Complete physical simulation of the entangling-probe attack on the Bennett-Brassard 1984 protocol

We have used deterministic single-photon two-qubit quantum logic to implement the most powerful individual-photon attack against the Bennett-Brassard 1984 (BB84) quantum key distribution protocol. Our measurement results, including physical source and gate errors, are in good agreement with theoretical predictions for the Rényi information obtained by Eve as a function of the errors she imparts to Alice and Bob’s sifted key bits. The current experiment is a physical simulation of a true attack, because Eve has access to Bob’s physical receiver module. Nevertheless, the physical simulation allows investigation of the fundamental security limit of the BB84 protocol against eavesdropping in the presence of realistic physical errors, and it affords the opportunity to study the effectiveness of error correction and privacy amplification when the BB84 protocol is attacked.

Figure 1

(Color online) Relations between different bases. (a) Control qubit basis for Eve’s CNOT gate referenced to the BB84 polarization states. (b) $\mid T_0⟩$ and $\mid T_1⟩$ relative to the target qubit basis.

Figure 2

Quantum circuit diagram for the FPB-probe attack. Photon 1 of a polarization-entangled singlet photon pair heralds photon 2 and sets Eve’s probe qubit to its initial state. The SWAP gate allows Alice’s qubit to be set in the polarization mode of photon 2, whose momentum mode is Eve’s probe qubit. The CNOT gate entangles Alice’s qubit with Eve’s qubit. $R_E$, rotation by Eve; $R_A$, rotation by Alice; $R_B$, rotation by Bob; $R_{\pm \pi ∕8}$, rotation by angle $\pm \pi ∕8$.

Figure 3

(Color online) Experimental configuration for a complete physical simulation of the FPB attack on BB84. SPDC, spontaneous parametric down-conversion source; $H$, half-wave plate; $Q$, quarter-wave plate; $P$, polarizing beam splitter; $D$, single-photon detector. $R$, $L$ refer to spatial paths.

Figure 4

(Color online) Eve’s Rényi information $I_R$ about Bob’s error-free sifted bits as a function of the error probability $P_E$ that her eavesdropping creates. Solid curve: theoretical result from Eq. (11). Diamonds (triangles): measured values for $H\text{−}V$ $\left(D\text{−}A\right)$ basis. Dashed (dotted) curves are fits to the data with error model for the $H\text{−}V$ $\left(D\text{−}A\right)$ basis.