4

Quantum Key Distribution

Quantum key distribution protocols are introduced here as the first appli-
cation of qubits to quantum information processing. Completely secure en-
cryption key can be shared by two parties (Alice and Bob) by making use of
quantum resources. This key is used for classical encryption afterward.

4.1 One-Time Pad

A classical encryption system to send a string of n characters p1 p2 . . . pn made
of English alphabets is to use an encryption key k1 k2 . . . kn , (0 ≤ kj ≤ 25)
of the same length, which shifts each character pj by kj mod 26. Suppose
Alice sends an encrypted message HAL to Bob, which is eavestropped by
Eve. Eve tries many different keys to decode the message but she will get
many meaningful results. If she tries a key 111, she will get IBM,∗ while if
she tries 588, she will get MIT. This encryption system is totally secure if the
key is used only once. If the same key is used more than once, Eve can guess
the key by examining candidate decrypted messages. † This is the reason
why this cryptosystem is called the “one-time pad”.
In the following, we use the binary system to make the story simplified and
also make it relevant for our purpose. Alice wants to send a message in a
form of a bit-string of length n (plaintext) to Bob through a public channel.
To prevent from being eavesdropped, she encrypts the plaintext with a key,
which is another bit-string of the same length, and is supposed to be shared
only by Alice and Bob. Let Alice’s message be a1 a2 . . . an (aj ∈ {0, 1}) and
the key be k1 k2 . . . kn (kj ∈ {0, 1}). She adds kj to each aj bitwise mod 2,
which we denote by aj ⊕ kj , namely

0 ⊕ 0 = 0, 0 ⊕ 1 = 1 ⊕ 0 = 1, 1 ⊕ 1 = 0.

∗ This is a joke from a movie “2001 A Space Odyssey”.

† She can use the fact that “E” appears most frequently in an English plaintext, followed
by “A”, “T”, and “I”. Some combinations of alphabets, such as “TH”, “EH” and “THE”,
also appear with high frequencies.

89
90 QUANTUM COMPUTING

Now an encrypted bit-string of length n (ciphertext) has been produced and

is sent to Bob through a public channel with possible Eve’s eavesdropping.
Bob adds the same key bitwise to the ciphertext to recover the plaintext.
Alice adds kj to aj mod 2 to obtain cj = aj ⊕ kj and Bob adds kj mod 2 to
cj to recover cj ⊕ kj = aj ⊕ kj ⊕ kj = aj . Note that kj ⊕ kj = 0 for any kj .
This one-time pad scheme is secure as far as the key is shared only between
Alice and Bob and the key is used once and only once.
We can formally define the encryption map E by

E : (a, k) 7→ c = a ⊕ k (4.1)

and decryption map D as

D : (c, k) 7→ a = c ⊕ k. (4.2)

Observe that D(E(a, k)) = D(a ⊕ k) = a ⊕ k ⊕ k = a.

EXAMPLE 4.1.1. Let Alice’s plaintext be a = 1001011011001101 and the

key be k = 1101011101010010. Then the ciphertext c is c = a ⊕ k =
0100000110011111. Bob adds the same key to the ciphertext as c ⊕ k = a
to recover the plaintext a.

It is possible to share the encryption key between Alice and Bob by using
qubits so that Eve’s attack can be detected with high precision. Such a scheme
is called a quantum key distribution, or QKD for short. There are several
QKD schemes, all of which make use of the fact that Eve’s eavesdropping is
a measurement of qubits and the qubit state is altered by this action.
QKD is the first practical application of quantum information in this book.
QKD devices are manufactured by several companies worldwide and already
commercially available [1, 2, 3, 4].

4.2 BB84
The first example of QKD has been proposed by Bennett and Brassard in 1984
and hence this protocol is called BB84 [5]. The sender Alice and the receiver
Bob can detect a possible third party Eve eavesdropping their communications
by comparing the sequence of qubits sent and received.
Figure 4.1 shows the BB84 setting, in which Alice sends a qubit-string to
Bob through a unidirectional quantum channel Q while they can communicate
through a bidirectional classical channel C, where both Q and C channels may
be eavesdropped by Eve.
To make our discussion concrete, suppose they employ polarized photons
as qubits. Let us define four polarized photon states |e0 ⟩ = | ↔⟩, |e1 ⟩ = | ↕
 Quantum Key Distribution 91

FIGURE 4.1
Quantum key distribution protocol BB84. Q is a unidirectional quantum
channel while C is a bidirectional classical channel. Eve might intercepts
both channels.

√ √
⟩, |f0 ⟩ = | ⟩, |f1 ⟩ = | ⟩, where |f0 ⟩ = (|e0 ⟩+|e1 ⟩)/ 2, |f1 ⟩ = (|e0 ⟩−|e1 ⟩)/ 2.
↔

In optics, they are also knows as |e0 ⟩ = |H⟩, |e1 ⟩ = |V⟩, |f0 ⟩ = |D⟩, and
|f1 ⟩ = |X⟩. Alice encodes 0 and 1 with respect to two bases B1 = {|e0 ⟩, |e1 ⟩}
and B2 = {|f0 ⟩, |f1 ⟩} as
Basis B1 0 7→ |e0 ⟩, 1 7→ |e1 ⟩,
Basis B2 0 7→ |f0 ⟩, 1 7→ |f1 ⟩.
Step 1 Alice randomly chooses one of the four polarizations {|e0 ⟩, |e1 ⟩, |f0 ⟩, |f1 ⟩}
for each photon and sends a photon sequence |f1 ⟩, |e0 ⟩, |f0 ⟩, . . ., for ex-
ample, to Bob. Bob also chooses a basis B1 or B2 randomly and in-
dependently of Alice, to measure the polarization of each photon he
receives. 4N photons must be sent from Alice to Bob to generate a key
of bit-length N as will be shown below.
Step 2 After all photons have been sent, Alice and Bob exchange the sequence
of the bases B1 /B2 they employed using the classical communication
channel (so Eve might intercept their communication), without disclos-
ing the bits (0/1) Alice sent and Bob received. They will know, as a
result, for which photons they employed the same basis. They discard
all the cases where they employed different bases since the sent bits and
the received bits agree only with probability 1/2 in these cases. For
example, suppose Alice sent a photon |e0 ⟩ and Bob measures it with
B2 basis. Since the photon he receives is |e0 ⟩ = √12 (|f0 ⟩ + |f1 ⟩), his
measurement outcome is f0 or f1 both with probability 1/2. There are
∼ 2N cases that are discarded.
Step 3 Now ∼ 2N photons, on average, are correctly transmitted and they
share a bit-string of length ∼ 2N in their hands. To make sure that
 92 QUANTUM COMPUTING

no one eavesdrops their quantum channel, they sacrifice N cases chosen

randomly from the 2N cases with matched bases and exchange N bits
(0/1) associated with these N cases over the classical channel. If there
are no eavesdroppers operating, they should have the same bits for all
the N cases.
Step 4 After verifying they are free from eavesdroppers, they discard these N
cases (since the classical channel to exchange the bit-strings may be
eavesdropped) and use the remaining N bits to generate a one-time pad
key of bit-length N .

Suppose Eve is in action. After eavesdropping each photon, she immediately

sends Bob a photon polarized as her measurement outcome in order to hide
her presence. Note that Bob will immediately recognize the presence of Eve
from missing photons unless Eve sends some photons to Bob. Eve’s basis is
different from Alice’s with probability 1/2, and she sends Bob the results of
her measurement with the same basis as she employed for measurement. Then
there exist cases in which the bit (0/1) Alice sends disagrees with the one Bob
receives even when they employed the same basis B1 /B2 . This happens with
probability 1/4 as is shown now. Suppose both Alice and Bob employed the
basis B1 , for example, and Alice sent Bob 0 as |e0 ⟩. Eve will use the basis
B1 with probability 1/2, in which case Eve definitely measures e0 and sends
Bob |e0 ⟩. Bob, also employing the basis B1 , will measure e0 with probability
1. If, in contrast, Eve employs basis B2 , which happens with probability 1/2,
then Eve measures f0 or f1 with probability 1/2 for each photon and sends
Bob her result with basis B2 . Then Bob, with basis B1 , will obtain e0 or e1
both with probability 1/2. Eventually, Bob obtains 0 (e0 ) with probability
3/4 and 1 (e1 ) with probability 1/4, even though Alice and Bob employ the
same basis. This argument remains true if both Alice and Bob use basis B2 .
Suppose 4N photons are sent from Alice to Bob. They find their bases agree
in ∼ 2N cases and discard the remaining ∼ 2N cases. By comparing bits
(0/1) of N cases randomely chosen from the remaining 2N bits, they find
approximately N/4 bits disagree if Eve is in action, from which they detect
there is an eavesdropper operating in the quantum channel. They may try
different quantum channels until the security is confirmed.
EXAMPLE 4.2.1. Suppose the sent and received sequences are

Alice’s basis B1 B2 B1 B2 B2 B1 B2 B1 B2 B2 B1 B1
Alice’s bit 0 1 0 0 1 1 0 1 0 0 1 0
Bob’s basis B1 B2 B2 B1 B2 B2 B1 B2 B1 B2 B2 B1
Bob bit 0 1 ? ? 1 ? ? ? ? 0 ? 0

where ? is randomly chosen from {0, 1}. Alice and Bob keep the sequence
0, 1, 1, 0, 0, . . . and discard the rest. Half of the kept sequence is exchanged to
check the security of the channel and the rest is used to generate a key.
Quantum Key Distribution 93

Suppose Eve eavesdrops their communication. Then their readings may, for
example, be

Alice’s basis B1 B2 B1 B2 B2 B1 B2 B1 B2 B2 B1 B1
Alice’s bit 0 1 0 0 1 1 0 1 0 0 1 0
Eve’s basis B1 B2 B1 B2 B1 B2 B1 B2 B1 B2 B1 B2
Eve’s bit 0 1 0 0 ? ? ? ? ? 0 1 ?
Bob’s basis B1 B2 B2 B1 B2 B2 B1 B2 B1 B2 B2 B1
Bob bit 0 1 ? ? ? ? ? ? ? 0 ? ?

The 5th and 12th bits Bob mesaures may not be the correct ones, even though
Alice and Bob employed the same basis.

4.3 B92
Bennett proposed a QKD protocol different from BB84 in 1992, which is now
called B92 [6]. BB84 employs four different polarizations for encoding, while
B92 employs two. The setting of B92 is essentially the same as that of BB84
depicted in Fig. 4.1 except that the classical channel can be unidirectional
from Bob to Alice.
Alice uses two types of photons for encoding as

0 7→ |e0 ⟩, 1 7→ |f0 ⟩.

Alice randomly chooses one of {|e0 ⟩, |f0 ⟩} for each photon and sends a pho-
ton sequence |f0 ⟩, |e1 ⟩, |f0 ⟩, |e0 ⟩, . . ., for example, to Bob. Bob chooses one of
measurement bases B1 = {|e0 ⟩, |e1 ⟩} and B2 = {|f0 ⟩, |f1 ⟩} randomly to mea-
sure each photon he receives. The following table shows the relation between
Alice’s photon state and Bob’s measurement outcome. The table also shows
the probability of each event to happen.

(|a⟩, |b⟩) (|e0 ⟩, |e0 ⟩) (|e0 ⟩, |e1 ⟩) (|e0 ⟩, |f0 ⟩) (|e0 ⟩, |f1 ⟩)
Prob. 1/4 0 1/8 1/8

(|a⟩, |b⟩) (|f0 ⟩, |e0 ⟩) (|f0 ⟩, |e1 ⟩) (|f0 ⟩, |f0 ⟩) (|f0 ⟩, |f1 ⟩)
Prob. 1/8 1/8 1/4 0
Here |a⟩ is the photon state Alice sends while |b⟩ is the photon state Bob
measures. Note that Bob measures |ek ⟩ if the basis B1 is employed while
|fk ⟩ if the basis B2 is employed. It is important to recognize that (i) if Bob
measures e1 , then Alice has definitely sent |f0 ⟩, while (ii) if he measures f1 ,
Alice has definitely sent |e0 ⟩. Bob can say nothing definite for other cases
with the measurement outcomes e0 and f0 .
 94 QUANTUM COMPUTING

Step 1 Alice sends 8N photons to Bob. We show below that this is the necessary
number of photons to generate a key of bit-length N .

Step 2 Bob tells Alice over a public channel when he measured e0 and f0 . We
find from the above table that there are approximately 8N × 3/4 = 6N
such cases among 8N photons. They discard these cases and keep 2N
cases, for which Bob measured e1 or f1 .

Step 3 For these 2N cases, Alice assigns 0 to her e0 and 1 to her f0 , while Bob
assigns 0 to his f1 and 1 to his e1 . By these assignments, they should
share the same bit-string of the average length 2N . Note that Alice does
not send any classical information to Bob in this scheme.

Step 4 To check if Eve is in action, they randomly pick up N bits out of the
2N bits obtained in Step 3 and Bob sends these bits to Alice over a
public channel. They can use the remaining N bits for encryption key if
Alice confirms all N bits are the same as hers. Otherwise, they repeat
the same process with a different quantum channel until the security is
confirmed.

Let us analyze Eve’s action in more details. Suppose that Alice has sent the
ith state |ai ⟩ and Eve intercepted the transmission with the basis B1 or B2 . In
her measurements, Eve will have probability 1/2 of getting |ai ⟩, a probability
1/4 of getting a state in {|e0 ⟩, |f0 ⟩} \ {|ai ⟩}, and a probability 1/4 of getting
a state in {|e1 ⟩, |f1 ⟩}. If Eve measures |e1 ⟩ or |f1 ⟩, she knows for sure that
|ai ⟩ = |f0 ⟩ or |e0 ⟩, respectively. Then Eve should send Bob |ci ⟩ = |f0 ⟩ or |e0 ⟩,
respectively. In other cases, Eve should send Bob her measured state, which
is the best action she can take.
Let us estimate the fraction of the N bits sent to Alice, which indicates Eve’s
presence. Recall that these bits corresponds to Bob’s measurement outcomes
e1 , f1 . There are two cases that are impossible without eavesdropping, namely
(Alice, Bob) = (|e0 ⟩, |e1 ⟩) and (|f0 ⟩, |f1 ⟩). The first case takes place if Alice
sends |e0 ⟩ and Eve measures it with B2 basis and measure |f0 ⟩, which is sent
to Bob who measures it with B1 basis. Note that if Eve measures |f1 ⟩, she
will send Bob |e0 ⟩ and Bob will definitely measure |e0 ⟩. The probability Alice
chooses |e0 ⟩ is 1/2, the probability Eve chooses B2 and measure f0 is 1/4,
while the probability Bob chooses B1 and measure e1 is 1/4, which results
in overall probability of 1/32. Obviously the probability of the second case
(Alice, Bob) = (|f0 ⟩, |f1 ⟩) is also 1/32. Therefore, if N bits are sent from Bob
to Alice, she finds approximately N/16 bits do not match with hers.
These cases should be compared with the following experiment. Suppose
one places a polarization plate that polarizes an unpolarized light to horizon-
tal direction. The second plate polarizes light vertically. If the second plate
is placed after the first, there should be not light passing through them. This
corresponds to the case |e0 ⟩ ↛ |e1 ⟩ and |f0 ⟩ ↛ |f1 ⟩. If the third polarization
plate making angle π/4 to the horizontal line is inserted between the first
Quantum Key Distribution 95

FIGURE 4.2
Probability distribution of Bob’s measurement outcomes when Eve is in ac-
tion. The fractional number attached to each line corresponds to the branch-
ing probability while the state shows the projected state after measurement.
When Eve measures f1 (e1 ), she replaces it by |e0 ⟩ (|f0 ⟩), respectively, and
send it to Bob. The bold line denotes the case by which Alice can detect an
eavesdropper.
 96 QUANTUM COMPUTING

and the second plates, then 1/8 of the incoming light propagates through the
three plates. Eve’s measurement with B2 basis plays the rôle of the third po-
larization plate, which opens the channel that leads to forbidden propagation
(|e0 ⟩ → |e1 ⟩ above and | ↔⟩ → | ↕⟩ here) in both cases.

4.4 E91
BB84 and B92 use a string of single qubits. It is also possible to use entangled
pairs for QKD. Here we introduce a protocol, known as E91, which was
proposed by Ekert in 1991 [6]. Another protocol BBM92, also making use of
entanglement, will be introduced in the next section.
E91 is based on the very property of entanglement: It violates the Bell
inequality. The third party prepares an entangled state
1
|Ψ− ⟩ = √ (|e0 ⟩|e1 ⟩ − |e1 ⟩|e0 ⟩).
2
Then the first qubit is sent to Alice while the second to Bob. They share an
entangled state |Ψ− ⟩ if there are no eavesdroppers acting.
Suppose Eve intercepts a photon sent to Bob. She measures the qubit
with an arbitrary basis and sends Bob a photon in the state Eve mea-
sured. Suppose Eve used a basis {|ϵ0 ⟩ = (cos(θ/2), eiϕ sin(θ/2))t , |ϵ1 ⟩ =
(− sin(θ/2), eiϕ cos(θ/2))2 } for her measurement. Since |Ψ− ⟩ = √12 (|ϵ0 ⟩|ϵ1 ⟩ −
|ϵ1 ⟩|ϵ0 ⟩) up to unphysical overall phase for any θ and ϕ, the state after the
measurement is either |ϵ0 ⟩|ϵ1 ⟩ or |ϵ1 ⟩|ϵ0 ⟩. Note that both of them are ten-
sor product state and hence satisfies the Bell inequality. It is impossible to
eavesdrop the qubit sent to Bob without disentangling |Ψ− ⟩.

Step 1 A third party (it may be Alice as well) prepares 9N/2 entangled photon
pairs |Ψ− ⟩ and sends the first photons to Alice and the second photons
to Bob.
Step 2 Alice and Bob measure photons they possess one by one by choosing
one of the following bases independently and randomly;
Alice : veca1 , veca2 , veca3
(4.3)
Bob : vecb1 , vecb2 , vecb2 ,

where vecai is a unit vector making angle α1 = 0, α2 = π/4, α3 = π/2

from the horizontal axis, while vecbj is another unit vector making angle
β1 = π/4, β2 = π/2, β3 = 3π/4 from the horizontal axis in the xy-plane.
Step 3 Alice and Bob exchange the list of their measurement axes over a clas-
sical channel after all photons are measured. They keep the data for
 Quantum Key Distribution 97

which they used the common axis for measurement, namely those cor-
responding to (veca2 , vecb1 ) and (veca3 , vecb2 ) out of 9 combinations
{(vecaj , vecbk )}. There are approximately N such cases, for which Al-
ice’s and Bob’s measurement outcomes are anti-correlated; if Alice mea-
sures e0 , Bob will measure e1 and vice versa. The other 7 combinations
are used to detect eavesdroppers.
Step 4 Alice and Bob check the CHSH variant of the Bell’s inequality, see below.
The photons they keep could be disentangled by possible eavesdropping
if the inequality is satisfied, in which case they use other quantum chan-
nels until they confirm the security of the channels. Once they confirm
the security, they use the n bits corresponding to the common axis mea-
surements to generate a key of length N .
To examine the CHSH inequality, they use the following observables
σz − σx σz − σx
Q = σz ⊗ I2 , R = σx ⊗ I2 , S = −I2 ⊗ √ , T = I2 ⊗ √
2 2
and evaluate the expectation values E(QS), E(RS), E(RT ) and E(QT ) to
check the inequality
|E(QS) + E(RS) + E(RT ) − E(QT )| ≤ 2
is satisfied or not. If the state |Ψ− ⟩ is intact, they should have
 
1 σz + σx 1
E(QS) = ⟨Ψ− |QS|Ψ− ⟩ = − (0, 1, −1, 0) σz ⊗ √ (0, 1, −1, 0)t = √ .
2 2 2
Similarly they evaluate
1
E(RS) = E(RT ) = −E(QT ) = √ ,
2
from which they obtain
√
|E(QS) + E(RS) + E(RT ) − E(QT )| = 2 2 > 2.
If, on the other hand, the state they share is |Ξ⟩ = |e0 ⟩|e1 ⟩, for example,
because of eavesdropping, they have
1
⟨Ξ|QS|Ξ⟩ = −⟨Ξ|QT |Ξ⟩ = √ , ⟨Ξ|RS|Ξ⟩ = ⟨Ξ|RT |Ξ⟩ = 0,
2
from which they find the CHSH inequality is satisfied as
√
|E(QS) + E(RS) + E(RT ) − E(QT )| = 2 < 2.
BB84 and B92 employ a string of single qubit states. There can be a security
problem if a single photo source produces multiple photons, which allows for
eavesdropping without being recognized by Alice and Bob by stealing a part of
photons. It should be also noted that E91 protocol does not require random
number generators, which might lower the security of single-photon based
QKD. Note that randomness in E91 is built in Nature.
 98 QUANTUM COMPUTING

4.5 BBM92
Bennett, Brassard and Mermin proposed a QKD protocol making use of en-
tangled states, which is now known as BBM92 [8]. This protocol is regarded
as a natural extension of BB84 to entangled states.
Suppose Alice generates many two-qubit states of the form
1
|Φ+ ⟩ = √ (|e0 ⟩|e0 ⟩ + |e1 ⟩|e1 ⟩)
2
and keeps the first qubits while the string of the second qubits is sent to Bob.
They measure qubits they possess one by one. They should share a common
bit-string such as 00101101 . . ., where e0 is mapped to 0 while e1 is mapped
to 1. Of course we know this protocol is too naı̈ve. Eve may intercepts
qubits sent to Bob and measure them with B1 = {|e0 ⟩, |e1 ⟩} basis and sends
the result to Bob. Then Alice, Bob and Eve share the same bit-string and
confidentiality will be lost.
To overcome this problem, we employ the same strategy as that of BB84
and B92; we introduce two measurement bases B1 and B2 = {|f0 ⟩, |f1 ⟩}. Let
us note that |Φ+ ⟩ is also written as

1
|Φ+ ⟩ = √ (|f0 ⟩|f0 ⟩ + |f1 ⟩|f1 ⟩).
2
If both Alice and Bob employ the measurement basis B1 , they will obtain
the identical outcome e0 or e1 while if both of them employ the measurement
basis B2 , they will obtain identical outcome f0 or f1 . If they employ different
measurement bases, their measurement outcomes are random. For example,
if Alice employs B1 basis while Bob employs B2 basis and Alice obtains e0 ,
Bob’s outcome will be f0 or f1 both with probability 1/2.

Step 1 To generate a one-time pad key of bit-length N , Alice generates 4N

pairs |Φ+ ⟩, keeps the first qubits and sends Bob the second qubits.

Step 2 They choose measurement basis independently and randomly, after

which they measure 4N qubits in their possession.

Step 3 They exchange the measurement bases they employed upon each mea-
surement over a classical channel while keeping the measurement out-
comes secret.

Step 4 They discard the ∼ 2N cases, for which they employed different mea-
surement bases, while keeping ∼ 2N measurement outcomes with the
same measurement bases. They assign 0 to e0 and f0 and 1 to |e1 and
f1 to generate a one-time pad key of bit-length ∼ 2N .
Quantum Key Distribution 99

The following example with 4N = 8 illustrates the above protocol.

Alice’s basis B1 B2 B1 B1 B2 B2 B1 B2
Alice’s outcome e0 f1 e0 e1 f0 f0 e1 f1
Bob’s basis B2 B2 B1 B2 B1 B2 B1 B1
Bob’s outcome f0 f1 e0 f1 e1 f0 e1 e0
Code generated 1 0 0 1

Now they share the common key “1001”.

To detect eavesdropping, they sacrifice randomly chosen N bits from the
bit-string of length 2N . Suppose Eve intercepts qubits sent to Bob and mea-
sures them with randomly chosen basis B1 or B2 . After Eve’s measurement,
the qubits are not entangled any more. If she employs B1 basis, the state
after measurement is either |e0 ⟩|e0 ⟩ or |e1 ⟩|e1 ⟩ while if she employs B2 basis,
the state after the measurement is either |f0 ⟩|f0 ⟩ or |f1 ⟩|f1 ⟩. Suppose both
Alice and Bob used B1 basis while Eve used B2 basis for measurement. Sup-
pose Eve measured the photon first. Then the state before Alice’s and Bob’s
measurements is either |f0 ⟩|f0 ⟩ or |f1 ⟩|f1 ⟩, and hence their measurement out-
comes are e0 or e1 independently and randomly with equal probability. When
Alice and Bob employ the same basis, Eve might employ a different basis with
probability 1/2, in which case Alice and Bob will have different bit 0 or 1 with
probability 1/2. This means that among N bits broadcast, there are N/4 bits
on average, where the bits disagree even though they used the same basis.
Now Eve’s eavesdropping is detected.
The following example with 4N = 8 illustrates this.

Eve’s basis B2 B1 B2 B2 B2 B1 B1 B2
Eve’s outcome f0 e0 f1 f0 f1 e0 e1 f1
Alice’s basis B1 B2 B1 B1 B2 B2 B1 B2
Alice’s outcome ? ? ? ? f1 ? e1 f1
Bob’s basis B2 B2 B1 B2 B1 B2 B1 B1
Bob’s outcome f0 ? ? f0 ? ? e1 ?
Code generated ? ? ? 1

Alice obtains the same outcome with Eve’s if and only if they employ the
common basis. It is also true for Bob and Eve. Otherwise, the outcome is
random as shown with a symbol “?” in the table above. The three parties
share the same outcome if and only if all of them employ a common basis.
In the table above, there are four cases in which Alice and Bob shared the
common basis. However, their outcomes are independently random in three
cases out of four.
Above, we assumed Eve makes measurement first among the three. In fact,
the order does not matter at all. Either Alice or Bob may measure their qubit
first to disentangle the pair. Suppose both Alice and Bob employ the basis
B1 and Eve employs B2 . Alice measures her qubit first to project |Φ+ ⟩ to
100 QUANTUM COMPUTING

|e0 ⟩|e0 ⟩, for example. Now Eve intercepts the second qubit and measures it to
produce either |f0 ⟩ or |f1 ⟩. In both cases, Bob will obtain e0 and e1 randomly
with equal probability upon measurement of his qubit even thought Alice and
Bob employ the same measurement basis.

4.6 Note and open problems

In this section, we illustrate how to use the quantum properties on no-cloning
theorem, measurements, and entanglement to design secured private quantum
key distribution schemes. One may extend these properties to design other
efficient and secure quantum key distribution schemes. For example, one
may use the idea of setting up a POVM {Q1 , . . . , Qm+1 } associated with
{|ψ1 ⟩, . . . , |ψm ⟩} so that Bob will know for sure that |ψj ⟩ is sent to him if
he gets the measurement of Qj for j = 1, . . . , m (see Example 3.4.3). A
careful choice of {|ψ1 ⟩, . . . , |ψm ⟩} will yield an efficient and secure quantum
key distribution scheme.

References
[1] http://www.magiqtech.com/
[2] https://www.toshiba.co.jp/qkd/en/products.htm
[3] https://www.idquantique.com/
[4] https://www.quintessencelabs.com/
[5] C. H. Bennett and G. Brassard, in Proc. IEEE Int. Conf. Comp., Systems
and Signal Processing 175 (1984).
[6] A. Ekert, Phys. Rev. Lett. 67, 661 (1991).
[7] C. H. Bennett, Phys. Rev. Lett. 68, 3121 (1992).
[8] C. H. Bennett, G. Brassard, and N. D. Mermin, Phys. Rev. Lett. 68,
557 (1992).