At 08:35 PM 1/16/01 -0800, [EMAIL PROTECTED] wrote in part:

>In some variants the photon travels around the group multiple times before
>it is measured.   Let us call this number of times the "circulation count".

1) Let C denote the circulation count.  The idea of having C>1 is very 
nice.  One can make a completely macroscopic argument (i.e. without 
invoking quantum mechanics) that Eve must tap the signal at least C times, 
once each time the signal circulates around the ring;  otherwise she knows 

2) The foregoing macroscopic result is important when combined with the 
following quantum mechanical result:

At 11:20 PM 1/17/01 -0800, [EMAIL PROTECTED] wrote in part:
>The probability that Eve's measurement will leave the result unchanged is 
>3/4, and therefore the probability that she will perturb the result is 1/4.
>each additional measurement brings us closer to a 50-50 chance
>of detection.

So by increasing the circulation count, one can make things tough for Eve.

3) OTOH, one cannot increase the circulation count without bound.  A 
real-world quantum computer would have some nonzero chance of making a 
mistake, so in the limit of a very large C it wouldn't work at all.  One 
would have to find a happy medium value for C.

4) Possibly constructive suggestion:  To describe the physics of systems 
like this, it is often helpful to use the machinery of _density matrices_.
   a) A density matrix can represent a pure quantum state, although in this 
case it doesn't tell you anything that the state vector didn't tell you.
   b) A density matrix can also represent a probabilistic combination of 
quantum states, which is something a state vector cannot do.

In the (H, V) basis, the density matrix for a pure H state is
       rho_1 =  1  0                             (1)
                0  0
while the density matrix for a pure V state is
       rho_2 =  0  0                             (2)
                0  1
and the density matrix for a state rotated by an angle x away from the H 
axis is
       rho_3 =  cos(x)cos(x)   cos(x)sin(x)      (3)
                sin(x)cos(x)   sin(x)sin(x)

It is useful to check whether the number of photons is correct.  The 
probability of a photon in _some_ polarization state is Trace(rho), and we 
immediately see that Trace(rho)=1 in the foregoing examples.

We can also check whether a given density matrix represents a pure 
state.  Trace(rho^2)=1 for a pure state.  We confirm that the foregoing 
examples represent pure states.

Using this machinery we have a nice description of what Eve does to the 
signal.  Without loss of generality we analyze things in her basis.  The 
state incoming to her eavesdropping apparatus is given by equation (3) 
above.  Assuming she makes a strong measurement, the state outgoing from 
her apparatus is
       rho_4  =  cos(x)cos(x)       0            (4)
                      0        sin(x)sin(x)
We see the off-diagonal elements have been smashed.  This still has the 
right number of photons: Tr(rho_4)=1, but it is no longer a pure state 
(except on a set of measure zero):
         Tr(rho_4^2) = cos^4(x) + sin^4(x)  =  .75 + .25 cos(4x)    (5)
which averages to 3/4 and is less than unity unless Eve happens to stumble 
onto a very lucky x value.

A more general form of equation (4) is
         rho_4 = P(h) rho_3 P(h)  +  P(v) rho_3 P(v)             (6)
where P(h) is the projection operator that projects onto Eve's horizontal 
axis, and P(v) projects onto her vertical axis.

One could also mumble something about the entropy,
         S = Trace(rho log rho)

<tirade> Note that (despite what you read in textbooks) projection 
operators have no physical implementation.  A polarizer cannot be properly 
modelled as a projection operator.  The operator is not unitary, so it 
cannot properly describe any physical device.  A nonunitary device would 
violate the Heisenberg uncertainty principle, violate the 2nd law of 
thermodynamics, violate the fluctuation/dissipation theorem, and generally 
be a Bad Thing.  Such operators may be a serviceable shorthand under some 
special assumptions (strong measurements of photon number at zero 
temperature) but you should not get too attached to them, because they will 
lead you astray if you consider weak measurements, voltage measurements, 
and/or nonzero temperatures. </tirade>


5) Eve must make a tradeoff:  decreasing the probability of detection, 
versus increasing the probability of learning something.

If she taps the ring at only a single point, she cannot learn 
anything.  This is another macroscopic (i.e. non-quantum) property of the 
algorithm, assuming we have a circulation count C>1.

Therefore let us consider the case where Eve wishes to focus her attack on 
Bob, a particular member of the ring.  This may or may not be her best 
strategy, but it is a case that we must consider.

This seems to require Eve to tap the signal 2C times:  one just upstream of 
Bob and one just downstream, for each cycle of the circulation.

6) Let us revisit this:
At 11:20 PM 1/17/01 -0800, [EMAIL PROTECTED] wrote in part:
>The probability that Eve's measurement will leave the result unchanged is 
>3/4, and therefore the probability that she will perturb the result is 1/4.

OK so far.  Then, for the case of two measurements,

>Eve's chances of perturbing the measurement have increased from
>1/4 to 3/8 by doing two measurements rather than one..... Increasing the 
>number of measurements to three reduces the chance of
>success to 9/16, with a 7/16 chance of perturbation.

That's not correct, if Eve is clever.  She can arrange that later 
measurements are correlated with the first measurement in interesting ways.

In particular, suppose she has received state rho_3 and has measured 
it.  She is about to construct her outgoing signal.  Rather than simply 
constructing an outgoing photon described by rho_4, she instead constructs 
an EPR pair of photons.  She measures the first element of the pair and 
fiddles with it to make it look like rho_4.  She feeds this one to 
Bob.  Bob rotates this one according to the algorithm and passes it along 
the ring.

Now, Eve taps the signal that Bob puts out.  Since she has kept the second 
element of the EPR pair, she can combine the two photons and make two (!) 
measurements.  This allows a perfect determination of the angle of rotation 
that Bob imparted to the signal;  it inflicts no additional entropy.

 From Eve's point of view, this is a better tapping strategy than simply 
making multiple independent measurements.  To analyze the strength of the 
Shining Cryptographers algorithm, we must consider advanced tapping 
strategies such as this.


7) Nitpick:
At 11:20 PM 1/17/01 -0800, [EMAIL PROTECTED] remarked parenthetically:
>(Note: Eve can also use a circular polarization basis, but that only
>adds an imaginary factor to the coefficients, and since we are taking
>the square of the norm of the coefficient to get our probabilities,
>the imaginary term is irrelevant for these calculations.)

Actually, circular polarization does make a difference.  Operationally, it 
is equivalent to a worst-case choice of the angle x (i.e. x=45 degrees) so 
it is markedly worse than an average x value.  However, we can assume that 
Eve would not bother with such an inferior strategy, so if we just ignore 
the foregoing parenthetical remark the other parts of the note are unaffected.

Reply via email to