量子密码学：理论、实验与应用

需积分: 10 37 浏览量更新于2024-07-29 收藏 1.81MB PDF 举报

"这篇文档是关于量子密码学的综述，由Nicolas Gisin, Grégoire Ribordy, Wolfgang Tittel, 和 Hugo Zbinden撰写，来自日内瓦大学应用物理小组。文章讨论了量子密码学的发展，特别是单量子级别的应用，并重点探讨了未解的问题和技术挑战。" 量子密码学是一种利用量子力学原理实现安全通信的技术，尤其是它在单量子级别的潜力，可能是量子力学最早的实际应用之一。随着理论和实验的快速发展，这一领域已经取得了显著进步。本文档主要分为以下几个部分： I. 引言：这部分简要介绍了量子密码学的重要性以及它在信息安全中的角色。 II. 一个美妙的想法： A. 直觉：量子密码学的概念基于量子状态的不可复制性（即无克隆定理）和量子纠缠等基本原理。 B. 经典密码学：首先回顾了两种主要的加密方法，包括非对称（公钥）密码系统和对称（秘密密钥）密码系统，以及一次一密（one-time pad）作为最安全的古典加密技术。 C. BB84协议：这是量子密码学中的基础协议，由Charles Bennett和Gilles Brassard于1984年提出。其原理是利用量子态的四种可能基来建立密钥，无法被第三方复制或检测而不被发现。 D. 其他协议：除了BB84协议，还提到了两态协议、六态协议、爱因斯坦-波多尔斯基-罗森（EPR）协议以及其他变种，每种都有其独特的优点和应用场景。 E. 量子隐形传态作为“量子一次性密钥”：量子隐形传态允许量子信息在没有实际传输粒子的情况下从一处传递到另一处，这可以为安全通信提供新的可能性。 III. 开放问题和技术挑战：作者强调了量子密码学仍面临的一些关键问题，比如量子错误纠正、隐私放大、量子密钥的生成与分发，以及如何应对拦截重发攻击等。 IV. 结论：总结了量子密码学的现状和未来展望，指出了该领域的研究方向和潜在的应用前景。量子密码学为信息安全性提供了革命性的解决方案，通过利用量子力学的特性，如叠加态、纠缠和不可测量性，确保了信息的绝对保密性和通信的完整性。然而，该领域的研究仍然充满挑战，包括提高量子比特的稳定性、实现长距离的量子通信以及解决实际应用中的技术难题。随着科技的进步，量子密码学有望在未来的信息安全领域发挥更大的作用。

Alice and one to Bob. A ﬁrst possibility would be that

the source always emits the two qubits in the same state

chosen randomly among the four states of the BB84 pro-

tocol. Alice and Bob would then both measure their qu-

bit in one of the two bases, again chosen independently

and randomly. The source then announces the bases,

and Alice and Bob keep the data only when they hap-

pen to have made their measurements in the compatible

basis. If the source is reliable, this protocol is equivalent

to that of BB84: It is as if the qubit propagates back-

wards in time from Alice to the source, and then for-

ward to Bob. But better than trusting the source, which

could be in Eve’s hand, the Ekert protocol assumes that

the two qubits are emitted in a maximally entangled

state like

␾

⫹

⫽

共

兩

↑,↑

典

⫹

兩

↓,↓

典

). (9)

Then, when Alice and Bob happen to use the same ba-

sis, either the x basis or the y basis, i.e., in about half of

the cases, their results are identical, providing them with

a common key. Note the similarity between the one-

qubit BB84 protocol illustrated in Fig. 1 and the two-

qubit Ekert protocol of Fig. 3. The analogy can be made

even stronger by noting that for all unitary evolutions

and U

, the following equality holds:

丢 U

⌽

(⫹)

⫽ 1丢 U

⌽

(⫹ )

, (10)

where U

denotes the transpose.

In his 1991 paper Ekert suggested basing the security

of this two-qubit protocol on Bell’s inequality, an in-

equality which demonstrates that some correlations pre-

dicted by quantum mechanics cannot be reproduced by

any local theory (Bell, 1964). To do this, Alice and Bob

can use a third basis (see Fig. 4). In this way the prob-

ability that they might happen to choose the same basis

is reduced from

, but at the same time as they

establish a key, they collect enough data to test Bell’s

inequality.

They can thus check that the source really

emits the entangled state (9) and not merely product

states. The following year Bennett, Brassard, and Mer-

min (1992) criticized Ekert’s letter, arguing that the vio-

lation of Bell’s inequality is not necessary for the secu-

rity of QC and emphasizing the close connection

between the Ekert and the BB84 schemes. This criticism

might be missing an important point. Although the exact

relation between security and Bell’s inequality is not yet

fully known, there are clear results establishing fascinat-

ing connections (see Sec. VI.F). In October 1992, an ar-

ticle by Bennett, Brassard, and Ekert demonstrated that

the founding fathers of QC were able to join forces

to develop the ﬁeld in a pleasant atmosphere (Bennett,

Brassard, and Ekert, 1992).

4. Other variations

There is a large collection of variations on the BB84

protocol. Let us mention a few, chosen somewhat arbi-

trarily. First, one can assume that the two bases are not

chosen with equal probability (Ardehali et al., 1998).

This has the nice consequence that the probability that

Alice and Bob choose the same basis is greater than

thus increasing the transmission rate of the sifted key.

However, this protocol makes Eve’s job easier, as she is

more likely to guess correctly the basis that was used.

Consequently, it is not clear whether the ﬁnal key rate,

after error correction and privacy ampliﬁcation, is

higher or not.

Another variation consists in using quantum systems

of dimension greater than 2 (Bechmann-Pasquinucci

and Peres, 2000; Bechmann-Pasquinucci and Tittel,

2000; Bourennane, Karlsson, and Bjo

rn, 2001). Again,

the practical value of this idea has not yet been fully

determined.

A third variation worth mentioning is due to Golden-

berg and Vaidman of Tel Aviv University (1995). They

suggested preparing the qubits in a superposition of two

spatially separated states, then sending one component

of this superposition and waiting until Bob receives it

before sending the second component. This does not

A maximal violation of Bell’s inequality is necessary to rule

out tampering by Eve. In this case, the QBER must necessarily

be equal to zero. With a nonmaximal violation, as typically

obtained in experimental systems, Alice and Bob can distill a

secure key using error correction and privacy ampliﬁcation.

FIG. 3. Einstein-Podolsky-Rosen (EPR) protocol, with the

source and a Poincare

representation of the four possible

states measured independently by Alice and Bob.

FIG. 4. Illustration of protocols exploiting EPR quantum sys-

tems. To implement the BB84 quantum cryptographic proto-

col, Alice and Bob use the same bases to prepare and measure

their particles. A representation of their states on the Poincare

sphere is shown. A similar setup, but with Bob’s bases rotated

by 45°, can be used to test the violation of Bell’s inequality.

Finally, in the Ekert protocol, Alice and Bob may use the vio-

lation of Bell’s inequality to test for eavesdropping.

153

Gisin

et al.

: Quantum cryptography

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

sound of great practical value, but has the nice concep-

tual feature that the minimal two states do not need to

be mutually orthogonal.

E. Quantum teleportation as a ‘‘quantum one-time pad’’

Since its discovery in 1993 by a surprisingly large

group of physicists, quantum teleportation (Bennett

et al., 1993) has received much attention from both the

scientiﬁc community and the general public. The dream

of beaming travelers through the universe is exciting,

but completely out of the realm of any foreseeable tech-

nology. However, quantum teleportation can be seen as

the fully quantum version of the one-time pad (see Sec.

II.B.3), hence as the ultimate form of QC. As in ‘‘classi-

cal teleportation,’’ let us assume that Alice aims to trans-

fer a faithful copy of a quantum system to Bob. If Alice

has full knowledge of the quantum state, the problem is

not really a quantum one (Alice’s information is classi-

cal). If, on the other hand, Alice does not know the

quantum state, she cannot send a copy, since quantum

copying is impossible according to quantum physics (see

Sec. II.C.2). Nor can she send classical instructions, since

this would allow the production of many copies. How-

ever, if Alice and Bob share arbitrarily many entangled

qubits, sometimes called a quantum key, and share a

classical communication channel, then the quantum tele-

portation protocol provides them with a means of trans-

ferring the quantum state of the system from Alice to

Bob. In the course of running this protocol, Alice’s

quantum system is destroyed without Alice’s having

learned anything about the quantum state, while Bob’s

qubit ends in a state isomorphic to the state of the origi-

nal system (but Bob does not learn anything about the

quantum state). If the initial quantum system is a quan-

tum message coded in the form of a sequence of qubits,

then this quantum message is faithfully and securely

transferred to Bob, without any information leaking to

the outside world (i.e., to anyone not sharing the prior

entanglement with Alice and Bob). Finally, the quantum

message could be formed of a four-letter quantum al-

phabet consisting of the four states of the BB84 proto-

col. With futuristic but not impossible technology, Alice

and Bob could keep their entangled qubits in their re-

spective wallets and could enjoy totally secure commu-

nication at any time, without even having to know where

the other is located (provided they can communicate

classically).

F. Optical ampliﬁcation, quantum nondemolition

measurements, and optimal quantum cloning

After almost every general talk on QC, two questions

arise: What about optical ampliﬁers? and What about

quantum nondemolition measurements? In this section

we brieﬂy address these questions.

Let us start with the second one, as it is the easiest.

The term ‘‘quantum nondemolition measurement’’ is

simply confusing. There is nothing like a quantum mea-

surement that does not perturb (i.e., modify) the quan-

tum state, except if the state happens to be an eigenstate

of the observable. Hence, if for some reason one conjec-

tures that a quantum system is in some state (or in a

state among a set of mutually orthogonal ones), one can

in principle test this conjecture repeatedly (Braginsky

and Khalili, 1992). However, if the state is only restricted

to be in a ﬁnite set containing nonorthogonal states, as

in QC, then there is no way to perform a measurement

without ‘‘demolishing’’ (perturbing) the state. Now, in

QC the term ‘‘nondemolition measurement’’ is also used

with a different meaning: one measures the number of

photons in a pulse without affecting the degree of free-

dom coding the qubit (e.g., the polarization; see Sec.

VI.H), or one detects the presence of a photon without

destroying it (Nogues et al., 1999). Such measurements

are usually called ideal measurements,orprojective mea-

surements, because they produce the least possible per-

turbation (Piron, 1990) and because they can be repre-

sented by projectors. It is important to stress that these

‘‘ideal measurements’’ do not invalidate the security of

QC.

Let us now consider optical ampliﬁers (a laser me-

dium, but without mirrors, so that ampliﬁcation takes

place in a single pass; see Desurvire, 1994). They are

widely used in today’s optical communication networks.

However, they are of no use for quantum communica-

tion. Indeed, as seen in Sec. II.C, the copying of quan-

tum information is impossible. Here we illustrate this

characteristic of quantum information by the example of

optical ampliﬁers: the necessary presence of spontane-

ous emission whenever there is stimulated emission pre-

vents perfect copying. Let us clarify this important and

often confusing point, following the work of Simon et al.

(1999, 2000; see also De Martini et al., 2000 and Kempe

et al., 2000). Let the two basic qubit states

兩

典

and

兩

典

physically implemented by two optical modes:

兩

典

⬅

兩

1,0

典

and

兩

典

⬅

兩

0,1

典

. Thus

兩

n,m

典

丢

兩

k,l

典

denotes

the state of n photons in mode 1 and m photons in mode

2, while k,l⫽ 0(1) denotes the ground (or excited) state

of two-level atoms coupled to mode 1 or 2, respectively.

Hence spontaneous emission corresponds to

兩

0,0

典

丢

兩

1,0

典

→

兩

1,0

典

丢

兩

0,0

典

, (11)

兩

0,0

典

丢

兩

0,1

典

→

兩

0,1

典

丢

兩

0,0

典

, (12)

and stimulated emission to

兩

1,0

典

丢

兩

1,0

典

→&

兩

2,0

典

丢

兩

0,0

典

, (13)

兩

0,1

典

丢

兩

0,1

典

→&

兩

0,2

典

丢

兩

0,0

典

, (14)

where the factor of & takes into account the ratio of

stimulated to spontaneous emission. Let the initial state

of the atom be a mixture of the following two states,

each with equal (50%) weight:

兩

0,1

典

and

兩

1,0

典

. (15)

By symmetry, it sufﬁces to consider one possible initial

state of the qubit, e.g., one photon in the ﬁrst mode

兩

1,0

典

. The initial state of the photon⫹ atom system is

thus a mixture:

154

Gisin

et al.

: Quantum cryptography

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

兩

1,0

典

丢

兩

1,0

典

兩

1,0

典

丢

兩

0,1

典

. (16)

This corresponds to the ﬁrst-order term in an evolution

with a Hamiltonian (in the interaction picture): H

⫽

␹

†

␴

⫺

⫹ a

␴

†

⫹ a

†

␴

⫺

⫹ a

␴

†

). After some time the

two-photon component of the evolved states becomes

兩

2,0

典

丢

兩

0,0

典

兩

1,1

典

丢

兩

0,0

典

. (17)

The correspondence with a pair of spin

goes as fol-

lows:

兩

2,0

典

⫽

兩

↑↑

典

兩

0,2

典

⫽

兩

↓↓

典

, (18)

兩

1,1

典

⫽

␺

(⫹ )

⫽

共

兩

↑↓

典

⫹

兩

↓↑

典

). (19)

Tracing over the ampliﬁer (i.e., the two-level atom), an

(ideal) ampliﬁer achieves the following transformation:

↑

→2P

↑↑

⫹ P

␺

(⫹ ), (20)

where the P’s indicate projectors (i.e., pure-state density

matrices) and the lack of normalization results from the

ﬁrst-order expansion used in Eqs. (11)–(14). Accord-

ingly, after normalization, each photon is in the state

1⫺ ph mode

冉

↑↑

⫹ P

␺

(⫹ )

冊

⫽

↑

⫹

. (21)

The corresponding ﬁdelity is

F⫽

2⫹

⫽

, (22)

which is precisely the optimal ﬁdelity compatible with

quantum mechanics (Buz

ek and Hillery, 1996; Gisin and

Massar, 1997; Bruss et al., 1998). In other words, if we

start with a single photon in an arbitrary state and pass it

through an ampliﬁer, then due to the effect of spontane-

ous emission the ﬁdelity of the state exiting the ampli-

ﬁer, when it consists of exactly two photons, with the

initial state will be equal to at most 5/6. Note that if it

were possible to make better copies, then signaling at

arbitrarily fast speed, using EPR correlations between

spatially separated systems, would also be possible (Gi-

sin, 1998).

III. TECHNOLOGICAL CHALLENGES

The very ﬁrst demonstration of QC was a table-top

experiment performed at the IBM laboratory in the

early 1990s over a distance of 30 cm (Bennett, Bessette,

et al., 1992), marking the start of a series of impressive

experimental improvements over the past few years.

The 30-cm distance is of little practical interest. Either

the distance should be even shorter [think of a credit

card and an ATM machine (Huttner, Imoto, and Bar-

nett, 1996), in which case all of Alice’s components

should ﬁt on the credit card—a nice idea, but still im-

practical with present technology] or the distance should

be much longer, at least in the kilometer range. Most of

the research so far uses optical ﬁbers to guide the pho-

tons from Alice to Bob, and we shall mainly concentrate

on such systems here. There is also, however, some very

signiﬁcant research on free-space systems (see Sec.

IV.E).

Once the medium has been chosen, there remain the

questions of the source and detectors. Since they have to

be compatible, the crucial choice is that of the wave-

length. There are two main possibilities. Either one

chooses a wavelength around 800 nm, for which efﬁcient

photon counters are commercially available, or one

chooses a wavelength compatible with today’s telecom-

munications optical ﬁbers, i.e., near 1300 or 1550 nm.

The ﬁrst choice requires free-space transmission or the

use of special ﬁbers, hence the installed telecommunica-

tions networks cannot be used. The second choice re-

quires the improvement or development of new detec-

tors, not based on silicon semiconductors, which are

transparent above a wavelength of 1000 nm.

In the case of transmission using optical ﬁbers, it is

still unclear which of the two alternatives will turn out to

be the best choice. If QC ﬁnds niche markets, it is con-

ceivable that special ﬁbers will be installed for that pur-

pose. But it is equally conceivable that new commercial

detectors will soon make it much easier to detect single

photons at telecommunications wavelengths. Actually,

the latter possibility is very likely, as several research

groups and industries are already working on it. There is

another good reason to bet on this solution: the quality

of telecommunications ﬁbers is much higher than that of

any special ﬁber; in particular, the attenuation is much

lower (this is why the telecommunications industry

chose these wavelengths): at 800 nm, the attenuation is

about 2 dB/km (i.e., half the photons are lost after 1.5

km), while it is only of the order of 0.35 and 0.20 dB/km

at 1300 and 1550 nm, respectively (50% loss after about

9 and 15 km).

In the case of free-space transmission, the choice of

wavelength is straightforward, since the region where

good photon detectors exist—around 800 nm—coincides

with that where absorption is low. However, free-space

transmission is restricted to line-of-sight links and is very

weather dependent.

In the next sections we successively consider the ques-

tions of how to produce single photons (Sec. III.A), how

to transmit them (Sec. III.B), how to detect single pho-

tons (Sec. III.C), and ﬁnally how to exploit the intrinsic

randomness of quantum processes to build random gen-

erators (Sec. III.D).

A. Photon sources

Optical quantum cryptography is based on the use of

single-photon Fock states. Unfortunately, these states

are difﬁcult to realize experimentally. Nowadays, practi-

cal implementations rely on faint laser pulses or en-

tangled photon pairs, in which both the photon and the

photon-pair number distribution obey Poisson statistics.

The losses in dB (l

) can be calculated from the losses in

percent (l

): l

⫽⫺10 log

关

1⫺ (l

/100)

兴

155

Gisin

et al.

: Quantum cryptography

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

剩余50页未读，继续阅读

zhchpku

粉丝: 0
资源: 2

量子密码学：理论、实验与应用

quantum cryptography

Quantum Cryptography and Secret

Tight Finite-Key Analysis for Quantum Cryptography

"Post-Quantum Cryptography: A Ten-Year Survey" by Daniele Micciancio et al. 的引用格式

《后量子密码关键技术及IP研究》课题，利用EBSCO数据库的“高级检索”功能并用英文编制检索式。

TensorFlow PQC参数多

近五年有关加密算法的有关文献

帮我写一段用基础函数实现的基于整数多项式环的NTRU数字签名的MATLAB代码

crystals-dilithium python实现代码

使用编程方法求出最早的合数世纪的算法思想

最新资源