1: %% $Date: 2007/08/26 03:14:07 $
2: %% $Revision: 1.2 $
3: \documentclass[aps,pra,preprint,showpacs,amsmath,amssymb]{revtex4}
4: \usepackage{graphicx}
5: \usepackage{bm}% bold math
6: \begin{document}
7:
8: \title{Quantum key distribution using quantum Faraday rotators}
9:
10: \author{Taeseung Choi}
11: \affiliation{Department of Physics, Korea University, Seoul 136-713,
12: Korea}
13: \author{Mahn-Soo Choi}
14: \email{choims@korea.ac.kr}
15: \affiliation{Department of Physics, Korea University, Seoul 136-713,
16: Korea}
17: \date{\today}
18:
19: \begin{abstract}
20: We propose a new quantum key distribution (QKD) protocol based on the
21: fully quantum mechanical states of the Faraday rotators.
22: %%
23: The protocol is unconditionally secure against collective attacks for
24: multi-photon source up to two photons on a noisy environment. It is
25: also robust against impersonation attacks.
26: %%
27: The protocol may be implemented experimentally with the current
28: spintronics technology on semiconductors.
29: \end{abstract}
30: \pacs{03.67.Dd, 03.65.Nk}
31: \maketitle
32:
33: %%%%
34: \newcommand\ket[1]{\left|{\textstyle#1}\right\rangle}
35: \newcommand\bra[1]{\left\langle{\textstyle#1}\right|}
36: \newcommand\braket[1]{\left\langle{\textstyle#1}\right\rangle}
37:
38: \section{Introduction}
39: \label{sec:introduction}
40:
41: The computational algorithm powered by quantum mechanics, on the one
42: hand, has posed a serious threat to the classical
43: cryptosystem\cite{Shor94a}.
44: %%
45: On the other hand, quantum cryptography allows for secure sharing of
46: private keys. Ever since the pioneering works by Bennet, Brassard, and
47: Ekert\cite{Bennett84a,Ekert91a,Bennett92c}, a great number of new
48: quantum key distribution (QKD) protocols have been proposed to enhance
49: the security and efficiency under non-idealistic situations and
50: to incorporate new ideas\cite{Gisin02a}.
51: %%
52: In particular, Bostr\"om and Felbinger\cite{Bostrom02a} recently
53: proposed the so-called \emph{ping-pong protocol}. The protocol is
54: interesting in that it enables direct communication deterministically
55: and without classical communications (except for checking
56: eavesdropping). Although the original protocol turned out to be
57: insecure in the case of lossy channels\cite{Wojcik03a} and against blind
58: attacks without eavesdropping\cite{Cai03a}, the idea still survives in a
59: recent modified version\cite{Lucamarini05a}.
60:
61: In the ping-pong protocol\cite{Bostrom02a,Lucamarini05a}, Bob sends a
62: qubit to Alice, Alice performs a unitary operation on it with a random
63: probability $p$ and send it back to Bob, and finally Bob make a
64: measurement on it. The unitary operation by Alice (if ever performed)
65: transforms the initial state of the qubit to a state orthogonal to the
66: initial state. This enables Bob to read Alice's massage directly.
67: Putting another way, the unitary operation is performed conditioned on
68: the \emph{classical} information ($0$ or $1$) that Alice wants to send
69: to Bob.
70: %%
71: A conceptually interesting question would be, ``What if we perform the
72: unitary operation conditioned on the \emph{quantum state} of another
73: qubit?'' In this work, we propose a new QKD protocol implementing this
74: idea and address the security issues of it. The protocol is explained
75: in Section~\ref{sec:protocol}. We will show in
76: Sections~\ref{sec:securityProof} and \ref{sec:impersonation} that the
77: protocol is secure against eavesdropping for ideal single-photon source
78: and robust against impersonation attacks. The protocol turns out to be
79: insecure when the photon source produces more
80: than two photons; this will be analyzed in Section~\ref{sec:PNS}. We
81: will discuss in Section~\ref{sec:experiment} possible experimental
82: realizations of the protocol using semiconductor spintronics.
83:
84: \begin{figure}
85: \centering
86: \includegraphics*[width=3cm]{fig-1a}
87: \includegraphics*[width=5cm]{fig-1b}
88: \caption{(color on-line) (a) Poincar\'e sphere for photon polarization or
89: Bloch sphere for spin. (b) Quantum Faraday rotation (QFR) or
90: conditional rotation $U_{A;C}$ on $C$ conditioned by $A$; see
91: Eq.~(\ref{paper::eq:3}). It rotates the state of qubit $C$ around
92: $z$-axis by angle $\pm\pi/2$ depending on the state of qubit $A$.}
93: \label{fig:1}
94: \end{figure}
95:
96: \begin{figure}
97: \centering
98: \includegraphics*{fig-2}
99: \caption{(color on-line) Quantum key distribution protocol using quantum
100: Faraday rotators.}
101: \label{fig:2}
102: \end{figure}
103:
104: \section{Protocol}
105: \label{sec:protocol}
106: While the protocol is independent of the physical system in use, we will
107: have in mind the photon polarizations as travel qubits and electron
108: spins as home qubits. In the description of the protocol, we will use
109: as the basis the eigenstates of $\sigma^z$, $\ket{\uparrow}$ (right-handed
110: circular polarization) and
111: $\ket{\downarrow}$ (left-handed circular polarization).
112: We denote by $\ket{\phi}$ the state along the azimuthal angle $\phi$ on the
113: equator of the Poincar\'e (or Bloch) sphere:
114: \begin{equation}
115: \label{paper::eq:2}
116: \ket\phi = \frac{\ket\uparrow + e^{+i\phi}\ket\downarrow}{\sqrt{2}} \,.
117: \end{equation}
118: %%
119: The key element of our protocol will be the \emph{quantum Faraday
120: rotation} (QFR), namely, the Faraday rotation by angle $\pi/2$ around
121: $z$-axis of the Poincar\'e sphere
122: \begin{equation}
123: \label{paper::eq:3}
124: U_{A;C}=\exp\left[-i(\pi/4)\sigma_A^z\sigma_C^z\right]
125: \end{equation}
126: on the travel qubit $C$ \emph{conditioned by} the home qubit $A$.
127: %%
128: For example, operating on the product state $\ket{\phi=0}_A\ket{\phi}_C$,
129: it gives
130: \begin{equation}
131: \label{paper::eq:1}
132: U_{A;C}\ket{0}_A\ket{\phi}_C =
133: \frac{e^{-i\pi/4}\ket\uparrow_A\ket{\phi_+}_C
134: + e^{+i\pi/4}\ket\downarrow_A\ket{\phi_-}_C}{\sqrt{2}},
135: \end{equation}
136: where $\ket{\phi_\pm}=\ket{\phi\pm\pi/2}$.
137: %%
138: In the quantum information theoretic terms, the QFR in
139: Eq.~(\ref{paper::eq:3}) corresponds to the \emph{conditional phase
140: shift}. Possible physical realizations of QFR will be discussed
141: later.
142:
143: The protocol is as following. (1) To start the $n$th iteration of the
144: protocol, Alice and Bob first prepare their home qubits $A$ and $B$,
145: respectively, in the state $\ket{\phi=0}$\cite{endnote:1}. (2) Alice
146: then takes a travel qubit $C$ and prepares it in the state $\ket\alpha$.
147: The angle $\alpha$ should be chosen randomly in the interval
148: $0\leq\alpha<2\pi$. (3) Alice performs (by interacting $A$ and $C$) the
149: QFR $U_{A;C}$ on $C$ and send it to Bob. We note that on its way to
150: Bob, the travel qubit $C$ is maximally entangled with $A$:
151: \begin{equation}
152: \label{paper::eq:5}
153: e^{-i\pi/4}\ket\uparrow_A\ket{\alpha_+}_C
154: + e^{+i\pi/4}\ket\downarrow_A\ket{\alpha_-}_C
155: \end{equation}
156: (not normalized). (4) Bob receives $C$, performs $U_{B;C}$ on it, and
157: send it back to Alice. The qubit $C$ is again maximally entangled on
158: its way back to Alice, now with both $A$ and $B$ :
159: \begin{equation}
160: \label{paper::eq:4}
161: \left(\ket{\uparrow\downarrow}+\ket{\downarrow\uparrow}\right)_{AB}
162: \ket{\alpha}_C
163: -i\left(\ket{\uparrow\uparrow}-\ket{\downarrow\downarrow}\right)_{AB}
164: \ket{\bar\alpha}_C
165: \end{equation}
166: (not normalized), where $\ket{\bar\alpha}\equiv\ket{\alpha+\pi}$. (5)
167: Now Bob takes his own travel qubit $D$ and prepares it in the state
168: $\ket\beta$. The angle $\beta$ should be chosen randomly in the
169: interval $0\leq\beta<2\pi$. (6) Bob performs the QFR $U_{B;D}$ on $D$
170: and send it to Alice. (7) Alice receives $D$, performs $U_{A;D}$ on it,
171: and send it back to Bob. The final state of all the qubits $A$, $B$,
172: $C$, and $D$ is given by a GHZ-like state
173: \begin{equation}
174: \label{paper::eq:6}
175: \left(\ket{\uparrow\downarrow}+\ket{\downarrow\uparrow}\right)_{AB}\ket{\alpha\beta}_{CD}
176: -\left(\ket{\uparrow\uparrow}+\ket{\downarrow\downarrow}\right)_{AB}\ket{\bar\alpha\bar\beta}_{CD}
177: \end{equation}
178: (8) Alice measures the observable
179: $S_\alpha=\cos\alpha\sigma^x+\sin\alpha\sigma^y$ on $C$. Likewise, Bob
180: measures the observable $S_\beta=\cos\beta\sigma^x+\sin\beta\sigma^y$ on
181: $D$. They will get (in the ideal case) the identical result $+1$ or
182: $-1$, which enables Alice and Bob to share the the key $K_{2n-1}=1$ or
183: $0$. (9) If $K_{2n-1}=1$, Bob performs $\sigma^x$ (the NOT gate), on
184: his home qubit $B$. (10) Alice and Bob measures $\sigma^z$ on their
185: home qubits $A$ and $B$, respectively. Depending on the measurement
186: result, another bit of key $K_{2n}=0$ ($\sigma^x=+1$) or $1$
187: ($\sigma^x=-1$) is generated. (11) Repeat the steps 1 through 10 with
188: $n$ increased by $1$ until $n$ becomes $N$. (12) Alice and Bob takes
189: randomly $M$ bits out of $\{K_{2k-1}|k=1,\cdots,N\}$, and test possible
190: eavesdropping (or any other attack) by comparing the values through a
191: classical communication channel.
192:
193: A few remarks on the procedure are in order.
194: Alice can measure $S_\alpha$ (see Step 8 above) even before the Step 5.
195: It follows from the GHZ-like structure of the states in
196: Eqs.~(\ref{paper::eq:4}) and (\ref{paper::eq:6}). Step 9 is not
197: essential. It can be removed with a minor change in Step 10.
198:
199: Before analyzing the security of the protocol, we point out a few
200: interesting features of the protocol. First, the travel qubit is always
201: in a maximally entangled states with the home qubit(s) whenever exposed
202: to eavesdropping. This is the essential feature of the protocol that
203: provides the protocol with the security. Second, at the key sharing
204: stage no classical communication is necessary. The key is shared only
205: through the quantum channel\cite{endnote:2}. This is also closely
206: related to the security of the protocol. Third, two bits are generated
207: out of one iteration and they have the common security fate. If the
208: first bit has been tampered by eavesdropping or noise in the channel,
209: the security of the second bit is not guaranteed either.
210:
211:
212: \begin{figure}
213: \centering
214: \includegraphics*{fig-3}
215: \caption{(color on-line) General attack on a noisy environment.}
216: \label{fig:3}
217: \end{figure}
218:
219: \section{Security Proof}
220: \label{sec:securityProof}
221: Let us analyze general attacks from a third party in case the photon
222: source generates single photon. We closely follow the lines in
223: Ref.\cite{Lucamarini05a}. As usual, Eve is assumed to be an almighty
224: eavesdropper limited only by the law of physics. The most general
225: (assuming that Eve does not know Alice's choice of basis) operation
226: $\hat{\cal E}_1$ Eve can do on the travel qubit $C$ can be written as
227: \begin{equation}
228: \label{Eq:generalAttack}
229: \hat{\cal E}_1 \ket{\gamma}_C \ket{\epsilon}_E
230: = e \ket{\gamma}_C \ket{\epsilon_{00}}_E+
231: f \ket{\bar\gamma}_C \ket{\epsilon_{01}}_E,
232: \end{equation}
233: and
234: \begin{equation}
235: \label{qkd::eq:1}
236: \hat{\cal E}_1 \ket{\bar\gamma}_C \ket{\epsilon}_E =
237: e \ket{\bar\gamma}_C \ket{\epsilon_{11}}_E + f \ket{\gamma}_C
238: \ket{\epsilon_{10}}_E,
239: \end{equation}
240: where the states $\ket{\epsilon_{00}}$, $\ket{\epsilon_{01}}$,
241: $\ket{\epsilon_{11}}$, and $\ket{\epsilon_{10}}$ of the ancilla $E$ are
242: normalized, but not orthogonal to each other.
243: %%
244: Without loss of generality, we can set
245: \begin{math}
246: \braket{\epsilon_{00}|\epsilon_{01}} =
247: \braket{\epsilon_{00}|\epsilon_{10}} =
248: \braket{\epsilon_{10}|\epsilon_{11}} =
249: \braket{\epsilon_{01}|\epsilon_{11}} = 0
250: \end{math},
251: from the unitarity of $\mathcal{E}_1$\cite{Lucamarini05a}.
252:
253: The basis $\{\ket{\gamma},\ket{\bar\gamma}\}$ for $C$ is an arbitrary
254: choice made by Eve. Recall that the angle $\alpha$ has been chosen
255: randomly for each travel qubit $C$ and is never announced to the public;
256: this is one of the biggest differences of our protocol both from the
257: BB84-type and ping-pong-type protocols.
258:
259: % We denote angles between nonorthogonal states as
260: % $\braket{\epsilon_{00}|\epsilon_{11}} = \cos{x}$ andc
261: % $\braket{\epsilon_{01}|\epsilon_{10}}=\cos{y}$ with $|x|,|y|\leq \pi/2$
262: % (these Hermitian products can be put real positive without loss of
263: % generality).
264: When
265: \begin{math}
266: \braket{\epsilon_{00}|\epsilon_{11}} =
267: \braket{\epsilon_{01}|\epsilon_{10}} = 1
268: \end{math}, Eve cannot distinguish between $\ket{\gamma}_C$ and
269: $\ket{\bar\gamma}_C$ by any measurement on her ancillae. In this case,
270: Eve can acquire no more information than no attack is performed.
271: Therefore, a minimal requirement for Eve's strategy is that such an
272: operation as gives no information at all to her should not be detected
273: by the legitimate partners (Alice and Bob).
274: %%
275: This can be achieved if Eve does not disturb travel qubits. It gives
276: the condition, $|e|=1$ and $|f|=0$.
277: %%
278: In passing, we note that $\braket{\epsilon_{00}|\epsilon_{11}}=0$
279: corresponds to an intercept-and-resend attack.
280:
281: Having this ($|e|=1$ and $|f|=0$) in mind, we rewrite the attack operation
282: on the travel qubit as
283: \begin{multline}
284: \label{Eq:AttackTravel}
285: \hat{\cal E}_1 \ket{\alpha_+}_C
286: = \ket{\alpha_+}_C
287: \left(\cos^2{\frac{\tilde{\alpha}}{2}} \ket{\epsilon_{00}}
288: + \sin^2{\frac{\tilde{\alpha}}{2}} \ket{\epsilon_{11}}\right) \\\mbox{}
289: + i \sin{\frac{\tilde{\alpha}}{2}}
290: \cos{\frac{\tilde{\alpha}}{2}}\ket{\alpha_-}_C
291: \left(\ket{\epsilon_{00}} - \ket{\epsilon_{11}}\right)
292: \end{multline}
293: and
294: \begin{multline}
295: \hat{\cal E}_1 \ket{\alpha_-}_C
296: = -i \sin{\frac{\tilde{\alpha}}{2}} \cos{\frac{\tilde{\alpha}}{2}}
297: \ket{\alpha_+}_C \left(\ket{\epsilon_{00}}
298: - \ket{\epsilon_{11}}\right) \\\mbox{}
299: + \ket{\alpha_-}_C
300: \left(\sin^2{\frac{\tilde{\alpha}}{2}} \ket{\epsilon_{00}}
301: + \cos^2{\frac{\tilde{\alpha}}{2}} \ket{\epsilon_{11}}\right),
302: \end{multline}
303: where $\tilde\alpha\equiv\alpha-\gamma+\pi/2$.
304:
305: On $C$'s way from Bob back to Alice, Eve can perform another similar
306: attack $\hat{\cal E}_2$ with a new ancilla $F$. With
307: the same requirement as in $\hat{\cal E}_1$, the attack operation
308: $\hat{\cal E}_2$ takes the simple form
309: \begin{eqnarray}
310: \label{Eq:AttackReturn}
311: \hat{\cal E}_2 \ket{\gamma}_C \ket{\eta}_F = \ket{\gamma}_C
312: \ket{\eta_{00}}_F
313: \end{eqnarray}
314: and
315: \begin{equation}
316: \hat{\cal E}_2 \ket{\bar\gamma}_C \ket{\eta}_F =
317: \ket{\bar\gamma}_C \ket{\eta_{11}}_F .
318: \end{equation}
319: % As before, we put $\braket{\eta_{00}|\eta_{11}} = \cos{y}$.
320:
321: Since our protocol is symmetric between Alice and Bob, Eve's attack
322: operations $\hat{\cal E}_1'$ and $\hat{\cal E}_2'$ on Bob's travel qubit $D$
323: can be written, analogously to $\hat{\cal E}_1$ and $\hat{\cal E}_2$,
324: with respect to new ancillae $E'$ and $F'$.
325: %%
326: The optimal Eve's attack will be the symmetric one such that
327: \begin{math}
328: \braket{\epsilon_{00}|\epsilon_{11}}=
329: \braket{\epsilon_{00}'|\epsilon_{11}'}
330: \end{math}
331: and
332: \begin{math}
333: \braket{\eta_{00}|\eta_{11}}=
334: \braket{\eta_{00}'|\eta_{11}'}
335: \end{math}.
336: %%
337: The angle $\tilde\beta=\beta-\gamma+\pi/2$ relates
338: Bob's choice $\{\ket{\beta},\ket{\bar\beta}\}$ and Eve's choice
339: $\{\ket{\gamma},\ket{\bar\gamma}\}$ for the basis for $D$.
340:
341: After all the procedures by Alice and Bob, Eve performs a collective
342: measurement on her ancillae $E$, $F$, $E'$, and $F'$. From the
343: measurement result, she extracts the information about the state of
344: Alice's home qubit $A$ and Bob's $B$; namely, the information about the
345: results of the QFR on the travel qubits $C$ and $D$. The information is
346: eventually the information about the key values shared by Alice and Bob.
347:
348: The operations $\hat{\cal E}_1$, $\hat{\cal E}_2$, $\hat{\cal E}_1'$, and
349: $\hat{\cal E}_2'$ by Eve inevitably disturb the quantum state of the travel
350: qubit $C$ and $D$. Simply comparing the test key bits (step 12 of the
351: protocol), Alice and Bob may detect the attack. The detection
352: probability $p_d$ depends on the angle differences $\tilde{\alpha}$ and
353: $\tilde{\beta}$.
354: %%
355: Since the angles $\tilde{\alpha}$ and $\tilde{\beta}$ are randomly
356: distributed, the detection probability is given by
357: \begin{equation}
358: \label{Eq:AverageDetect}
359: p_d = \frac{3}{8}- \frac{1}{8}
360: \left(\cos^2{x} + \cos^2{y} +\cos^2{x}\cos^2{y}\right) \,,
361: \end{equation}
362: where
363: \begin{math}
364: \cos{x}\equiv\braket{\epsilon_{00}|\epsilon_{11}}
365: =\braket{\epsilon_{00}'|\epsilon_{11}'}
366: \end{math}
367: and
368: \begin{math}
369: \cos{y}\equiv\braket{\eta_{00}|\eta_{11}}
370: =\braket{\eta_{00}'|\eta_{11}'}
371: \end{math}.
372: %%
373: The maximum value of $p_d$ is 3/8 corresponding to the
374: intercept-and-resend attack($\cos{x}=\cos{y}=0$).
375:
376: Let us suppose that the initial state prepared by Alice and Bob is given by
377: \begin{eqnarray}
378: \label{Eq:InitialAB}
379: \ket{\Psi}_{i} = \ket{0}_A \ket{0}_B \ket{\alpha \beta}_{CD}.
380: \end{eqnarray}
381: After all attacks the final state is given by
382: \begin{widetext}
383: \begin{multline}
384: \label{Eq:AttackFinal}
385: \frac{1}{{2}} \ket{\alpha\beta}_{CD} \Bigg\{
386: \frac{1}{4}\sin\tilde\alpha\sin\tilde\beta
387: \ket{\uparrow\uparrow}_{AB}\ket{1}_{EF}\ket{1'}_{E'F'}
388: + \ket{\uparrow \downarrow}_{AB}\ket{5}_{EF}\ket{2'}_{E'F'} \\\mbox{}
389: + \ket{\downarrow \uparrow}_{AB}\ket{2}_{EF}\ket{5'}_{E'F'}
390: + \frac{1}{4}\sin\tilde\alpha\sin\tilde\beta
391: \ket{\downarrow\downarrow}_{AB}\ket{4}_{EF}\ket{4'}_{E'F'}\Bigg\} \\\mbox{}
392: %%
393: + \frac{1}{{2}}\ket{\alpha\bar\beta}_{CD} \Bigg\{
394: - \frac{i}{2}\sin\tilde\alpha
395: \ket{\uparrow\uparrow}_{AB}\ket{1}_{EF}\ket{3'}_{E'F'}
396: - \frac{i}{2}\sin\tilde\beta
397: \ket{\uparrow\downarrow}_{AB}\ket{5}_{EF}\ket{1'}_{E'F'} \\\mbox{}
398: + \frac{i}{2}\sin\tilde\beta
399: \ket{\downarrow\uparrow}_{AB}\ket{2}_{EF}\ket{4'}_{E'F'}
400: + \frac{i}{2}\sin\tilde\alpha
401: \ket{\downarrow\downarrow}_{AB}\ket{4}_{EF}\ket{6'}_{E'F'} \Bigg\} \\\mbox{}
402: %%
403: \frac{1}{{2}}\ket{\bar\alpha\beta}_{CD} \Bigg\{
404: - \frac{i}{2}\sin\tilde\beta
405: \ket{\uparrow\uparrow}_{AB}\ket{3}_{EF}\ket{1'}_{E'F'}
406: + \frac{i}{2}\sin\tilde\alpha
407: \ket{\uparrow\downarrow}_{AB}\ket{4}_{EF}\ket{2'}_{E'F'} \\\mbox{}
408: - \frac{i}{2}\sin\tilde\alpha
409: \ket{\downarrow\uparrow}_{AB}\ket{1}_{EF}\ket{5'}_{E'F'}
410: + \frac{i}{2}\sin\tilde\beta
411: \ket{\downarrow\downarrow}_{AB}\ket{6}_{EF}\ket{4'}_{E'F'} \Bigg\} \\\mbox{}
412: %%
413: + \frac{1}{{2}}\ket{\bar\alpha\bar\beta}_{CD} \Bigg\{
414: - \ket{\uparrow\uparrow}_{AB}\ket{3}_{EF}\ket{3'}_{E'F'}
415: +\frac{1}{4}\sin\tilde\alpha\sin\tilde\beta
416: \ket{\uparrow\downarrow}_{AB}\ket{4}_{EF}\ket{1'}_{E'F'} \\\mbox{}
417: + \frac{1}{4}\sin\tilde\alpha\sin\tilde\beta
418: \ket{\downarrow\uparrow}_{AB}\ket{1}_{EF}\ket{4'}_{E'F'}
419: -\ket{\downarrow\downarrow}_{AB}\ket{6}_{EF}\ket{6'}_{E'F'} \Bigg\}
420: \end{multline}
421: \end{widetext}
422: with
423: \begin{equation}
424: \ket{1}_{EF} \equiv
425: \ket{\epsilon_{00}}_E\ket{\eta_{00}}_F
426: - \ket{\epsilon_{11}}_E\ket{\eta_{11}}_F
427: \end{equation}
428: \begin{equation}
429: \ket{2}_{EF} \equiv
430: \sin^2{\frac{\tilde{\alpha}}{2}} \ket{\epsilon_{00}}_E\ket{\eta_{00}}_F
431: + \cos^2{\frac{\tilde{\alpha}}{2}} \ket{\epsilon_{11}}_E\ket{\eta_{11}}_F
432: \end{equation}
433: \begin{equation}
434: \ket{3}_{EF} \equiv
435: \cos^2{\frac{\tilde{\alpha}}{2}}\ket{\epsilon_{00}}_E\ket{\eta_{00}}_F
436: + \sin^2{\frac{\tilde{\alpha}}{2}}\ket{\epsilon_{11}}_E \ket{\eta_{11}}_F
437: \end{equation}
438: \begin{equation}
439: \ket{4}_{EF} \equiv
440: \ket{\epsilon_{00}}_E\ket{\eta_{11}}_F
441: - \ket{\epsilon_{11}}_E\ket{\eta_{00}}_F
442: \end{equation}
443: \begin{equation}
444: \ket{5}_{EF} \equiv
445: \cos^2{\frac{\tilde{\alpha}}{2}} \ket{\epsilon_{00}}_E\ket{\eta_{11}}_F
446: + \sin^2{\frac{\tilde{\alpha}}{2}} \ket{\epsilon_{11}}_E\ket{\eta_{00}}_F
447: \end{equation}
448: and
449: \begin{equation}
450: \ket{6}_{EF} \equiv
451: \sin^2{\frac{\tilde{\alpha}}{2}}\ket{\epsilon_{00}}_E\ket{\eta_{11}}_F
452: + \cos^2{\frac{\tilde{\alpha}}{2}}\ket{\epsilon_{11}}_E\ket{\eta_{00}}_F
453: \end{equation}
454: The states $\ket{1'}_{E'F'}$, $\ket{2'}_{E'F'}$, $\ket{3'}_{E'F'}$,
455: $\ket{4'}_{E'F'}$, $\ket{5'}_{E'F'}$, and $\ket{6'}_{E'F'}$ are defined
456: analogously (with $\tilde\alpha$ replaced by $\tilde\beta$).
457:
458: Equation~(\ref{Eq:AttackFinal}) clearly reveals how Eve can extract the
459: information about the quantum state of the Alice's and Bob's home qubits
460: $A$ and $B$, respectively. For example, Eve can infer the state
461: $\ket{\uparrow}_B$ on Bob's home qubit $B$ if she finds her ancilla qubits
462: $E$ and $F$ in the collective state $\ket{1}_{EF}$, $\ket{2}_{EF}$, or
463: $\ket{3}_{EF}$. Likewise, Eve infers the state $\ket{\downarrow}_B$ if she
464: finds $E$ and $F$ in the state $\ket{4}_{EF}$, $\ket{5}_{EF}$, or
465: $\ket{6}_{EF}$. The state of Alice's home qubit $A$ can be inferred
466: analogously from the ancillae $E'$ and $F'$. The remaining question for
467: Eve would be, for example, how to distinguish the states $\ket{1}_{EF}$,
468: $\ket{2}_{EF}$, and $\ket{3}_{EF}$ from $\ket{4}_{EF}$, $\ket{5}_{EF}$,
469: and $\ket{6}_{EF}$.
470:
471: To this end, we first note that
472: \begin{equation}
473: \braket{1|4}_{EF}=\braket{1|5}_{EF}=\braket{1|6}_{EF}=0
474: \end{equation}
475: and that
476: \begin{equation}
477: \braket{4|1}_{EF}=\braket{4|2}_{EF}=\braket{4|3}_{EF}=0 \,.
478: \end{equation}
479: Therefore, Eve's best policy will be first to exploit the orthogonal
480: subspaces containing $\ket{1}_{EF}$ and $\ket{4}_{EF}$, respectively,
481: and then to distinguish the non-orthogonal states, namely $\ket{2}_{EF}$
482: and $\ket{3}_{EF}$ from $\ket{5}_{EF}$ and $\ket{6}_{EF}$, within these
483: subspaces.
484: %%
485: Further, defining the normalized overlap
486: \begin{equation}
487: \overline{\braket{i|j}}_{EF} \equiv
488: \frac{\braket{i|j}_{EF}}{\sqrt{\braket{i|i}_{EF}\braket{j|j}_{EF}}}
489: \end{equation}
490: ($i,j=1,\cdots,6$),
491: we have the inequalities
492: \begin{equation}
493: \overline{\braket{2|5}}_{EF} = \overline{\braket{3|6}}_{EF}
494: \geq \min\{\cos{x},\cos{y}\}
495: \end{equation}
496: and
497: \begin{equation}
498: \overline{\braket{2|6}}_{EF} = \overline{\braket{3|5}}_{EF}
499: \geq \min\{\cos{x},\cos{y}\}
500: \end{equation}
501: % \begin{multline}
502: % \cos{\angle(2,5)_{EF}} = \cos{\angle(3,6)_{EF}} \\
503: % = \frac{\sin^2\tilde\alpha(\cos{y}-\cos{x}) + 2\cos{x}}{%
504: % 2 - \sin^2\tilde\alpha(1-\cos{x}\cos{y})} \\\mbox{}%
505: % \geq \min\{\cos{x},\cos{y}\}
506: % \end{multline}
507: % and
508: % \begin{multline}
509: % \cos\angle(2,6)_{EF} = \cos\angle(3,5)_{EF} \\
510: % = \frac{\sin^2\tilde\alpha(\cos{x}-\cos{y}) + 2\cos{y}}{%
511: % 2 - \sin^2\tilde\alpha(1-\cos{x}\cos{y})} \\\mbox{}%
512: % \geq \min\{\cos{x},\cos{y}\}
513: % \end{multline}
514: Namely, the states $\ket{2}_{EF}$ and $\ket{3}_{EF}$ can be
515: distinguished worse from $\ket{5}_{EF}$ and $\ket{6}_{EF}$ than any two
516: states with the mutual overlap of
517: \begin{math}
518: \min\{\cos{x},\cos{y}\}
519: \end{math}
520: can be distinguished from each other. Based on this observation, we
521: analyze the worst case, where
522: \begin{math}
523: \overline{\braket{2|5}}_{EF} = \overline{\braket{3|6}}_{EF} =
524: \overline{\braket{2|6}}_{EF} = \overline{\braket{3|5}}_{EF} =
525: \min\{\cos{x},\cos{y}\}.
526: \end{math}
527: Further, it is clear that the optimal attack for Eve is the balanced one
528: \cite{Lucamarini05a}, for which $\cos{x}=\cos{y}$, and hereafter we
529: focus on the balanced case.
530:
531: Putting all the above observations together and with lengthy algebra,
532: one can calculate the mutual information $I(A,B)$ between Alice and Bob
533: and $I(A,E)$ [or $I(B,E)$] between Alice (or Bob) and Eve; note that
534: because of the symmetry in our protocol, $I(A,E)=I(B,E)$.
535: %%
536: They are given by
537: \begin{equation}
538: \label{qkd::eq:2}
539: I(A,B) = 1 + p_d\log_2p_d + (1-p_d)\log_2(1-p_d)
540: \end{equation}
541: and
542: \begin{equation}
543: \label{qkd::eq:3}
544: I(A,E) = 1 + p_e\log_2p_e + (1-p_e)\log_2(1-p_e) \,,
545: \end{equation}
546: respectively. $p_d$ in Eq.~(\ref{qkd::eq:2}) is the detection
547: probability [see Eq.~(\ref{Eq:AverageDetect})] for the balanced attack
548: ($\cos{x}=\cos{y}$), and $p_e$ in Eq.~(\ref{qkd::eq:3}) is defined by
549: \begin{widetext}
550: \begin{equation}
551: p_e = \frac{1}{2} - \frac{1}{2}\sqrt{1-2p_d}(1-\sqrt{1-2p_d})
552: \left[2\sqrt{1-2p_d}+\sqrt{2(1-\sqrt{1-2p_d})}\right].
553: \end{equation}
554: \end{widetext}
555: %%%%
556: % \begin{widetext}
557: % \begin{multline}
558: % I(A,E) = 1 + \\
559: % [\frac{1}{2} - \frac{1}{8}\sin^2{z}(2-\sin^2{z}) (2-\sin{z})(1+\sin{z})]
560: % \log_2{[\frac{1}{2} - \frac{1}{8}\sin^2{z}(2-\sin^2{z})
561: % (2-\sin{z})(1+\sin{z})]} +\\
562: % [ \frac{1}{2} + \frac{1}{8}\sin^2{z}(2-\sin^2{z})
563: % (2-\sin{z})(1+\sin{z})]\log_2{ [\frac{1}{2} +
564: % \frac{1}{8}\sin^2{z}(2-\sin^2{z}) (2-\sin{z})(1+\sin{z})]}
565: % \end{multline}
566: % where $\cos{z}\equiv\min\{\cos{x},\cos{y}\}$.
567: % \end{widetext}
568: %
569: For a QKD to be secure, it is required that $I(A,B)\geq
570: I(A,E)$\cite{Gisin02a}.
571: % Because of the symmetry of our protocol, it is enough
572: % to compare Alice-Bob and Alice-Eve information to investigate the
573: % security.
574: % We get Alice-Bob information
575: % \begin{widetext}
576: % \begin{multline}
577: % I(A,B) =1 + \frac{1}{8} \sin^2{z}(4-\sin^2{z})
578: % \log_2{[\frac{1}{8}\sin^2{z}(4-\sin^2{z})]} \\
579: % + \frac{1}{8}( 8-4\sin^2{z} + \sin^4{z})\log_2{[\frac{1}{8}(
580: % 8-4\sin^2{z} + \sin^4{z})]}
581: % \end{multline}
582: % \end{widetext}
583: % The balanced attack, for which $x=y$, is the optimal attack for Eve
584: % \cite{Lucamarini05a}.
585: %
586: The mutual information $I(A,B)$ and $I(A,E)$ are
587: plotted as functions of the detection probability $p_d$ in
588: Fig.~\ref{fig:4}.
589: %%
590: The maximum information between Alice and Eve occurs at
591: $p_d=0.345$, which is less than the maximum detection probability
592: ($p_d=3/8$) corresponding to the intercept-and-resend attack.
593: This means that the intercept-and-resend attack is not an optimal
594: attack for Eve.
595: %%
596: $I(A,B)$ and $I(A,E)$ becomes equal for the detection probability $p_d =
597: 0.266188$. This detection probability is greater than $p_d=0.18$ for
598: the ping-pong protocol \cite{Lucamarini05a} and $p_d=0.15$ for BB84
599: protocol.
600:
601: \begin{figure}
602: \centering
603: \includegraphics*[width=6cm]{fig-4a}
604: \includegraphics*[width=6cm]{fig-4b}
605: \caption{(a) Mutual information a function of the detection probability,
606: $p_d$, for general incoherent attacks against our protocol. The
607: solid (dashed) line represents the mutual information $I(A,B)$
608: [$I(A,E)$] between Alice and Bob (Alice and Eve). (b) $I(A,B)+I(A,E)$
609: as a function of $p_d$ for our protocol (solid line) and for the
610: BB84 protocol (dashed line). For our protocol, the maximum value of
611: $p_d$ is 3/8.}
612: \label{fig:4}
613: \end{figure}
614:
615: So far the security has been analyzed for incoherent attacks. In
616: general, Eve can attacks many qubits coherently by collecting many
617: ancillae and performing a global measurement on them. Since our
618: protocol shares many common features with the BB84 or similar protocols,
619: we can first follow the lines in Section VI.G of Ref.~\cite{Gisin02a} to
620: prove the security of our protocol against collective
621: attacks\cite{Biham97a}. An argument for the security against the most
622: general coherent attacks\cite{Mayers93a} is given below. After Alice
623: and Bob repeats the protocol $n$ times to share a key of length of $2n$
624: bits, the sum of the mutual information $I(A,B)$ and $I(A,E)$ should be
625: less than $2n$, i.e.,
626: \begin{equation}
627: \label{qkd::eq:4}
628: I(A,B) + I(A,E) \leq 2n \,.
629: \end{equation}
630: Equivalently speaking, $I(A,B)+I(A,E)\leq 1$ per single qubit. This is
631: because Eve and Bob cannot acquire more information than is sent out
632: mutually by Alice and Bob whatever measurement is performed by Eve.
633: Therefore, in order that $I(A,B)>I(A,E)$ (Theorem 1 in
634: Ref.~\cite{Gisin02a}), it suffices to have $I(A,B)\geq n$. Since
635: \begin{math}
636: I(A,B) = 2n\left[1+p_d\log_2p_d+(1-p_d)\log_2(1-p_d)\right],
637: \end{math}
638: $p_d$ is required to be less than 0.110028, approximately 11 \%, which
639: is the upper bound for the BB84 protocol\cite{Biham97a,Mayers93a}. This
640: proves that our protocol is \emph{at least} as secure as the BB84
641: protocol against collective attacks.
642: %%
643: The above lines of proof applies only for collective attacks. However,
644: it has been argued that the collective attack may be the optimal one of
645: the most general coherent attacks\cite{coherent-attacks}.
646: %%
647: It is also interesting to note that for incoherent attacks, $I(A,E)$ in
648: Eq.~(\ref{qkd::eq:3}) is significantly restricted and hence the sum
649: $I(A,B)+I(A,E)$ per single qubit is far less than 1;
650: cf.~(\ref{qkd::eq:4}). This is demonstrated in Fig.~\ref{fig:4} (b)
651: comparing the sum for the BB84 protocol and for ours. It suggest that
652: the upper bound $p_d\approx 11$ \% may be reduced further with proper
653: analysis of the restriction on the possible measurements by Eve. More
654: detailed analysis of the security of our protocol against the coherent
655: attacks should therefore be an interesting topic for further studies in
656: the future.
657:
658:
659: \section{Impersonation Attack}
660: \label{sec:impersonation}
661:
662: In our protocol, Alice sends a qubit to Bob and gets it back. So does
663: Bob with another travel qubit. It is possible for Eve to intercept the
664: channel and pretend to be her/his legitimate partner to each. One can
665: think of two different ways of impersonation attack. In the first
666: method [see Fig.~\ref{fig:5}(a)], Eve uses two home qubits of her own.
667: Eve can use one of the two to share a perfect key with Alice following
668: the procedures of the protocol in Section~\ref{sec:protocol}, and the
669: other to share another key with Bob. However, the keys so generated to
670: Alice and Bob are independent and have no correlation. Therefore, by
671: bit verification procedure, this attack can be detected with probability
672: $1/2$.
673:
674: In the second method [see Fig.~\ref{fig:5}(b)], Eve uses only one home
675: qubit $E$ of her own, which is used for the interaction with both Alice and
676: Bob. In this case, the total wave function of the whole qubits is given by
677: \begin{multline}
678: \label{paper::eq:10}
679: \left(\ket{\uparrow\uparrow\uparrow}
680: +\ket{\downarrow\downarrow\downarrow}\right)
681: \ket{\bar\alpha\bar\beta\bar\epsilon}
682: + \left(\ket{\uparrow\downarrow\uparrow}
683: + \ket{\downarrow\uparrow\downarrow}\right)
684: \ket{\bar\alpha\beta\bar\epsilon} \\\mbox{}
685: + \left(\ket{\uparrow\uparrow\downarrow}
686: + \ket{\downarrow\downarrow\uparrow}\right)
687: \ket{\alpha\beta\epsilon}
688: + \left(\ket{\uparrow\downarrow\downarrow}
689: +\ket{\downarrow\uparrow\uparrow}\right)
690: \ket{\alpha\bar\beta\epsilon}
691: \end{multline}
692: (not normalized), where the product states are arranged such as
693: \begin{math}
694: \ket{...}_{ABE}\ket{...}_{CDE'}
695: \end{math}
696: ($E'$ is the travel qubit of Eve's). It then follows immediately that
697: the detection probability of this attack is still $1/2$.
698:
699:
700: \begin{figure}
701: \centering
702: \includegraphics*[width=4cm]{fig-5a}
703: \includegraphics*[width=4cm]{fig-5b}
704: \caption{Impersonation attack}
705: \label{fig:5}
706: \end{figure}
707:
708: \section{Photon Number Splitting Attack}
709: \label{sec:PNS}
710:
711: \begin{figure}
712: \centering
713: \includegraphics*{fig-6}
714: \caption{Photon-number splitting attack.}
715: \label{fig:6}
716: \end{figure}
717:
718: Finally, we investigate the security of the protocol against the photon
719: number splitting attack (PNS). (We note that the security analysis in
720: the case of lossy channel is essentially the same as that against the
721: PNS attack.) Let us suppose that the photon source generate three
722: photons (the discussion can be trivially generalized to the case of more
723: photons; see below). Eve takes one photon (say $E_1$) on the quantum
724: channel from Alice to Bob and another ($E_2$) on the channel back to
725: Alice from Bob; see Fig.~\ref{fig:6}. Only photon $C$ finally arrives
726: at Alice's hand. Similarly, Eve takes photons $E_1'$ and $E_2'$ out of
727: the photons from Bob. Bob receives back only $D$. The final state of
728: the whole photons and home qubits are given by
729: \begin{multline}
730: \label{PNS::eq:1}
731: i\ket{\uparrow\uparrow}\ket{\bar\alpha\bar\beta}
732: \ket{\bar\alpha\bar\beta}\ket{\bar\alpha\bar\beta}
733: -i\ket{\downarrow\downarrow}\ket{\alpha\beta}
734: \ket{\bar\alpha\bar\beta}\ket{\bar\alpha\bar\beta}
735: \\\mbox{}
736: + \ket{\uparrow\downarrow}\ket{\bar\alpha\beta}
737: \ket{\alpha\beta}\ket{\alpha\beta}
738: + \ket{\downarrow\uparrow}\ket{\alpha\bar\beta}
739: \ket{\alpha\beta}\ket{\alpha\beta} \,,
740: \end{multline}
741: where the product states have been denoted according to the arrangement
742: of the qubits such as
743: \begin{math}
744: \ket{..}_{AB}\ket{..}_{E_1E_2}\ket{..}_{E_1'E_2'}\ket{..}_{CD}
745: \end{math}.
746: Eve waits until Alice and Bob performs projective measurement on their
747: travel qubits $C$ and $D$. Then the wave function in
748: Eq.~(\ref{PNS::eq:1}) collapses into either
749: \begin{equation}
750: \label{paper::eq:7}
751: \ket{\uparrow\uparrow}\ket{\bar\alpha\bar\beta}
752: \ket{\bar\alpha\bar\beta}\ket{\bar\alpha\bar\beta}
753: -\ket{\downarrow\downarrow}\ket{\alpha\beta}
754: \ket{\bar\alpha\bar\beta}\ket{\bar\alpha\bar\beta}
755: \end{equation}
756: or
757: \begin{equation}
758: \label{paper::eq:8}
759: \ket{\uparrow\downarrow}\ket{\bar\alpha\beta}
760: \ket{\alpha\beta}\ket{\alpha\beta}
761: + \ket{\downarrow\uparrow}\ket{\alpha\bar\beta}
762: \ket{\alpha\beta}\ket{\alpha\beta} \,.
763: \end{equation}
764: Therefore, Eve can know the key without being detected simply by
765: checking whether
766: \begin{math}
767: \braket{\epsilon_1|\epsilon_2}\braket{\epsilon_1'|\epsilon_2'} > 0
768: \end{math} (Alice and Bob share the key $0$)
769: \begin{math}
770: \braket{\epsilon_1|\epsilon_2}\braket{\epsilon_1'|\epsilon_2'} < 0
771: \end{math} (Alice and Bob share the key $1$), where
772: $\epsilon_1,\epsilon_1'=\alpha,\bar\alpha$ and
773: $\epsilon_2,\epsilon_2'=\beta,\bar\beta$.
774: This test can be easily done, for example, using an interferometer.
775: %%
776: The discuss is trivially generalized to the case of even more photons.
777: It is enough for Eve to steal two photons from Alice and another two
778: from Bob.
779:
780: \begin{figure}
781: \centering
782: \includegraphics{fig-7}
783: \caption{(color on-line) A variation of the protocol using four home qubits.}
784: \label{fig:7}
785: \end{figure}
786:
787: One may be tempted to overcome this problem using four home qubits (two
788: for Alice and two for Bob) as illustrated in Fig.~\ref{fig:7}. This
789: scheme ``hides'' by means of entanglement the output state of $C$ and
790: $D$ even after Alice and Bob performs projective measurements on $C$ and
791: $D$.
792: However, following the similar lines as above,
793: the total wave function of the whole qubits is given by
794: \begin{widetext}
795: \begin{multline}
796: \label{paper::eq:9}
797: -\frac{1}{4}\ket{\bar\alpha\bar\beta}
798: \left(\ket{\Phi^+\Psi^+}\ket{\Phi^+\Psi^+}
799: +\ket{\Phi^+\Psi^-}\ket{\Phi^+\Psi^-}
800: -\ket{\Phi^-\Psi^+}\ket{\Phi^-\Psi^+}
801: -\ket{\Phi^-\Psi^-}\ket{\Phi^-\Psi^-}\right)
802: \\\mbox{}
803: - \frac{1}{4}\ket{\bar\alpha\bar\beta}
804: \left(\ket{\Psi^-\Phi^-}\ket{\Psi^+\Phi^+}
805: -\ket{\Psi^-\Phi^+}\ket{\Psi^+\Phi^-}
806: +\ket{\Psi^+\Phi^-}\ket{\Psi^-\Phi^+}
807: -\ket{\Psi^+\Phi^+}\ket{\Psi^-\Phi^-}\right)
808: \\\mbox{}
809: -\frac{i}{4}\ket{\alpha\beta}
810: \left(\ket{\Psi^-\Psi^+}\ket{\Phi^+\Phi^+}
811: -\ket{\Psi^-\Psi^-}\ket{\Phi^+\Phi^-}
812: -\ket{\Psi^+\Psi^+}\ket{\Phi^-\Phi^+}
813: +\ket{\Psi^+\Psi^-}\ket{\Phi^-\Phi^-}\right)
814: \\\mbox{}
815: + \frac{i}{4}\ket{\alpha\beta}
816: \left(\ket{\Phi^+\Phi^-}\ket{\Psi^+\Psi^+}
817: +\ket{\Phi^+\Phi^+}\ket{\Psi^+\Psi^-}
818: +\ket{\Phi^-\Phi^-}\ket{\Psi^-\Psi^+}
819: +\ket{\Phi^-\Phi^+}\ket{\Psi^-\Psi^-}\right)
820: \end{multline}
821: \end{widetext}
822: arranging the product states such as
823: \begin{math}
824: \ket{..}_{CD}\ket{..}_{A_1A_2B_1B_2}\ket{..}_{E_1E_2E_1'E_2'}
825: \end{math}
826: Therefore, in order to know the key, all Eve has to do is to distinguish
827: the Bell state $\ket{\Phi^\pm}$ from $\ket{\Psi^\pm}$, which is as easy
828: as the test for the two-home-qubit scheme analyzed above.
829:
830:
831: \section{Experimental Feasibility}
832: \label{sec:experiment}
833:
834: The parametric Faraday rotation of photon polarization by atomic spins
835: have been widely used in quantum optics and atomic physics. For
836: example, it has been used for quantum non-demolition measurement of the
837: atomic spin\cite{Kitagawa93a,Wineland92a,Kuzmich00a}. However, because
838: of the weak atom-photon interaction, the Faraday rotation angle is
839: usually quite small (several degrees). To enhance the atom-photon
840: interaction to achieve the rotation angle of $\pi/2$, one has to put an
841: atom to a cavity. However, trapping a single atom in a cavity is still
842: technologically challenging.
843:
844: Another candidate for a conditional Faraday rotation of photon
845: polarization is the quantum dot in a micro-cavity, which has already been
846: demonstrated experimentally\cite{Imamoglu99a,Leuenberger}. Here the
847: photon interacts with the electron spin in the semiconductor quantum
848: dot. The transmission distance is limited mainly by the coherence time
849: of the electron spin in the quantum dot. The maximum transmission
850: distance (given by the speed of light) would be ~10 m and $1 \times
851: 10^6$ m for coherence times of 100 ns \cite{Kik} and for 10 ms
852: \cite{Krout} in one-way transmission. We believe the distance limitation
853: will be extensively relaxed in the near future.
854:
855: \section{Conclusion}
856: \label{sec:conclusion}
857:
858: We have proposed a new QKD protocol exploring the quantum states of the
859: Faraday rotators. The protocol is secure against eavesdropping for
860: ideal single-photon source and robust against impersonation attacks.
861: This protocol is not allowed for multiphoton source which produces more
862: than two photons. The protocol could be implemented experimentally with
863: semiconductor quantum dots in micro-cavity.
864:
865: \section*{Acknowledgments}
866: We thank J.~W. Lee and B.-G. Englert for helpful discussions.
867: %%
868: This work was supported by the SRC/ERC program of MOST/KOSEF
869: (R11-2000-071), the Korea Research Foundation Grants
870: (KRF-2005-070-C00055 and KRF-2006-312-C00543), the SK Fund, and the
871: KIAS.
872:
873: \begin{thebibliography}{99}
874: \bibitem{Shor94a}
875: P.~W. Shor, in \emph{Proceedings of the 35th Annual Symposium on the
876: Foundations of Computer Science} (IEEE Press, Los Alamitos, CA, 1994), p.
877: 124.
878:
879: \bibitem{Bennett84a} C.~H. Bennett and G.~Brassard (IEEE Press, New
880: York, 1984), pp. 175--179.
881:
882: \bibitem{Ekert91a} A.~K. Ekert, Phys. Rev. Lett. \textbf{67}, 661
883: (1991).
884:
885: \bibitem{Bennett92c} C.~H. Bennett, G.~Brassard, and A.~Ekert,
886: Sci. Am. \textbf{267}, 50 (1992).
887:
888: \bibitem{Gisin02a} N.~Gisin, G.~Ribordy, W.~Tittel, and H.~Zbinde,
889: Rev. Mod. Phys. \textbf{74}, 145 (2002).
890:
891: \bibitem{Bostrom02a} K.~Bostr\"om and T.~Felbinger,
892: Phys. Rev. Lett. \textbf{89}, 187 902 (2002).
893:
894: \bibitem{Wojcik03a} A.~W\'ojcik, Phys. Rev. Lett. \textbf{90}, 157901
895: (2003).
896:
897: \bibitem{Cai03a} Q.-Y. Cai, Phys. Rev. Lett. \textbf{91}, 109801 (2003).
898:
899: \bibitem{Lucamarini05a} M.~Lucamarini and S.~Mancini,
900: Phys. Rev. Lett. \textbf{94}, 140501 (2005).
901:
902: \bibitem{endnote:1} %
903: The initial preparation of $\ket{\phi=0}$ of QFR is just for
904: convenience. The initial state of QFR is required to be an arbitrary
905: state on the equator of the Poincar\'e sphere.
906:
907: \bibitem{endnote:2} %
908: Yet a classical channel is necessary at the key verification state in
909: order to detect possible eavesdropping.
910:
911: \bibitem{Biham97a}
912: E.~Biham and T.~Mor, Phys. Rev. Lett. \textbf{78}, 2256 (1997).
913:
914: \bibitem{Mayers93a}
915: C.~R. Mayers and J.~S. Langer, Phys. Rev. E \textbf{47}, 3048 (1993).
916:
917: \bibitem{coherent-attacks}
918: See, e.g.,
919: R. Renner, arXiv:quant-ph/0512258v2;
920: J. Bae and A. Acin, arXiv:quant-ph/0610048v1;
921: R. Renner, arXiv:quant-ph/0703069v1.
922:
923: \bibitem{Kitagawa93a} M.~Kitagawa and M.~Ueda, Phys. Rev. A \textbf{47},
924: 5138 (1993).
925:
926: \bibitem{Wineland92a} D.~J. Wineland, J.~J. Bollinger, W.~M. Itano,
927: F.~L. Moore, and D.~J. Heinzen, Phys. Rev. A \textbf{46}, 6797 (1992).
928:
929: \bibitem{Kuzmich00a} A.~Kuzmich, L.~Mandel, and N.~P. Bigelow,
930: Phys. Rev. Lett. \textbf{85}, 1594 (2000).
931:
932: \bibitem{Imamoglu99a} A.~Imamo\=glu, D.~D. Awschalom, G.~Burkard,
933: D.~P. DiVincenzo, D.~Loss, M.~Sherwin, and A.~Small,
934: Phys. Rev. Lett. \textbf{83}, 4204 (1999).
935:
936: \bibitem{Leuenberger} M. N. Leuenberger, M. E. Flatt\'e, and
937: D. D. Awschalom, Phys. Rev. Lett. {\bf 94}, 107401 (2005).
938:
939: \bibitem{Kik} J. M. Kikkawa and D.D. Awschalom, Phys. Rev. Lett. {\bf
940: 80}, 4313 (1998).
941:
942: \bibitem{Krout} M. Kroutvar \textit{et al.}, Nature (London) {\bf 432}, 81
943: (2004).
944:
945: \end{thebibliography}
946: \end{document}
947:
948: