Cryptography is crucial to communication security. In 1984, a well-known QKD (quantum key distribution) protocol, BB84, was published by Bennett and Brassard. The BB84 Protocol was followed by the QKD protocols published by Ekert (1991) (E91) and Bennett (1992) (B92). Some authors proved security of the theoretical QKD protocols in different theoretical frameworks by defining security of QKD protocols differently. My argument is that the previous proofs of security are neither unique nor exhaustive for each theoretical QKD protocol, which means that proof of security of the theoretical QKD protocols has not been completed or achieved. The non-uniqueness and the non-exhaustiveness of the proofs will lead to more proofs. However, a coming “proof” of security of the theoretical QKD protocols is possible to be a disproof. The research by quantum mechanics in this paper disproves security of the theoretical QKD protocols, by establishing the theoretical framework of quantum mechanical proof, defining security of QKD protocols, establishing the quantum state of the final key of the theoretical protocols from their information leakages, and applying Grover’s fast quantum mechanical algorithm for database search to the quantum state of the final key to result in the Insecurity Theorem. This result is opposite to those of the previous proofs where the theoretical QKD protocols were secure. It is impossible for Alice and Bob to protect their communications from information leakage by stopping or canceling the protocols. The theoretical QKD keys are conventional and basically insecure. Disproof of security of the theoretical QKD protocols is logical.
Cryptography is crucial to communication security. In 1984, a well-known QKD (quantum key distribution) protocol, BB84, was published by Bennett and Brassard [
Some authors (E. Biham, M. Boyer, P.O. Boykin, T. Mor and V. Roychowdhury; P. W. Shor and J. Preskill; D. Mayers; D. Gottesman and H.-K. Lo; H.-K. Lo, H. F. Chau and M. Ardehali; R. Renner, N. Gisin and B. Kraus; M. Boyer, R. Liss and T. Mor; H.-Y. Su) proved security of BB84 [
My argument is that the authors understand security of QKD with different perspectives, and the previous proofs of security are neither unique nor exhaustive for each theoretical QKD protocol, which means that proof of security of the theoretical QKD protocols has not been completed or achieved. On the other hand, it is possible, from the non-uniqueness and non-exhaustiveness of proofs of security of QKD, that the theoretical QKD protocols will be proved insecure in an updated theoretical framework with an updated definition of security. For insecurity, one proof is enough.
Quantum mechanics is applied to variant research fields. For example, Stanisław Olszewski examines the time intervals characteristic for the quantum emission process, partly on the basis of the Ehrenfest treatment of the adiabatic invariants and partly with the aid of a study of the mechanical properties of electrons entering the simple quantum systems [
Quantum computation holds much promise to break cryptosystems. In 1994, Shor published an algorithm for quantum computation of factoring [
In this research Grover’s fast quantum mechanical algorithm for database search is applied to disprove security of the theoretical quantum key distribution protocols [
From the previous proofs the theoretical QKD protocols, free of quantum computation attack, are secure, while my research concludes, from quantum mechanics, that the theoretical QKD protocols are insecure.
BB84, E91 and B92 are the theoretical and fundamental QKD protocols. Their insecurity implies that all QKD protocols developed following their model are insecure, and the strategy or direction of the quantum cryptography based on QKD should be adjusted.
Discussions are given.
The theoretical framework of quantum mechanical proof in this paper consists of the theoretical QKD protocols, Grover’s fast quantum mechanical algorithm for database search and the rules of mathematical inference in quantum mechanics.
The variables in the framework are listed as:
ki: the bit string of the i-th component of the quantum state of the final key;
pj: the bit string of the j-th component of the quantum state of the plain-text;
ks: the bit string of the key, whose value is set by Alice;
pt: the bit string of the plain-text, whose value is set by Alice;
C: the bit string of the cypher-text produced by Alice’s encryption.
A QKD (quantum key distribution) protocol is secure if and only if its final key cannot be deduced from the information leakage of the protocol.
The theoretical QKD protocols, BB84, E91 and B92, are insecure in the theoretical framework of quantum mechanical proof in this paper.
After the “public discussion” of BB84 Protocol, the “remaining shared secret bits”, announced or leaked over the public channel, are used as the final key [
Eve, the adversary, overhears the legitimate users’ public announcements, neither disturbing the quantum channel nor violating the requirement of quantum mechanics, to know n, the number of the bits of the final key, by counting the measurements or the orientations of the analyzers within the second group, which Alice and Bob used the same orientation of their analyzers for and publicly announced or leaked [
1) Detecting the key-length of EPR and non-EPR key distribution system by Eve:
For “EPR and non-EPR key distribution” system [
2) A scheme of “interferometric quantum key distribution using two non-or-thogonal low-intensity coherent states” is proposed [
My argument is that it is unnecessary for Eve to “see” the same subset of flashes. She can seize the knowledge of the key-length by eavesdropping on Bob’s public report and counting the subset flashes seen by Bob.
The leakage of the lengths of the final keys of BB84, E91 and B92 discussed in Sections 5.1 - 5.3 results in the establishment, in terms of quantum mechanics, of | K 〉 , superposition of N (N = 2n) states of | k i 〉 (of n bits), as the quantum state of the final key.
| K 〉 = 1 2 ( | 0 〉 + | 1 〉 ) ⊗ 1 2 ( | 0 〉 + | 1 〉 ) ⊗ ⋅ ⋅ ⋅ ⊗ 1 2 ( | 0 〉 + | 1 〉 ) = 1 2 n ( | 00 ⋅ ⋅ ⋅ 0 〉 + | 00 ⋅ ⋅ ⋅ 1 〉 + ⋅ ⋅ ⋅ + | 11 ⋅ ⋅ ⋅ 1 〉 ) = 1 N ∑ i = 0 N − 1 | k i 〉 (1)
where n is the number of the bits of the final key of any one of BB84, E91 and B92. Equation (1) and the analysis below in Section 5 are valid for any one of BB84, E91 and B92 protocols.
Bennett and Brassard declare that “If the transmission has not been disturbed, they agree to use these shared secret bits in the well-known way as a one-time pad to conceal the meaning of subsequent meaningful communications, or for other cryptographic applications (e.g. authentication tags) requiring shared secret random information.” [
The length (the number of the bits) of the plain-text is n, equal to the length of the key, because the encryption algorithm of QKD is OTP encryption algorithm [
| P 〉 = 1 2 ( | 0 〉 + | 1 〉 ) ⊗ 1 2 ( | 0 〉 + | 1 〉 ) ⊗ ⋅ ⋅ ⋅ ⊗ 1 2 ( | 0 〉 + | 1 〉 ) = 1 2 n ( | 00 ⋅ ⋅ ⋅ 0 〉 + | 00 ⋅ ⋅ ⋅ 1 〉 + ⋅ ⋅ ⋅ + | 11 ⋅ ⋅ ⋅ 1 〉 ) = 1 N ∑ j = 0 N − 1 | p j 〉 (2)
After the protocol is implemented, Alice encrypts her plain-text by the operation
E ( k s , p t ) = C ( 0 ≤ s ≤ N − 1 , 0 ≤ t ≤ N − 1 ) (3)
where E is the OTP (one-time pad) encryption algorithm, ks is the bit string of | k s 〉 , the key, pt is the bit string of | p t 〉 , the plain-text, C is the cipher-text. Then she sends the cipher-text and the encryption algorithm (for Bob’s decryption) to Bob during the communication between them.
Bob receives the cypher-text and the encryption algorithm sent by Alice to him, and establishes his decryption equation
E ( k s , p j ) = C ( 0 ≤ s ≤ N − 1 , 0 ≤ j ≤ N − 1 ) , (4)
where E is the OTP (one-time pad) encryption algorithm, ks is the bit string of | k s 〉 , the key, pj is the bit string of | p j 〉 , C is the cipher-text.
Bob’s decryption is to solve the decryption equation, Equation (4), to find the plain-text | p t 〉 .
It is obvious that there exists at least one solution of Equation (4) because of Alice’s encrypting (Equation (3)). It is obvious that solution of Equation (4) is required to be unique for successful communication between Alice and Bob.
Solving Equation (4) is to search | P 〉 (expressed by Equation (2)) for the | p j 〉 whose bit string, pj, satisfies Equation (4). Bob prefers using Grover’s fast quantum mechanical algorithm for database search because Grover’s quantum searching algorithm is optimal [
Eve intercepts the cipher-text and the encryption algorithm sent by Alice to Bob.
For Eve, if | k i 〉 is the key and | p j 〉 is the plain-text, they satisfy
E ( k i , p j ) = C ( 0 ≤ i ≤ N − 1 , 0 ≤ j ≤ N − 1 ) (5)
where E is the OTP encryption algorithm, ki is the bit string of | k i 〉 , pj is the bit string of | p j 〉 , C is the cipher-text. Equation (5) is the key-equation.
It is obvious that there exists at least one couple of ki and pj that satisfies Equation (5) because of Alice’s encrypting (Equation (3)). Furthermore, multiplicity of solution of Equation (5), if any, can result in multiplicity of solution of Equation (4) because of | k s 〉 ∈ { | k i 〉 | ( 0 ≤ i ≤ N − 1 ) } . Then logically, uniqueness of solution of Equation (4) can result in uniqueness of solution of Equation (5). And so, if communication between Alice and Bob is successful, solution of the key-equation Equation (5) can be unique.
Eve searches the quantum state of the secrete key (Equation (1)) for the key by Grover’s fast quantum mechanical algorithm for database search. She succeeds as the communication between Alice and Bob is successful and solution of the key-equation is unique:
1) Defining a function f ( k i , p j ) (using the key-equation Equation (5)):
f ( k i , p j ) = { 1, E ( k i , p j ) = C 0, E ( k i , p j ) ≠ C (6)
2) Repeating the following operations (a) and (b) for O ( N ) times (Grover Iteration) [
a) Applying the oracle operation [
| k i 〉 → O ( − 1 ) f ( k i , p j ) | k i 〉 , (7)
where f ( k i , p j ) is the function defined by Equation (6).
b) Performing Grover operation (in terms of inversion about average operation)
D | K 〉 , (8)
where the diffusion transform D can be implemented as
D = W R W , (9)
where W is the Walsh-Hadamard Transform Matrix and R is the phase rotation matrix [
3) Measuring the resulting state of | K 〉 results in | k s 〉 , the secrete key, with a probability of O ( 1 ) [
From the inference of Section 5, the result of Section 5.11 and the definition of security of QKD protocols suggested in Section 3, the Insecurity Theorem of the theoretical QKD protocols suggested in Section 4 is proved.
1) An alternative approach to establishing of the quantum state of the final key, Equation (1), and the quantum state of the plain-text, Equation (2), is open to Eve. Eve intercepts the cypher-text sent by Alice to Bob and counts its bits forn, then establishes Equation (1), wheren is the key-length, and Equation (2), where n is the number of the bits of the plain-text, because the encryption algorithm of QKD is one-time pad (OTP) encryption algorithm [
2) Bob’s O ( N ) Grover’s iterations are completed within a period of time decided by him, no matter how big N ( N < ∞ ) is, if and only if computing speed of quantum computation is unlimited.
Eve’s O ( N ) Grover’s iterations (of Equation (7) and Equation (8)) are completed within a period of time decided by her, no matter how big N ( N < ∞ ) is, if and only if computing speed of quantum computation is unlimited.
Quantum computers perform any operations allowed by quantum mechanics. Quantum computation is, in principle, of unlimited computational power (unlimited computing speed), because no limit of computing speed is possible to be defined or proved by the fundamental principles of quantum mechanics (superposition, uncertainty and entanglement) that quantum computation is based on.
Thus, the unlimited computing speed of quantum computation guarantees that both the communication between Alice and Bob and Eve’s searching for the key are successful.
3) It is obvious that it is impossible for Alice and Bob to detect Eve’s activities because the quantum transmission between them is not disturbed by Eve’s operations of eavesdropping and quantum computation. Thus, it is impossible for Alice and Bob to protect their communications from information leakage by stopping or canceling the protocols.
4) The theoretical QKD keys are conventional ones because they are constructed by conventional bits. Therefore, the essential difficulty of the theoretical QKD protocols is that the theoretical QKD keys are basically insecure. Disproof of security of the theoretical QKD protocols is logical.
This research, based on quantum mechanics and quantum computation, proves that the theoretical QKD protocols, BB84, E91 and B92, are insecure in the theoretical framework of quantum mechanical proof in this paper. This result is opposite to those of the previous proofs where BB84 and B92 QKD protocols were secure. The information leakage of the theoretical QKD protocols is unavoidable because the quantum transmission of the protocols is not disturbed by Eve’s operations. The keys of the theoretical QKD protocols are conventional ones of conventional bits and basically insecure. The Insecurity Theorem of the theoretical QKD protocols proved in this paper is a logical result. The insecurity of the theoretical and fundamental QKD protocols implies that all QKD protocols developed following their model (featured by a quantum channel, a conventional channel, a conventional key and OTP encryption) are insecure, and the strategy or direction of the quantum cryptography based on QKD should be adjusted, that will stimulate more topics to be studied in the quantum information field.
I thank Jin Zhao for her suggestions for this manuscript.
The author declares no conflicts of interest.
Zhao, J.Z. (2022) A Quantum Mechanical Proof of Insecurity of the Theoretical QKD Protocols. Journal of Quantum Information Science, 12, 53-63. https://doi.org/10.4236/jqis.2022.123006
Bob searches the quantum state of the plain-text (Equation (2)) for the plain-text by Grover’s fast quantum mechanical algorithm for database search. He succeeds as solution of the decryption equation is unique for successful communication between Alice and him:
A) Defining a function g ( k s , p j ) (using the decryption equation, Equation (4)):
g ( k s , p j ) = { 1, E ( k s , p j ) = C 0, E ( k s , p j ) ≠ C (10)
B) Repeating the following operations (a) and (b) for O ( N ) times (Grover Iteration) [
a) Applying the oracle operation [
| p j 〉 → O ( − 1 ) g ( k s , p j ) | p j 〉 , (11)
where g ( k s , p j ) is the function defined by Equation (10).
b) Performing Grover operation (in terms of inversion about average operation)
D | P 〉 , (12)
where the diffusion transform D can be implemented as
D = W R W , (13)
where W is the Walsh-Hadamard Transform Matrix and R is the phase rotation matrix [
C) Measuring the resulting state of | P 〉 results in | p t 〉 , the plain-text, with a probability of O ( 1 ) [
Suppose the OTP encryption algorithm used by Alice is XOR [