Experimental generationand characterisation of private

statesPaweł Horodecki

Wydział Fizyki Technicznej i Matematyki Stosowanej,

Politechnika Gdańska

Karol HorodeckiInstytut Informatyki, Uniwersytet

Gdański

Konrad BanaszekRafał Demkowicz-DobrzańskiMichał KarpińskiWydział FizykiUniwersytet Warszawski

Krzysztof DobekWydział Fizyki, Uniwersytet Adama Mickiewicza w Poznaniu

1p 2³j$ $ i + jl l i

´

Bell’s inequalities+

-

A: a = 45o

A’: a = 0oB: b = 22.5o

B’: b = 67.5o

+

-1p 2³j00i + j11i

´

hAB i + hA0B i + hAB 0i ¡ hA0B 0i = 2p 2

Clauser-Horne-Shimony-Holt inequality¯hAB i + hA0B i + hAB 0i ¡ hA0B 0i

¯¯ · 2

is violated!

Quantum cryptography

A1: a = 45o

A2: a = 0o

B1: b = 22.5o

B2: b = 67.5o

For each photon pair Alice and Bob select randomly measurement bases…

A. K. Ekert, Phys. Rev. Lett. 67, 661 (1991)

B3: b = 0o

Perfect correlations one-time pad

Security test

…and compare measurements over a public channel afterwards.

Entangled photon pairsP. G. Kwiat, E. Waks, A. G. White, I. Appelbaum, and P. H. Eberhard, Phys. Rev. A 60, R773 (1999)

Output state:

j$ $ i + jl l ij©+ i /

Correlation measurements

b

0a

45a

Entanglement monogamy

• Even when the pair has been prepared by Eve…

• …if Alice and Bob verify that the systems arrived in a maximally entangled pure state…

• …measurement results will be known only to Alice and Bob.

Eve

Alice

Bob

j©+ iAB = 1p 2³j00iAB + j11iAB

´

Statistical mixtureDefine:

Equally weighted mixture:

Eve

Alice

Bob

Density matrixMaximally entangled state

Statistical mixture12

³j©+ i AB h©+ j + j©¡ i AB h©¡ j

´

Correlations between measurement outcomes in the key basis

0BBBB@

12 ¢ ¢ 1

2¢ ¢ ¢ ¢¢ ¢ ¢ ¢12 ¢ ¢ 1

2

1CCCCA

0BBBB@

12 ¢ ¢ ¢¢ ¢ ¢ ¢¢ ¢ ¢ ¢¢ ¢ ¢ 1

2

1CCCCA

j©+ i AB h©+ j

Security tested by the violation of Bell’s inequalities(If trusting quantum theory, could be also tested by measurements in the basis.)( j0i § j1i )=

p2

j00ij01ij10ij11i

Noisy entanglement

How much secure key can be extracted from a noisy state?

0BBBB@

12 ¢ ¢ 1

4¢ ¢ ¢ ¢¢ ¢ ¢ ¢14 ¢ ¢ 1

2

1CCCCA

Distillation

M …

…N

Distillable entanglement:

C. H. Bennett et al., Phys. Rev. Lett. 76, 722 (1996)

Example I

A B

A’

B’

Shield states:

enable Alice and Bob to distinguish locally and generatethe key using the standard strategy. Hence

E D = 1

Example II

A B

A’

B’

• States and cannot be discriminated unambiguously using local operations and classical communication.

• Distillable entanglement bounded by log-negativity:

What if

jª ¡ i = 1p 2(j01i ¡ j10i )

Eavesdropping

AA’

B B’

The worst case scenario: all the noise is controlled by Eve

K. Horodecki, M. Horodecki, P. Horodecki, and J. Oppenheim,Phys. Rev. Lett. 94, 160502 (2005)

E

%AA0B B 0 = T rE³jª i AA0B B 0E hª j

´

Alice Eve channel

Alice measures an outcome a with a probability

Eve infers a from the conditional state of her subsystem E:

%(a)E = 1

paT rA0B B 0³Ahajª ihª jaiA

´

pa = T rA0B B 0E³Ahajª i hª jaiA

´

Holevo quantity:

X (A : E ) = SÃX

apa%(a)

E

!¡

Xa

paS³%(a)

E´

Key rate

Key rate

E

Mutual information

Holevo quantity

For Example II, Eve’s subsystem contains no information about outcomes of Alice’s measurement on her qubit, hence KD = 1.

AA’

B B’

ShieldWithout the shield:

The complete state:

key security

T rA0B 0³%AA0B B 0

´=

0BBBB@

12 ¢ ¢ 1

4¢ ¢ ¢ ¢¢ ¢ ¢ ¢14 ¢ ¢ 1

2

1CCCCA

AB

00

01

10

11

Double photon pairs

Output state:A’

AB’

B

j©+ iAB j©+ iA0B 0

Experimental setup

Quantum state tomography

Projective qubit measurements:

¾x; ¾y; ¾zFour-qubit POVM:

M i = j§ iA i j§ iA0i j§ iB i j§ iB 0i34 = 81 measurement bases

34 x 24 = 1296 event types

: number of events i

Probability of an outcome i:

X

ini ¼5 £ 105

Density matrix estimate

%

Maximum likelihood reconstruction

L(%) = p(fnigj%) = Qi [p(ij%)]n i

– number of events i

Likelihood function:

Maximum-likelihood estimatemaximizes

Probability of an outcome i:

Z. Hradil, Phys. Rev. A 55, R1561 (1997)

ML: Parametrisation

PRO: - Guaranteed positivityCON: - Impractical in higher dimensions (>6 qubits)

- Underestimates errors, difficult to include uncertainty of the measuring device (Monte Carlo simulations)

- Biased towards low-rank matrices for undersampled data

K. Banaszek, G. M. D’Ariano, M. G. A. Paris, and M. F. Sacchi,Phys. Rev. A 61, 010304(R) (1999)

Task: maximize

with a constraint

Ensuring positivity:

Bayesian approach

A priori distributionA posteriori:

Estimate:

PRO:

CON: - Difficult to normalise probability distribution- A priori distribution not well defined

- Clear statistical interpretation- Provides uncertainty- No numerical optimisation

K. Audenaert and S. Scheel, New J. Phys. 11, 023028 (2009)

• Gaussian approximation• Truncated to positive definite density operators

State reconstructionK. Dobek. M. Karpiński, R. Demkowicz-Dobrzański, K. Banaszek,

and P. Horodecki, Phys. Rev. Lett. 106, 030501 (2011)

Privacy characterisation

Distillable entanglement: ED 0.581(4)

A posteriori ensemble

Warning:

Key (cqq scenario): K 0.690(7)

More conservative

Distillation protocol

Measure qubits A′B′ in the same basis.

50% 50%

Identical outcomes

Opposite outcomes

Single-copy distillation

averageidentical outcomes A

′B′

K = 0.354(5)

Reduced density matrix

K = 0

opposite outcomes A′B′

conditional

Cryptographic key

Optimal strategy

Raw key: 3716 bits

Error correction

2726 bits

Privacy amplification

Secure key: 2164 bits

Distillation-based approach

Raw key: 1859 bits

1300 bits

Secure key: 650 bits

%AA0B B 0=

0BBB@

S00;00 S00;01 S00;10 S00;11S01;00 S01;01 S01;10 S01;11S10;00 S10;01 S10;10 S10;11S11;00 S11;01 S11;10 S11;11

1CCCA

Witnessing privacy

ab

00011011

00 01 10 11

Complete density matrix for key and shield subsystems:

Si j ;kl = A0B 0hij j%AB A0B 0jkliA0B 0

where

Key bound

K³%AA0B B 0

´

¾AB = 12

0BBB@

p+ ¢ ¢ c+¢ p¡ c¡ ¢¢ c¡ p¡ ¢

c+ ¢ ¢ p+

1CCCA

where

p+ = jjS00;00 + S11;11jjc+ = jjS00;11 + S11;00jj

¸ K³¾AB

´In general:

p¡ = jjS01;01 + S10;10jjc¡ = jjS01;10 + S10;01jj

K. Horodecki et al., IEEE Trans. Inf. Theory 54, 2621 (2008); ibid. 55, 1898 (2009).

Single witness

w =¯¯D1

2(¾xA ¾x

B ¡ ¾yA ¾y

B ) UA0B 0E¯¯

Suppose we have measured

where UyU · I

K. Banaszek, K. Horodecki, and P. Horodecki,Phys. Rev. A 85, 012330 (2012)

w =¯T r[(S00;11 + S11;00)UA0B 0]

¯¯

· jjS00;11 + S11;00jj = c+

This provides an estimate

Single witness

12

0BBB@

p+ ¢ ¢ c+¢ p¡ c¡ ¢¢ c¡ p¡ ¢

c+ ¢ ¢ p+

1CCCA

c+ ¸ wPositivity of implies that ¾AB

p+ ¸

w

Take the worst-case scenario for p¡ ; c¡

K. Banaszek, K. Horodecki, and P. Horodecki,Phys. Rev. A 85, 012330 (2012)

K

Two observables

wx =¯¯D¾xA ¾xB UA0B 0

E¯¯

12

0BBB@

p+ ¢ ¢ c+¢ p¡ c¡ ¢¢ c¡ p¡ ¢

c+ ¢ ¢ p+

1CCCA

We have:

c+ + c¡ ¸ wx

p§ = 12(1 § wz)

wz =¯¯D¾z

A ¾zB I A0B 0

E¯¯

c¡ · p¡

K. Banaszek, K. Horodecki, and P. Horodecki,Phys. Rev. A 85, 012330 (2012)

Conclusions

• Experimental demonstration of the separation between distillable entanglement and cryptographic key contents

• Practical comparison of quantum state reconstruction methods for a noisy multiqubit state

• Full privacy analysis based on the reconstructed state• Evaluation of highly non-linear information theoretic

quantities• Implementation of a simple entanglement distillation

protocol• Witnessing privacy with few observables• Multiple degrees of freedom?