## Tuesday, 10 December 2013

### Secret key ecryption

Consider a scenario where Alice wants to send a qubit $\ket{\psi}$ to Bob over a quantum channel that is possibly being monitored by and eavesdropper, Eve.

Suppose Alice and Bob share a classical secret key $k\in\{0,1\}$, and Alice tries to encrypt the state $\ket{\psi}$ by sending Bob the state $X^k\ket{\psi}$. This approach is highly insecure because there are certain states whose encryptions can be perfectly distinguished by Eve. For instance, consider the states
$\ket{\psi_0}=\frac{1}{\sqrt{2}}(\ket{0}+\ket{1}), \ket{\psi_1}=\frac{1}{\sqrt{2}}(\ket{0}-\ket{1}).$
which both happen to be eigenstates of $X$ with eigenvalues $+1$ and $-1$, respectively.

Then the two possible ways this state can be be encrypted are given by
\begin{align*} X^0\ket{\psi_0}=\ket{\psi_0}, X^1\ket{\psi_0}=\ket{\psi_0}, X^0\ket{\psi_1}=\ket{\psi_1}, X^1\ket{\psi_1}=-\ket{\psi_0}. \end{align*}
Regardless of how either of these states are encrypted, for $k\in\{0,1\}$,
$\bra{\psi_0}X^k\ket{\psi_1}=(-1)^k\bra{\psi_0}\ket{\psi_1}=0,$
which shows that the two states always remain orthogonal and can be distinguished with perfect accuracy.

Suppose that Alice and Bob have two independently generated key bits $k_1, k_2$ and Alice encrypts $\ket{\psi}$ as $Z^{k_1}X^{k_2}\ket{\psi}$. Note that Bob can decrypt this state since it is being assumed that he knows the key bits $k_1, k_2$. Consider any two arbitrary qubit states
$\ket{\psi_0}=\alpha_0\ket{0}+\beta_0\ket{1} \ \ \text{and} \ \ \ket{\psi_1}=\alpha_1\ket{0}+\beta_1\ket{1}.$
Then the density operators of these two states will be of the form
$\rho_j=\ket{\psi_j}\bra{\psi_j}=\begin{pmatrix} \alpha_j\overline{\alpha_j}&\alpha_j\overline{\beta_j} \\ \beta_j\overline{\alpha_j}&\beta_j\overline{\beta_j} \end{pmatrix}.$

The encrypted state $Z^{k_1}X^{k_2}\ket{\psi_j}$ can be described as a general quantum operation $\Phi$ with four Krauss operators, one for each possible combination key bits $(k_1,k_2)$, given by
$\Phi(\rho_j)=\SUM{k_1,k_2=0}{1}A_{k_1,k_2}\rho_jA_{k_1,k_2}^\dagger,$
where
$A_{k_1,k_2}=\frac{1}{2}Z^{k_1}X^{k_2}.$
Since $X^\dagger=X, Z^\dagger=Z$, and $X^2=Z^2=I$, it can be seen that $\Phi$ is indeed a valid quantum operation because the Krauss operators satisfy the completeness condition:
$\SUM{k_1,k_2=0}{1}A_{k_1,k_2}^\dagger A_{k_1,k_2}=\frac{1}{4}I+\frac{1}{4}X^\dagger X+\frac{1}{4}Z^\dagger Z+\frac{1}{4}X^\dagger Z^\dagger ZX = I$
The factor of $1/2$ is present in each $A_{k_1,k_2}$ so that each term in the sum contained in $\Phi$ occurs with equal probability since the key bits $k_1,k_2$ that specify how the state $\ket{\psi}$ is encoded are chosen with uniform probability.

The action of $\Phi$ on a general quantum state is given by
\begin{align*} \Phi(\rho_j)&=\SUM{k_1,k_2=0}{1}A_{k_1,k_2}\rho_jA_{k_1,k_2}^\dagger \\ &= \frac{1}{4}\rho_j+\frac{1}{4}X\rho_jX^\dagger +\frac{1}{4}Z\rho_jZ^\dagger +\frac{1}{4}ZX\rho_jX^\dagger Z^\dagger \\ &=\frac{1}{4}\begin{pmatrix} \alpha_j\overline{\alpha_j}&\alpha_j\overline{\beta_j} \\ \beta_j\overline{\alpha_j}&\beta_j\overline{\beta_j} \end{pmatrix} + \frac{1}{4}\left( \begin{array}{cc} \beta _j \bar{\beta }_j & \beta _j \bar{\alpha }_j \\ \alpha _j \bar{\beta }_j & \alpha _j \bar{\alpha }_j \\ \end{array} \right) + \frac{1}{4}\left( \begin{array}{cc} \alpha _j \bar{\alpha }_j & -\alpha _j \bar{\beta }_j \\ -\beta _j \bar{\alpha }_j & \beta _j \bar{\beta }_j \\ \end{array} \right) + \frac{1}{4}\left( \begin{array}{cc} \beta _j \bar{\beta }_j & -\beta _j \bar{\alpha }_j \\ -\alpha _j \bar{\beta }_j & \alpha _j \bar{\alpha }_j \\ \end{array} \right)\\ &= \frac{1}{2}\left( \begin{array}{cc} \alpha _j \bar{\alpha }_j+ \beta _j \bar{\beta }_j & 0 \\ 0 & \alpha _j \bar{\alpha }_j+ \beta _j \bar{\beta }_j \\ \end{array} \right)\\ &= \frac{1}{2}\left( \begin{array}{cc} 1 & 0 \\ 0 & 1 \\ \end{array} \right), \end{align*}
since $\alpha _j \bar{\alpha }_j+ \beta _j \bar{\beta }_j=1$ because the states $\ket{\psi_j}$ are taken to be normalized. Therefore, $\Phi(\rho_j)$ is the maximally mixed state. Moreover, it can be seen that $\Phi(\rho_j)$ does not depend on $j$ and thus not on any particular state $\ket{\psi}$ that is encoded by $Z^{k_1}X^{k_2}$$\ket{\psi}$. This implies that it is impossible to distinguish between any of the encrypted states $\ket{\psi_0}$ and $\ket{\psi_1}$, since any measurement of $\Phi(\rho_j)$ will only yield one of the computational basis states with equal probability.