1. Marcos Curty 1,2 Coauthors: Tobias Moroder 2,3, and Norbert Lütkenhaus 2,3 1.Center for Quantum Information and Quantum Control (CQIQC), University of Toronto 2.Institute for Quantum Computing, University of Waterloo 3.Max-Plank-Forschungsgruppe, Institut für Optik, Information und Photonik, Universität Erlangen-Nürnberg On One-way and Two-way Classical Post- Processing Quantum Key Distribution

2. Quantum Key Distribution (QKD) Precondition for secure QKD (Two-way & One-way) Witness Operators (Two-way & One-way QKD) Semidefinite Programming Evaluation Overview

3. Quantum Key Distribution (QKD) Phase I: Physical Set-Up Mathematical Model AiAi BjBj Pr(A i,B j )=Tr(A i B j )  AB  AB =  i Pr(A i ) 1/2  A i  A i  with  AB =  AB  AB BjBj  A i  Pr(A i,B j )=Pr(A i )Tr(B j )  A i  A i  Reduced density matrix of Alice fixed Add:  A = Tr B (  AB ) A i 1 

4. Quantum Key Distribution (QKD) Phase II: Classical Communication Protocol Pr(A i,B j ) Secret key Advantage distillation (e.g. announcement of bases in BB84 protocol) Error Correction (  Alice and Bob share the same key) Privacy Amplification (  generates secret key shared by Alice and Bob) Authenticated Classical Channel Two-way

5. Quantum Key Distribution (QKD) Phase II: Classical Communication Protocol Pr(A i,B j ) Secret key Advantage distillation (e.g. announcement of bases in BB84 protocol) Error Correction (  Alice and Bob share the same key) Privacy Amplification (  generates secret key shared by Alice and Bob) Authenticated Classical Channel One-way (Reverse Reconciliation: RR)

6. Quantum Key Distribution (QKD) Phase II: Classical Communication Protocol Pr(A i,B j ) Secret key Advantage distillation (e.g. announcement of bases in BB84 protocol) Error Correction (  Alice and Bob share the same key) Privacy Amplification (  generates secret key shared by Alice and Bob) Authenticated Classical Channel One-way (Direct communication: DC)

7. Quantum Key Distribution (QKD) Which type of correlations Pr(A i,B j ) are useful for QKD? secret bits per signal Distance (channel model) Not secure (proven) Protocol independent Regime of Hope secure (proven) protocol Talk: T. Moroder This talk Talk: G. O. Myhr

8. Precondition for Secure QKD Theorem (Two-way QKD)  AB Pr(A i,B j )  AB separable No Key MC, M. Lewenstein and N. Lütkenhaus, Phys. Rev. Lett. 92, 217903 (2004) AiAi BjBj  AB is separable if  AB =  i p i |a i  a i | A  |b i  b i | B

9. Precondition for Secure QKD Theorem (One-way QKD)  AB Pr(A i,B j )  AB has a symmetric extension to two-copies of system B (A), then the secret key rate for direct communication (reverse reconciliation) vanishes. T. Moroder, MC and N. Lütkenhaus, quant-ph/0603270. AiAi BjBj

10. Precondition for Secure QKD  AB with symmetric extension to two copies of system B  AB Tr E (  ABE )=  AB  ABE AB E AB E  AB AB E Tr B (  ABE )=  AE =  AB  AB

11. Witness Operators (Two-way QKD)  AB separable? Tr  W  AB  < 0 Tr  W  AB   0   AB comp.with separable Witness Operators Tr  W  AB  =  ij c ij P(A i,B j ) MC, M. Lewenstein and N. Lütkenhaus, Phys. Rev. Lett. 92, 217903 (2004) MC, O. Gühne, N. Lewenstein, N. Lütkemhaus, Phys. Rev. A 71, 022306 (2005)  restricted knowledge compatible with sep. verifiable entangled  AB W Accesible witnesses: W =  ij c ij A i  B j Optimal W opt W opt

12. Witness Operators (One-way QKD)  AB symmetric extension? T. Moroder, MC and N. Lütkenhaus, quant_ph/0603270. Tr  W  AB  =  ij c ij P(A i,B j ) Tr  W  AB  < 0 Tr  W  AB   0   AB comp. with symmetric extension  restricted knowledge compatible with symmetric extension. Without symmetric extension  AB W opt Witness Operators Accesible witnesses: W =  ij c ij A i  B j

13. Witness Operators (Two-way QKD) Evaluation: 4-state QKD protocol Uses two mutually unbiased bases: e.g. X,Z direction in Bloch sphere |0  |1  |1|1 |0|0 Error Rate: 36 % 0.07987 0.04516 0.00913 0.11591 0.04508 0.07986 0.11593 0.00901 0.11599 0.00909 0.08001 0.04507 0.00897 0.11593 0.04505 0.07985 01010101 0 1 A\B Pr(A i,B j ) |  e  =cos(X)|00  +sin(X)(cos(Y)|01  +sin(Y)(cos(Z)|10  +sin(Z)|11  )) Systematic Search MC, M. Lewenstein and N. Lütkenhaus, Phys. Rev. Lett. 92, 217903 (2004) W 4 = 1/2(|  e  e | + |  e  e |  )

14. Witness Operators (Two-way QKD) (only parameter combinations leading to negative expectation values are marked) MC, O. Gühne, N. Lewenstein, N. Lütkemhaus, Phys. Rev. A 71, 022306 (2005) MC, O. Gühne, N. Lewenstein, N. Lütkemhaus, Proc. SPIE Int. Soc. Opt. Eng. 5631, 9-19 (2005). J. Eisert, P. Hyllus, O. Gühne, MC, Phys. Rev. A 70, 062317 (2004). Evaluation: 4-state QKD protocol Tr  W  AB  =  ij c ij P(A i,B j ) Other QKD protocols (including higher dimensional QKD schemes)

15. Witness Operators (Two-way and One-way QKD) One witness: Sufficient condition as a first step towards the demonstration of the feasibility of a particular experimental implementation of QKD. This criterion is independent of any chosen communication protocol in Phase II. All witnesses: Systematic search for quantum correlations (or symmetric extensions) for a given QKD setup. Ideally the main goal is to obtain a compact description of a minimal verification set of witnesses (Necessary-and Sufficient). Advantages: Witnesses operators Disadvantages: Witnesses operators Too many tests: To guarantee that no secret key can be obtained from the observed data it is necessary to test all the members of the minimal verification set. How to find them?: To find a minimal verification set of EWs, even for qubit-based QKD schemes, is not always an easy task, and it seems to require a whole independent analysis for each protocol.

16. Semidefinite Programming (SDP) Primal problem minimise c T x subject to F 0 +  i x i F i ≥ 0 with x=(x 1,..., x t ) T the objective variable, c is fixed by the optimisation problem, and the matrices F i are Hermitian SDPs can be efficiently solved Equivalent class of states S S = {  AB such as Tr(A i  B j  AB ) = Pr(A i,B j )  i,j} Qubit-based QKD (with losses):  AB  H 2  H 3

17. Semidefinite Programming (SDP) Two-way QKD  AB  S with  AB   0 No Key  AB Pr(A i,B j ) AiAi BjBj SDP Feasibility problem c = 0 minimise 0 subject to  AB (x)  0  AB  (x)  0 S  AB (x)  S MC, T. Moroder, and N. Lütkenhaus, in preparation (2006)

18. Dual problem maximise -Tr(F 0 Z) subject to Z ≥ 0 Tr(F i Z) = c i for all i where the Hermitian Z is the objective variable Semidefinite Programming (SDP) SDP: One-way QKD MC, T. Moroder, and N. Lütkenhaus, in preparation (2006) minimise 0 S subject to  AB (x)  S P  ABA’ (x)P =  ABA’ (x)  ABA’ (x)  0 Tr A’ [  ABA’ (x)] =  AB (x) with P the swap operator: P|ijk  ABA’ = |kji  ABA’ Dual problem (one way & two-way)  Witness operator optimal for Pr(A i,B j )

19. Evaluation We need experimental data  Pr(A i,B j ) Channel Model:  AB = (1-p) [ (1-e)|  AB  |+e/2  A  1 B ] + p  A  |vac  B  vac| p: probability Bob receives the vacuum state |vac  B e: depolarizing rate 1 B : 1 B - |vac  B  vac|

20. Evaluation Six-state protocol: |0  0|00|0 |1  |0  1|11|1 Alice and Bob: Bruß, Phys. Rev. Lett. 81, 3018 (1998). Four-state protocol: |0  0|00|0 |1  1|11|1 Alice and Bob: C.H. Bennett and G. Brassard, Proc. IEEE Int. Conf. On Computers, System and Signal Processing, 175 (1984). QBER: 33 % QBER: 16.66 % H. Bechmann-Pasquinucci, and N. Gisin, Phys. Rev. A 59, 4238 (1999). QBER: 25 % QBER: 14.6 % C. A. Fuchs, N. Gisin, R. B. Griffiths, C.-S. Niu, and A. Peres, Phys. Rev. A 56, 1163 (1997); J. I. Cirac, and N. Gisin, Phys. Lett. A 229, 1 (1997).

21. Evaluation Two-state protocol: Alice: |  0  =  |0  +  |1  |  1  =  |0  -  |1  C. H. Bennett, Phys. Rev. Lett. 68, 3121 (1992). Bob: B 0 = 1/(2  2 )|  1   1  | B 1 = 1/(2  2 )|  0   0  | B ? = |0  0|+|1  1|-B 0 -B 1 B vac = |vac  vac| Limit USD p  1-2  2 e=0 Four-plus-two-state protocol: |0  |1  |0  Like 2 two-state protocols: B. Huttner, N. Imoto, N. Gisin, and T. Mor, Phys. Rev. A 51, 1863 (1995). Inflexion point e constant p=1-2  2 (USD) Other QKD protocols  MC, T. Moroder, and N. Lütkenhaus, in preparation (2006)

22. Summary Interface Physics – Computer Science: Classical Correlated Data with a Promise Necessary condition for secure QKD (Two-way & One-way). Relevance for experiments: show the presence of entanglement (states without symmetric extension) No need to enter details of classical communication protocols Prevent oversights in preliminary analysis One properly constructed proof suffices Evaluation: Semidefinite programming (qubit-based QKD protocols in the presence of loss). Task for Theory: Develop practical tools for realistic experiments ( for given measurements).