An Efficient Quantum Key Distribution Protocol with Dense Coding on Single Photo

Hao Xiao,Jun Zhang,Wenhua Huang,Mi Zhou and Wencheng Hu

Abstract:Combined with the dense coding mechanism and the bias-BB84 protocol,an efficient quantum key distribution protocol with dense coding on single photons(QDKD-SP)is proposed.Compared with the BB84 or bias-BB84 protocols based on single photons,our QDKD-SP protocol has a higher capacity without increasing the difficulty of its experiment implementation as each correlated photon can carry two bits of useful information.Compared with the quantum dense key distribution (QDKD)protocol based on entangled states,our protocol is more feasible as the preparation and the measurement of a single-photon quantum state is not difficult with current technology.In addition,our QDKD-SP protocol is theoretically proved to be secure against the intercept-resend attack.

Keywords:Quantum key distribution,bias-BB84,dense coding mechanism,quantum dense key distribution,single photons.

1 Introduction

In recent decades,with the development of quantum mechanics,the theory of quantum mechanics has been utilized in the information processing field.Especially,quantum cryptography communication has aroused more and more researchers’ interest,and it has been used to complete many tasks,such as quantum key distribution (QKD)[Bennett and Brassard (1984);Bennett and Wiesner (1992);Ekert (1991)],quantum secret sharing(QSS)[Chen,Tang,Xuet al.(2018);Liu,Chen,Xuet al.(2012)],quantum key agreement (QKA)[Chong and Hwang (2010);Huang,Su,Liuet al.(2017);Liu,Xu,Yanget al.(2018)],quantum secure direct communication(QSDC)[Liu,Chen,Liet al.(2008);Liu,Chen,Ma et al.(2009);Xu,Chen,Liet al.(2015)],quantum private comparison(QPC)[Liu,Liu,Wanget al.(2013);Liu,Liu,Chenet al.(2014);Liu,Liu,Liuet al.(2014);Liu,Liu,Wang et al.(2014)],quantum sealed-bid auction(QSBA)[Liu,Wang,Jiet al.(2014);Liu,Wang,Yuanet al.(2016)],quantum remote state preparation (QRSP)[Chen,Sun,Xuet al.(2017);Liu,Chen,Liuet al.(2015);Qu,Wu,Wanget al.(2017)],quantum steganography [Qu,Chen,Jiet al.(2018);Qu,Cheng,Liuet al.(2018)],delegating quantum computation [Liu,Chen,Jiet al.(2017);Liu,Chen,Liuet al.(2018)],quantum machine learning [Liu,Gao,Yuet al.(2018),Liu,Gao,Wanget al.(2019)],and so on.

As the most basic and important research direction,QKD is used to produce a private key between two legitimate users with the fundamental principles in quantum mechanics or some special features in an entangled quantum system.With the aid of a private key,the two users can communicate their secret message securely.With the unconditional security rather than the infeasible computation in the conventional cryptography,a number of QKD protocols were proposed accordingly.Besides the security,many efforts were made to improve the key distribution efficiency.Generally,these QKD protocols can be divided two categories：the QKD protocols based on single photon(SinglePhoton-QKD)such as BB84 [Bennett and Brassard (1984)],B92 [Ekert (1991)]and their improved schemes [Bechmann-Pasquinucci and Tittel (2000);Lo,Chau,and Ardehali (2005)],and the other QKD protocols based on entangled state (Entangled-QKD)[Bennett and Wiesner (1992);Karimipour,Bahraminasab and Bagherinezhad (2002)].In the above two categories,SinglePhoton-QKD has the advantage of the simple and feasible experiment implementation but less efficiency,while Entangled-QKD enhances the efficiency but needs more complex quantum resources and equipment.

In 2004,Degiovanni et al.[Degiovanni,Berchera,Castellettoet al.(2004)] proposed a novel QKD protocol,called quantum dense key distribution (QDKD),by using the operations on the Entangled state (i.e.,one of the Bell states)to embed the key information.It embeds the benefits of quantum dense coding and quantum key distribution,and can generate shared secret keys four times more efficiently than the BB84 protocol.Although the security of Degiovanni et al.’s QDKD protocol was questioned by Wójcik [Wojcik(2005)],a modified security proof was then given [Degiovanni,Berchera,Castellettoet al.(2005)] and showed that the protocol is able to detect any individual eavesdropping attack including the injecting-subtracting attack proposed in Wójcik’s Comment.Since then,this idea of QDKD has been successfully exploited by other scholars,using different entangled states.For example,in 2011,Hwang et al.[Hwang,Hwang and Tsai (2011)] proposed a QKD protocol by utilizing dense coding on three-qubit W state,and Liu et al.[Liu,Chen,Liuet al.(2013)] put forward a quantum simultaneous secret distribution protocol with dense coding on cluster states.

Combined with the bias-BB84 protocol [Lo,Chau and Ardehali (2005)] and the dense coding mechanism in Degiovanni et al.’s QDKD protocol [Degiovanni,Berchera,Castellettoet al.(2004)],we proposed an efficient QKD protocol with dense coding on single photons (QDKD-SP),where two efficiencies of key distribution are used in this paper：(theoretical efficiency)and (practical efficiency).Our QDKD-SP protocol at least has the same practical efficiency like the bias-BB84 protocol,and better practical efficiency than BB84 and Degiovanni et al.’s QDKD protocol.Besides,it has the same theoretical efficiency as Degiovanni et al.’s QDKD protocol,and better theoretical efficiency than BB84 and bias-BB84.

The rest of this paper is organized as follows.In Section 2,we describe the previous QKD protocols：the bias-BB84 protocol (a single-polarized-photon protocol)and Degiovanni et al.’s QDKD protocol (an entangled-pair protocol).Section 3 introduces the proposed QDKD-SP protocol.Also,two key distribution efficiencies are used to evaluate the proposed QDKD-SP protocol.Security analysis and comparison are given in Section 4.The conclusion is drawn in Section 5.

2 Preliminaries

2.1 BB84 protocol

BB84 [Bennett and Brassard (1984)] is a quantum key distributionprotocol developed byBennettand Brassard in 1984.It is the first quantum cryptography protocol,which isprovably secure,relying on the quantum property that information gain is only possible at the expense of disturbing the signal if the two states one is trying to distinguish are not orthogonal (i.e.,no-cloning theorem)and an authenticatedpublic classical channel.It is usually explained as a method of securely communicating aprivate keyfrom one party to another for use inone-time padencryption.

In the BB84 protocol,Alicewishes to send a private key toBob.She begins with two strings ofbits,aandb,each (4+δ)nbits long.She then encodes these two strings as as a block of(4+δ)nqubits,

whereakis thekth bit ofa(and similarly forb),and each qubit is one of the four states

The effect of this procedure is to encodeain the baseR-basisorD-basisas determined byb.

Alice sends the resulting stateover a public and authenticated quantum channelto Bob.Bob receives the(4+δ)nqubits,announces this fact,and measures each qubit in theR-basis orD-basis at random.At the same time,Alice announcesb.Alice and Bob discard any bits where Bob measured a different basis than Alice prepared.With high probability,there are at least2nbits left (if not,abort the protocol).They keep 2nbits.Alice selects a subset ofnbits that will be used to serve as a check on Eve’s interference,and tells Bob which bits she selected.Both Alice and Bob announce and compare the values of thencheck bits publicly,and run a check to see whether more than a certain number of them agree.If this check passes,Alice and Bob proceed to useinformation reconciliation and privacy amplificationtechniques to create on the remainingnbits to obtainmshared key bits.Otherwise,they cancel and start over.

2.2 Bias-BB84 protocol

In 2005,Lo et al.[Lo,Chau and Ardehali (2005)] proposed an efficient QKD protocol to enhance the efficiency of BB84.The major new ingredient of the efficient BB84 protocol is to put a bias in the probabilities of choosing between the two bases,so it is also called bias-BB84.

Recall the fraction of rejected data of BB84 is likely to be 50%.This is because in BB84 Alice and Bob choose between the two bases randomly and independently.The efficiency will be increased if Alice prepares and Bob measures their photons with a bias choice of basis.Specifically,they first agree on a fixed numberAlice prepares(Bob measures)each photon randomly and independently in the rectilinear and diagonal basis with probabilitiespand 1 -p,respectively.Clearly,the bias-BB84 protocol is insecure whenp=0.Nonetheless,in the limit of a large number of photon transfer,this bias-BB84 protocol is secure in the limit ofp→0+.Hence,the efficiency of bias-BB84 is asymptotically doubled when compared with BB84.

2.3 Degiovanni et al.’s QDKD protocol

The first QDKD protocol [Degiovanni,Berchera,Castellettoet al.(2004)] was proposed by Degiovanni et al.,which embeds the benefits of a quantum dense coding and a quantum key distribution and is able to generate shared secret keys four times more efficiently than BB84 one.

In Degiovanniet al.’s QDKD protocol,Alice produces pairs of particles in the singlet stateand stores particleAin her lab,whereas she acts randomly with gateIBorZBon particleBand then sends it to Bob.AsandAlice’s random selection of gateIBorZBencodes the bits of her secret key on the EPR pair,with

Bob randomly switches particleBtowards either his measurement or his encoding apparatus.In one case Bob projects particleBon the basewhile in the other case,Bob,analogously to Alice,randomly acts withIBorZBon particleBand then sends it back to Alice.

Alice receives particleB,and her measurement apparatus performs an incomplete Bell’s state analysis,i.e.,a projection onof the two-particle state composed by the previously stored particleAand particleB.Then Alice measures particleAon the baseinstead of performing a Bell’s state analysis when Bob’s apparatus projects particleB.As Alice prepares only statesAlice and Bob results should be always anti-correlated.The anti-correlation can be checked in Fig.1,consists in comparing Alice and Bob results,and guarantees the security of the distributed keys against individual eavesdropping attack.

Figure1:The anti-correlation check process of Degiovanni et al.’s QDKD protocol

3 The proposed efficient QDKD-SP protocol

3.1 The procedures of QDKD-SP protocol

The proposed protocol combines the dense coding mechanism in Degiovanni et al.’s protocol and the bias-BB84 protocol to achieve the advantages of both protocols,i.e.,the high efficiency and easy implementation.Suppose Alice and Bob transmit their secret message to each other through the protocol,andR-basisD-basis

And the specific steps of the proposed QDKD-SP protocol are as follows.

Step 1:Alice randomly prepares a photonin stateorwith equal probability.Then,Alice randomly uses one of four polarized operationsu00,u01,u10andu11to polarize the photon and sends it to Bob.These four polarized operations on the single photon are defined as follows.

where the operationsu01andu10with probability (p2),respectively,and the operationsu00andu11with probability ((1 -p)2),respectively,where 0 ＜p≤ 1/2.

Step 2:Bob receives the polarized photon,polarizes it in the same strategy as Alice,and then returns it to Alice.

Step 3:Alice receives the polarized photon and measures the photon by usingR-basis with probability (1 -p)or usingD-basis with the probabilitypto get the stateAfter the measurement,she sends the result information to Bob through the classic channel.The result information is determined byIfthe result information is “00”;ifthe result information is “01”;ifthe result information is “10”;ifthe result information is “11”.

Step 4:Bob uses the classic channel to inform Alice of the information about polarized operations.Bob announces the bit “0” if he polarizes the photon with 0oor 90oand“1” for45oor 135o.

Step 5:Alice determines whether the measurement base used is correct based on the received information.If it is correct,it is marked as “Y”;otherwise,it is marked as “N”.Then,Alice sends the location information of “Y” and “N” to Bob.

Step 6:Bob discards all information marked “N” according to the location information sent by Alice.

Step 7:Alice and Bob generate a shared bit string based on their own information and the received information.

3.2 An example of QDKD-SP protocol

We take a 12-bit sample sequence as an example and the detail operation is listed and described in Tab.1.Suppose Alice has the |0〉 photon for the first bit after operation.From the announced bit “0” (Alice does not change the basis,i.e.,usesR-basis),so she knows that she chooses the right basis.Also,Alice checks her measurement result |1〉,andand then she announces “10”.Because Alice and Bob know their own operations,so Alice knows that Bob usesu11and Bob knows that Alice usesu00.Finally,they share four information bits “0011”,where “00” is generated by Alice’s operation and “11” is generated by Bob’s operation.

Because the announcements of Alice and Bob are disclosed publicly,correspondent to the B’s announcement “0” or “1” and A’s announcement “00”,“01”,“10”,“11”,an eavesdropper Eve on the public channel can intercept some information by correlating the two announcements.For example,the announcements of Alice and Bob are “10” and “0”for the first bit in Tab.1.Eve does not get the direct information on the single key B (the last two bits produced by B),however,she knows the possible key B is “00” or “11”.And from the disclosure of A’s announcement “10”,Eve has the correlation of the single key A (the first two bits produced by A)and the single key B,i.e.,she knows the single key A is “11” (resp.“00”)when the single key B is “00” (resp.“11”).This obviously induces a lack of security.In fact,the lack of security for our QDKD-SP protocol is the same as Degiovanni et al.’s QDKD protocol.To ensure the security,we can use the single key A and the single key B like the way mentioned in Degiovanni et al.[Degiovanni,Berchera,Castellettoet al.(2004)].

Table1:A 12-bit sample of Alice (A)and Bob (B)for the proposed QDKD-SP protocol

As shown in Fig.2,the overall correct received probability is to add up Case (1),Case (4),Case (6)and Case (7),and then we obtainThe number of bits and qubits for the proposed QDKD-SP arebs=4,bt=3 andqt=q(A→B)=q(A←B)= 1,wherebt=3 is two bits in Step 4 and one bit in Step 5 (see Tab.1).

4 Security analysis

Our protocol uses the operations on the single polarized photon with the bias probability to transmit the secret information.Thus,it is compromised by the intercept-resend attack.Similar to bias-BB84,we should do the refined error analysis in our protocol.Suppose that Eve intercepts the photons usingR-basis orD-basis with the probabilitiespRandpD,respectively,and does nothing with the probability (1 -pR-pD).By using the intercept-resend attack,Eve has two ways to compromise our QDKD-SP protocol：one is to use the intercept-resend attack in only one stage (Alice→Bob stage or Bob→Alice stage),and the other is to use the intercept-resend attack in both two stages (Alice→Bob stage and Bob→Alice stage).The error rates for these two cases are calculated as follow.

4.1 Single-stage intercept-resend attack

By resending the photon in the Alice→Bob (or Bob→Alice) stage, it may cause the error when choosing the wrong basis to intercept the photon. First, we discuss the interception on the Alice→Bob stage. All erroneous situations are summarized in Tab. 2. Suppose that Alice prepares the photon |0〉 and her operation isu00oru11, then the photon is polarized to the photon |0〉 or |1〉 which are both inR-basis. When Eve uses theD-basis to intercept the photon, she obtains the wrong measurement and resends the wrong photon state (|+〉 or |-〉). After Bob’s announcement, Alice knows that the basis is not changed and she should use theR-basis to receive the correct state. However, there is 50%probability to share the wrong photon due to the incorrect one resent by Eve. The probability for this case is

Figure2:The received probability for all eight cases

Table2:Eve (E)uses the wrong basis to eavesdrop in the Alice(A)→Bob(B)stage

According to the refined error analysis, the error ratescaused by Eve’s eavesdropping for the cases that Alice usesR-basis andD-basis are calculated respectively as follows：

Therefore,the average ratefor the single-stage (Alice→Bob)intercept-resend attack is

Suppose that Alice always eavesdrops solely along theR-basis (i.e.,pR=1andpD=0),then

Because Alice uses the operationsu00andu11with the probability tends to 1,so eavesdropping the quantum channel with the probabilitiespR=1andpD=0is reasonable.The average error rate→0asptends to 0.Hence Alice and Bob cannot detect Eve’s eavesdropping.The refined error analysis can make our protocol against the single-stage (Alice→Bob)intercept-resend attack.It is evident that,from Eq.(6),the error rateis 1/4.

Secondly,we consider the interception on the Bob→Alice stage,and Tab.3 shows the erroneous situations caused by the eavesdropping in the Bob→Alice stage.For example,Alice prepares the |0〉-photon,after the operations of Alice and Bob’s operation,the photon may be |0〉-photon or |1〉-photon which are both inR-basis.When Eve uses theD-basis to intercept the photon,she gets the wrong measurement and resends the wrong photon state (|+〉 or |-〉).After Bob’s announcement,Alice knows that the basis is not changed and she should use theR-basis to receive the correct state.However,there is 50% probability to share the wrong photon due to the incorrect one resent by Eve.

Table3:Eve (E)uses the wrong basis to eavesdrop in the Bob(B)→Alice(A)stage

From Eq.(11),it is evident thatasptends to 0.However,by using the refined error analysis the error rateis 1/2.

4.2 Two-stage intercept-resend attack

Actually,Eve can eavesdrop in both two stages (Alice→Bob and Bob→Alice)simultaneously.Consider the case that Eve at least uses a wrong basis in one of the two stages.The wrong basis polarizes the photon to another basis and results in the possible erroneous situations (see Tab.4).

Table4:Eve(E)at least uses a wrong basis in one of the two stages

5 Efficiency analysis

In this paper,we use two types of key distribution efficiency [Lo,Chau and Ardehali(2005)] to fairly evaluate our QDKD-SP protocol.One is the so-called theoretical efficiency from the point of information theory,and the other is the practical efficiency which is used for precisely measuring the practical protocols.

5.1 Definition of key distribution efficiency

In order to compare the key distribution efficiency of QKD protocol,there is a theoretical definition on the efficiencyfrom the point of information theory,wherebsis the shared bits,btis the announced bits per transmission (using the classical channel)andqtis the number of sent photons per transmission (using the quantum channel).In fact,this definition of efficiency ignores the bits used for checking integration when eavesdropped.This theoretical definition shows a bound of efficiency,but it is not precisely to measure the efficiency for comparing practical QKD protocols.

Another practical key distribution efficiency (more suitably used for evaluating a QKD protocol)is defined asfor one-stage protocol andfor two-stage protocol,respectively,whereq(A→B)is the qubits traveling from Alice to Bob in the one-stage protocol andq(A←B)is the qubits traveling from Bob to Alice in the two-stage protocol.Notice thatqt=q(A→B)andq(A←B)=0 for the one-stage protocol,andqt=q(A→B)=q(B→A)for the two-stage protocol.

5.2 Efficiency comparison

The efficiencyε1is a theoretical evaluation for a lossless,noiseless quantum channel and perfect detectors.It is valid to show whether the limit ofε1=1is achieved.This is the most fundamental question in information theory.At this time,the bits and qubits are considered as two types of the same source.However,the efficiencyε2is more practical on the efficiency measurement.Both efficiencies have their substance,and we may use each in its proper purpose.For example,the number of bits and qubits for BB84 are：andq(A←B)=0.The efficiencies areandIt is more reasonable to say that the efficiency of BB84 isε2=50% without privacy amplification when considering the practical application.

According to the example of Section 3.2,we can find out the efficienciesε1andε2of this example.The efficienciesε1andε2are：

The values ofε1=ε2are about 100% asptends to 0.The proposed QDKD-SP protocol is dense like Degiovanni et al.’s QDKD because the efficiencyε1=100% is the same as Degiovanni et al.’s QDKD protocol.

Comparison among BB84,bias-BB84,Degiovanni et al.’s QDKD and the proposed QDKD protocol is summarized in Tab.5.Certainly,efficiency is an important point of comparison of QKD protocols.Both efficienciesε1andε2have their own substances,and we may use each in its proper purpose.Our QDKD-SP protocol is a hybrid of two schemes：Degiovanni et al.’s QDKD and bias-BB84.Thus,it has the same advantage of Degiovanni et al.’s QDKD,i.e.,the efficiency of our protocolε1=100%(note thatε1=25% and 50% for BB84 and bias-BB84).Also,our protocol has the same advantage of bias-BB84,which is implemented by the single polarized photon rather than the Entangled state and the efficiencyε2is 100% (Note：ε2=50% for BB84 and Degiovanni et al.’s QDKD).Among these four QKD protocols,it is observed that our new protocol is the best choice from either practical or theoretical consideration.

Table5:Comparison among different QKD protocols

6 Conclusion

As we know,efficiency and security are the main goals of the ongoing research of the QKD protocol.In this paper,through combing the bias-BB84 protocol and dense coding mechanism,we proposed a new efficient protocol with dense coding on single photons,which can achieve the high key distribution efficiencies (ε1=ε2=100%)and easy implementation (the single photon is more feasible in physical implementation than those entangled quantum resources).Moreover,our protocol is theoretically proved to be secure against the intercept-resend attacks.We believe that our work will have some reference value in the future practical application of quantum key distribution,quantum direct communication,or even the construction of quantum internet.

Acknowledgement:The authors would like to thank the anonymous reviewers and editor for their comments that improved the quality of this paper.This work is supported by the Natural Science Foundation of China under Grant No.11272120.