Ping-Pong Protocol Eavesdropping in Almost Perfect Channels

Abstract

An undetectable eavesdropping of the entanglement based quantum direct communication in lossy quantum channels has already been demonstrated by Zhang et al. (Phys Lett A 333(12):46–50, 2004). The circuit proposed therein induces losses at a constant 25 % rate. Skipping of some protocol cycles is advised in situations when the induced loss rate is too high. However, such policy leads to a reduction in information gain proportional to the number of skipped cycles.

The entangling transformation, parametrized by the induced loss ratio, is proposed. The new method permits fine-tuning of the loss ratio by a modification of coupling coefficients. The proposed method significantly improves efficiency of the attack operated in the low loss regime. The other properties of the attack remain the same.

1 Introduction

The ping-pong protocol [1] aims to provide confidentiality without encryption. It has been proven that it is asymptotically secure in lossless channels [2–6]. Unfortunately, the existence of the losses is a rule in a quantum world and their exclusion from the analysis is an oversimplification. Zhang et al. [7] presented a circuit than permits successful eavesdropping of 0.311 bits per protocol cycle at the price of loosing one quarter of control photons. The attack targets the only practical implementation [8] of the protocol, so its further analysis and deeper understanding is scientifically justified.

To exemplify the power of the attack, it is frequently argued that the existing quantum channel can be replaced with a better one to mask the presence of the circuit. Although in practice this is usually not the option, the attack still cannot be excluded completely. Legitimate parties usually monitor the average loss ratio of the channel and they assume some safety margin to avoid false alarms. The presence of an adversary is hidden as long as the additional losses stay below that margin, which is usually much lower than 25 % rate. The typical policy of an eavesdropper is to skip some protocol cycles to reduce induced losses. Linear reduction of average information gain with the number of skipped cycles is the price he pays.

It follows that impact of the attack on practically deployed systems is determined by its properties in the low-loss regime. The new method of an attack that outperforms known solutions in this area is proposed. It permits fine-tuning of the loss ratio by a modification of coupling coefficients of the entangling transformation. The other properties of the attack remain the same.

The paper is constructed as follows. A brief reclaim the ping-pong protocol and the analysis of the Zhang’s circuit is provided in Sect. 2. An alternative entangling transformation and key results are introduced in Sect. 3. Concluding remarks are made in the last section.

2 Analysis

The message mode of the ping-pong protocol is composed of three phases: an entanglement distribution, a message encoding and its subsequent decoding. Its further description adheres to the standard cryptographic personification rules: Alice and Bob are the names of the communicating parties, the malevolent eavesdropper is referred as Eve.

Bob starts the communication process through the creation of an EPR pair

$$\begin{aligned} |\psi _\mathrm {init}\rangle =|\psi ^+\rangle =\left( |0_B\rangle |1_A\rangle +|1_B\rangle |0_A\rangle \right) /\sqrt{2}. \end{aligned}$$

(1)

The qubits that constitute the pair are further referred to as home and travel/signal qubits, respectively. Bob sends the signal qubit to Alice. Alice applies a phase flip operator $\mathcal{Z_A}=|0_A\rangle \langle 0_A|-|1_A\rangle \langle 1_A|$ to the received qubit to encode a single classic bit

$$\begin{aligned} |\psi ^\nu \rangle =\mathcal{Z_A}|\psi _\mathrm {init}\rangle =(\mathcal{Z}_A)^\nu |\psi ^+\rangle =\left( (-1)^\nu |0_B\rangle |1_A\rangle +|1_B\rangle |0_A\rangle \right) /\sqrt{2}. \end{aligned}$$

(2)

The signal particle is sent back to Bob, who identifies the transformation that has been applied through the measurement of both qubits (Fig. 1).

Fig. 1.

The schematic diagram of a message mode in the ping-pong protocol

Unfortunately, such a communication scenario is vulnerable to the intercept-resend attack. As a countermeasure, Alice measures the received qubit in randomly selected protocol cycles and asks Bob over an authenticated classic channel to do the same with his qubit (Fig. 2). Her measurement causes the collapse of the shared state. The correlation of the outcomes is preserved only if the qubit measured by Alice is the same one that was sent by Bob. That way Alice and Bob can convince themselves with the confidence approaching certainty that the quantum channel is not spoofed provided that they have executed a sufficient number of control cycles. The above scheme is asymptotically secure in the absence of losses and/or transmission errors i.e., in a perfect quantum channel.

Fig. 2.

The schematic diagram of a control mode in the ping-pong protocol

Further, we will consider individual (incoherent) attacks in which Eve attacks each protocol cycle independently. The signal particle travelling back and forth between Alice and Bob can be the subject of any quantum action $\mathcal{Q}$ introduced by Eve, as depicted in Fig. 3. Eve’s activity can be described as a unitary operation acting on the signal qubit and two additional qubit registers, as follows from Stinespring’s dilation theorem.

Fig. 3.

A schematic diagram of an individual attack

The efficiency of the eavesdropping detection depends on the properties of the control mode. In the seminal version of the protocol, the reliability of quantum communication is estimated by the measurements in the computational basis. The probability of verification failure $p_C$ (the specific form of the operator depends on the assumed initial state) and the probability of a non-conclusive control cycle $p_L$ (it is assumed that Bob’s qubit is never lost) can be found as

$$\begin{aligned} \mathcal{P}_{C}&= |0_B\rangle |0_A\rangle \langle 0_A|\langle 0_B|+|1_B\rangle |1_A\rangle \langle 1_A|\langle 1_B|,\end{aligned}$$

(3)

$$\begin{aligned} \mathcal{P}_{L}&= \mathcal{I}_B \otimes |v_A\rangle \langle v_A|,\end{aligned}$$

(4)

$$\begin{aligned} p_{C,L}&= \mathrm {Tr}_{x,y}\left( \left( \mathcal{P}_{C,L}\otimes \mathcal{I}_E\right) \left( \mathcal{I}_B \otimes \mathcal{Q}\right) |\psi _\mathrm {init}\rangle |\chi _E\rangle \right) . \end{aligned}$$

(5)

where $|v\rangle$ denotes vacuum state and $|\chi _E\rangle$ is the initial state of the ancilla system.

Zhang’s attack [7] addresses the violation of the protocol security in the presence of losses in a quantum channel. The clever circuit permits the detection of phase flip operations at the price of introducing some losses. The expected correlation of outcomes of the conclusive measurements made in the control mode (3) is also preserved so the attack is undetectable.

The Zhang’s circuit is composed of two modules [7, Eq. (2)]: the coupling unit $\mathcal{C}_\mathrm {U}$ followed by the selective swap $\mathcal{C}_\mathrm {SWAP}$ (Fig. 4). The first one entangles the signal qubit from register A with the ancilla registers x and y. The second module swaps the contents of the A and x registers exclusively for signal qubit being in state $|1_A\rangle$. If qubit in register A is equal to $|0_A\rangle$ then no swapping occurs. Both modules are build around Controlled Polarization Beam Splitter (CPBS) originally proposed by Wójcik [9].

Fig. 4.

The block diagram of the Zhang’s circuit

Polarization Beam Splitter (PBS) is a two qubit gate which conditionally swaps the port of the input based on its value – the qubit $|0\rangle$ arriving on port x (y) appears on port y (x) of output, but the qubit set to $|1\rangle$ does not change its port. The CPBS acts as normal PBS for control qubit is set to $|0\rangle$. In the complementary situation, i.e., for the control register set to $|1\rangle$, we have the opposite behaviour: $|1\rangle$ ($|0\rangle$) is swapped (hold). The CPBS can be realized as PBS preceded and followed by double CNOT gates (Fig. 5).

The coupling module $\mathcal{C}_\mathrm {U}$ is realized as a circuit from Fig. 5. The quantum state of the whole system is given as

$$\begin{aligned} |\psi _{BAE}^{(0)}\rangle =|\psi _\mathrm {init}\rangle |\chi _E\rangle = \frac{1}{\sqrt{2}}\left( |0_B\rangle |1_A\rangle +|1_B\rangle |0_A\rangle \right) |v_x\rangle |0_y\rangle , \end{aligned}$$

(6)

where it was assumed that the ancilla is initially in the state $|\chi _E\rangle =|v_x\rangle |0_y\rangle$. The $\mathcal{C}_\mathrm {U}$ actions are as follows

$$\begin{aligned} \mathcal{C}_\mathrm {U} |0_A\rangle |v_x\rangle |0_y\rangle&= \frac{1}{\sqrt{2}}|0_A\rangle \left( |0_x\rangle |v_y\rangle +|v_x\rangle |1_y\rangle \right) = |0_A\rangle |\alpha ^+\rangle ,\end{aligned}$$

(7a)

$$\begin{aligned} \mathcal{C}_\mathrm {U} |0_A\rangle |v_x\rangle |1_y\rangle&= \frac{1}{\sqrt{2}}|0_A\rangle \left( |0_x\rangle |v_y\rangle -|v_x\rangle |1_y\rangle \right) = |0_A\rangle |\alpha ^-\rangle ,\end{aligned}$$

(7b)

$$\begin{aligned} \mathcal{C}_\mathrm {U} |1_A\rangle |v_x\rangle |0_y\rangle&= \frac{1}{\sqrt{2}}|1_A\rangle \left( |v_x\rangle |0_y\rangle +|1_x\rangle |v_y\rangle \right) = |1_A\rangle |\beta ^+\rangle ,\end{aligned}$$

(7c)

$$\begin{aligned} \mathcal{C}_\mathrm {U} |1_A\rangle |v_x\rangle |1_y\rangle&= \frac{1}{\sqrt{2}}|1_A\rangle \left( |v_x\rangle |0_y\rangle -|1_x\rangle |v_y\rangle \right) = |1_A\rangle |\beta ^-\rangle . \end{aligned}$$

(7d)

so the resulting state of the system takes the form (compare with Fig. 4)

$$\begin{aligned} |\psi _{BAE}^{(1)}\rangle =\frac{1}{\sqrt{2}}\left( |1_B\rangle |0_A\rangle |\alpha ^+\rangle +|0_B\rangle |1_A\rangle |\beta ^+\rangle \right) . \end{aligned}$$

(8)

Fig. 5.

The coupling circuit $\mathcal{C}_{\mathrm {U}}$

It enters the $\mathcal{C}_\mathrm {SWAP}$ circuit (Fig. 6) which is also build on the CPBS basis, but this time the y register serves as the control.

Fig. 6.

The selective swap circuit $\mathcal{C}_{\mathrm {SWAP}}$

The circuit does nothing for signal qubit set to $|0_A\rangle$. Otherwise, i.e., for signal qubit equal to $|1_A\rangle$, it swaps the contents of A and x registers:

$$\begin{aligned} \mathcal{C}_\mathrm {SWAP} |0_A\rangle |\alpha ^+\rangle&= \frac{1}{\sqrt{2}} \left( |0_A\rangle |0_x\rangle |v_y\rangle +|0_A\rangle |v_x\rangle |1_y\rangle \right) = |0_A\rangle |\alpha ^+\rangle ,\end{aligned}$$

(9a)

$$\begin{aligned} \mathcal{C}_\mathrm {SWAP} |1_A\rangle |\beta ^+\rangle&= \frac{1}{\sqrt{2}} \left( |v_A\rangle |1_x\rangle |0_y\rangle +|1_A\rangle |1_x\rangle |v_y\rangle \right) . \end{aligned}$$

(9b)

In effect, the state of the system at Alice’s end reads (see Fig. 4)

$$\begin{aligned} |\psi _{BAE}^{(2)}\rangle = \frac{1}{\sqrt{2}}|1_B\rangle |0_A\rangle |\alpha ^+\rangle + \frac{1}{\sqrt{2}}|0_B\rangle \left[ \frac{1}{\sqrt{2}} \left( |v_A\rangle |1_x\rangle |0_y\rangle +|1_A\rangle |1_x\rangle |v_y\rangle \right) \right] . \end{aligned}$$

(10)

Her encoding affects only the term in square brackets

$$\begin{aligned} \mathcal{Z}_A^\nu \left( |v_A\rangle |1_x\rangle |0_y\rangle +|1_A\rangle |1_x\rangle |v_y\rangle \right) = \left( |v_A\rangle |1_x\rangle |0_y\rangle +(-1)^\nu |1_A\rangle |1_x\rangle |v_y\rangle \right) . \end{aligned}$$

(11)

The photons that “carry” encoded information and travel back to Bob are affected by $\mathcal{C}_\mathrm {SWAP}^{-1}$. The component with $|\alpha ^+\rangle$ is not changed again but the term (11) sensitive to Alice’s encoding operation is transformed to

$$\begin{aligned} \frac{1}{\sqrt{2}} |1_A\rangle \left( |v_x\rangle |0_y\rangle +(-1)^\nu |1_x\rangle |v_y\rangle \right) =|1_A\rangle |\beta ^\pm \rangle . \end{aligned}$$

(12)

Thus the forward and backward application of the $\mathcal{C}_\mathrm {SWAP}$ circuit to the state (8) caused that Alice’s encoding is effectively applied to the x register. The states visible at this cross-section after applied encoding read (Fig. 4)

$$\begin{aligned} \nu =0&\quad&|\xi _0\rangle = \frac{1}{\sqrt{2}}\left( |1_B\rangle |0_A\rangle |\alpha ^+\rangle +|0_B\rangle |1_A\rangle |\beta ^+\rangle \right) ,\end{aligned}$$

(13a)

$$\begin{aligned} \nu =1&\quad&|\xi _1\rangle = \frac{1}{\sqrt{2}}\left( |1_B\rangle |0_A\rangle |\alpha ^+\rangle +|0_B\rangle |1_A\rangle |\beta ^-\rangle \right) , \end{aligned}$$

(13b)

where $|\beta ^\pm \rangle =\left( |v_x\rangle |0_y\rangle \pm |1_x\rangle |v_y\rangle \right)$. These states are transformed by the $\mathcal{C}_\mathrm {U}^{-1}$ to

$$\begin{aligned} |\varepsilon _0\rangle&=\mathcal{C}_\mathrm {U}^{-1}|\xi _0\rangle = \frac{1}{\sqrt{2}}\left( |1_B\rangle |0_A\rangle |v_x\rangle |0_y\rangle +|0_B\rangle |1_A\rangle |v_x\rangle |0_y\rangle \right) ,\end{aligned}$$

(14a)

$$\begin{aligned} |\varepsilon _1\rangle&=\mathcal{C}_\mathrm {U}^{-1}|\xi _1\rangle = \frac{1}{\sqrt{2}}\left( |1_B\rangle |0_A\rangle |v_x\rangle |0_y\rangle +|0_B\rangle |1_A\rangle |v_x\rangle |1_y\rangle \right) , \end{aligned}$$

(14b)

where expressions (7) have been taken into account. Eve has to discriminate between states

$$\begin{aligned} \rho _0 = \mathrm {Tr}_{BA}\left( |\varepsilon _0\rangle \langle \varepsilon _0|\right) =&|v_x\rangle |0_y\rangle \langle v_x|\langle 0_y|,\end{aligned}$$

(15)

$$\begin{aligned} \rho _1 = \mathrm {Tr}_{BA}\left( |\varepsilon _1\rangle \langle \varepsilon _1|\right) =&\frac{1}{2}|v_x\rangle |0_y\rangle \langle v_x|\langle 0_y| + \frac{1}{2}|v_x\rangle |1_y\rangle \langle v_x|\langle 1_y|. \end{aligned}$$

(16)

The information she can draw is limited by the Holevo bound [10]

$$\begin{aligned} I_{AE} = S\left( \frac{1}{2}\rho _0 + \frac{1}{2}\rho _1\right) - \frac{1}{2} S\left( \rho _0\right) - \frac{1}{2} S\left( \rho _1\right) \end{aligned}$$

(17)

where $S\left( \cdot \right)$ denotes von Neumann entropy. The straightforward analysis shows that Eve’s information gain is equal to $I_{AE}=0.311\,$bits per single message mode cycle. However, the information is intercepted at the price of an induction of a 25 % loss rate in the control mode (10). As long as legitimate parties accept losses above that threshold, the quantum channel can be in theory replaced with a perfect one and the attack can be applied without modification. But the replacement of the quantum channel is impossible in typical real-life scenarios. Moreover, the communicating parties monitor the average losses occurring in the link they use and any abrupt change and/or excess value can trigger an alarm. However, to avoid false alarms, the estimation procedure cannot be exact and some safety margin have to be assumed. This opens a gap for mounting the attack as long as the induced losses are below that margin. It is advised that Eve should skip some protocol cycles to keep average induced losses below the required threshold. But this decreases her information gain proportionally to the number of omitted cycles. Further, it is shown that such a policy is not optimal. The entangling transformation that provides fine-tuning of the induced loss rate via the control of the coupling coefficients, is proposed. It provides better results than a linear decrease in information gain while reducing losses. The proposed enhancement can be considered as the generalization of the Zhang’s attack.

3 Results

The map (7) that defines coupling of the signal qubit with the ancilla has straightforward generalization

$$\begin{aligned} \mathcal{W} |0_A\rangle |v_x\rangle |0_y\rangle&= |0_A\rangle \left( a |0_x\rangle |v_y\rangle + f |v_x\rangle |1_y\rangle \right) = |0_A\rangle |\alpha ^+\rangle ,\end{aligned}$$

(18)

$$\begin{aligned} \mathcal{W} |1_A\rangle |v_x\rangle |0_y\rangle&= |1_A\rangle \left( a |1_x\rangle |v_y\rangle + f |v_x\rangle |0_y\rangle \right) = |1_A\rangle |\beta ^+\rangle , \end{aligned}$$

(19)

where $\left| a\right| ^2+\left| f\right| ^2=1$. The transformation $\mathcal{W}$ is unitary when

$$\begin{aligned} \mathcal{W} |0_A\rangle |v_x\rangle |1_y\rangle&= |0_A\rangle \left( f |0_x\rangle |v_y\rangle - a |v_x\rangle |1_y\rangle \right) = |0_A\rangle |\alpha ^-\rangle ,\end{aligned}$$

(20)

$$\begin{aligned} \mathcal{W} |1_A\rangle |v_x\rangle |1_y\rangle&= |1_A\rangle \left( f |1_x\rangle |v_y\rangle - a |v_x\rangle |0_y\rangle \right) = |1_A\rangle |\beta ^-\rangle , \end{aligned}$$

(21)

$f a^* = f^* a$ and

$$\begin{aligned} \mathcal{W} |0_A\rangle |0_x\rangle |v_y\rangle = |0_A\rangle |v_x\rangle |0_y\rangle ,&\quad \quad&\mathcal{W} |0_A\rangle |1_x\rangle |v_y\rangle = |0_A\rangle |1_x\rangle |v_y\rangle ,\end{aligned}$$

(22)

$$\begin{aligned} \mathcal{W} |1_A\rangle |0_x\rangle |v_y\rangle = |1_A\rangle |0_x\rangle |v_y\rangle ,&\quad \quad&\mathcal{W} |1_A\rangle |1_x\rangle |v_y\rangle = |1_A\rangle |v_x\rangle |1_y\rangle . \end{aligned}$$

(23)

The state (10) used for control measurements then takes the form

$$\begin{aligned} |\psi _{BAE}^{(1)}\rangle = \frac{1}{\sqrt{2}}|1_B\rangle |0_A\rangle |\alpha ^+\rangle + \frac{1}{\sqrt{2}}|0_B\rangle \left( f |v_A\rangle |1_x\rangle |0_y\rangle +a|1_A\rangle |1_x\rangle |v_y\rangle \right) . \end{aligned}$$

(24)

The average loss rate observed in control measurements is related to coefficient f as

$$\begin{aligned} p_L = \frac{1}{2} \left| f\right| ^2 \end{aligned}$$

(25)

and Eve is now able to fine-tune induced losses by an appropriate selection of this coupling parameter. However, the above capability does not come without a price. Alice’s encoding is still effectively applied to the x register when the system state is observed at the $\mathcal{C}_\mathrm {SWAP}$-$\mathcal{C}_{\mathrm {U}}$ cross-section. But this time information encoding does not transform $|\beta ^+\rangle$ into $|\beta ^-\rangle$ as in (13) but instead into the state

$$\begin{aligned} |\beta ^z\rangle = \left( - a |1_x\rangle |v_y\rangle + f |v_x\rangle |0_y\rangle \right) . \end{aligned}$$

(26)

so the information-encoded states take the form

$$\begin{aligned} \nu =0&\quad&|\xi _0\rangle = \frac{1}{\sqrt{2}}\left( |1_B\rangle |0_A\rangle |\alpha ^+\rangle +|0_B\rangle |1_A\rangle |\beta ^+\rangle \right) ,\end{aligned}$$

(27a)

$$\begin{aligned} \nu =1&\quad&|\xi _1\rangle = \frac{1}{\sqrt{2}}\left( |1_B\rangle |0_A\rangle |\alpha ^+\rangle +|0_B\rangle |1_A\rangle |\beta ^z\rangle \right) , \end{aligned}$$

(27b)

Consequently, disentangling $\mathcal{W}^{-1}=\mathcal{W}^\dag$ leads to states

$$\begin{aligned} |\varepsilon _0\rangle&=\mathcal{W}^{\dag }|\xi _0\rangle = \frac{1}{\sqrt{2}}\left( |1_B\rangle |0_A\rangle |v_x\rangle |0_y\rangle +|0_B\rangle |1_A\rangle |v_x\rangle |0_y\rangle \right) ,\end{aligned}$$

(28a)

$$\begin{aligned} |\varepsilon _1\rangle&=\mathcal{W}^{\dag }|\xi _1\rangle , \end{aligned}$$

(28b)

and Eve’s information gain is determined by the distinguishability of states

$$\begin{aligned} \rho _0&= \mathrm {Tr}_{BA}\left( |\varepsilon _0\rangle \langle \varepsilon _0|\right) = |v_x\rangle |0_y\rangle \langle v_x|\langle 0_y|,\end{aligned}$$

(29)

$$\begin{aligned} \rho _1&= \mathrm {Tr}_{BA}\left( \mathcal{W}^{\dag }|\varepsilon _1\rangle \langle \varepsilon _1|\mathcal{W}\right) . \end{aligned}$$

(30)

Fig. 7.

Eve’s information gain as a function of the average loss rate

Figure 7 presents Eve’s information gain for the two policies of total induced loss reduction. A key “Zhang” denotes the information gain when the losses are reduced by the plain skipping of protocol cycles. The curve marked as “PZ” illustrates the same quantity computed with the introduced technique and obtained for real-valued coefficient f. The improvement $\varDelta I=I_\mathrm {PZ}-I_\mathrm {Zhang}$ expressed in bits does not first appear to be impressive as it does not exceed $\varDelta I_\mathrm {max}=0.1\,$bit. However, the ratio of the additional eavesdropped information to the one received with the traditional technique better exhibits the strength of the contribution. As the graph illustrates, the new way of eavesdropping can be almost 80 % better than methods proposed so far. The other features of the new method remain unchanged compared to Zhang’s method. Numerical simulations have shown that maximal information gain is obtained for $a=f=1/\sqrt{2}$ i.e., for values hard encoded in Zhang’s circuit. At the same time, the maximal loss ratio is observed for these coupling constants.

4 Conclusion

The entangling transformation, parametrized by the induced loss ratio, is proposed. In the new method, the eavesdropper’s information gain exceeds values offered by other methods. The other key properties of the attack remain the same. The proposed method significantly improves efficiency when attack is operated in low loss regime. It follows, that instead of skipping some protocol cycles, a better policy based on the modification of the entangling transformation parameters should be used to fine tune induced losses.