a

nd

wos fromsecure key.or rotations

Physics Letters A 349 (2006) 53–58

www.elsevier.com/locate/pl

Quantum key distribution without alternative measurements arotations✩

Fei Gaoa,b,∗, Fen-Zhuo Guoa, Qiao-Yan Wena, Fu-Chen Zhuc

a School of Science, Beijing University of Posts and Telecommunications, Beijing 100876, Chinab State Key Laboratory of Integrated Services Network, Xidian University, Xi’an 710071, China

c National Laboratory for Modern Communications, P.O. Box 810, Chengdu 610041, China

Received 12 July 2005; received in revised form 1 September 2005; accepted 5 September 2005

Available online 16 September 2005

Communicated by P.R. Holland

Abstract

A quantum key distribution protocol based on entanglement swapping is proposed. Through choosing particles by tthe sequence and performing Bell measurements, two communicators can detect eavesdropping and obtain theBecause the two particles measured together are selected out randomly, we need neither alternative measurements nof the Bell states to obtain security. 2005 Elsevier B.V. All rights reserved.

PACS: 03.67.-a; 03.67.Dd; 03.65.Ud

Keywords: Quantum key distribution; Quantum cryptography; Entanglement swapping

on,

tionforrant

foranton of

og-ap-of

ure-iffer-ar-

-re-thero-the

1. Introduction

As a kind of important resource, entanglement[1]is widely used in the research of quantum informati

✩ Supported by the National Natural Science Foundaof China, Grant No. 60373059; the National LaboratoryModern Communications Science Foundation of China, GNo. 51436020103DZ4001; the National Research Foundationthe Doctoral Program of Higher Education of China, GrNo. 20040013007; the Graduate Students Innovation FoundatiBUPT; and the ISN Open Foundation.

* Corresponding author.E-mail address: hzpe@sohu.com(F. Gao).

0375-9601/$ – see front matter 2005 Elsevier B.V. All rights reserveddoi:10.1016/j.physleta.2005.09.012

including quantum communication, quantum cryptraphy and quantum computation. Entanglement swping [2], abbreviated by ES, is a nice propertyentanglement. That is, by appropriate Bell measments, entanglement can be swapped between dent particles. For example, consider two pairs of pticles in the state of|Φ+〉, equivalently,|Φ+〉12 =|Φ+〉34 = 1/

√2(|00〉+|11〉), where the subscripts de

note different particles. If we make a Bell measument on 1 and 3, they will be entangled to one ofBell states. Simultaneously, 2 and 4 will be also pjected onto a corresponding Bell state. We can findpossible results through the following process:

.

54 F. Gao et al. / Physics Letters A 349 (2006) 53–58

ults:

ithn

an-da-un-)

og-first

pro-d

as

,

re

edure-

pingl.na-c-

s:

-

le

e,kes

ea-

er-airs,ple,the

ut-

ob-an

isrs inext

tsedmly.airsressedsultsan

ple,,ri-d

isthis,ica-s. Ititialal-

erbit-thekey

|Φ+〉12 ⊗ |Φ+〉34

= 1

2

(|00〉 + |11〉)12 ⊗ (|00〉 + |11〉)34

= 1

2

(|0000〉 + |0101〉 + |1010〉 + |1111〉)1324

= 1

2

(|Φ+Φ+〉 + |Φ−Φ−〉 + |Ψ +Ψ +〉(1)+ |Ψ −Ψ −〉)1324.

It can be seen that there are four possible res|Φ+〉13|Φ+〉24, |Φ−〉13|Φ−〉24, |Ψ +〉13|Ψ +〉24 and|Ψ −〉13|Ψ −〉24. Furthermore, these results appear wequal probability, that is, 1/4. For further discussioabout ES, please see Refs.[3–6].

Quantum cryptography is the combination of qutum mechanics and cryptography. It employs funmental theories in quantum mechanics to obtainconditional security. Quantum key distribution (QKDis an important research direction in quantum cryptraphy. Bennett and Brassard came up with theQKD protocol (BB84 protocol) in 1984[7]. After-wards, many protocols were presented[8–22]. Re-cently, several QKD schemes based on ES wereposed[23–30]. In Refs.[23–25]the author introducea protocol without alternative measurements. It wsimplified [26] and generalized[27] before long, andits security was proved in Ref.[28]. Besides, by ESdoubly entangled photon pairs[29] and previouslyshared Bell states[30] can be used to distribute secukey.

In this Letter we propose a QKD protocol bason ES, which needs neither alternative measments[29] nor rotations of the Bell states[25–27]. Thesecurity against the attack discussed in Ref.[24] is as-sured by a special technique, that is, random grou(RG). See Section2 for the details of this protocoThe security against general individual attack is alyzed in Section3 and a conclusion is given in Setion 4.

2. The QKD protocol

The particular process of this scheme is as follow

1. Prepare the particles. Alice generates a sequence of EPR pairs in the state|Φ+〉AB = 1/

√2×

(|00〉 + |11〉). For each pair, Alice stores one particand sends the other to Bob.

2. Detect eavesdropping.(1) Having received all the particles from Alic

Bob randomly selects a set of particles out and maBell measurements on them by twos.

(2) Bob tells Alice the sequence numbers and msurement results of the pairs he measured.

(3) According to the sequence numbers, Alice pforms Bell measurements on the corresponding pand compares her results with Bob’s. For examconsider one of the pairs Bob measured, in whichsequence numbers of the two particles arem andn,respectively. Then Alice measures hermth and nthparticles in Bell basis, and compares the two ocomes. As discussed in Section1, if these particleswere not eavesdropped, Alice and Bob shouldtain the same results. With this knowledge, Alice cdetermine, through the error rate, whether thereany eavesdropping. If there are no eavesdroppethe channel, Alice and Bob proceed with the nstep.

3. Obtain the key. Bob makes Bell measuremenon his left particles by twos. It should be emphasizthat each pair he measures is selected out randoBob records the sequence numbers of all these pand sends the record to Alice. Alice then measuher corresponding particles in Bell basis. As discusin the above paragraphs, their measurement rewould be identical. Subsequently, Alice and Bob cobtain the raw key from these results. For exam|Φ+〉, |Φ−〉, |Ψ +〉 and|Ψ −〉 are encoded into 00, 0110 and 11, respectively. After error correction and pvacy amplification[32], the raw key will be processeinto ideal secret key.

Thus the whole QKD protocol is finished. By thprocess, Alice and Bob can obtain secure key. Inscheme, we use|Φ+〉 as the initial state. In practiceany other Bell state is competent and the communtors can even utilize various states for different pairshould be emphasized that, however, the various instates cannot improve the efficiency of QKD (theleged “high efficiency” in Ref.[30] is a mistake[31]).In fact, our protocol works in a deterministic mannand then has full efficiency in the sense that one qutransmission brings one key bit. That is, except fordetection particles, the users can obtain 1 bit (raw)

F. Gao et al. / Physics Letters A 349 (2006) 53–58 55

er

ation-lateurely)rti-ndobis

ob-irsursi-chhe

I

e beim-ingre-andple,e pab’st inpar-etves

useith

tan-ndthere-gerro-

el isces

veo-hatpar-

iteor-

d Eve,notesweaingiche

in-ce

de-

s,

l)ions

.

per qubit-transmission in our protocol, which is highthan the BB84 protocol (0.5 bit).

To compare the efficiency of our protocol with thof others deeply, we can employ Cabello’s definitof QKD efficiency [19]. Let us give a simple example to implement the above protocol and then calcuits efficiency. Suppose Alice and Bob deal with foEPR pairs (denoted as pairs 1, 2, 3, 4, respectivin one step. More specifically, Alice sends four pacles (each from one of the four EPR pairs) to Bob aannounces a classical (random) bit (0 or 1) after Breceived this group of particles. If the classical bit0, they perform ES on the pairs 1, 3 and 2, 4 totain the key. Otherwise they perform ES on the pa1, 4 and 2, 3. In this example, Alice and Bob get fokey bits by transmitting four qubit and one cbit (clascal bit). Obviously, the efficiency equals to 0.8, whiis relatively higher. (For instance, the efficiency of tfamous protocols in Refs.[9,7,11,8,13,23]is < 0.25,0.25, � 0.33, 0.5, 0.5, 0.67, respectively. See Tablein Ref. [19] for details.)

3. Security

The above scheme can be regarded as securcause the key distributed cannot be eavesdroppedperceptively. There are two general eavesdroppstrategies for Eve. One is called “intercept andsend”, that is, Eve intercepts the legal particlesreplaces them by her counterfeit ones. For examEve generates the same EPR pairs and sends onticle from each pair to Bob, thus she can judge Bomeasurement results as Alice does in step 3. Buthis case there are no correlations between Alice’sticles and the counterfeit ones. Alice and Bob will grandom measurement results when they detect eadropping in step 2. Suppose both Alice and Bobs pairs to detect eavesdropping, the probability wwhich they obtain the same results is only(1/4)s . Thatis, Eve will be detected with high probability whensis big enough. The second strategy for Eve is to engle an ancilla with the two-particle state that Alice aBob are using. At some later time she can measureancilla to gain information about the measurementsults of Bob. This kind of attack seems to be stronthan the first strategy. However, it is invalid to our ptocol as we prove below.

-

r-

-

Because each particle transmitted in the channin a maximally mixed state, there are no differenamong all these particles for Eve. Furthermore, Edoes not know which two particles Bob will put tgether to make a Bell measurement. As a result, wshe can do is to make the same operation on eachticle. Let |ϕ〉ABE denote the state of the compossystem including one certain EPR pair and the cresponding ancilla, where the subscripts A, B anexpress the particles belonging to Alice, Bob and Erespectively. Note that each ancilla’s dimension islimited here, and Eve is permitted to build all devicallowed by the laws of quantum mechanics. Whatwant to show is that|ϕ〉ABE must be a product oftwo-particle state and the ancilla if the eavesdroppintroduces no errors into the QKD procedure, whimplies that Eve will gain no information about thkey by observing the ancilla. Conversely, if gainingformation about the key, Eve will invariably introduerrors.

Without loss of generality, suppose the Schmidtcomposition[33] of |ϕ〉ABE is in the form

|ϕ〉ABE = a1|ψ1〉AB |φ1〉E + a2|ψ2〉AB |φ2〉E

(2)+ a3|ψ3〉AB |φ3〉E + a4|ψ4〉AB |φ4〉E,

where|ψi〉 and|φj 〉 are two sets of orthonormal stateak are nonnegative real numbers (i, j, k = 1,2,3,4).

Because|ψi〉 are two-particle (four-dimensionastates, they can be written as the linear combinatof |00〉, |01〉, |10〉 and|11〉. Let

|ψ1〉 = b11|00〉 + b12|01〉 + b13|10〉 + b14|11〉,|ψ2〉 = b21|00〉 + b22|01〉 + b23|10〉 + b24|11〉,|ψ3〉 = b31|00〉 + b32|01〉 + b33|10〉 + b34|11〉,

(3)|ψ4〉 = b41|00〉 + b42|01〉 + b43|10〉 + b44|11〉,where bpq (p,q = 1,2,3,4) are complex numbersThen|ϕ〉ABE can be written, thanks to Eqs.(2) and (3),as

|ϕ〉ABE = |00〉AB ⊗ (a1b11|φ1〉 + a2b21|φ2〉

+ a3b31|φ3〉 + a4b41|φ4〉)E

+ |01〉AB ⊗ (a1b12|φ1〉 + a2b22|φ2〉

+ a3b32|φ3〉 + a4b42|φ4〉)E

+ |10〉AB ⊗ (a1b13|φ1〉 + a2b23|φ2〉

+ a3b33|φ3〉 + a4b43|φ4〉)

E

56 F. Gao et al. / Physics Letters A 349 (2006) 53–58

tum

nd

anle

andm-

in

veob,

re-

d inow

eis.lds,

eent

Evewesult

+ |11〉AB ⊗ (a1b14|φ1〉 + a2b24|φ2〉

(4)+ a3b34|φ3〉 + a4b44|φ4〉)E.

For convenience, we define four vectors (not quanstates) as follows:

(5)vl = (a1b1l , a2b2l , a3b3l , a4b4l ) l = 1,2,3,4.

Consider any two sets of particles on which Alice aBob will do ES, the state of the system is|ϕ〉ABE ⊗|ϕ〉ABE. According to the properties of ES, we ccalculate the probability with which each possibmeasurement-results-pair is obtained after AliceBob measured their particles in Bell basis. For exaple, observe the event that Alice gets|Φ+〉 and Bobgets|Ψ +〉, which corresponds to the following itemthe expansion:

1

2|Φ+〉A |Ψ +〉B ⊗

[4∑

r,s=1

(arbr1asbs2 + arbr2asbs1

(6)+ arbr3asbs4 + arbr4asbs3)|φrφs〉E

].

Therefore, this event occurs with the probability

P(Φ+A Ψ +

B ) = 1

4

4∑r,s=1

|arbr1asbs2 + arbr2asbs1

(7)+ arbr3asbs4 + arbr4asbs3|2.However, this event should not occur. In fact, if Ewants to escape from the detection of Alice and Bany results-pair other thanΦ+Φ+, Φ−Φ−, Ψ +Ψ +and Ψ −Ψ − should not appear. LetP(Φ+

A Ψ +B ) = 0,

we then have, from Eqs.(7) and (5),

(8)vT1 v2 + vT

2 v1 + vT3 v4 + vT

4 v3 = 0

in whichvTl is the transpose ofvl .

Similarly, let the probabilities ofΦ+A Ψ −

B , Φ−A Ψ +

BandΦ−

A Ψ −B equal to 0, we get

(9)vT1 v2 − vT

2 v1 + vT3 v4 − vT

4 v3 = 0,

(10)vT1 v2 + vT

2 v1 − vT3 v4 − vT

4 v3 = 0,

(11)vT1 v2 − vT

2 v1 − vT3 v4 + vT

4 v3 = 0.

From Eqs.(8)–(11), we can obtain

(12)vT1 v2 = vT

2 v1 = vT3 v4 = vT

4 v3 = 0.

That is,

(13)

{v1 = 0 or v2 = 0,

v3 = 0 or v4 = 0.

For the same reason, we can obtain the followingsults:

(1) Let the probabilities ofΨ +A Φ+

B , Ψ +A Φ−

B , Ψ −A Φ+

BandΨ −

A Φ−B equal to 0, we can get

(14)

{v1 = 0 or v3 = 0,

v2 = 0 or v4 = 0.

(2) Let the probabilities ofΦ+A Φ−

B and Φ−A Φ+

Bequal to 0, we then have

(15)vT1 v1 − vT

2 v2 + vT3 v3 − vT

4 v4 = 0,

(16)vT1 v1 + vT

2 v2 − vT3 v3 − vT

4 v4 = 0.

And then

(17){

v1 = ±v4,

v2 = ±v3.

(3) Let the probabilities ofΨ +A Ψ −

B and Ψ −A Ψ +

Bequal to 0, we can get the same conclusion as Eq.(17).

Finally, we can obtain three results from Eqs.(13),(14) and (17):

1. v1 = v2 = v3 = v4 = 0;2. v1 = v4 = 0 andv2 = ±v3;3. v2 = v3 = 0 andv1 = ±v4.

That is, each of these results makes Eve succeeescaping from the detection of Alice and Bob. Nwe observe what the state|ϕ〉ABE is by putting theseresults into Eq.(4). If the first result holds, we hav|ϕ〉ABE = 0, which is meaningless for our analysConsider the condition where the second result ho|ϕ〉ABE can be written as:

|ϕ〉ABE = (|01〉 ± |10〉)AB ⊗ (a1b12|φ1〉 + a2b22|φ2〉

(18)+ a3b32|φ3〉 + a4b42|φ4〉)E.

It can be seen that|ϕ〉ABE is a product of a two-particlstate and the ancilla. That is, there is no entanglembetween Eve’s ancilla and the legal particles, andcan obtain no information about the key. Similarly,can draw the same conclusion when the third reholds.

F. Gao et al. / Physics Letters A 349 (2006) 53–58 57

ef-the

ob

re-keinaldenher

hus

n-te

n-etre-

lity

d as-

no

re-n-

p one--ptshern.rop-

olssedad

esary

col.obin

pro-f en-

atalor,tes.edsure-

tainof

ent

77.

From another point of view, we can derive anfective relation between the errors introduced inkey and the information gained by Eve as in Ref.[34].Consider any two EPR pairs on which Alice and Bwill perform ES, for example,Φ+

12 and Φ+34, where

particles 1, 3 and 2, 4 belong to Alice and Bob,spectively. As we know, when Alice and Bob maBell measurements on these particles, the margstatistics of the measurement results are indepenof the measurement order. Suppose Alice makesmeasurement before Bob, the state of 2, 4 will tbe projected onto one of the Bell states|ξ 〉. Becauseof Eve’s intervention, these two particles will be etangled into Eve’s ancilla and it follows that the sta|ξ 〉 becomes a mixed stateρ. The information Bobcan gain fromρ is bounded by the Holevo quatity χ(ρ) [33]. Let IEve denote the information Evcan obtain, thenIEve � χ(ρ). (Obviously, Eve cannogain more information about Bob’s measurementsult than Bob.) From

(19)χ(ρ) = S(ρ) −∑

i

piS(ρi)

we knowS(ρ) is the upper bound ofχ(ρ). “High fi-delity implies low entropy”[34]. Suppose

(20)F(|ξ 〉, ρ)2 = 〈ξ |ρ|ξ 〉 = 1− γ,

whereF(|ξ 〉, ρ) is the fidelity[35] of the states|ξ 〉 andρ, 0� γ � 1. Therefore, the entropy ofρ is boundedabove by the entropy of a diagonal density matrixρmaxwith diagonal entries 1− γ , γ /3, γ /3, γ /3. The en-tropy ofρmax is

(21)S(ρmax) = −(1− γ ) log2(1− γ ) − γ log2γ

3.

Then we have

(22)IEve� −(1− γ ) log2(1− γ ) − γ log2γ

3.

Let us discuss the connection between the fideF(|ξ 〉, ρ) and the detection probabilityd . When Aliceand Bob detect eavesdropping, only|ξ 〉 is the correctresult, whereas any other Bell state will be regardean error. SinceF(|ξ 〉, ρ)2 = 1−γ , the detection probability d = γ . From Eq.(22), we get

(23)IEve� −(1− d) log2(1− d) − d log2d

3.

It can be seen from this relation that whend = 0, i.e.,Eve introduces no error to the key, she will obtain

t

information, which is in agreement with the abovesult. Whenγ > 0, i.e., Eve can gain some of Bob’s iformation, but she has to face a nonzero riskd = γ ofbeing detected. Whenγ = 3/4, we haveS(ρmax) = 2,which implies that Eve has the chance to eavesdroall of Bob’s information. In this case, however, the dtection probability is no less than 3/4 per ES for eavesdropping detection. For example, when Eve interceall the particles and resends new particles fromown EPR pairs, she will get all of the informatioabout Bob’s key while introduce 3/4 error rate per ES

To sum up, our protocol can resist the eavesdping with ancilla.

4. Conclusion

We have presented a full-efficiency QKD protocbased on ES. The security against the attack discuin Ref. [24] is assured by the technique of RG insteof requiring alternative measurements[29] or rotationsof the Bell states[25–27]. Furthermore, this techniqubrings us another advantage. That is, it is unnecesto randomize the initial Bell states as in Refs.[23,25],which leads to less Bell measurements in our protoFor instance, to distribute two key bits, Alice and Bmake two Bell measurements in our protocol, whileRefs.[23,25] they must make three.

On the other hand, we have to confess that ourtocol has a disadvantage, i.e., it uses a sequence otangled states instead of a single quantum system[25–27] to generate the key. Nevertheless, it is not a fproblem. Many QKD protocols work in this model, fexample, the famous E91 protocol[8]. Furthermoreeach pair of particles is still in one of the Bell staand can be reused in other applications after QKD

In practical implementations, our scheme necomplete Bell states analysis. Though Bell measment has not been generally accomplished[36], itwas experimentally realized based on some certechniques[37–39]. Furthermore, the realizationsentanglement swapping has been proposed[6,40].Therefore, our scheme is within the reach of currtechnology.

References

[1] A. Einstein, B. Podolsky, N. Rosen, Phys. Rev. 47 (1935) 7

58 F. Gao et al. / Physics Letters A 349 (2006) 53–58

v.

v.

.ys.

ev.

na-cess-

1.9.5)

od.

3.ett.

01.

5.

ss.

4

an-.

her,

ev.

03)

05)

al.,

[2] M. Zukowski, A. Zeilinger, M.A. Horne, et al., Phys. ReLett. 71 (1993) 4287.

[3] A. Zeilinger, M.A. Horne, H. Weinfurter, et al., Phys. ReLett. 78 (1997) 3031.

[4] S. Bose, V. Vedral, P.L. Knight, Phys. Rev. A 57 (1998) 822[5] V. Karimipour, A. Bahraminasab, S. Bagherinezhad, Ph

Rev. A 65 (2002) 042320.[6] J. Pan, D. Bouwmeester, H. Weinfurter, et al., Phys. R

Lett. 80 (1998) 3891.[7] C.H. Bennett, G. Brassard, in: Proceedings of IEEE Inter

tional Conference on Computers, Systems and Signal Proing, Bangalore, India, IEEE, New York, 1984, p. 175.

[8] A.K. Ekert, Phys. Rev. Lett. 67 (1991) 661.[9] C.H. Bennett, Phys. Rev. Lett. 68 (1992) 3121.

[10] C.H. Bennett, S.J. Wiesner, Phys. Rev. Lett. 69 (1992) 288[11] L. Goldenberg, L. Vaidman, Phys. Rev. Lett. 75 (1995) 123[12] B. Huttner, N. Imoto, N. Gisin, et al., Phys. Rev. A 51 (199

1863.[13] M. Koashi, N. Imoto, Phys. Rev. Lett. 79 (1997) 2383.[14] D. Bruß, Phys. Rev. Lett. 81 (1998) 3018.[15] G.L. Long, X.S. Liu, Phys. Rev. A 65 (2002) 032302.[16] S.J.D. Phoenix, S.M. Barnett, P.D. Townsend, et al., J. M

Opt. 42 (1995) 1155.[17] P. Xue, C.F. Li, G.C. Guo, Phys. Rev. A 65 (2002) 022317.[18] H.-K. Lo, H.F. Chan, M. Ardehali, quant-ph/0011056.[19] A. Cabello, Phys. Rev. Lett. 85 (2000) 5635.[20] B.S. Shi, L. Jian, J.M. Liu, et al., Phys. Lett. A 281 (2001) 8[21] W.T. Buttler, J.R. Torgerson, S.K. Lamoreaux, Phys. L

A 299 (2002) 38.

[22] G.C. Guo, B.S. Shi, Phys. Lett. A 256 (1999) 109.[23] A. Cabello, Phys. Rev. A 61 (2000) 052312.[24] Y.S. Zhang, C.F. Li, G.C. Guo, Phys. Rev. A 63 (2001) 0363[25] A. Cabello, Phys. Rev. A 64 (2001) 024301.[26] D. Song, Phys. Rev. A 69 (2004) 034301.[27] A. Cabello, quant-ph/0009025.[28] J. Lee, S. Lee, J. Kim, et al., Phys. Rev. A 70 (2004) 03230[29] Z. Zhao, T. Yang, Z.B. Chen, et al., quant-ph/0211098.[30] C. Li, H.S. Song, L. Zhou, et al., J. Opt. B: Quantum Semicla

Opt. 5 (2003) 155.[31] S. Qin, Q. Wen, F. Zhu, quant-ph/0507002.[32] N. Gisin, G. Ribordy, W. Tittel, et al., Rev. Mod. Phys. 7

(2002) 145.[33] M.A. Nielsen, I.L. Chuang, Quantum Computation and Qu

tum Information, Cambridge Univ. Press, Cambridge, 2000[34] Q. Cai, B. Li, Phys. Rev. A 69 (2004) 054301.[35] C.A. Fuchs, quant-ph/9601020;

H. Barnum, C.M. Caves, C.A. Fuchs, R. Jozsa, B. SchumacPhys. Rev. Lett. 76 (1996) 2818.

[36] N. Lütkenhaus, J. Calsamiglia, K.-A. Suominen, Phys. RA 59 (1999) 3295.

[37] Y.-H. Kim, Phys. Rev. A 67 (2003) 040301.[38] S.P. Walborn, S. Pádua, C.H. Monken, Phys. Rev. A 68 (20

042313.[39] S.D. Barrett, P. Kok, K. Nemoto, et al., Phys. Rev. A 71 (20

060302.[40] H. de Riedmatten, I. Marcikic, J.A.W. van Houwelingen, et

Phys. Rev. A 71 (2005) 050302.