At 08:35 PM 1/16/01 -0800, [EMAIL PROTECTED] wrote in part:
>In some variants the photon travels around the group multiple times before
>it is measured. Let us call this number of times the "circulation count".
1) Let C denote the circulation count. The idea of having C>1 is very
nice. One can make a completely macroscopic argument (i.e. without
invoking quantum mechanics) that Eve must tap the signal at least C times,
once each time the signal circulates around the ring; otherwise she knows
nothing.
2) The foregoing macroscopic result is important when combined with the
following quantum mechanical result:
At 11:20 PM 1/17/01 -0800, [EMAIL PROTECTED] wrote in part:
>The probability that Eve's measurement will leave the result unchanged is
>3/4, and therefore the probability that she will perturb the result is 1/4.
....
>each additional measurement brings us closer to a 50-50 chance
>of detection.
So by increasing the circulation count, one can make things tough for Eve.
3) OTOH, one cannot increase the circulation count without bound. A
real-world quantum computer would have some nonzero chance of making a
mistake, so in the limit of a very large C it wouldn't work at all. One
would have to find a happy medium value for C.
4) Possibly constructive suggestion: To describe the physics of systems
like this, it is often helpful to use the machinery of _density matrices_.
a) A density matrix can represent a pure quantum state, although in this
case it doesn't tell you anything that the state vector didn't tell you.
b) A density matrix can also represent a probabilistic combination of
quantum states, which is something a state vector cannot do.
In the (H, V) basis, the density matrix for a pure H state is
rho_1 = 1 0 (1)
0 0
while the density matrix for a pure V state is
rho_2 = 0 0 (2)
0 1
and the density matrix for a state rotated by an angle x away from the H
axis is
rho_3 = cos(x)cos(x) cos(x)sin(x) (3)
sin(x)cos(x) sin(x)sin(x)
It is useful to check whether the number of photons is correct. The
probability of a photon in _some_ polarization state is Trace(rho), and we
immediately see that Trace(rho)=1 in the foregoing examples.
We can also check whether a given density matrix represents a pure
state. Trace(rho^2)=1 for a pure state. We confirm that the foregoing
examples represent pure states.
Using this machinery we have a nice description of what Eve does to the
signal. Without loss of generality we analyze things in her basis. The
state incoming to her eavesdropping apparatus is given by equation (3)
above. Assuming she makes a strong measurement, the state outgoing from
her apparatus is
rho_4 = cos(x)cos(x) 0 (4)
0 sin(x)sin(x)
We see the off-diagonal elements have been smashed. This still has the
right number of photons: Tr(rho_4)=1, but it is no longer a pure state
(except on a set of measure zero):
Tr(rho_4^2) = cos^4(x) + sin^4(x) = .75 + .25 cos(4x) (5)
which averages to 3/4 and is less than unity unless Eve happens to stumble
onto a very lucky x value.
A more general form of equation (4) is
rho_4 = P(h) rho_3 P(h) + P(v) rho_3 P(v) (6)
where P(h) is the projection operator that projects onto Eve's horizontal
axis, and P(v) projects onto her vertical axis.
One could also mumble something about the entropy,
S = Trace(rho log rho)
<tirade> Note that (despite what you read in textbooks) projection
operators have no physical implementation. A polarizer cannot be properly
modelled as a projection operator. The operator is not unitary, so it
cannot properly describe any physical device. A nonunitary device would
violate the Heisenberg uncertainty principle, violate the 2nd law of
thermodynamics, violate the fluctuation/dissipation theorem, and generally
be a Bad Thing. Such operators may be a serviceable shorthand under some
special assumptions (strong measurements of photon number at zero
temperature) but you should not get too attached to them, because they will
lead you astray if you consider weak measurements, voltage measurements,
and/or nonzero temperatures. </tirade>
========================
5) Eve must make a tradeoff: decreasing the probability of detection,
versus increasing the probability of learning something.
If she taps the ring at only a single point, she cannot learn
anything. This is another macroscopic (i.e. non-quantum) property of the
algorithm, assuming we have a circulation count C>1.
Therefore let us consider the case where Eve wishes to focus her attack on
Bob, a particular member of the ring. This may or may not be her best
strategy, but it is a case that we must consider.
This seems to require Eve to tap the signal 2C times: one just upstream of
Bob and one just downstream, for each cycle of the circulation.
6) Let us revisit this:
At 11:20 PM 1/17/01 -0800, [EMAIL PROTECTED] wrote in part:
>The probability that Eve's measurement will leave the result unchanged is
>3/4, and therefore the probability that she will perturb the result is 1/4.
OK so far. Then, for the case of two measurements,
>Eve's chances of perturbing the measurement have increased from
>1/4 to 3/8 by doing two measurements rather than one..... Increasing the
>number of measurements to three reduces the chance of
>success to 9/16, with a 7/16 chance of perturbation.
That's not correct, if Eve is clever. She can arrange that later
measurements are correlated with the first measurement in interesting ways.
In particular, suppose she has received state rho_3 and has measured
it. She is about to construct her outgoing signal. Rather than simply
constructing an outgoing photon described by rho_4, she instead constructs
an EPR pair of photons. She measures the first element of the pair and
fiddles with it to make it look like rho_4. She feeds this one to
Bob. Bob rotates this one according to the algorithm and passes it along
the ring.
Now, Eve taps the signal that Bob puts out. Since she has kept the second
element of the EPR pair, she can combine the two photons and make two (!)
measurements. This allows a perfect determination of the angle of rotation
that Bob imparted to the signal; it inflicts no additional entropy.
From Eve's point of view, this is a better tapping strategy than simply
making multiple independent measurements. To analyze the strength of the
Shining Cryptographers algorithm, we must consider advanced tapping
strategies such as this.
=====================================
7) Nitpick:
At 11:20 PM 1/17/01 -0800, [EMAIL PROTECTED] remarked parenthetically:
>(Note: Eve can also use a circular polarization basis, but that only
>adds an imaginary factor to the coefficients, and since we are taking
>the square of the norm of the coefficient to get our probabilities,
>the imaginary term is irrelevant for these calculations.)
Actually, circular polarization does make a difference. Operationally, it
is equivalent to a worst-case choice of the angle x (i.e. x=45 degrees) so
it is markedly worse than an average x value. However, we can assume that
Eve would not bother with such an inferior strategy, so if we just ignore
the foregoing parenthetical remark the other parts of the note are unaffected.
