Experimental Eavesdropping Based on Optimal Quantum Cloning

The security of quantum cryptography is guaranteed by the no-cloning theorem, which implies that an eavesdropper copying transmitted qubits in unknown states causes their disturbance. Nevertheless, in real cryptographic systems some level of disturbance has to be allowed to cover, e.g., transmission losses. An eavesdropper can attack such systems by replacing a noisy channel by a better one and by performing approximate cloning of transmitted qubits which disturb them but below the noise level assumed by legitimate users. We experimentally demonstrate such symmetric individual eavesdropping on the quantum key distribution protocols of Bennett and Brassard (BB84) and the trine-state spherical code of Renes (R04) with two-level probes prepared using a recently developed photonic multifunctional quantum cloner [Lemr et al., Phys. Rev. A 85, 050307(R) (2012)]. We demonstrated that our optimal cloning device with high-success rate makes the eavesdropping possible by hiding it in usual transmission losses. We believe that this experiment can stimulate the quest for other operational applications of quantum cloning.

Figure 1

Diagram describing R04 [11]. Alice (Bob) publicly agrees beforehand to send (measure) one of the trine states marked by red (black) dots, respectively. Both agree that the clockwise (anticlockwise) sequence of their states corresponds, e.g., to bit 1 (0). Bob publicly informs Alice what he has not measured (marked by an exclamation mark). Alice ignores the inconclusive cases (and informs Bob about them). In the other two cases, Alice and Bob obtain the same bit value.

Figure 2

Experimental setup as described in the text. States of the probed and ancillary photons are prepared with half-wave (HWP) and quarter-wave (QWP) plates. The photons overlap on the polarization-dependent beam splitter (PDBS) and undergo polarization-sensitive filtering in the beam divider assemblies (BDAs). Each BDA (see figure inset) consists of a pair of beam dividers (BDs), a neutral density filter (F), and a half-wave plate (HWP). The tomography of the two-photon state is accomplished by means of the HWPs, QWPs, polarizing beam splitters (PBDs), and single-photon detectors (D).

Figure 3

Cloning parameters, QBER and the cloning-attack security of the (a) BB84 and (b) R04 as a function of the cloning asymmetry parameter $p$ and cloning “strength” $\Lambda$. Dashed red lines show the QBER bound corresponding to the zero-length distilled key, i.e., $R=I_{A,B}-\min (I_{A,E},I_{B,E})=0$. Thus, cloning enables successful eavesdropping in the regions marked by names of the QKDs. The optimal cloning attacks cause $\mathrm{QBER}=16.7\%$ if $p=0.57$ and ${\Lambda }^2=0.36$ (point $O^{\prime \prime }$) for R04 and $p=0.5$ and ${\Lambda }^2=0.33$ (point $O^{\prime }$) for BB84. The vertical solid red lines show the $\mathrm{QBER}$ bounds on the privacy of directly transmitted information corresponding to $I_{A,B}=I_{A,E}$, which are equal to 15.0% for R04 and 14.6% for BB84. The area of ${\Lambda }^2\ge 1/2$ (${\Lambda }^2=1/2$) corresponds to the mirror phase-covariant OQC [22] (the asymmetric phase-covariant OQC [5, 25]). Hatched areas indicate the range of the cloning attacks without using quantum memory.