Upper Bound of Collective Attacks on Quantum Key Distribution
Wei Li Shengmei Zhao








 zhaosm@njupt.edu.cn
^1Nanjing University of Posts and Telecommunications, Institute of Signal Processing and Transmission, Nanjing, 210003, China.
^2Nanjing University of Posts and Telecommunications, Key Lab Broadband Wireless Communication and Sensor Network, Ministy of Education, Nanjing, 210003, China.
^3National Laboratory of Solid State Microstructures, Nanjing University, Nanjing 210093, China.




             



Evaluating the theoretical limit of the amount of information Eve can steal from a quantum key distribution protocol under given conditions is one of the most important things that need to be done in security proof. In addition to source loopholes and detection loopholes, channel attacks are considered to be the main ways of information leakage, while collective attacks are considered to be the most powerful active channel attacks. Here we deduce in detail the capability limit of Eve's collective attack, the most powerful attack scheme in channel attacks, in non-entangled quantum key distribution, like BB84 and measurement-device-independent protocols, and entangled quantum key distribution, like device-independent protocol, in which collective attack is composed of quantum weak measurement and quantum unambiguous state discrimination detection. The theoretical results show that collective attacks are equivalent in entangled and non-entangled quantum key distribution protocols. We also find that compared with the loose bond on Eve's attack provided by security proof based on entanglement purification, the security proof against collective attacks not only improves the system's tolerable bit error rate, but also improves the key rate.



Valid PACS appear here
                             

                              
Upper Bound of Collective Attacks on Quantum Key Distribution
    Shengmei Zhao^1,2
    December 30, 2023
=============================================================






§ INTRODUCTION


Security proof is one of the most important components of quantum key distribution (QKD)<cit.>. It is not only used to evaluate the validity of a protocol, but also to give the maximum key rate that the protocol can extract. A QKD protocol is considered to be secure in this case that after the two communication parties, Alice and Bob, complete the transmission and measurement of quantum states and all post-processing, the probability of eavesdropper Eve acquiring their shared key tends to be exponentially infinitesimal. The security of QKD can be divided into two categories. The first category belongs to security loopholes, such as imperfect light source<cit.> and detection loopholes<cit.>. Under appropriate attack schemes, the information of shared keys between Alice and Bob can be eavesdropped almost entirely. At present, many approaches have been proposed to close these loopholes, such as decoy-state protocol for imperfect light source<cit.>, measurement-device-independent (MDI)-QKD protocols for detection loopholes<cit.>.

The other category of QKD security is the channel-side leakage of information introduced by imperfect devices in the transmission and measurement of quantum states, such as the beam-splitting (BS) attack caused by the attenuation of quantum states<cit.>, and the collective attack scheme introduced by finite bit error rate (BER)<cit.>. The amount of information lost by channel-side attacks will determine the amount of information needed for secret amplification and the maximum tolerable BER by QKD. BS attack is a passive attack scheme in which the attenuated photon states can be considered to be intercepted and stored by Eve. The amount of information eavesdropped by Eve is determined by the joint measurement probability between Eve and Alice and Bob. In contrast with BS attack, collective attack is an active attack scheme. Eve uses weak measurement technology to obtain as much information as possible about the shared quantum states between Alice and Bob under certain perturbations. The security proof based on entanglement purification has given the general loose bound of information consumed by secret amplification. Although the security against collective attacks in the BB84 and B92 protocols<cit.> has been proved, there is no corresponding expression of the general bound. Furthermore, the Holove quantity provided by DI-QKD security proof against collective attacks is not improved compared with the entanglement purification protocol<cit.>. However, after knowing Eve's attack strategy, a tighter bound for information leakage should be obtained. We already know that QKD protocols based on single-photon and entangled states have equivalence. Like entanglement purification protocols, we need to give the general expression of Holove quantity between Eve and Alice and Bob under the collective attack for all QKDs.

In this paper, we will evaluate the performance of Eve's collective attacks on different kinds of QKDs by deducing the Holove quantity and the tolerable maximum bit error rate. Firstly, we derive the maximum amount of information that Eve can steal using collective attack in non-entangled QKD. Eve's collective attack consists of quantum weak measurement and quantum unambiguous state discrimination detection. Eve can perform any quantum operation, and any operation of Eve only needs to obey quantum mechanics. Next, we extend Eve's collective attack to entangled QKD systems, and give the generality of collective attack in these two kinds of QKD systems.



§ COLLECTIVE ATTACK IN NON-ENTANGLED QKD PROTOCOLS


Collective attack is currently considered to be the most powerful channel attack scheme. In collective attack, Eve attaches his quantum state to each of the states transmitted between Alice and Bob independently. Eve performs a weak measurement operation on the joint quantum states to entangle his state with the joint system of Alice and Bob. Eve then stores his quantum state and re-sends the quantum state transmitted between Alice and Bob. After Alice and Bob have completed state measurement and announcement of measurement base, Eve then makes unambiguous state discrimination (USD) measurements on the corresponding quantum state stored by him to obtain the shared information between Alice and Bob. We first show collective attacks in non-entangled two-dimensional QKD protocols, such as BB84- and MDI-QKDs. These conclusions are then extended to the entanglement-based QKD protocol.



 §.§ Weak measurement




Assume that the quantum state space in QKD protocol is formed by orthogonal basis vectors | p ⟩ and | q ⟩ which can interact with Eve's system without any crossing, and the bases in Z space and X space can be written as

    | 0 ⟩   =a  | p ⟩ + b | q ⟩,  | 0 ⟩=b | p ⟩ -a | q ⟩, 
     | + ⟩   =√(2)/2 [  ( a+b  )  | p ⟩ -  ( a-b  ) | q ⟩ ],  | + ⟩ =√(2)/2 [  ( a-b  )  | p ⟩ +  ( a+b  ) | q ⟩ ],

where a and b are the normalization constants that satisfy a^2+b^2=1. In BB84, as shown in Fig. 1, Alice prepares these two sets of mutually-unbiased-bases (MUBs) with equal probabilities and sends them to Bob. Eve has a powerful attack capability in the collective attack scheme, any operation by Eve should only be restricted to the principle of quantum mechanics. Eve is free to change the values of a and b in Eqs. (1). Assume that Eve's initial quantum state is | E ⟩, the weak measurement on the joint system is represented by a unitary operator U,

    U  | p ⟩ | E ⟩   =  | α_p⟩ | E_p⟩,
    
    U  | q ⟩ | E ⟩   =  | β_q⟩ | E_q⟩,

where | α_p⟩ and | β_q⟩ are obtained by rotating α and β degrees of | p ⟩ and | q ⟩ in a two-dimensional plane under weak measurements, respectively, | E_p⟩ and | E_q⟩ are the corresponding states stored by Eve, all the phase terms generated by the interaction are included in | E_p⟩ and | E_q⟩. The unitary of operator U leads to the following equality

    ⟨ p | q ⟩⟨ E | E ⟩=0=⟨ E  | ⟨ q  | U^+ U  | q ⟩ | E ⟩=⟨α_p | β_q⟩⟨ E_p | E_q⟩.

In general, | E_p⟩ and | E_q⟩ are not necessary to be orthogonal to each other. Thus for any quantum states | α_p⟩ and | β_q⟩, we have ⟨α_p | β_q⟩=0, which means that | p ⟩ and | q ⟩ are rotated at the same angle under weak measurement. After the unitary operation, Eve can reverse-rotate | α_p⟩ and | β_q⟩ at the same angle to reduce the perturbation,

    T  | p ⟩ | E ⟩   = RU  | p ⟩ | E ⟩=  | p ⟩ | E_p⟩,
    
    T  | q ⟩ | E ⟩   = RU  | q ⟩ | E ⟩=  | q ⟩ | E_q⟩.

Then the weak measurement on the states in Z bases can be written as

    T  | 0 ⟩ | E ⟩= √(p_0,0) | 0 ⟩ | E_0,0⟩+√(p_0,1) | 1 ⟩ | E_0,1⟩,
    
    T  | 1 ⟩ | E ⟩= √(p_1,0) | 0 ⟩ | E_1,0⟩+√(p_1,1) | 1 ⟩ | E_1,1⟩,

where | E_0,0⟩, | E_0,1⟩, | E_1,0⟩ and | E_1,1⟩ are the normalized states stored by Eve, and their expressions are
 
    | E_0,0⟩   =a^2 | E_p⟩+b^2 | E_q⟩/√(1-2a^2b^2 ( 1- | ⟨ E_p | E_q⟩ | cosθ )),
     | E_1,1⟩   =b^2 | E_p⟩+a^2 | E_q⟩/√(1-2a^2b^2 ( 1- | ⟨ E_p | E_q⟩ | cosθ )),
     | E_0,1⟩   = | E_1,0⟩=ab(  | E_p⟩- | E_q⟩ )/√(2a^2b^2 ( 1- | ⟨ E_p | E_q⟩ | cosθ )),

where θ is the phase difference between | E_p⟩ and | E_q⟩. The corresponding transition probabilities p_0,0, p_0,1, p_1,0 and p_1,1 are

    p_0,0   =p_1,1=1-2a^2b^2 ( 1- | ⟨ E_p | E_q⟩ | cosθ ),
    
    p_0,1   =p_1,0=2a^2b^2 ( 1- | ⟨ E_p | E_q⟩ | cosθ ).

The weak measurement on the states in Z bases can be written as

    T  | + ⟩ | E ⟩= √(p_+,+) | + ⟩ | E_+,+⟩+√(p_+,-) | - ⟩ | E_+,-⟩,
    
    T  | - ⟩ | E ⟩= √(p_-,+) | + ⟩ | E_-,+⟩+√(p_-,-) | - ⟩ | E_-,-⟩,

where | E_+,+⟩, | E_+,-⟩, | E_-,+⟩ and | E_+,+⟩ are the normalized states stored by Eve, and their expressions are

    | E_+,+⟩   = ( a+b  )^2 | E_p⟩+ ( a-b  )^2 | E_q⟩/√(1-1/2 ( 1-4a^2b^2 )  ( 1- | ⟨ E_p | E_q⟩ | cosθ )),
     | E_-,-⟩   = ( a-b  )^2 | E_p⟩+ ( a+b  )^2 | E_q⟩/√(1-1/2 ( 1-4a^2b^2 )  ( 1- | ⟨ E_p | E_q⟩ | cosθ )),
     | E_+,-⟩   = | E_-,+⟩= ( a^2-b^2 ) (  |  E_q-E_p⟩ )/√(1/2 ( 1-4a^2b^2 ) ( 1- | ⟨ E_p | E_q⟩ | cosθ )),

and p_+,+, p_+,-, p_-,+ and p_-,- are the corresponding transition probabilities which satisfy

    p_+,+   =p_-,-=1-1/2 ( 1-4a^2b^2 )  ( 1- | ⟨ E_p | E_q⟩ | cosθ ),
    
    p_+,-   =p_-,+=1/2 ( 1-4a^2b^2 )  ( 1- | ⟨ E_p | E_q⟩ | cosθ ).

From Eqs. (5) and (8), we can see that after the weak measurement performed by Eve, Eve's system is entangled with the state transmitted between Alice and Bob. From Bob's point of view, the quantum state he receives is

    ρ=1/4 [  ( p_0,0 +p_1,0 ) ρ_0 + ( p_0,1 +p_1,1 ) ρ_1+ ( p_+,+ +p_-,+ )ρ_++ ( p_+,- +p_-,- ) ρ_- ].

In this case, the BER caused by weak measurement is

    p_e=1/4 ( p_1,0+p_0,1+p_-,+ +p_+,- ),

After substituting Eqs. (7) and (10) into Eqs. (12), we can get

    p_e≥1/4 ( 1- | ⟨ E_p | E_q⟩ | cosθ ).

It can be seen from Eqs. (13) that the BER p_e is independent of the values of a and b, and only depends on the inner product between | E_p⟩ and | E_q⟩. Here | ⟨ E_p | E_q⟩ | denotes the degree of discrimination between | E_p⟩ and | E_q⟩. The smaller the value of | ⟨ E_p | E_q⟩ |, the higher the probability that Eve could distinguish | E_p⟩ and | E_q⟩. As can be seen from Eqs. (13), when the BER of the system p_e is determined, θ=0 is the best way to help Eve get information from Alice and Bob.



 §.§ Unambiguous state discrimination


After Alice and Bob have announced their selected bases, Eve makes appropriate measurements on his stored quantum states to infer Alice's information. The dependence of Eve's stored states on | E_p⟩ and | E_p⟩ is shown in Fig. 2. Quantum states | E_0,1⟩, | E_1,0⟩, | E_+,-⟩ and | E_-,+⟩ are in the direction of | E_p⟩- | E_p⟩, | E_0,0⟩, | E_1,1⟩ and | E_+,-⟩, | E_-,+⟩ are symmetrically located on each side of | E_p⟩+ | E_p⟩, respectively. There is an interesting mutually exclusive relationship between the angle of | E_0,0⟩, | E_1,1⟩ relative to | E_p⟩+ | E_p⟩ and the angle of | E_+,+⟩, | E_-,-⟩ relative to | E_p⟩+ | E_p⟩. For example, when | E_0,0⟩, | E_1,1⟩ are far from the direction of | E_p⟩+ | E_p⟩, the magnitude of | E_0,1⟩ and | E_1,0⟩ will decrease, meanwhile | E_+,+⟩, | E_-,-⟩ will be near the direction of | E_p⟩+ | E_p⟩, and the magnitude of | E_+,-⟩, | E_-,+⟩ will increase. In the extreme case, when | E_0,0⟩, | E_1,1⟩ are equal to | E_p⟩ and | E_p⟩, the magnitude of | E_0,1⟩ and | E_1,0⟩ is zero. At this time, | E_+,+⟩, | E_-,-⟩ will be strictly in the direction of | E_p⟩+ | E_p⟩, and the magnitude of | E_+,-⟩, | E_-,+⟩ will reach the maximum value √(1/2 ( 1-⟨ E_p | E_q⟩ )).



Here we set the value of a to cosα and b to sinα. After hearing the basis chosen by Alice and Bob, Eve should make a unambiguous discrimination between | E_0,0⟩ and | E_1,1⟩ or | E_+,+⟩ and | E_-,-⟩ to infer the state sent by Alice. The best known option for Eve is to use quantum USD measurements, which increases the detection probability from 1-⟨ x | y ⟩^22 by conventional USD measurements to 1-⟨ x | y ⟩ for non-orthogonal states | x ⟩, | y ⟩<cit.>. Suppose that at one moment, the base chosen by Alice and Bob is Z, Eve entangles an auxiliary bit with | E_0,0⟩ or | E_1,1⟩ through weak measurements<cit.>. After measuring the state of the auxiliary bit, Eve chooses two orthogonal measurements E_0 and E_1 to measure the quantum states collapsed from | E_0,0⟩ and | E_1,1⟩, as shown in Fig. 1(a). In the plane formed by | E_p⟩ and | E_p⟩, the angles of the two measurements E_0 and E_1 from the direction of | E_p⟩- | E_p⟩ are π4 and 3π4, respectively. When the value of α is between 0 and π4, USD measurements will be influenced by | E_0,1⟩ and | E_1,0⟩. It should be noted that in the above quantum USD measurements, | E_0,1⟩ and | E_1,0⟩ are not affected by auxiliary bits.

If the state sent by Alice is | 0 ⟩, the probability that Eve could guess right Alice's bit under USD measurement is

    p_0^r=p_0,0 ( 1-⟨ E_0,0 | E_1,1⟩ ) + 1/2p_0,1,

the probability that Eve could guess wrong Alice's bit is

    p_0^e= 1/2p_0,1.

The guessing probabilities for p_1^r andp_1^e can also be obtained in the same way. So on the Z basis, Eve's quantum USD measurement matrix is

    p_z=A_z[ p_0^r/A_z p_0^e/A_z; p_1^e/A_z p_1^r/A_z ],

where the normalization constant A_z is equal to 4p_e-2p_esin^22α, and p_0^r=p_1^r, p_0^e=p_1^e. Thus under Z base, through collective attack, the Holove quantity between Eve and Alice and Bob χ^z ( E:A,B  ) is

    χ^z ( E:AB  )=A_z [ 1-H ( p_0^r/A_z,p_0^e/A_z )  ],

where H ( x,y  )=-xlog _2x-ylog_2y. Similarly, under X base, the Holove quantity between Eve and Alice and Bob under collective attack through quantum USD measurement is

    χ^x ( E:AB  )=A_x [ 1-H ( p_+^r/A_x,p_+^e/A_x )  ],

where the normalization constant A_x is equal to 2p_e ( 1+ sin^22α ). Then the total Holove quantity χ (E: A,B  ) is

    χ (E: AB  )=1/2 [ χ^z ( E:AB  )+χ^x ( E:AB  )  ].




Fig. 3 shows the simulation result of the dependence of the total Holove quantity χ (E: AB  ) on α. We can see that when the value of α is an integer multiple of π4, χ (E: AB  ) takes the maximum value 2p_e. When the value of α is 0, | E_0,0⟩ and | E_1,1⟩ are located in the direction of | E_p⟩ and | E_q⟩, the amplitudes of | E_0,1⟩ and | E_1,0⟩ are both 0, the BER in Z-base is 0, the maximum information Eve can obtain on Z basis is 4p_e. However, for X basis, | E_+,+⟩ and | E_-,-⟩ are both in the direction of | E_p⟩+ | E_p⟩, | E_+,-⟩ and | E_-,+⟩ are in the direction of | E_p⟩- | E_p⟩, regardless of what quantum state Alice sends, Eve stores the same mixed state, the BER in X-base is 2p_e. In this case, the amount of information Eve can obtain is 0. When the value of α is π4, the situation in X-base and Z-base under collective attack is completely opposite. In order to balance the BERs on X-and Z-bases, Eve would be better off doing the following collective attack operation

    ρ_ABE=1/2Tρ_ϕρ_E T^+ +1/2THρ_ϕρ_EH^+ T^+ ,

where ρ_E= | E ⟩⟨ E  | is the state controlled by Eve and ρ_ϕ= | ϕ⟩⟨ϕ | is the state sent by Alice, H is a Hadamard operator, which is used to exchange X and Z bases.



The collective attack scheme derived from BB84 protocol can also be applied to MDI-QKD. In MDI-QKD, as shown in Fig. 4, Alice and Bob randomly prepare quantum states according to two sets of MUBs agreed beforehand and send them along two identical optical fibers to the third party, Charlie, for Bell-state measurement (BSM). The BERs on the two channels are p ( e_A ) and p ( e_B ), respectively. For symmetric MDI-QKD, the BER satisfies p ( e_A ) ≈ p ( e_B ). When the value of BER is small enough, the total BER p ( e  ) of the system is approximately p ( e_A )+p ( e_B ). Eve can execute collective attacks on two channels separately, and the total amount of information obtained is r≤ 2 ( p ( e_A )+p ( e_B )  ). In MDI-QKD, Eve could execute the following collective attack operation

    ρ_ABE=1/2Tρ_ABρ_E T^+ +1/2THρ_ABρ_EH^+ T^+,

where T=T_AT_B is the joint weak measurement operator on channels A and B, H=H_AH_B is the joint Hadamard operator on states sent by Alice and Bob. In order to obtain the information definitely, the weak measurements T_A and T_B on both sides need to satisfy the condition α_A=α_B, where α is the angle shown in Fig. 2.



§ COLLECTIVE ATTACK IN ENTANGLED QKD PROTOCOLS


Entangled QKD protocols, such as DI-QKD<cit.>, single-photon entanglement based phase-matching-QKD<cit.>, and non-entangled QKD protocols, such as BB84-QKD<cit.>, MDI-QKD<cit.> and twin-field (TF)-QKD<cit.>, have many inherent links. Both of these two kinds of QKD protocols need to select two MUBs to prepare quantum states. The final shared key is extracted after announcing the selected base through a trusted public channel. The security proof of non-entangled QKD protocol sometimes uses the method of entanglement distillation<cit.>. The time reversal relationship between MDI-QKD and DI-QKD is satisfied. Therefore, we have reason to believe that there are similarities between collective attacks in non-entangled QKD protocol and those in entangled QKD protocol. Whether in Fock-space based MDI-QKD or wave-space entanglement-based DI-QKD, BSM is an effective method to close the detection loopholes. However, in the conventional QKD protocol based on two-photon entanglement, detection loopholes is one of the main factors limiting its practicability. Because the collective attack is a channel attack scheme, we temporarily ignore the information leak caused by the detection-side loopholes.



Fig. 5 shows a brief experimental schematic of DI-QKD. The third party, Charlie, who controls the entanglement resources, sends the two parts of the entanglement to Alice and Bob respectively over two identical channels. Since a Bell state is symmetrical or anti-symmetrical in conjugate spaces, Alice and Bob can select two sets of MUBs (or conjugate measurement bases) to measure the quantum states they receive. After announcing the measurement basis publicly, they randomly select some measurement data to construct Bell-inequality to infer the degree of entanglement and BER of the system. Like the non-entangled QKD protocol, the bit error rate of the system is Eve's operating space for collective attacks.

Suppose that in an entangled QKD protocol, a third party, Charlie, prepares the Bell state | Φ_AB^+⟩_Z=√(2)/2 [  | 0 ⟩_A | 0 ⟩_B + | 1 ⟩_A | 1 ⟩_B ]. Alice and Bob choose measurement operators σ_Z and σ_X in Z basis and √(2)/2 ( σ_Z+ σ_X ) and √(2)/2 ( σ_Z-σ_X ) in X basis. Eve attaches his state | E_A⟩ | E_B⟩ to each of the Bell state | Φ_AB^+⟩ independently, then performs a weak measurement operation on the joint state to entangle his state with the joint system of Alice and Bob. In a worse case, Charlie is Eve's puppet, and Eve can instruct Charlie to prepare three-body quantum states as he wishes. These two versions of collective attack are equivalent. In collective attack scheme, Eve's controllable range includes the light source and the two channels, while Alice and Bob's detection sides are isolated from Eve. Alice and Bob extract the key on Z-basis and Z-basis from the same Bell state, the transformation relations of Bell states in X and Z bases can be expressed as follows

    | Φ_AB^+⟩_Z =  | Φ_AB^+⟩_X,     | Φ_AB^-⟩_Z =  | Ψ_AB^+⟩_X,
     | Ψ_AB^+⟩_Z =  | Φ_AB^-⟩_X,     | Ψ_AB^-⟩_Z = - | Ψ_AB^+⟩_X.

By substituting Eqs. (5) and (8) into triplet state | Φ_AB^+⟩_Z, we obtain collective attacks on entangled QKD under Z- and X-base representations

    T_AB | Φ_AB^+⟩_Z | E_A⟩ | E_B⟩   =√(2)/2  [  | E_00⟩_AB | 0 ⟩_A | 0 ⟩_B
     + | E_11⟩_AB | 1 ⟩_A | 1 ⟩_B
       + | E_01⟩_AB | 0 ⟩_A | 1 ⟩_B
    + | E_10⟩_AB | 1 ⟩_A | 0 ⟩_B],
    
    T_AB | Φ_AB^+⟩_X | E_A⟩ | E_B⟩   =√(2)/2  [  | E_++⟩_AB | + ⟩_A | + ⟩_B
    + | E_–⟩_AB | - ⟩_A | - ⟩_B
       +  | E_+-⟩_AB | + ⟩_A | - ⟩_B
    +  | E_-+⟩_AB | - ⟩_A | + ⟩_B],

where the states in Eve's hands have the following expressions

    | E_00⟩_AB   =a^2 | E_p⟩_A | E_p⟩_B+b^2 | E_q⟩_A | E_q⟩_B,
     | E_11⟩_AB   =b^2 | E_p⟩_A | E_p⟩_B+a^2 | E_q⟩_A | E_q⟩_B,
     | E_01⟩_AB   = | E_10⟩_AB=ab ( | E_p⟩_A | E_p⟩_B- | E_q⟩_A | E_q⟩_B ),
     | E_++⟩_AB   =1/2 ( ( a+b  )^2 | E_p⟩_A | E_p⟩_B+ ( a-b  )^2 | E_q⟩_A | E_q⟩_B ),
     | E_+-⟩_AB   =1/2 ( ( a-b  )^2 | E_p⟩_A | E_p⟩_B+ ( a+b  )^2 | E_q⟩_A | E_q⟩_B ),
     | E_-+⟩_AB   = | E_–⟩_AB=1/2 (a^2-b^2 ) ( | E_p⟩_A | E_p⟩_B- | E_q⟩_A | E_q⟩_B ).

From Eqs. (24) we can see that the quantum states in Eve's hands in Z and X bases are the same as those in Eve's hands, in Eqs. (6) and (9), under collective attack in non-entangled QKD. | E_00⟩_AB,  | E_11⟩_AB and | E_11⟩_AB are symmetrically located on each side of | E_p⟩_A | E_p⟩_B+ | E_q⟩_A | E_q⟩_B, | E_01⟩_AB, | E_10⟩_AB and | E_+-⟩_AB, | E_-+⟩_AB are in the direction of | E_p⟩_A | E_p⟩_B- | E_q⟩_A | E_q⟩_B. Thus the same quantum USD measurements for collective attacks can be applied here. Just like the collective attack scheme in BB84 protocol, Eve can steal the maximum amount of information when α is an integer multiple of π4.


Eve operates on Bell state | Φ_AB^+⟩_Z using a joint operator consisting of a weak measurement operator and a reverse rotation operator for α=0,

    T_AB | Φ_AB^+⟩_Z | E_A⟩ | E_B⟩ =√(2)/2 [  | 0 ⟩_A | 0 ⟩_B | E_0⟩_A | E_0⟩_B +  | 1 ⟩_A | 1 ⟩_B | E_1⟩_A | E_1⟩_B ].

As both | E_0(1)⟩_A and | E_0(1)⟩_B are in Eve's hand, it will be of Eve's convenience to set the joint state | E_0⟩_A | E_0⟩_B to | E_0⟩, and the joint state | E_1⟩_A | E_1⟩_B to | E_1⟩. As in Fig. 1, we choose two orthogonal directions | E_p⟩+  | E_q⟩ and | E_p⟩+  | E_q⟩ according to | E_p⟩ and | E_q⟩, here we construct a pair of normalized orthogonal bases | E_⊥⟩ and | E_∥⟩

    | E_⊥⟩    = 1/√(2 ( 1+ ⟨ E_0 | E_1⟩ )) [  | E_0⟩ + | E_1⟩ ],
     | E_∥⟩    = 1/√(2 ( 1-⟨ E_0 | E_1⟩ )) [  | E_0⟩ - | E_1⟩ ].

So by substituting Eqs. (26) into Eqs. (25), we get the three-body joint state

    | Ψ_ABE⟩    = √(2)/2 [  | 0 ⟩_A | 0 ⟩_B | E_0⟩ +  | 1 ⟩_A | 1 ⟩_B | E_1⟩ ]
       =√(2)/2 [ √(1+ ⟨ E_0 | E_1⟩) | E_⊥⟩ | Φ_AB^+⟩_Z+√(1- ⟨ E_0 | E_1⟩) | E_∥⟩ | Φ_AB^-⟩_Z ].


Therefore, according to Eqs. (25, 26, 27), we can see that when Alice and Bob measure in Z basis, the BER of the system is 0, and the maximum amount of information that Eve can obtain based on quantum USD measurement is 1-⟨ E_0 | E_1⟩. While in X basis, what Alice and Bob receive is the mixed state

    ρ_AB=1+ ⟨ E_0 | E_1⟩/2 | Φ_AB^+⟩_X⟨Φ_AB^+ | +1- ⟨ E_0 | E_1⟩/2 | Ψ_AB^+⟩_X⟨Ψ_AB^+ | .

In this case, the state of Eve and the joint state of Alice and Bob will be disentangled, Eve will not steal any information, and the BER measured in X basis is 1- ⟨ E_0 | E_1⟩2. Alice and Bob choose their measurement operations half on the Z basis and half on the X basis, then the total BER of the system is p_e=1- ⟨ E_0 | E_1⟩4. To balance the BERs on X and Z bases, Eve can perform the following collective attack

    ρ_ABE=1/2 [ T_AB | Φ_AB^+⟩_Z⟨Φ_AB^+ | T_AB^+ + H_ABT_AB | Φ_AB^+⟩_Z⟨Φ_AB^+ | T_AB^+ H_AB^+ ],

where H_AB is the joint Hadamard operator used to exchange X and Z bases. It should be noted here that because operators T_AB and H_AB do not commute, Eve should first perform  the weak measurement operation T_AB and then carry out the joint Hadamard transform H_AB when conducting collective attacks on X-base. Just like the non-entangled QKD protocol, the maximum amount of information that Eve can steal by collective attack on the entangled QKD protocol is 2p_e.

Finally, we compare the system key rate and the maximum tolerable BER obtained by security proof based on entanglement purification and security proof against collective attacks in the non-entangled QKD and entangled QKD. The secrete key rate of a QKD is lower bounded by

    r ≥ I ( A; B  ) - χ ( E; AB  ),

where I ( A; B  ) =1-H ( p_e ) is the mutual information between Alice and Bob, the constraints of the system's tolerable BER is r>0. In this discussion, we temporarily ignore all detection loopholes and the impact of post-processing. In entanglement purification protocol, the Holove quantity χ (E;AB ) between Eve and Alice and Bob in a non-entangled QKD, like BB84- and MDI-QKD, is H (p_e )<cit.>, the maximum tolerable BER is 11%. While in collective attack scheme, we demonstrate that the maximum value of χ (E;AB ). When the BER is less than 0.5, we have H (p_e )>2p_e, which means that Eve can actually steal less information. The maximum tolerable BER in the security proof against collective attack increases to 17%. In entangled QKDs, Eve's eavesdropping is monitored by testing the violation of Bell's inequality. Under the collective attack like Eqs. (29), the Bell function satisfies S= 2√(2) ( 1-2p_e ). Quantum non-localized correlation between Alice and Bob requires S > 2. The maximum tolerable BER in a entangled QKD based on the security proof against collective attack is 14.6%. Therefore, the upper bound of key rate is obtained by entanglement purification protocol, and the lower bound of key rate is obtained by security against collective attack.



§ CONCLUSION


In this paper, we deduce the maximum amount of information Eve can steal through collective attacks for different QKD protocols. We find that in different QKD protocols, including non-entangled and entangled QKDs, Eve's collective attacks scheme based on quantum weak measurement are equivalent. Among these attacks, the maximum amount of information Eve can steal is 2p_e. This proof not only enhances the maximum bit error rate tolerated by the system, but also enhances the maximum key rate that can be extracted. This work not only gives a clear lower bound for the key rate of security proof against all collective-attacks, but also helps us to have a more comprehensive and deeper understanding of collective attacks in different kinds of QKDs.

This work is supported by Young fund of Jiangsu Natural Science Foundation of China (SJ216025), National fund incubation project (NY217024), the National Natural Science Foundation of China (No. 61871234), Scientific Research Foundation of Nanjing University of Posts and Telecommunications (NY215034), the open subject of National Laboratory of Solid State Microstructures of Nanjing University (M31021).


