🚀 go-pugleaf

Recent exciting and ingenious articles on "quantum cryptography" [1,2]
seem to bring this interesting field close to practical fruition.
One thing bothers me, though, and I wonder if it bothers anybody else.
Explanations of the technique's strength rely heavily on the
fact that measurements made on a single photon cannot possibly give
a complete knowledge of its original state of polarization.
While this basic fact is true, the articles seem not to consider the
possibility of "amplifying" the photon into a large number of identically
polarized photons, and then making many independent measurements on those
duplicate photons, from which the original state of polarization can
indeed be deduced with the necessary precision.

Details (modestly abridged but essentially intact):

In the proposed communication channel [1,2], Alice sends Bob a single
photon in one of four polarization states: (1) linear vertical, (2) linear
horizontal, (3) circular right-handed, or (4) circular left-handed.  The
photon's state of polarization encodes one bit of information.  To measure
the polarization, Bob must decide whether to look for linear or circular
polarization. If he looks for linear polarization, he will always get an
answer of "vertical" or "horizontal", and this answer will always agree
with what Alice sent if she sent the photon in state (1) or (2), but will
be random if she sent (3) or (4). After Bob measures the photon, Alice
tells him which way (linear or circular) she polarized it. If he was
measuring in the same regime (linear or circular), the measured
polarization must agree with what Alice sent, so a bit has been
communicated. If not, no information has been communicated, and they try
again.

The fact that Bob gets only one chance to measure the polarization of
the photon comes from the peculiar (but accepted) quantum-mechanical
principle that when you measure some property of an object, you are
guaranteed to get an answer that is an eigenvalue of the (mystical)
operator associated with that measurement, and the object will thereafter
behave as if it were in the corresponding eigenstate of that measurement.
For example, if you measure the circular polarization of a linearly
polarized photon, you'll get the answer "right-handed" or "left-handed",
and the photon will thereafter behave exactly like a right- or left-handed
circularly polarized photon, all evidence of its previous polarization
being lost.

The appeal of this system [1,2] is that if an evesdropper, Eve, intercepts the
photon, measures its polarization, and sends a new photon with the measured
polarization on to Bob, half the time she will measure in the wrong regime,
and so will get a random answer, and will send on to Bob a photon with
some inappropriate polarization. This will produce a lot of disagreement
in bits that Alice and Bob expect should agree. The authors of [1] present
some delightful and clever methods by which Alice and Bob can detect these
disagreements, estimate how many bits Eve could have intercepted, and
deprive Eve of any hope of profiting from her ill-gotten bits.

What seems to be ignored is the possibility that Eve will intercept the
photon and pass it through an amplifier, producing a large number of
photons with identical polarizations. (As I understand it [and I've
checked with two local laser gurus], amplification does not constitute
a polarization measurement, so polarization can be unchanged.) Eve passes
one of these photons on to Bob, passes half of the rest through a linear
polarization-measurer, and the remainder through a circular polarization-
measurer. Of the two measurers, one will produce a 50-50 split, and the
other (the correct one) a 100-0 split. Eve has complete polarization
information without even waiting to hear Alice tell Bob what the correct
measurement regime was.

I suppose there may be practical difficulties: Eve may slightly upset the
distribution of photon counts that Bob sees, and I've no idea whether
available amplifiers can provide the needed performance. But unless
I'm completely confused, the security of quantum cryptography depends
more on the greys of amplifier capabilities than on black-and-white
guarantees of quantum mechanics.

Comments, anyone?

[1] C. H. Bennett, F. Bessette, G. Brassard, L. Salvail, and John Smolin,
Experimental Quantum Cryptography, J. of Cryptology, vol. 5 p. 3 (1992).

[2] C. H. Bennett, Gilles Brassard, and A. Ekert, Quantum Cryptography,
Scientific American vol. 267 no. 4 p. 50, October 1992.

Peter Pearson
pearson6@llnl.gov
-- 
pearson6@llnl.gov