In a recent paper (Scheme of the arrangement for attack on the protocol BB84, Optik 127(18):7083-7087, Sept 2016), a protocol was proposed for using weak measurement to attack BB84. This claimed the four basis states typically used could be perfectly discriminated, and so an interceptor could obtain all information carried. We show this attack fails when considered using standard quantum mechanics, as expected - such ``single-shot" quantum state discrimination is impossible, even using weak measurement

Hance JR

Rarity J

English

Newcastle University E-Prints

Comment on “Scheme of the arrangement for attack on the protocol BB84”Jonte Hance1, ∗ and John Rarity11Quantum Engineering Technology Laboratory, Department of Electrical and Electronic Engineering,University of Bristol, Woodland Road, Bristol, BS8 1UB, UKIn a recent paper (Scheme of the arrangement for attack on the protocol BB84, Optik 127(18):7083-7087, Sept 2016), a protocol was proposed for using weak measurement to attack BB84. This claimedthe four basis states typically used could be perfectly discriminated, and so an interceptor couldobtain all information carried. We show this attack fails when considered using standard quantummechanics, as expected - such “single-shot” quantum state discrimination is impossible, even usingweak measurement.In his recent paper, Khoklhov claims to have developeda protocol that can be used to distinguish between thefour basis states used in BB84 to encode information -the H-, V -, D- and A-polarised states of a single pho-ton [1]. He claims this is through weak measurement -where weak coupling of a quantum variable to an ancillaallows data about a quantum state to be obtained with-out collapsing the state. However, weak measurementtypically only obtains a small amount of information permeasurement, so a large number of identically-preparedquantum objects are needed to obtain this fully. An al-ternative proposal given by Aharonov et al discusses thepossibility of performing a weak measurement on a singleparticle [2] - however, this is still subject to Busch’s limiton information gained for a given disturbance [3].Khoklhov previously gave an interferometric devicethat he claims allows a weak measurement to tell thepath a photon travelled via, without disturbing the stateof that photon (see Fig.1a) [4]. For this, a photon ofstate α |H〉+ β |V 〉 goes through a polarising beamsplit-ter (PBS), which transmits H- and reflects V -polarisedcomponents. The two components each travel down a re-spective arm, where they have a momentum-kick appliedto them, such that their eventual arrival position on thesecond PBS isn’t affected - here, the H-component gets adownwards kick, and the V -component an upwards kick.The two components meet at the second PBS, recombine,and then exit, but the difference in momentum allows, ata far distance from the second PBS, the respective com-ponents to be identified. Khoklhov claims, by using manyphotons, this allows the probability amplitudes of thetwo polarisation components to be determined, and sothe preparation state (in truth, we only get the moduli-squared of those components, and so the classical bal-ance of probabilities). Further, Khoklhov implies thatthe photon emitted into one of the two distinguishablefar-field paths would still be in its original state, ratherthan collapsed to either H or V . This is also incorrect -as the polarisation becomes entangled with the momen-tum degree-of-freedom, the collapse to either upwards- ordownwards-momentum causes the simultaneous collapseto either H- or V -polarisation.In this paper, Khoklov then makes the bold claim that,FIG. 1. Diagrams of a) the single-interferometer device, whichforms the building blocks of the attack protocol, and b) thelayout formed of these, where each red square is an interfer-ometer of the sort given in a. As can be seen, once initiallysplit by the first interferometer, the H and V componentsremain these separate components, and so never travel thepaths marked X. Therefore, only two of the four detectorsever receive photons, making the protocol useless for deter-mining the full initial state for a single photon.using these single-interferometer units as building blocks,he can make a device which can perfectly distinguish be-tween the four basis states used in BB84 - H, V , D (orH+V√2) and A (or H−V√2). Given the security of BB84 restson the quantum assumption that, even with an optimalchoice of measuring basis, one cannot distinguish betweenall four bases perfectly (thus bounding an eavesdropper’spotential knowledge), this claim threatens the security ofone of the most well-known QKD protocols.Khoklhov claims this is possible by taking the sepa-rated outputs of one of his single-interferometer devices,then putting each output through another device. Thoseoutputs which disagree with their original polarisation-determination (due to his assumption that the photonexits in its original state) are then combined - the com-ponents which agree with their original polarisation areput through another device, and again have any fur-ther outputs which disagree combined. The combinedarXiv:2106.08718v1  [quant-ph]  16 Jun 20212beam is then put through a polarising beamsplitter inthe A −D basis, with its two outputs sent to detectors,alongside the other two outputs (that always agreed withtheir initially-determined polarisation). We present thisin Fig.1b. Khoklhov claims that if the input photon’s ini-tial state is D (A) it will end up in the inner left (right)detector. This claim is false.Let us examine the path of the input photon usingstandard quantum mechanics (as represented by Bra-Ket notation). We can describe the action of one ofKhoklhov’s single-interferometer devices (pre-detection),as given in Fig.1a, on a single polarisation-encoded pho-ton qubit byα |H〉+ β |V 〉 → α |H, ↓〉+ β |V, ↑〉 (1)This effectively entangles the polarisation and path de-grees of freedom. Applying this to the larger set-up (asgiven in Fig.1b), we then see the two components (H andV ) then act as separate for the remainder of the chain,obeyingα |H〉+ β |V 〉 → α |H,R,R,R〉+ β |V,L, L, L〉 (2)where L and R describe the paths on the figure aftereach interferometer. This means the inner paths, |R,L〉,|L,R〉, |L,L,R〉 and |R,R,L〉 are never explored, so thetwo inner detectors never click. Given the determinationof the single photon’s polarisation qubit in the attackis predicated on these two detectors being able to click(being taken to represent H+V√2and H−V√2), this showsthe attack does not work - as expected, standard quan-tum mechanics preserves the security of BB84 from thisattack.We finally give a more proper account of the resultof using true weak measurements to attempt Khoklhov’sscheme, using the description of weak measurement from[5].To do this, in each of Khoklhov’s apparatuses, we cou-ple our photon’s polarisation|ψ〉 ∈ {|H〉 ; |V 〉 ; |H〉+ |V 〉√2;|H〉 − |V 〉√2}= α |H〉+ β |V 〉(3)with the pointer (the photon’s momentum)|φ〉 = |φd〉 =∫pφ(p) |p〉 dp (4)where p is the vertical momentum of the photon. P̂dis the momentum operator such that P̂d |p〉 = p |p〉.We assume φ(p) has a Gaussian distribution around 0(input vertical momentum), such thatφ(p) = e−p2/4σ2/√2πσ2 (5)If we define the polarisation-distinguishing operatorÂ = |H〉〈H| − |V 〉〈V | (6)we can consider an interaction Hamiltonian between thetwoĤint = g(t)Â⊗ X̂d (7)where X̂d is the operator conjugate to P̂d such that[P̂d, X̂d] = i~, and g(t) is the coupling function such that∫ T0g(t)dt = 1 (8)for coupling time T .This means, applying this HamiltonianeiĤt/~ |ψ〉 ⊗ |φ〉 (9)we see for each of |H〉 ⊗ |φ(p)〉, |V 〉 ⊗ |φ(p)〉, the Hamil-tonian takes P̂d to P̂d + 1, P̂d − 1 respectively, asP̂d(T )− P̂d(0) =∫ T0i~[Ĥ, P̂d]dt ∈ {+1,−1} (10)Therefore, the corresponding transformation iseiĤt/~ |ψ〉 ⊗ |φ(p)〉= α |H〉 ⊗ |φ(p− 1)〉+ β |V 〉 ⊗ |φ(p+ 1)〉=∫p(α |H〉 ⊗ φ(p− 1) + β |V 〉 ⊗ φ(p+ 1))|p〉 dp(11)The above wavefunctions φ(p − 1) and φ(p + 1) needto overlap each other for the measurement to be weak- and so need to have high variance, σ. The higher thevariance, the weaker the measurement - if these Gaus-sian wavefunctions don’t overlap, them the measurementis strong. Given σ is initially defined from the verticalmomentum of the photon, this means the photon inputinto the system must also have high σ.The effect of the strength of the measurement can bemost readily seen when observe and collapse the pointerto a specific momentum-value, p0, to read out our weakmeasurement, which gives(e−(p0−1)24σ2 α |H〉+ e−(p0+1)24σ2 β |V 〉)⊗ |p0〉 (12)where both the coefficients on |H〉 and |V 〉 are biasedslightly depending on where they are in relation to p0.This makes sense, analogous to how measuring an eigen-value for an observable collapses the measured state tothe relevant eigenstate - the only difference here is the3variance σ providing some uncertainty in that measure-ment.The far-field vertical position of the photon will dependon the vertical momentum of the photon, as Khoklhovrightly says. However, the variance in this momentum(which must be large enough to allow overlap betweenthe momenta for up and for down in order for the mea-surement to be weak, and the final polarisation state tonot have changed too far) means that these positionsmust overlap heavily too. While, in the limit of manyidentically-prepared photons, we could obtain informa-tion about whether the polarisation-state was |H〉, |V 〉,or a superposition of the two, we cannot gain this for asingle run without inducing collapse. Therefore, a pro-tocol built up of several of these devices, as Khoklhov’sattack protocol is, either doesn’t work due to collapse(as we show with the standard quantum-mechanical ap-proach above), or gains effectively no information aboutthe polarisation state of the photon, making it useless asan attack.Acknowledgements— This work was supportedby the Engineering and Physical Sciences ResearchCouncil (Grants EP/P510269/1, EP/T001011/1,EP/R513386/1, EP/M013472/1 and EP/L024020/1).∗ jonte.hance@bristol.ac.uk[1] Dmitri L Khokhlov. Scheme of the arrangement for attackon the protocol bb84. Optik, 127(18):7083 – 7087, 2016.[2] Yakir Aharonov, Eliahu Cohen, and Avshalom C Elitzur.Foundations and applications of weak quantum measure-ments. Physical Review A, 89(5):052105, 2014.[3] Paul Busch. “no information without disturbance”: Quan-tum limitations of measurement. In Quantum Reality,Relativistic Causality, and Closing the Epistemic Circle,pages 229–256. Springer, 2009.[4] DL Khokhlov. Scheme of the weak measurement of thepolarization state of the photon. Optik, 127(8):4089–4091,2016.[5] Boaz Tamir and Eliahu Cohen. Introduction to weak mea-surements and weak values. Quanta, 2(1):7–17, 2013.

Comment on "Scheme of the arrangement for attack on the protocol BB84"

https://eprints.ncl.ac.uk/file_store/production/297836/FB0AC52D-B9EA-4419-8A31-5952FB4CA3A7.pdf

Comment on "Scheme of the arrangement for attack on the protocol BB84"

Abstract

Similar works

Full text

Available Versions

Newcastle University E-Prints