At 08:35 PM 1/16/01 -0800, [EMAIL PROTECTED] wrote in part: >In some variants the photon travels around the group multiple times before >it is measured. Let us call this number of times the "circulation count". 1) Let C denote the circulation count. The idea of having C>1 is very nice. One can make a completely macroscopic argument (i.e. without invoking quantum mechanics) that Eve must tap the signal at least C times, once each time the signal circulates around the ring; otherwise she knows nothing. 2) The foregoing macroscopic result is important when combined with the following quantum mechanical result: At 11:20 PM 1/17/01 -0800, [EMAIL PROTECTED] wrote in part: >The probability that Eve's measurement will leave the result unchanged is >3/4, and therefore the probability that she will perturb the result is 1/4. .... >each additional measurement brings us closer to a 50-50 chance >of detection. So by increasing the circulation count, one can make things tough for Eve. 3) OTOH, one cannot increase the circulation count without bound. A real-world quantum computer would have some nonzero chance of making a mistake, so in the limit of a very large C it wouldn't work at all. One would have to find a happy medium value for C. 4) Possibly constructive suggestion: To describe the physics of systems like this, it is often helpful to use the machinery of _density matrices_. a) A density matrix can represent a pure quantum state, although in this case it doesn't tell you anything that the state vector didn't tell you. b) A density matrix can also represent a probabilistic combination of quantum states, which is something a state vector cannot do. In the (H, V) basis, the density matrix for a pure H state is rho_1 = 1 0 (1) 0 0 while the density matrix for a pure V state is rho_2 = 0 0 (2) 0 1 and the density matrix for a state rotated by an angle x away from the H axis is rho_3 = cos(x)cos(x) cos(x)sin(x) (3) sin(x)cos(x) sin(x)sin(x) It is useful to check whether the number of photons is correct. The probability of a photon in _some_ polarization state is Trace(rho), and we immediately see that Trace(rho)=1 in the foregoing examples. We can also check whether a given density matrix represents a pure state. Trace(rho^2)=1 for a pure state. We confirm that the foregoing examples represent pure states. Using this machinery we have a nice description of what Eve does to the signal. Without loss of generality we analyze things in her basis. The state incoming to her eavesdropping apparatus is given by equation (3) above. Assuming she makes a strong measurement, the state outgoing from her apparatus is rho_4 = cos(x)cos(x) 0 (4) 0 sin(x)sin(x) We see the off-diagonal elements have been smashed. This still has the right number of photons: Tr(rho_4)=1, but it is no longer a pure state (except on a set of measure zero): Tr(rho_4^2) = cos^4(x) + sin^4(x) = .75 + .25 cos(4x) (5) which averages to 3/4 and is less than unity unless Eve happens to stumble onto a very lucky x value. A more general form of equation (4) is rho_4 = P(h) rho_3 P(h) + P(v) rho_3 P(v) (6) where P(h) is the projection operator that projects onto Eve's horizontal axis, and P(v) projects onto her vertical axis. One could also mumble something about the entropy, S = Trace(rho log rho) <tirade> Note that (despite what you read in textbooks) projection operators have no physical implementation. A polarizer cannot be properly modelled as a projection operator. The operator is not unitary, so it cannot properly describe any physical device. A nonunitary device would violate the Heisenberg uncertainty principle, violate the 2nd law of thermodynamics, violate the fluctuation/dissipation theorem, and generally be a Bad Thing. Such operators may be a serviceable shorthand under some special assumptions (strong measurements of photon number at zero temperature) but you should not get too attached to them, because they will lead you astray if you consider weak measurements, voltage measurements, and/or nonzero temperatures. </tirade> ======================== 5) Eve must make a tradeoff: decreasing the probability of detection, versus increasing the probability of learning something. If she taps the ring at only a single point, she cannot learn anything. This is another macroscopic (i.e. non-quantum) property of the algorithm, assuming we have a circulation count C>1. Therefore let us consider the case where Eve wishes to focus her attack on Bob, a particular member of the ring. This may or may not be her best strategy, but it is a case that we must consider. This seems to require Eve to tap the signal 2C times: one just upstream of Bob and one just downstream, for each cycle of the circulation. 6) Let us revisit this: At 11:20 PM 1/17/01 -0800, [EMAIL PROTECTED] wrote in part: >The probability that Eve's measurement will leave the result unchanged is >3/4, and therefore the probability that she will perturb the result is 1/4. OK so far. Then, for the case of two measurements, >Eve's chances of perturbing the measurement have increased from >1/4 to 3/8 by doing two measurements rather than one..... Increasing the >number of measurements to three reduces the chance of >success to 9/16, with a 7/16 chance of perturbation. That's not correct, if Eve is clever. She can arrange that later measurements are correlated with the first measurement in interesting ways. In particular, suppose she has received state rho_3 and has measured it. She is about to construct her outgoing signal. Rather than simply constructing an outgoing photon described by rho_4, she instead constructs an EPR pair of photons. She measures the first element of the pair and fiddles with it to make it look like rho_4. She feeds this one to Bob. Bob rotates this one according to the algorithm and passes it along the ring. Now, Eve taps the signal that Bob puts out. Since she has kept the second element of the EPR pair, she can combine the two photons and make two (!) measurements. This allows a perfect determination of the angle of rotation that Bob imparted to the signal; it inflicts no additional entropy. From Eve's point of view, this is a better tapping strategy than simply making multiple independent measurements. To analyze the strength of the Shining Cryptographers algorithm, we must consider advanced tapping strategies such as this. ===================================== 7) Nitpick: At 11:20 PM 1/17/01 -0800, [EMAIL PROTECTED] remarked parenthetically: >(Note: Eve can also use a circular polarization basis, but that only >adds an imaginary factor to the coefficients, and since we are taking >the square of the norm of the coefficient to get our probabilities, >the imaginary term is irrelevant for these calculations.) Actually, circular polarization does make a difference. Operationally, it is equivalent to a worst-case choice of the angle x (i.e. x=45 degrees) so it is markedly worse than an average x value. However, we can assume that Eve would not bother with such an inferior strategy, so if we just ignore the foregoing parenthetical remark the other parts of the note are unaffected.

- The Shining Cryptographers Net hal
- Re: The Shining Cryptographers Net John Denker
- Re: The Shining Cryptographers Net Jaap-Henk Hoepman
- Re: The Shining Cryptographers Net hal
- Re: The Shining Cryptographers Net hal
- Re: The Shining Cryptographers Net John Denker
- Re: The Shining Cryptographers Net John Denker
- Re: The Shining Cryptographers Net John Denker

- Re: The Shining Cryptographers Net hal
- Re: The Shining Cryptographers Net Jaap-Henk Hoepman

- Re: The Shining Cryptographers Net hal
- Re: The Shining Cryptographers Net hal
- Re: The Shining Cryptographers Net Bill Stewart

- Re: The Shining Cryptographers Net hal
- Re: The Shining Cryptographers Net Ray Dillinger
- Re: The Shining Cryptographers Net John Denker

- Re: The Shining Cryptographers Net hal