Entanglement and Security Proofs

3.1 A source shared by Alice and Bob

Everything in this chapter rests on one equivalence: a prepare-and-measure protocol can be rewritten as a measurement on a shared entangled state without changing any statistic either Bob or Eve can observe. This section establishes the equivalence and then asks when the resulting pair is clean enough to imply secrecy.

3.1.1 Calculate Bell-pair correlations

The Bell state \(|\Phi^+\rangle=(|00\rangle+|11\rangle)/\sqrt2\) gives identical random outcomes when both parties measure Z. Rewriting it in the X basis,

shows the same property in the complementary basis. The two expansions are the same vector written differently, so no measurement can prefer one. Each party alone holds the reduced state

and likewise for Bob. Perfect correlation between the parties is therefore fully compatible with a local bit that is uniform and unpredictable—the same \(I/2\) state met in Section 1.2.2.

The four Bell states organise these correlations, and it pays to keep their two axes separate from the start.

Alice can measure her half first and thereby prepare a definite state for Bob. That observation is not a communication channel—Bob's unconditional state stays \(I/2\) and Alice cannot steer her own random outcome—but it does give a virtual description of BB84 for ideal sources. The description earns its place because entanglement purification connects noise correction to secrecy, as Section 3.3 makes quantitative.

It also needs the correct source model. A real emitter that leaks basis information into another optical mode does not automatically match this virtual experiment. A source outside the laboratories may even be distrusted, but only if the security proof is written for that arrangement; an argument that assumes a pure, isolated pair cannot be applied to a device that does not provide one.

3.1.2 Derive remote preparation as an equality of experiments

Start from \(|\Phi^+\rangle_{AB}=(|00\rangle+|11\rangle)/\sqrt2\) and let Alice measure Z, obtaining \(a\). The unnormalised conditional state on Bob is

whose squared norm is \(1/2\); dividing by that norm leaves \(|a\rangle\). Repeating the calculation for a real X-basis vector produces \(|+\rangle\) or \(|-\rangle\) with equal probability. So Alice's outcome, although random, fixes Bob's conditional state exactly.

For a general complex vector \(|u\rangle\) the rule is

with the complex conjugate appearing because \(|\Phi^+\rangle=\sum_j|j\rangle|j\rangle\) pairs matching indices. This is why one should check the chosen basis rather than assume every entangled preparation carries identical labels. BB84's Z and X states are real, so the conjugation leaves the protocol unchanged; a protocol using \(Y\)-basis states would not be so forgiving.

The equivalence itself rests on commutation. Alice's measurement acts on \(A\), while Eve's channel and Bob's measurement act on \(B\) and its environment. Operations on different subsystems commute, so Alice's measurement may be delayed, even until after Bob's, without changing any joint probability. That is the source-replacement argument: a convenient virtual experiment reproduces the actual observable one.

3.1.3 A pure shared pair leaves Eve uncorrelated

Suppose \(AB\) is exactly pure and in a Bell state, and Eve holds any extension whatsoever, possibly entangled with both halves. Because the reduced state on \(AB\) is pure, it has rank one. Purify the full state and expand in a Schmidt decomposition across \(AB\) versus everything else: a rank-one reduced state admits exactly one nonzero Schmidt coefficient, so the extension factors as

The product form is the whole argument. Because the state factorises across the \(AB\)–\(E\) split, Eve's marginal is the same no matter which outcome Alice records, so no measurement of hers can reveal anything about it. A correlated record would have required a second nonzero Schmidt term, and a rank-one reduced state has none to offer.

This is the connection between entanglement and secrecy. Measuring a perfect Bell pair in Z gives uniform bits that are equal on both sides and independent of Eve. Approximate Bell pairs need a quantitative continuity argument: a state close in trace distance to a pure pair yields a key close to ideal, with the distance supplying the error term. That is the shape of an entanglement-based proof—distil nearly pure pairs, then measure—even when the implemented protocol only prepares, measures, and processes classical data.

3.2 Bit errors and phase errors

A real pair is not pure, and Bob's measured string will disagree with Alice's somewhere. This section separates that noise into two kinds, gives each kind a label, and shows why correcting only the visible one is not enough.

3.2.1 Look in complementary bases

Apply \(Z\) to Bob's half of \(|\Phi^+\rangle\) and the state becomes \(|\Phi^-\rangle=(|00\rangle-|11\rangle)/\sqrt2\). Its Z outcomes still agree, but its X outcomes now differ, as the table in Section 3.1.1 records. A phase error is therefore invisible to a Z-only agreement test: the two states are indistinguishable unless you look in the complementary basis.

For a Z-basis raw key, complementary-basis observations are what constrain the phase errors entering a security proof. In a simplified Bell-diagonal picture the rule is easy to remember:

Two lessons follow. Correcting bit disagreement alone does not erase Eve's knowledge, because a Z error leaves the key bits intact while destroying the coherence a proof relies on; the conceptual role of virtual phase correction is precisely to explain why privacy amplification is also required. And the correspondence cannot be assumed for free. Translating observed X errors into a bound on Z-key phase errors requires random sampling and a stated source model—it cannot be done by declaring the two error rates equal (Section 2.3.3).

3.2.2 Use Bell labels as an error ledger

Define \(|\beta_{uv}\rangle=(I\otimes X^uZ^v)|\Phi^+\rangle\) for binary \(u\) and \(v\). The stabilisers \(Z\otimes Z\) and \(X\otimes X\) have eigenvalues \((-1)^u\) and \((-1)^v\) respectively, so \(u\) records a bit disagreement and \(v\) a phase disagreement. A Bell-diagonal state is then a classical mixture of these four labels,

and the two measured rates read off its weights:

The two measured rates do not determine all four probabilities, and that gap is where careless proofs fail. Given \(e_b=e_p=q\), the value of \(p_{11}\) can range over

with \(p_{10}=p_{01}=q-p_{11}\) and \(p_{00}=1-2q+p_{11}\). Every admissible \(p_{11}\) reproduces the same two observed rates while correlating the two error types differently, so a security argument must hold for the whole family rather than for one convenient member. The Bell-diagonal form itself is a modelling choice: it is justified in appropriately symmetrised analyses, and must not be assumed to describe every laboratory state without argument.

The labels also explain the algebra. A single Z error changes the relative sign of \(|00\rangle-|11\rangle\), which alters interference in the X basis while leaving Z probabilities untouched. For \(Y\), use \(Y=iXZ\): the global phase is immaterial to probabilities, and both labels flip. This bookkeeping lets a proof track virtual corrections without ever suggesting that Bob measures one qubit in two incompatible bases during a single run.

3.2.3 Count the information needed to correct a typical error pattern

Suppose a block of \(n\) bits carries independent errors at rate \(q\). A typical string has about \(nq\) errors, and the number of ways to place them is \(\binom n{nq}\). Stirling's approximation gives

to leading order in \(n\), where

is the binary entropy in bits, with endpoint values set by continuity. Naming one of those patterns therefore costs roughly \(nh_2(q)\) bits: that is the origin of the entropy term in ideal asymptotic reconciliation, and it is a counting statement, not a property of any particular code.

A separate virtual phase-error correction is governed by \(nh_2(e_p)\). In a CSS-code proof, compatible families of bit and phase checks connect these two costs to the number of distillable logical Bell pairs. The commutation of the checks and the construction of the codes are essential to that argument; subtracting two counts is useful intuition, not a construction.

Translating the virtual protocol back into classical data processing identifies the operations: bit correction becomes reconciliation, and virtual phase correction becomes privacy amplification. Alice and Bob never store \(n\) physical qubits or perform both corrections in the laboratory. What the proof establishes is an equivalence between the operations that matter for the final classical key. Shor and Preskill give the full CSS-based argument; the counting above is why its rate has exactly two entropy terms.

3.3 An asymptotic key fraction

With a bit-error cost and a phase-error cost in hand, the rate follows by subtraction. This section states the resulting bound, locates its zero, and then shows the second, entropy-based route that does not go through CSS codes at all.

3.3.1 State what the formula assumes

For ideal single-photon BB84 with one-way processing, a familiar asymptotic lower bound per sifted key bit is

with \(h_2\) the binary entropy in bits. The formula is short only because it hides its assumptions.

Two common readings of the formula are wrong. It is not the number of secret bits per emitted pulse: detection and sifting factors must also enter that rate. And a negative lower bound supplies no positive key guarantee from this expression; it does not prove that every other protocol is impossible. In the symmetric case \(e_b=e_p=q\) the bound reduces to \(1-2h_2(q)\), which is the curve plotted by the explorer at the end of this section. The full proof machinery lies beyond this lesson; the linked Shor–Preskill paper carries the entanglement-purification argument.

3.3.2 Recover the rate and locate its threshold

The binary entropy vanishes at zero error, equals one at \(q=1/2\), and increases on \([0,1/2]\). Differentiation gives

which is positive before \(q=1/2\). Hence \(1-2h_2(q)\) decreases continuously from one at \(q=0\) to minus one at \(q=1/2\) and crosses zero exactly once on that interval. Numerical bisection locates the crossing at

about 11.0% for this ideal asymptotic, one-way formula. Note what has and has not been shown: the existence and uniqueness of the root follows from monotonicity, while the value 0.110028 is a numerical approximation to a transcendental equation.

The often-quoted threshold is not a universal law for every QKD protocol. Inefficient reconciliation, finite-size penalties, multiphoton emission, and different processing all move it. If reconciliation reveals \(f_{\rm EC}nh_2(e_b)\) bits with efficiency overhead \(f_{\rm EC}\ge1\), the bookkeeping expression becomes

At \(e_b=e_p=0.05\) and \(f_{\rm EC}=1.15\) this gives \(1-2.15(0.2864)=0.3842\), against \(0.4272\) for ideal reconciliation. At a sifted rate of 10,000 bits per second those correspond to about 3,842 and 4,272 bits per second before other costs, under the same model. The overhead does not merely scale the rate; it moves the zero, as the next figure shows.

3.3.3 Connect complementarity to an entropy proof

A second route bounds Eve's uncertainty directly and does not pass through CSS codes. For two measurements with overlap

a smooth-entropy uncertainty theorem relates the Z outcomes that are unpredictable to Eve to the hypothetical X outcomes that are unpredictable to Bob. For complementary \(n\)-qubit Z/X measurements, where \(c=1/2\), the relevant form is

The first term measures how much uncertainty about the key survives in Eve's hands; the second measures how hard it is to predict Bob's complementary outcomes. Neither is the Shannon entropy of Alice's measured histogram. The inequality is a theorem, quoted here rather than proved; see Tomamichel and Renner.

A phase-error analysis bounding the second term by approximately \(nh_2(\bar e_p)\) then supplies a min-entropy lower bound near \(n[1-h_2(\bar e_p)]\). Subtracting reconciliation leakage and applying the quantum leftover-hash lemma yields a secret length. That chain—physical overlap, complementary predictability, Eve's conditional entropy, extraction—makes the logical dependencies visible.

For a finite block the conventions must match across steps: smoothing, conditioning on acceptance, parameter-estimation failure, and leakage each consume part of the same error budget, and a term counted twice produces an optimistic key length. Tight Finite-Key Analysis for Quantum Cryptography gives a protocol-specific treatment. Chapter 4 teaches the extraction and accounting steps without pretending that one asymptotic formula already covers those finite-size details.