Main Articles on quantum cryptography

$[$BB84$]$ Charles H. Bennett and Gilles Brassard, "Quantum cryptography: Public key distribution and coin tossing," in Proceedings of the International Conference on Computers, Systems and Signal Processing, pp. 175-179, Bangalore, 1984, https://arxiv.org/abs/2003.06557, republished in Theoretical Computer Science, vol. 560, 2014, pp. 7–11, https://dx.doi.org/10.1016/j.tcs.2014.05.025.

$[$BB89$]$ Charles H. Bennett and Gilles Brassard, "The dawn of a new era for quantum cryptography: the experimental prototype is working!" ACM SIGACT News, Vol. 20, no. 4, pp 78–80, 1989, https://doi.org/10.1145/74074.74087.

$[$E91$]$ Artur K. Ekert, "Quantum cryptography based on Bell's theorem," Physical Review Letters, Vol. 67, no. 6, pp. 661-663, 1991, https://dx.doi.org/10.1103/PhysRevLett.67.661.

$[$BBE92$]$ Charles H. Bennett, Gilles Brassard and Artur K. Ekert, "Quantum Cryptography," Scientific American, vol. 267, no. 4, 1992, pp. 50–57, http://www.jstor.org/stable/24939253.

1. Qubits as $\frac{1}{2}$-spin particles and the Bloch sphere

2. Qubits as polarized photons and the Poincaré sphere

3. Measurement of a non-entangled qubit

4. Time evolution of a non-entangled qubit

5. Modifying and measuring photonic qubits in practice

1.1.1. $\frac{1}{2}$-spin particles are qubits¶

$\frac{1}{2}$-spin can be viewed as an intrinsic angular momentum (angular momentum = rotation speed of a spinning object) in some oriented axis in our 3D space with the constant value $\frac{\hslash}{2}$.

For a given axis, spin value $-\frac{\hslash}{2}$ in a given orientation is equivalent to $+\frac{\hslash}{2}$ in the opposite orientation.

The qubit (pure) state can be represented by a vector $\vec{s} = \sin\left(\theta\right) \cos\left(\varphi\right) \cdot \vec{x} + \sin\left(\theta\right) \sin\left(\varphi\right) \cdot \vec{y} + \cos\left(\theta\right) \cdot \vec{z}$ on the unit sphere in 3D, which is called the Bloch sphere.

The orthogonal state (= opposite orientation state for qubit) $\left|s^\bot\right\rangle$ in the Hilbert space $\mathbb{C}^2$, for which $\left\langle \left. s^\bot \right| s\right\rangle=0$, i.e., $\left|s^\bot\right\rangle \perp \left|s\right\rangle$, is represented by the opposite vector $\vec{s}^\bot = -\vec{s}$ in the Bloch sphere.

Convention: for any orientation $\vec{s}$, bit value 0 corresponds to $+\frac{\hslash}{2}$, 1 corresponds to $-\frac{\hslash}{2}$.

1-to-1 correspondence with unitary vectors of Hilbert space $\mathbb{C}^2$ in quantum physics:
$\left|s\right\rangle = \left(e^{i\eta}\right) \cdot \left( \cos\left(\theta/2\right) \cdot \left|0\right\rangle + \sin\left(\theta/2\right) e^{i\varphi} \cdot \left|1\right\rangle \right)$, where $e^{i\eta}$ is the arbitrary phase factor.

Arbitrary phase factor and normalization to 1 $\Rightarrow$ Qubit quantum states of qubits are rays in the Hilbert space $\mathbb{C}^2$, i.e., elements of the projective space $\mathrm{P}\mathbb{C}^2 = {\mathbb{C}^2}/_{\mathbb{C}\setminus\left\{0\right\}}$.

The projective space $\mathrm{P}\mathbb{C}^2$ equipped with its angular distance $\theta'$ in the complex vector space $\mathbb{C}^2$ multiplied by 2 is isometric to the Bloch sphere equiped with the angular distance $\theta$ in the real vector space $\mathbb{R}^3$: we have $\theta = 2 \theta'$.

1.2.1. Photons are also qubits¶

Photons are 1-spin particles and should have 3 possible spin outcome states when measured on a given axis: $+\hslash$, $0$ or $-\hslash$, i.e., $-1$, $0$ or $1$.

Because of relativistic effect at light speed $c$, spin $0$ is forbidden.

$\Rightarrow$ Photons are qubits that behave like $\frac{1}{2}$-spin particles, but with $\pm \hslash$ spin instead of $\pm \frac{\hslash}{2}$.

More generally, a qubit is any quantum system which, after any measurement, can have only two possible outcome states, these outcome states depending of the measurement.

Physically, the spin of the photon is its polarization: $\left| 0 \right\rangle$ or $+1$ for left-circular polarization, $\left| 1 \right\rangle$ or $-1$ for righ-circular polarization, and a complex linear combination of both for elliptic or linear polarization.

With $\vec{z}$ being the propagation axis of the photon, the Bloch sphere representation of the qubit exactly corresponds to the Poincaré sphere representation of the polarization, where the polarizations $\uparrow$, $\rightarrow$, $\nwarrow$, $\nearrow$, $\circlearrowleft$ and $\circlearrowright$ corresponds respectively to the qubit states $\left| + \right\rangle = \left| \circlearrowleft \right\rangle$, $\left| - \right\rangle = \left| \circlearrowright \right\rangle$, $\left| +i \right\rangle = \left| \rightarrow \right\rangle$, $\left| -i \right\rangle = \left| \leftarrow \right\rangle$, $\left| 0 \right\rangle = \left| \uparrow \right\rangle$ and $\left| 1 \right\rangle = \left| \downarrow \right\rangle$, and to the Bloch vectors $\vec{x}$, $-\vec{x}$, $\vec{y}$, $-\vec{y}$, $\vec{z}$ and $-\vec{z}$.

1.3.1. Single measurement outcome for a non-entangled qubit¶

We consider a measurement according to the oriented axis $\vec{m}$ (i.e., $\left| \psi_{m} \right\rangle \in \mathbb{C}^2$) on the qubit in the known initial state $\vec{s}$ (i.e., $\left| \psi_{s} \right\rangle \in \mathbb{C}^2$), the measured outcome is $\vec{m}$ with probability $\mathrm{proba}\left[\vec{m}|\vec{s}\right]$ or $-\vec{m}$ with probability $\mathrm{proba}\left[-\vec{m}|\vec{s}\right]$ where:

• Probability $\mathrm{proba}\left[\vec{m}|\vec{s} \right] = \frac{1+\vec{m}\cdot\vec{s}}{2}$ that the output state is $\vec{m}$ and the bit value is $0$ (convention);
• Probability $\mathrm{proba}\left[-\vec{m}|\vec{s} \right] = 1 - proba\left[\vec{m}|\vec{s} \right] = \frac{1-\vec{m}\cdot\vec{s}}{2}$ that the output state is $-\vec{m}$ and the bit value is $1$ (convention);

With the convention: bit value 0 corresponds to $+\frac{\hslash}{2}$ (spin $\vec{m}$), bit value 1 corresponds to $-\frac{\hslash}{2}$ (spin $-\vec{m}$), like $z$ axis.

Because $\mathrm{proba}\left[\vec{m}| \vec{s} \right] = \frac{\left\langle \psi_{m} | \psi_{s} \right\rangle \left\langle \psi_{s} | \psi_{m} \right\rangle} {\left\langle \psi_{m} | \psi_{m} \right\rangle \left\langle \psi_{s} | \psi_{s} \right\rangle} = \cos^2\theta_{Hilbert}\left(\psi_{m},\psi_{s}\right) = \frac{1}{2}+\frac{1}{2}\cos 2\theta_{Hilbert}\left(\psi_{m},\psi_{s}\right) = \frac{1}{2}+\frac{1}{2}\cos\theta_{Bloch Sphere}\left(\vec{m},\vec{s}\right)$.

Initial qubit state: $\vec{s}$ (i.e., $\left| \psi_{s} \right\rangle \in \mathbb{C}^2$). The order of measurement matters,the outcomes being different:

(1) First measurement according to the oriented axis $\vec{m}_1$ then second measurement according to the oriented axis $\vec{m}_2$:

Measure outcome after the first measurement: $\vec{m}_1$ with probability $p_1 = \frac{1 + \vec{m}_1\cdot\vec{s}}{2}$ or $-\vec{m}_1$ with probability $1-p_1 = \frac{1 - \vec{m}_1\cdot\vec{s}}{2}$.

Measure outcome after the second measurement: $\vec{m}_2$ with probability $p_2 = p_1 \times \frac{1 + \vec{m}_2\cdot\vec{m}_1}{2} + \left(1-p_1\right) \times \frac{1 - \vec{m}_2\cdot\vec{m_1}}{2} = \frac{1 + \vec{m}_1\cdot\vec{s} \times \vec{m}_2\cdot\vec{m}_1}{2}$ or $-\vec{m}_2$ with probability $1-p_2= \frac{1 - \vec{m}_1\cdot\vec{s} \times \vec{m}_2\cdot\vec{m}_1}{2}$.

(2) First measurement according to the oriented axis $\vec{m}_2$ then second measurement according to the oriented axis $\vec{m}_1$:

Measure outcome after the first measurement: $\vec{m}_2$ with probability $p'_1 = \frac{1 + \vec{m}_2\cdot\vec{s}}{2}$ or $-\vec{m}_2$ with probability $1-p_2 = \frac{1 - \vec{m}_2\cdot\vec{s}}{2}$.

Measure outcome after the second measurement: $\vec{m}_1$ with probability $p'_2 = p'_1 \times \frac{1 + \vec{m}_1\cdot\vec{m}_2}{2} + \left(1-p'_1\right) \times \frac{1 - \vec{m}_1\cdot\vec{m}_2}{2} = \frac{1 + \vec{m}_2\cdot\vec{s} \times \vec{m}_1\cdot\vec{m}_2}{2}$ or $-\vec{m}_1$ with probability $1-p_2= \frac{1 - \vec{m}_2\cdot\vec{s} \times \vec{m}_1\cdot\vec{m}_2}{2}$.

$p_1 = \frac{1 + \vec{m}_1\cdot\vec{s}}{2}$, $p_2 = \frac{1 + \vec{m}_1\cdot\vec{s} \times \vec{m}_2\cdot\vec{m}_1}{2}$.

$1.$ If $0<\left|\vec{m}_1\cdot\vec{s}\right|<1$ and $0<\left|\vec{m}_2\cdot\vec{m}_1\right|<1$ then $\left| p_2 - \frac{1}{2}\right|<\left| p_1 - \frac{1}{2}\right|$: the entropy strictly increases.

$2.$ If $\left|\vec{m}_2\cdot\vec{m}_1\right|=1$, i.e., $\vec{m}_2 = \pm \vec{m}_1$, then $p_2 \in \left\{p_1,1-p_1\right\}$, the state (and the entropy) does not change with the second measurment.

$3.$ If $\vec{m}_1\cdot\vec{s} = 0$ then $p_2 = p_1 = \frac{1}{2}$: the initial knowledge is completely lost after the first measurement, 1 bit of information is renewed.

In quantum phisics, the evolution of the quantum state is governed by the Shrödinger equation: $i \hslash \frac{d}{dt} \left|\varphi\left(t\right)\right\rangle = H \left|\varphi\left(t\right)\right\rangle$ where $H$ is the Halmitonian operator (energy observable).

If $H$ does not depend on time $t$, the solution of this equation is $\left|\varphi\left(t\right)\right\rangle = U\left(t\right) \left|\varphi\left(0\right)\right\rangle$ where $U\left(t\right) = e^{- i H t / \hslash}$ is a unitary operator (because $H$ is hermitian).

If $H$ depends on time $t$, we still have $\left|\varphi\left(t\right)\right\rangle = U\left(t\right) \left|\varphi\left(0\right)\right\rangle$ where $U\left(t\right)$ is a unitary operator depending on time $t$ in a more complex way.

For qubits, unitary operators in $\mathbb{C}^2$ correspond to rotations in $\mathbb{R}^3$ (i.e., isometries that conserve the orientations of 3D bases). Thus the evolution of the qubit states in the Bloch sphere is given by a rotation: $\vec{s}\left(t\right) = rot_{\vec{\Delta}(t),\alpha(t)}\left(\vec{s}\left(0\right)\right)$.

The evolution is deterministic, i.e., there is no change in the amount of information an observer has on the observed system.

1.5.1. Modifying a photonic qubit in practice¶

Modifying (= quantum processing) a single photonic qubit = rotating its quantum state = modifying the polarization of a photon.

This can be done using waveplates, see https://en.wikipedia.org/wiki/Waveplate:

• Birefringent material that dephases the slow and fast polarization axis of an optical signal by $\Delta\Phi = \Phi_{slow}-\Phi_{fast} = \frac{2\pi\left(n_{slow}-n_{fast}\right)L}{\lambda}$ with $n_{slow}>n_{fast}$
  • $\uparrow$ or $\rightarrow$ : qubit rotation $rot_{\vec{x},\Delta\Phi}$,
  • $\nearrow$ or $\nwarrow$: qubit rotation $rot_{\vec{y},\Delta\Phi}$;

• Half-wave plates with slow polarization axis being:
  • $\uparrow$ or $\rightarrow$ : qubit rotation $rot_{\vec{x},\pi}$ $\Rightarrow$ $\Delta\Phi = \pi$ $\Rightarrow$ $(\uparrow,\rightarrow) \rightarrow (\uparrow,\rightarrow)$, $(\nearrow,\nwarrow) \rightarrow (\nwarrow,\nearrow)$ and $(\circlearrowleft,\circlearrowright) \rightarrow (\circlearrowright,\circlearrowleft)$,
  • $\nearrow$ or $\nwarrow$: qubit rotation $rot_{\vec{y},\pi}$ $\Rightarrow$ $\Delta\Phi = \pi$ $\Rightarrow$ $(\uparrow,\rightarrow) \rightarrow (\rightarrow,\uparrow)$, $(\nearrow,\nwarrow) \rightarrow (\nearrow,\nwarrow)$ and $(\circlearrowleft,\circlearrowright) \rightarrow (\circlearrowright,\circlearrowleft)$;

• Quarter-wave plates with slow polarization axis being:
  • $\uparrow$ or $\rightarrow$ : qubit rotation $rot_{\vec{x},\pi/2}$ $\Rightarrow$ $\Delta\Phi = \pi/2$ $\Rightarrow$ $(\uparrow,\rightarrow) \rightarrow (\uparrow,\rightarrow)$, $(\nearrow,\nwarrow) \rightarrow (\circlearrowright,\circlearrowleft)$ and $(\circlearrowleft,\circlearrowright) \rightarrow (\nearrow,\nwarrow)$,
  • $\nearrow$ or $\nwarrow$: qubit rotation $rot_{\vec{y},\pi/2}$ $\Rightarrow$ $\Delta\Phi = \pi/2$ $\Rightarrow$ $(\uparrow,\rightarrow) \rightarrow (\circlearrowright,\circlearrowleft)$, $(\nearrow,\nwarrow) \rightarrow (\nearrow,\nwarrow)$ and $(\circlearrowleft,\circlearrowright) \rightarrow (\uparrow,\rightarrow)$.

It can also be reached using 3 waveplates for which one can adequately position the axes: a quater-wave plate (any elliptical polarization $\rightarrow$ some linear polarization) + a half-wave plate (rotates the linear polarization with the desired long axis) + a quater-wave plate (transform it into the desired elliptical polarization). See https://en.wikipedia.org/wiki/Polarization_controller.

This corresponds to the "Mickey mouse ears" in optical fiber testbeds: 1 fiber loop with the right diameter is a quater-wave plate, with two loops we have a half-wave plate.

See for example https://www.photonics.com/Articles/Polarization_in_Fiber_Systems_Squeezing_out_More/a25149:

Use of a beam-splitting polarizer + two photo-detectors (photodiodes):

• A beam-splitting polarizer that is oriented according to a given axis splits a light beam into two linear polarizations beams, one polarization corresponding to the given axis and the other one being perpendicular.
• Then, if there is only one photon in the beam, only one of the two photodiodes detects the photon, giving its polarization according to the given axis.

This was used in Aspect's experiments in 1982, in a manual $[$AGR1982$]$ and automatically-varying $[$ADR1982$]$ configurations.

1. Bell pair of maximally-entangled qubits

2. Measurement of a Bell pair

3. Usual Bell pairs represented with Bloch spheres

4. Equivalence of Bell pairs

5. Bell pairs in practice

A generic Bell pair $BP$ is a maximally entangled pair of qubits $\left(A,B\right)$.

Maximal entanglement = maximal correlation between the qubits = 1 bit of correlation information, because the qubits interacted "totally" between themselves.

Because of this "total" interaction between the qubits, the previous information about the individual qubits is lost. Thus, an observer has no information neither on qubit $A$ nor on qubit $B$ (1 bit entropy for each).

But the observer has 1 bit of correlation information. Thus, if this observer measures the qubit $A$ (respectively the qubit $B$), then this observer infers the state of the qubit $B$ (respectively the qubit $A$).

2.2.1. Relation between the measured state and the infered state when measured on one qubit¶

If the qubit $A$ is measured according to the oriented axis $\vec{m}_A$, 1 additional bit of information is acquired: the measured outcome of qubit $A$ is $\vec{m}_A$ with probability $\frac{1}{2}$ or $-\vec{m}_A$ with probability $\frac{1}{2}$ (whatever the value of $\vec{m}_A$).

Because of the 1 bit of correlation information, if $\pm \vec{m}_A$ is measured, the inferred qubit state is $f\left(\pm \vec{m}_A\right)$.

Some information-based considerations imposes that $f$ is an isometry in 3D space: conservation of the angles, the angular distance being a measure of the distinguisghability between states, see Wootters' statistical distance $[$Woo1991$]$ (two states measured on A or B cannot be more or less easily distinguised on respectively B or A, which imposes the same angles).

There are two kinds of isometries in 3D spaces, related to unitary and antiunitary operators (Wigner's therorem $[$see https://en.wikipedia.org/wiki/Wigner%27s_theorem on Wikipedia$]$ applied to $\mathbb{C}^2$):

1. Isometries that conserve the orientations of 3D bases: rotations $r^A_{\vec{\Delta},\alpha}$ of oriented axis $\vec{\Delta}$ and angle $\alpha$, corresponding to unitaty operators in $\mathbb{C}^2$;
2. Isometries that reverse the orientations of 3D bases: improper rotations $ir^A_{\vec{\Delta},\alpha} = ref_{\Delta^\bot} \circ rot_{\vec{\Delta},\alpha} = rot_{\vec{\Delta},\alpha} \circ ref_{\Delta^\bot}$ of oriented axis $\vec{\Delta}$, angle $\alpha$ and plane orthogonal to $\vec{\Delta}$, corresponding to antiunitaty operators in $\mathbb{C}^2$ (planar reflection correspond to conjugation).

If the qubit $A$ is measured according to the oriented axis $\vec{m}_A$, the measured outcome of qubit $A$ is $\pm \vec{m}_A$ with probability $\frac{1}{2}$ for each possible outcome, and the inferred qubit $B$ state is $\pm \vec{m}_B = ir^A_{\vec{\Delta},\alpha} \left( \pm \vec{m}_A \right) = \pm ir^A_{\vec{\Delta},\alpha} \left( \vec{m}_A \right)$.

If, instead, the qubit $B$ is measured according to the oriented axis $\vec{m}_B$, the measured outcome of qubit $B$ is $\pm \vec{m}_B$ with probability $\frac{1}{2}$ for each possible outcome, and the infered qubit $A$ state is $\pm \vec{m}_A = ir^B_{\vec{\Delta},-\alpha} \left( \pm \vec{m}_B \right) = \pm ir^B_{\vec{\Delta},-\alpha} \left( \vec{m}_B \right)$.

Thus, the Bell Pair $BP_{\vec{\Delta},\alpha}$ is characterized by the improper rotation $ir^A_{\vec{\Delta},\alpha} = ref_{\Delta^\bot} \circ rot_{\vec{\Delta},\alpha} = rot_{\vec{\Delta},\alpha} \circ ref_{\Delta^\bot}$.

The Bell pair state in the Hilbert space $\mathbb{C}^2 \otimes \mathbb{C}^2 = \mathbb{C}^4$ is $\left|{BP_{\vec{\Delta},\alpha}} \right\rangle = \frac{1}{\sqrt{2}}\left( \left|s\right\rangle \otimes AU\left|s\right\rangle + \left|s^\bot\right\rangle \otimes AU\left|s^\bot\right\rangle \right)$ for all qubit states $s$, where $AU$ is the antiunitary operator corresponding to $ir^A_{\vec{\Delta},\alpha}$.

We consider the Bell pair $BP_{\vec{\Delta},\alpha}$ of maximally entangled pair of qubits $\left(A,B\right)$, characterized by $ir^A_{\vec{\Delta},\alpha}$.

The measurement on qubit $A$ with axis $\vec{m}_A$ then on qubit $B$ with axis $\vec{m}_B$ gives:

1. The first measurement outcome is $\left(\vec{m}_A , ir^A_{\vec{\Delta},\alpha} \left(\vec{m}_A\right)\right)$ or $\left(-\vec{m}_A , -ir^A_{\vec{\Delta},\alpha} \left(\vec{m}_A\right)\right)$ with probability $\frac{1}{2}$ each;
2. The second measurement outcome is, with $\sigma = \vec{m}_B \cdot ir^A_{\vec{\Delta},\alpha}\left(\vec{m}_A\right)$: $\left(\vec{m}_A , \vec{m}_B\right)$ with probability $\frac{1+\sigma}{4}$, $\left(\vec{m}_A , -\vec{m}_B\right)$ with probability $\frac{1-\sigma}{4}$, $\left(-\vec{m}_A , \vec{m}_B\right)$ with probability $\frac{1-\sigma}{4}$, and $\left(-\vec{m}_A , -\vec{m}_B\right)$ with probability $\frac{1+\sigma}{4}$.

The measurement on qubit $B$ with axis $\vec{m}_B$ then on qubit $A$ with axis $\vec{m}_A$ gives:

1. The first measurement outcome is $\left(ir^B_{\vec{\Delta},-\alpha} \left(\vec{m}_B\right), \vec{m}_B \right)$ or $\left(-ir^B_{\vec{\Delta},-\alpha} \left(\vec{m}_B\right), -\vec{m}_B \right)$ with probability $\frac{1}{2}$ each;
2. The second measurement outcome is, with $\sigma' = \vec{m}_A \cdot ir^B_{\vec{\Delta},-\alpha}\left(\vec{m}_B\right)$: $\left(\vec{m}_A , \vec{m}_B\right)$ with probability $\frac{1+\sigma'}{4}$, $\left(\vec{m}_A , -\vec{m}_B\right)$ with probability $\frac{1-\sigma'}{4}$, $\left(-\vec{m}_A , \vec{m}_B\right)$ with probability $\frac{1-\sigma'}{4}$, and $\left(-\vec{m}_A , -\vec{m}_B\right)$ with probability $\frac{1+\sigma'}{4}$.

(1) The outcome after the first measurement depends on the order of measurement of the two qubits except if $\vec{m}_B = \pm ir^A_{\vec{\Delta},\alpha}\left(\vec{m}_A\right)$.

This is in favor of a relational interpretation of quantum physics $[$Rov1996, Rov2021$]$ thats says that the information an observer has on a system (= quantum state) depends on the observer (a kind of generalization of the special or general relativity).

(2) The outcome after the two measurement does not depend on the order of these measurements of the two qubits (they commute):
$\sigma' = \vec{m}_A \cdot ir^B_{\vec{\Delta},-\alpha}\left(\vec{m}_B\right) = ir^A_{\vec{\Delta},\alpha}\left(\vec{m}_A\right) \cdot ir^A_{\vec{\Delta},\alpha}\left(ir^B_{\vec{\Delta},-\alpha}\left(\vec{m}_B\right)\right) = ir^A_{\vec{\Delta},\alpha}\left(\vec{m}_A\right) \cdot Id\left(\vec{m}_B\right) = \vec{m}_B \cdot ir^A_{\vec{\Delta},\alpha}\left(\vec{m}_A\right) = \sigma$,
because $ir^A_{\vec{\Delta},\alpha}$ conserves the scalar product since it is an isometry and $ir^A_{\vec{\Delta},\alpha} \circ ir^B_{\vec{\Delta},-\alpha} = Id$.

This commutation is due to the fact that the two measurements take place in different locations (locality of interactions).

$1$. Bell pair $BP_{\vec{y},0} = xz$-plane reflection $ir^A_{\vec{y},0} = \left|\Phi^+\right\rangle = \frac{1}{\sqrt{2}}\left( \left|0\right\rangle \otimes \left|0\right\rangle + \left|1\right\rangle \otimes \left|1\right\rangle \right)$

$2$. Bell pair $BP_{\vec{x},0} = yz$-plane reflection $ir^A_{\vec{x},0} = \left|\Phi^-\right\rangle = \frac{1}{\sqrt{2}}\left( \left|0\right\rangle \otimes \left|0\right\rangle - \left|1\right\rangle \otimes \left|1\right\rangle \right)$

$3$. Bell pair $BP_{\vec{z},0} = xy$-plane (linear-polarization plane) reflection $ir^A_{\vec{z},0} = \left|\Psi^+\right\rangle =\frac{1}{\sqrt{2}}\left( \left|0\right\rangle \otimes \left|1\right\rangle + \left|1\right\rangle \otimes \left|0\right\rangle \right)$

$4$. Bell pair $BP_{\vec{s},\pi} =$ point reflection $ir^A_{\vec{s},\pi} = \left|\Psi^-\right\rangle = \frac{1}{\sqrt{2}}\left( \left|0\right\rangle \otimes \left|1\right\rangle - \left|1\right\rangle \otimes \left|0\right\rangle \right)$

The Bell Pair $BP_{\vec{\Delta},\alpha}$ is characterized by $ir^A_{\vec{\Delta},\alpha} = ref_{\Delta^\bot} \circ rot_{\vec{\Delta},\alpha} = rot_{\vec{\Delta},\alpha} \circ ref_{\Delta^\bot}$.

The Bell Pair $BP_{\vec{\Delta'},\alpha'}$ is characterized by $ir^A_{\vec{\Delta'},\alpha'} = ref_{\Delta'^\bot} \circ rot_{\vec{\Delta'},\alpha'} = rot_{\vec{\Delta'},\alpha} \circ ref_{\Delta'^\bot}$.

Any improper rotation can be obtain from one given improper rotation combined with the rotation of one of the qubit: $ir^A_{\vec{\Delta'},\alpha'} = rot^A_{\vec{\Delta''},\alpha''} \circ ir^A_{\vec{\Delta},\alpha}$ with $rot^A_{\vec{\Delta''},\alpha''} = ir^A_{\vec{\Delta'},\alpha'} \circ ir^A_{\vec{\Delta},-\alpha}$, because the composition of two improper rotations is a rotation.

For exemple, using $rot_{\vec{x},\pi} = ir_{\vec{x},0} \circ ir_{\vec{y},0} = ref_{yz,0} \circ ref_{xz,0} = ref_{xz,0} \circ ref_{yz,0}$ on one of the qubits $A$ or $B$, which is realized with a half-wave plate aligned with the vertical or horizontal polarization axes for polarized photons, $BP_{\vec{y},0}$ is transformed into $BP_{\vec{z},0}$ and $BP_{\vec{z},0}$ is transformed into $BP_{\vec{y},0}$.

2.5.1. Bell pair creation¶

A Bell pair of maximally-entangled photons can be created for example with Calcium atoms:

1. Excitation of an atom of Calcium to a given energy level by laser pumping;
2. Decaying to an intermediate energy level (first photon emission by fluorescence);
3. Then, after a very short delay (~5 ns), successive decaying to the initial energy level (second photon emission by fluorescence);
4. Because of this process, the two photons are emited in opposite directions and have correlated but unknown polarizations: they form the Bell pair $BP_{\vec{z},0} = xy$-plane ($=$ linear-polarization plane) reflection $ir^A_{\vec{z},0} = \left|\Psi^+\right\rangle =\frac{1}{\sqrt{2}}\left( \left|0\right\rangle \otimes \left|1\right\rangle + \left|1\right\rangle \otimes \left|0\right\rangle \right)$.

Note: If one wants another Bell pair, one just needs to rotate one of the two qubits i.e., change the polarization of one of the two photons.

For example, one can use the Bell pair $BP_{\vec{z},0} = xy$-plane ($=$ linear-polarization plane) reflection $ir^A_{\vec{z},0} = \left|\Psi^+\right\rangle =\frac{1}{\sqrt{2}}\left( \left|0\right\rangle \otimes \left|1\right\rangle + \left|1\right\rangle \otimes \left|0\right\rangle \right)$.

$1.$ If the polarizations of the two photons are measured with the same linear vertical polarization axes $(\uparrow,\uparrow)$, then the measured polarization are $(\uparrow,\uparrow)$, i.e., $(0,0)$, or $(\rightarrow,\rightarrow)$, i.e., $(1,1)$, with $50$% probability each;

$2.$ If the polarizations of the two photons are measured with the same linear diagonal polarization axes $(\nearrow,\nearrow)$, then the measured polarization are $(\nearrow,\nearrow)$, i.e., $(0,0)$, or $(\nwarrow,\nwarrow)$, i.e., $(1,1)$, with $50$% probability each;

$3.$ If the polarizations of the two photons are measured with the different polarization axes $(\uparrow,\nearrow)$, then the measured polarization are $(\uparrow,\nearrow)$, i.e., $(0,0)$, $(\uparrow,\nwarrow)$, i.e., $(0,1)$, $(\rightarrow,\nearrow)$, i.e., $(1,0)$, or $(\rightarrow,\nwarrow)$, i.e., $(1,1)$, with $25$% probability each;

$4.$ If the polarizations of the two photons are measured with the different polarization axes $(\nearrow,\uparrow)$, then the measured polarization are $(\nearrow, \uparrow)$, i.e., $(0,0)$, $(\nearrow,\rightarrow)$, i.e., $(0,1)$, $(\nwarrow,\uparrow)$, i.e., $(1,0)$, or $(\nwarrow,\rightarrow)$, i.e., $(1,1)$, with $25$% probability each.

Case 3 and 4: Using différent polarization axes for the measurements of the two maximally-entangled photons leads to different quantum states for the observers of qubits A and B before they exchange their information.

For example, in case 3 of measurements with the different polarization axes $(\uparrow,\nearrow)$:

$1.$ The observer of qubit A gets $\uparrow \otimes \uparrow$ with probability $50$%,

$2.$ While the observer of qubit B gets $\nearrow \otimes \nearrow$ with probability $50$%,

$3.$ Which leads to $\uparrow \otimes \nearrow$ with probability $25$% after they exchange the results of their measurements.

This is in favor of a relational interpretation of quantum physics $[$Rov1996, Rov2021$]$ thats says that the information an observer has on a system (= quantum state) depends on the observer (a kind of generalization of the special or general relativity).

Protocol described in $[$BB84$]$.

1. BB84 protocol without eavesdropping

2. BB84 protocol with eavesdropping

3. Experimental setup for BB84

3.1.1. Example of initial configuration choice for QKD using BB84 protocol¶

We choose the Bell pair $BP_{\vec{z},0} \sim xy$-plane (linear-polarization plane) reflection $ir^A_{\vec{z},0} = ref_{xy} \sim \left|\Psi^+\right\rangle = \frac{1}{\sqrt{2}}\left( \left|0\right\rangle \otimes \left|1\right\rangle + \left|1\right\rangle \otimes \left|0\right\rangle \right)$.

Alice chooses the two orthogonal measurement axes $\vec{x} \perp \vec{y}$ corresponding to polarization axes $\uparrow$ and $\nearrow$ (there could be other choices...).

The induced choice of orthogonal measurement axes by Bob is $ir^A_{\vec{z},0}\left(\vec{x}\right) = \vec{x}$ $\perp$ $ir^A_{\vec{z},0}\left(\vec{y}\right) = \vec{y}$: same choices of polarization axes.

(1) Alice receives the qubit $A$ of the Bell pair $BP_{\vec{y},0}$ and Bob the qubit $B$ (quantum channel).

(2) Alice and Bob choose independently and randomly their axes of measurement $\vec{m}_A$ and $\vec{m}_B$ in $\left\{ \vec{x}, \vec{y} \right\}$, which correspond to $\uparrow$ and $\nearrow$ polarizations, and they process to the measurement of the qubit they have.

(3) Identifying $\vec{m}_A$ and $\vec{m}_B$ outcome states with binary value $0$ and $-\vec{m}_A$ and $-\vec{m}_B$ with binary value $1$, the measured bits are:

$\ \ \ \ \bullet \ $ If $\vec{m}_A = \vec{m}_B$, $\left( 0 , 0 \right)$ or $\left( 1 , 1 \right)$ with probability $\frac{1}{2}$for both possibilities;

$\ \ \ \ \bullet \ $ If $\vec{m}_A \neq \vec{m}_B$, $\left( 0 , 0 \right)$, $\left( 0 , 1 \right)$, $\left( 1 , 0 \right)$ or $\left( 1 , 1 \right)$ with probability $\frac{1}{4}$ for each possibility.

(4) They communicate their choice of axes (through an authenticated classical channel which may be not encrypted) and they consider the random shared secret bit they measured only when $\vec{m}_A = \vec{m}_B$.

Repeating this process $2K$ times in parallel (step 4 should be done after all the qubits have been measured in step 2), Alice and Bob can build a shared secret random key of average size $K$.

The qubits are indexed by $i \in I = \left\{1, \cdots, n_I\right\}$.

The choices for measurement axes by Alice ($X = A$) and Bob ($X = B$) are for Bell pair $i$, with our example, $m^X_i = 0$ for $\vec{x}$ (polarization axis $\uparrow$) and $m^X_i = 1$ for $\vec{y}$ (polarization axis $\nearrow$) .

The measurement results by Alice ($X = A$) and Bob ($X = B$) on their qubit of the Bell pair $i$, depending on the measurement axes, are $b^X_i = 0$ for $+\vec{x}$ ($\uparrow$ polarization) or $+\vec{y}$ ($\nearrow$ polarization), and $b^X_i = 1$ for $-\vec{x}$ ($\rightarrow$ polarization) or $-\vec{y}$ ($\nwarrow$ polarization).

The full set of data for the BB84 protocol is then $\left( \left(m^A_i,b^A_i\right) , \left(m^B_i,b^B_i\right) \right)_{i \in I}$.

The index set of Bell pairs for which Alice and Bob chose the same axes is $J = \left\{ i \in I \ |\ m^A_i = m^B_i \right\}$.

The quantum physics laws impose $\forall i \in J, b^A_i = b^B_i$.

3.2.1. Power of the eavesdropper¶

The eavesdropper Eve can have almost full power on the communications between Alice and Bob:

• She can intercept and modify the qubits transmitted to Alice and Bob in the quantum channel;

• She can intercept the information exchanged between Alice and Bob on the classical channel (which is authenticated but not encrypted: no man-in-the-middle attack on the classical channel);

• She does not know how and what Alice and Bob measure for each qubit, except the fact that the Bell pair is $BP_{\vec{z},0}$ and the initial set $\left\{\vec{x}, \vec{y}\right\}$ of orthogonal axes for Alice and Bob measurements.

Alice and Bob process the following additional steps to detect eavesdropping:

(5) Once Alice and Bob have measured all the qubits they received (step 2 of BB84) and have communicated their choice of axes for all of them (step 4 of BB84), they randomly select some of them and they communicates the corresponding measured bits (this is not done in BB84 for the qubits used to build the shared secret random key).

(6) If Eve (eavesdropper) has modify some qubits by some measurements, then, when $\vec{m}_A = \vec{m}_B$, the probability that the corresponding bits measured by Alice and Bob are different is greater or equal to $\frac{1}{4}$, while it would be $0$ without Eve intervention. This allows Alice and Bob to statistically evaluate the number of eavesdropped qubits.

(7) Alice and Bob process the step 4 of BB84 for the remaining qubits, and perform a purification process $[$BBE92$]$ to build a shared secret random key taking into account the estimated proportion of qubits that are eavesdropped.

In the following we prove this for the case when Eve measured the qubit $B$ before Bob.

It is also true for the cases when Eve measured the qubit $A$ before Alice of both qubits $A$ and $B$ before Alice and Bob.

The security proof relies on the following facts:

• Alice and Bob choose randomly and independantly the measurement axes between two axes that are orthogonal in $\mathbb{R}^3$, i.e., with angle 45° in $\mathbb{C}^2$;
• Eve does not know the measurement axes choosen by Alice and Bob before they communicate this information;
• Any measurement on one or both qubits breaks the entanglement and the correlation between the qubits of the Bell pair;
• The classical channel is authenticated;
• No cloning theorem: a qubit in an unknown state cannot be duplicated $[$WZ1982$]$;
• The quantum physics theory is complete $[$EPR1935,Bell1964,ADR1982$]$.

1. Eve intercepts the qubit $B$ and measures it according to the oriented axis $\vec{m}_E= \vec{x}$. The measured outcome is $\pm\vec{m}_E$ with probability $\frac{1}{2}$, which imposes $m_A = m_E \Rightarrow b_A = b_E$.
2. Eve sends to Bob the measured qubit, which imposes $m_B = m_E \Rightarrow b_B = b_E$.

Alice and Bob expect that the condition $m_A = m_B \Rightarrow b_A = b_B$ holds. Thus Eve is detected when $m_A = m_B$ and $b_A \neq b_B$ (orange boxes). The detection probability when $m_A = m_B$ is then $p_{detect} = \frac{1}{4}$.

Similar results with $\vec{m}_E = \vec{y}$. These cases correspond to the worst cases: $p_{detect} \geq \frac{1}{4}$ in all cases (see proof).

Eve intercept the qubit $B$ and measures it according to the oriented axis $\vec{m}_E$ which may or may not be in $\left\{\vec{x}, \vec{y}\right\}$. The measured outcome is $\pm\vec{m}_E$ with probability $\frac{1}{2}$.

Because she knows that the Bell pair is $BP_{\vec{z},0}$, her inferred qubit $A$ state is then $ir^B_{\vec{z},0}\left(\pm\vec{m}_E\right) = \pm ir^B_{\vec{z},0}\left(\vec{m}_E\right)$.

Alice measures qubit $A$ with axis $\vec{m}_A \in\left\{\vec{x}, \vec{y}\right\}$. $\vec{m}_A$ is unknown by Eve. The combined Eve + Alice measured outcome is then, with $\sigma_E = \vec{m}_A \cdot ir^B_{\vec{y},0}\left(\vec{m}_E\right)$, $\left( \vec{m}_A, \vec{m}_E \right)$ with probability $\frac{1 + \sigma_E}{4}$, $\left( \vec{m}_A, -\vec{m}_E \right)$ with probability $\frac{1 - \sigma_E}{4}$, $\left( -\vec{m}_A, \vec{m}_E \right)$ with probability $\frac{1 - \sigma_E}{4}$ or $\left( -\vec{m}_A, -\vec{m}_E \right)$ with probability $\frac{1 + \sigma_E}{4}$.

Alice sends to Bob a new qubit $E$ which may depends on what she measured and which can be a mixed state (statistical quantum mechanisms with density operator formalism): $\vec{s}\left(\pm\vec{m}_E\right)$ with probability $p\left(\pm\vec{m}_E\right)$, and $-\vec{s}\left(\pm\vec{m}_E\right)$ with probability $1-p\left(\pm\vec{m}_E\right)$.

She may choose to send the qubit $E = B$ that she measured: $p\left(\pm\vec{m}_E\right)=1$ and $s\left(\pm\vec{m}_E\right)=\pm\vec{m}_E$; but she can do other things, including sending a qubit $E$ fully or partially entangled with another quantum system (some aparatus she may use) including the qubit $B$ she measured.

Bob measured with axis $\vec{m}_B \in\left\{\vec{x}, \vec{y}\right\}$ the qubit $E$ coming from the interception by Alice of the qubit $B$. His measured outcome is $\vec{m}_B$ with probability $\frac{1 + \sigma_B}{2}$ or $-\vec{m}_B$ with probability $\frac{1 - \sigma_B}{2}$ where $\sigma_B\left(\pm\vec{m}_E\right) = \left(2p\left(\pm\vec{m}_E\right)-1\right) \vec{m}_B\cdot\vec{s}\left(\pm\vec{m}_E\right)$, but Bob does not know $\sigma_B$ nor $\pm\vec{m}_E$.

In the remaining parts of the proof, we will prove that, when $\vec{m}_A = \vec{m}_B$, the probability $p_{detect}$ that Alice and Bob detect that someone made a measurement on the qubit $B$ is lower bounded by $p_{detect} \geq \frac{1}{4}$, this lower bound being reached, for example, if $\vec{m}_E \in \left\{\vec{x}, \vec{y}\right\}$, $p\left(\pm\vec{m}_E\right)=1$ and $s\left(\pm\vec{m}_E\right)=\pm\vec{m}_E$.

The combined Eve + Alice measured outcome is, with $\sigma_E = \vec{m}_A \cdot ir^B_{\vec{y},0}\left(\vec{m}_E\right)$: $\left( \vec{m}_A, \vec{m}_E \right)$ with probability $\frac{1 + \sigma_E}{4}$, $\left( \vec{m}_A, -\vec{m}_E \right)$ with probability $\frac{1 - \sigma_E}{4}$, $\left( -\vec{m}_A, \vec{m}_E \right)$ with probability $\frac{1 - \sigma_E}{4}$ or $\left( -\vec{m}_A, -\vec{m}_E \right)$ with probability $\frac{1 + \sigma_E}{4}$.

When $\vec{m}_A = \vec{m}_B$, we have $\sigma_B\left(\pm\vec{m}_E\right) = \left(2p\left(\pm\vec{m}_E\right)-1\right) \vec{m}_A\cdot\vec{s}\left(\pm\vec{m}_E\right)$ and his measured outcome is $\vec{m}_A$ with probability $\frac{1 + \sigma_B\left(\pm\vec{m}_E\right)}{2}$ or $-\vec{m}_A$ with probability $\frac{1 - \sigma_B\left(\pm\vec{m}_E\right)}{2}$. This measured outcome is independant of the combined Eve + Alice measured outcome, because Bob's measurement comes after Eve's measurement.

Alice and Bob can detect the eavesdropping when Bob measures $\pm \vec{m}_A$ while Alice measures the opposite $\mp \vec{m}_A$. So we can compute the probability $p_{detect}\left(\vec{m}_A\right)$ as a function of $\vec{m}_A$, which is unknown by Eve.

$p_{detect}\left(\vec{m}_A\right)$ $=$ $\frac{1 + \sigma_B\left(+\vec{m}_E\right)}{2} \times \frac{1 - \sigma_E}{4} + \frac{1 + \sigma_B\left(-\vec{m}_E\right)}{2} \times \frac{1 + \sigma_E}{4} + \frac{1 - \sigma_B\left(+\vec{m}_E\right)}{2} \times \frac{1 + \sigma_E}{4} + \frac{1 - \sigma_B\left(-\vec{m}_E\right)}{2} \times \frac{1 - \sigma_E}{4}$
  $=$ $\frac{1}{2} - \frac{\sigma_B\left(+\vec{m}_E\right) \sigma_E}{4} + \frac{\sigma_B\left(-\vec{m}_E\right) \sigma_E}{4}$ $=$ $\frac{1}{2} + \frac{ \left(1-2p\left(\vec{m}_E\right)\right) \vec{m}_A\cdot\vec{s}\left(\vec{m}_E\right) \times \vec{m}_A \cdot ir^B_{\vec{y},0}\left(\vec{m}_E\right)}{4} - \frac{ \left(1-2p\left(-\vec{m}_E\right)\right) \vec{m}_A\cdot\vec{s}\left(-\vec{m}_E\right) \times \vec{m}_A \cdot ir^B_{\vec{y},0}\left(-\vec{m}_E\right)}{4}$.

The choice of $\left(\vec{m}_A\right)$ is fully random with $\vec{m}_A \in \left\{\vec{x}, \vec{y}\right\}$, thus the probability detection is $p_{detect} = \frac{1}{2} p_{detect}\left(\vec{x}\right) + \frac{1}{2} p_{detect}\left(\vec{y}\right)$.

We thus have $p_{detect} = \frac{1}{2} + \frac{f\left(p\left(\vec{m}_E\right),\vec{s}\left(\vec{m}_E\right),ir^B_{\vec{y},0} \left(\vec{m}_E\right)\right)}{8} - \frac{f\left(p\left(-\vec{m}_E\right),\vec{s}\left(-\vec{m}_E\right),ir^B_{\vec{y},0} \left(-\vec{m}_E\right)\right)}{8}$,
where $f\left(p,\vec{s},\vec{r}\right) = \left(1-2p\right)\left( \vec{z} \cdot \vec{s} \times \vec{z} \cdot \vec{r} + \vec{x} \cdot \vec{s} \times \vec{x} \cdot \vec{r} \right) = \left(1-2p\right)\left( \cos\theta_s \cos\theta_r + \cos\varphi_s \sin\theta_s \cos\varphi_r \sin\theta_r \right)$.

We have $f\left(p,\vec{s},\vec{r}\right) \in \left[-1,+1\right]$ because $1-2p \in \left[-1,+1\right]$ since $p \in \left[0,+1\right]$,
and $\left| \cos\theta_s \cos\theta_r + \cos\varphi_s \sin\theta_s \cos\varphi_r \sin\theta_r \right| \leq \max \left\{ \left| \cos\left( \theta_s - \theta_r \right) \right|, \left| \cos\left( \theta_s + \theta_r \right) \right| \right\} \leq 1$.

Thus $p_{detect} \geq \frac{1}{4}$.

For $\vec{m}_E = \vec{x}$, $p\left(\pm\vec{m}_E\right)=1$ and $s\left(\pm\vec{m}_E\right)=\pm\vec{m}_E=\pm\vec{x}$, we have $ir^B_{\vec{z},0} \left(\pm\vec{m}_E\right) = \pm\vec{x}$, which implies that $p_{detect} = \frac{1}{4}$. The probability value is the same with $\vec{m}_E = \vec{y}$.

The quantum channel can be realized using Alain Aspect's experimental set up $[$AGR1982,ADR1982$]$:

The classical channel could be any classical network (e.g., classical Internet communication).

Protocol described in $[$E91$]$.

1. Bell's inequalities

2. Usage of Bell's inequalities in E91 protocol

4.1.1. The inequalities¶

The Bell's inequalities that are used in the E91 protocol $[$E91$]$ and in Alain Aspect's experiments $[$AGR1982,ADR1982$]$ are a generalization $[$CHSH1969$]$ of the initial Bell's inequalities $[$Bell1964$]$.

We consider the Bell pair $BP_{\vec{z},0} \sim xy$-plane (linear-polarization plane) reflection $ir^A_{\vec{z},0} = ref_{xy} \sim \left|\Psi^+\right\rangle = \frac{1}{\sqrt{2}}\left( \left|0\right\rangle \otimes \left|1\right\rangle + \left|1\right\rangle \otimes \left|0\right\rangle \right)$.

Alice and Bob choose the measurement axes $\vec{m}_A$ and $\vec{m}_B$ in $xy$ plane (linear pôlarization). The measured qubits are $b_A$ and $b_B$ in $\left\{0,1\right\}$. For the inequalities, we transforme them into $\left\{+1,-1\right\}$ with $b'_A = 1-2b_A = (-1)^{b_A}$ and $b'_B = 1-2b_B = (-1)^{b_B}$.

The expectation value of the product is $\mathrm{\textbf{E}}\left[b'_A \cdot b'_B | \vec{m}_A, \vec{m}_B \right] = \sum_{\left(b'_A , b'_B\right) \in \left\{+1,-1\right\}^2}\mathrm{\textbf{P}}\left[b'_A , b'_B | \vec{m}_A, \vec{m}_B \right] \left(-1\right)^{b_A+b_B}$. With $\mathrm{\textbf{P}}\left[\pm 1, \pm 1| \vec{m}_A, \vec{m}_B \right] = \frac{1+\left(\pm \vec{m}_A\right)\cdot\left(\pm \vec{m}_A\right)}{2}$, we get $\mathrm{\textbf{E}}\left[b'_A \cdot b'_B | \vec{m}_A, \vec{m}_B \right] = \vec{m}_A \cdot \vec{m}_B$.

We consider the case where $\vec{m}_A \in \left\{\vec{m}_{A,0},\vec{m}_{A,1}\right\}$ and $\vec{m}_B \in \left\{\vec{m}_{B,0},\vec{m}_{B,1}\right\}$, and the quantity $S = \mathrm{\textbf{E}}\left[b'_A \cdot b'_B | \vec{m}_{A,0}, \vec{m}_{B,0} \right] - \mathrm{\textbf{E}}\left[b'_A \cdot b'_B | \vec{m}_{A,0}, \vec{m}_{B,1} \right] + \mathrm{\textbf{E}}\left[b'_A \cdot b'_B | \vec{m}_{A,1}, \vec{m}_{B,0} \right] + \mathrm{\textbf{E}}\left[b'_A \cdot b'_B | \vec{m}_{A,1}, \vec{m}_{B,1} \right]$.

The calculation according to quantum physics gives $S = \vec{m}_{A,0} \cdot \vec{m}_{B,0} - \vec{m}_{A,0} \cdot \vec{m}_{B,1} + \vec{m}_{A,1} \cdot \vec{m}_{B,0} + \vec{m}_{A,1} \cdot \vec{m}_{B,1} = \vec{m}_{A,0} \left(\cdot \vec{m}_{B,0} - \cdot \vec{m}_{B,1}\right) + \vec{m}_{A,1} \cdot \left(\vec{m}_{B,0} + \vec{m}_{B,1}\right)$.

Now we consider the specific case where $\vec{m}_A \in \left\{\vec{x},\vec{y}\right\}$ ($0$° and $90$° angles in plane $xy$) and $\vec{m}_B \in \left\{\frac{\vec{y}+\vec{x}}{\sqrt{2}}, \frac{\vec{y}-\vec{x}}{\sqrt{2}}\right\}$ ($45$° and $135$° angles in plane $xy$), This gives $S = \vec{x}\cdot\sqrt{2}\vec{x} + \vec{y}\cdot\sqrt{2}\vec{y} = 2\sqrt{2}$.

Hypotheses:

1. There are hidden independant variables $\left(a'_0,a'_1,b'_0,b'_1\right) \in \left\{+1,-1\right\}^4$ that exist before the measuraments such as, after the measurements, $b'_A = a'_0$ if $m_A = m_{A,0}$, $b'_A=a'_1$ if $m_A = m_{A,1}$, $b'_B=b'_0$ if $m_B = m_{B,0}$, $b'_A=b'_1$ if $m_B = m_{B,1}$ (realism);
2. Alice's choice cannot influence Bob's result or vice versa (locality).

Then $\left|S\right| = \left|\mathrm{\textbf{E}}\left[b'_A \cdot b'_B | \vec{m}_{A,0}, \vec{m}_{B,0} \right] - \mathrm{\textbf{E}}\left[b'_A \cdot b'_B | \vec{m}_{A,0}, \vec{m}_{B,1} \right] + \mathrm{\textbf{E}}\left[b'_A \cdot b'_B | \vec{m}_{A,1}, \vec{m}_{B,0} \right] + \mathrm{\textbf{E}}\left[b'_A \cdot b'_B | \vec{m}_{A,1}, \vec{m}_{B,1} \right] \right|$ $\leq \max\left\{\left|a'_0 \cdot b'_0 - a'_0 \cdot b'_1 + a'_1 \cdot b'_0 + a'_1 \cdot b'_1\right|\right\}$.

Looking at all the 16 possibilities for $\left(a'_0,a'_1,b'_0,b'_1\right) \in \left\{+1,-1\right\}^4$, one can show that $\left|a'_0 \cdot b'_0 - a'_0 \cdot b'_1 + a'_1 \cdot b'_0 + a'_1 \cdot b'_1\right|=2$, thus $\left|S\right| \leq 2$ (Bell's inequality).

Bell's inequality violation: $S = 2\sqrt{2} > 2$ can be reached with quantum physics, for example when $\vec{m}_A \in \left\{\vec{x},\vec{y}\right\}$ ($0$° and $90$° angles in plane $xy$) and $\vec{m}_B \in \left\{\frac{\vec{y}+\vec{x}}{\sqrt{2}}, \frac{\vec{y}-\vec{x}}{\sqrt{2}}\right\}$ ($45$° and $135$° angles in plane $xy$).

$(1935)$ Einstein, Podolsky an Rosen paradox $[$EPR1935$]$: If one supposes (1) realism, (2) locality, and (3) quantum mechanics completeness, then there is a contradiction. At least one of the hypotheses is wrong. Einstein and his co-authors thought that (3) was wrong.

$(1964-1969)$ Bell's inequalities $[$Bell1964, CHSH1969$]$: It is possible to check by an experiment if (1 and 2) or (3) is wrong.

$(1982)$ Alain Aspect's experiments $[$ADB1982$]$: The Bell's inequalities are violated by the quantum mechanics, (3) is right, (1) or (2) is wrong.

Many people think that (1) is right (realism) and thus (2) is wrong (locality): non-localilty hypothesis. But Einstein's special relativity has always been proven to be right and quantum mechanics do not allow usable information transfer faster than light.

Relational interpretation of quantum mechanism $[$Rov1996, Rov2021$]$: (1) is wrong (no-absolute-realism but relationalism/relativity) and (2) is right (locality of interactions).

Choice of the Bell pair $BP_{\vec{z},0} \sim xy$-plane (linear-polarization plane) reflection $ir^A_{\vec{z},0} = ref_{xy} \sim \left|\Psi^+\right\rangle = \frac{1}{\sqrt{2}}\left( \left|0\right\rangle \otimes \left|1\right\rangle + \left|1\right\rangle \otimes \left|0\right\rangle \right)$.

Alice has 3 random choices of axis $\vec{m}_A \in \left\{\vec{x}, \frac{\vec{y}+\vec{x}}{\sqrt{2}}, \vec{y}\right\}$ ($0$°, $45$° and $90$° angles in plane $xy$) and Bob has 3 random choices of axis $\vec{m}_B \in \left\{\frac{\vec{y}+\vec{x}}{\sqrt{2}}, \vec{y}, \frac{\vec{y}-\vec{x}}{\sqrt{2}}\right\}$ ($45$°, $90$° and $135$° angles in plane $xy$). There are 9 possibilities for $\left(\vec{m}_A,\vec{m}_B\right)$ with probabilit $1/9$ each.

$(1)$ With probability $2/9$, the measurement axes are equal and the measruements will be used by Alice and Bob to build the shared random secret key: $\left(\frac{\vec{y}+\vec{x}}{\sqrt{2}},\frac{\vec{y}+\vec{x}}{\sqrt{2}}\right)$ and $\left(\vec{y},\vec{y}\right)$;

$(2)$ With probability $4/9$, the measurements will be used for the Bell's inequality test, with the measurement axes: $\left(\vec{x},\frac{\vec{y}+\vec{x}}{\sqrt{2}}\right)$, $\left(\vec{x},\frac{\vec{y}-\vec{x}}{\sqrt{2}}\right)$, $\left(\vec{y},\frac{\vec{y}+\vec{x}}{\sqrt{2}}\right)$ and $\left(\vec{y},\frac{\vec{y}-\vec{x}}{\sqrt{2}}\right)$;

$(3)$ With probability $4/9$, the measurements will not be used with the measurement axes: $\left(\vec{x},\frac{\vec{y}+\vec{x}}{\sqrt{2}}\right)$, $\left(\frac{\vec{y}+\vec{x}}{\sqrt{2}},\vec{y}\right)$ and $\left(\frac{\vec{y}+\vec{x}}{\sqrt{2}},\frac{\vec{y}-\vec{x}}{\sqrt{2}}\right)$.

Without eavesdopping by Eve, Alice and Bob will get $S = 2\sqrt{2}$.

With total eavesdopping by Eve, Alice and Bob will get $\left|S\right| \leq \sqrt{2}$ $[$E91$]$.

Thus, the proportion $\rho$ of qubits that are eavesdropped by Eve can be upper-bounded according to what Alice and Bob measure for $S$: $\rho \leq 2\left(1-\frac{S}{2\sqrt{2}}\right)$, because $S \leq \left(1-\rho\right)\times 2\sqrt{2} + \rho \times \sqrt{2}$.

1. Some experimental QKD systems

2. Some commercial QKD products

3. QKD Standardization

4. Future of QKD: Quantum Internet

First QKD experiment in 1989, over $0.3$ m only $[$BB89$]$: 64516 light pulses with on average 0.34 photon per pulse $\rightarrow$ with 9% efficiency reception, about 2000 received pairs of qubits $\rightarrow$ with 50% worng choice of basies, about 1000 usable pairs of qubits $\rightarrow$ with distillation and equality confirmation protocols to remove errors, 443 then 403 perfectly shared qubits (i.e., with error $< 10^{-12}$) $\rightarrow$ with privacy amplification protocol, 175-bit final secret quantum key, with Eve knowing less than $5 \cdot 10^{-9}$ bits of information (!).

Fiber QKD record in 2015: Korzh, B., Lim, C., Houlmann, R. et al., "Provably secure and practical quantum key distribution over 307 km of optical fibre," Nature Photon 9, 163–168 (2015), https://doi.org/10.1038/nphoton.2014.327. About 3 bit/s with 51.8 dB loss (307 km fiber) for 660000-bit key (~3 days). The rate increases to ~900 bit/s for 200 km, and ~10000 bit/s for 100 km.

QKD by satellite in 2017: Liao, SK., Cai, WQ., Liu, WY. et al., "Satellite-to-ground quantum key distribution," Nature Vol. 549, pp. 43–47, 2017, https://doi.org/10.1038/nature23655. They achieved 1000 kbit/s key distribution over 1200 km, with Bell pair creation in the satellite.

Use of more complex realizations of QKD, e.g., Continuous-Variable QKD: For example (CiViQ project), F. Roumestan, A. Ghazisaeidi, J. Renaudier, L. T. Vidarte, E. Diamanti and P. Grangier, "High-Rate Continuous Variable Quantum Key Distribution Based on Probabilistically Shaped 64 and 256-QAM," 2021 European Conference on Optical Communication (ECOC), 2021, pp. 1-4, https://doi.org/10.1109/ECOC52684.2021.9606013. About 67 Mb/s secret key rates on average over a 9.5 km SMF link.

A good example is ID Quantique: https://www.idquantique.com/:

• White paper "Understanding Quantum Cryptography" (May 2020): https://marketing.idquantique.com/acton/attachment/11868/f-020d/1/-/-/-/-/Understanding%20Quantum%20Cryptography_White%20Paper.pdf;
• QKD products: Clavis XG QKD System, Cerberis XG QKD System, XGR Series – QKD Platform, Cerberis3 QKD System, Clavis300 Quantum Cryptography Platform, see https://www.idquantique.com/quantum-safe-security/products/#quantum_key_distribution.
  • Cerberis XG QKD System https://www.idquantique.com/quantum-safe-security/products/cerberis-xg-qkd-system/: Quantum Key Distribution for enterprise, government and telco production environments (see datasheet). Performances: 12 dB loss @ 60 km fiber (15 lost qubits each 16 qubits), qubits generated at 1.25 GHz, final key rate 2 kbps, probability of information leakage of 1 bit for 256-bits key is about $10^{-12}$.
  • Clavis300 Quantum Cryptography Platform https://www.idquantique.com/quantum-safe-security/products/clavis300-quantum-cryptography-platform/: Integrated Quantum Key Distribution & LEA Encryption System (see datasheet). Performances: Key generation rate 6 kbps @ 12 dB link loss (60 km fiber), max range = 18 dB (90 km fiber), premium version 24 dB.

• QKD group at ETSI: many standard documents.
  See https://www.etsi.org/technologies/quantum-key-distribution

• Quantum Internet Research Group at IRTF: currently 2 draft documents.
  $\Rightarrow$ QKD is an application case of Quantum Internet.
  See https://irtf.org/qirg.
  See Ludovic Noirie's LINCS reading group presentation on "Quantum Internet", a review of QIRG@IRTF documents (2020/09/09): https://www.lincs.fr/events/quantum-internet/.

$\bullet$ Today's QKD systems are limited in distances because of the no-cloning theorem:

• Few 10s km in fiber communication,
• Few 100s of km by satellite.

$\bullet$ To increase the distance, one can use of quantum buffers and quantum teleportation (not yet mature technologies).

$\bullet$ Then one can use optical switching to perform quantum routing (mature technology at least for optical circuit switching).

$\Rightarrow$ Quantum Internet to extend QKD between any pair of end points.