. Private-key cryptosystems with longer keys can be the solution — if the key-distribution scheme can be made secure and efficient, which is where QKD comes into play.

Quantum key distribution is a cryptographic technique that allows two remote users to establish a secure key (a random bit string) between them, using the principles of quantum mechanics, which can then be used for secure communication. Stephen Wiesner first proposed the idea of quantum cryptography in his paper “Conjugate Coding” (1970). In 1984, Charles Bennett and Gilles Brassard put forward the first quantum cryptography protocol, BB84, which uses the polarisation states of a photon to generate a secure bit string between two users. In 1991, Artur Ekert invented the E91 protocol, the first to use quantum entanglement for QKD, followed by the BBM92 protocol. The most important advantage of QKD is that, in principle, the users can detect the presence of an eavesdropper trying to gain information from the transmission. If the eavesdropping level is below a certain threshold, a key can be established that is guaranteed to be secure. The key features of quantum mechanics used are:

• Heisenberg’s uncertainty principle, which puts a fundamental limit on the knowledge an observer can have of a quantum system.
• No-cloning theorem, which states that an arbitrary quantum state cannot be copied to generate replicas.
• Quantum entanglement, which creates a non-classical correlation between two quantum entities.

We can gain further insight into these features in the context of a QKD protocol.

Alice and Bob are the users of a QKD protocol who want to generate a secure key between them for secret communication. They are assumed to work in impenetrable labs and to have full control over their devices. Both have random number generators, and they share an authenticated quantum channel (to send and receive quantum states) and an authenticated classical channel (for any communication the protocol requires).

Eve is the malicious party who wants to eavesdrop and gain information. Eve knows the protocol being used, except for any random numbers it asks Alice and Bob to produce. Eve is, in other words, all-powerful — she has a quantum computer with arbitrary quantum memory, and she sees a perfect quantum channel, so any noise in the channel can be attributed to her. Thus any error in the generated key string is assumed to be caused by the eavesdropper.

The BB84 protocol uses the polarisation state of photons to encode key bits. A pair of orthonormal polarisation bases is required because, according to Heisenberg’s principle, if the polarisation state is defined in one basis it is undefined in the other. The protocol uses four such polarisation states, and the no-cloning theorem ensures that a malicious eavesdropper cannot copy the transmitted quantum states — so any disturbance created by Eve can be detected by Alice and Bob.

Alice randomly prepares photons in one of four polarisation states — horizontal (H) and vertical (V) in the rectilinear basis, and diagonal (+) and anti-diagonal (−) in the diagonal basis — and sends them to Bob over the quantum channel. The ‘H’ and ‘+’ states correspond to binary “0”, while ‘V’ and ‘−’ correspond to binary “1”; Alice and Bob must agree on this convention beforehand. Bob randomly selects a basis (rectilinear R or diagonal D) and measures the polarisation of each incoming photon. After transmission of the desired number of states, Alice and Bob publicly discuss the preparation and measurement bases chosen for each state and keep only the bits where their bases matched. This process is called sifting, and with no eavesdropping it yields an identical bit string (the sifted key) shared by the two users. Any eavesdropping produces errors in the sifted key, which can be detected. Alice and Bob publicly announce part of the sifted key and compute the error — the quantum bit error rate (QBER). If it is below a certain threshold (25% for BB84) the key is considered secure; otherwise the protocol is aborted. The table below captures this concept.