This message analyzes the Shining Cryptographers network in terms of
how much information Eve the eavesdropper can hope to get by measuring
the photon state before and after it is rotated. See earlier messages
for more detail about how the SC Net works.
This analysis will focus on one particular kind of attack. Eve will make
measurements of the photon polarization angle as it travels through the
network and attempt to deduce information about the signals being sent
by the participants. Her measurements are analyzed as idealized "strong"
measurements; weak measurements would reduce the chance of being detected
at the cost of providing less information per measurement. We also
assume that she is measuring only the linear polarization; measuring
circular or elliptical polarization would appear to provide less useful
information. We further assume that she is only able to send a single
photon through the network; stations may be equipped with mechanisms
to prevent multiple-photon attacks. It is conceivable that more subtle
attacks are possible using advanced quantum-mechanical mechanisms.
Despite these limitations and simplifying assumptions, the data
presented here do provide concrete figures on how effective Eve can be
with an attack of this kind. Somewhat surprisingly, she can deduce a
significant amount of information with low-circulation-count networks.
Skip to the bottom to see the results, if you are not interested in the
mathematical derivation.
If we were using circulation count of 1, meaning that the photon goes
around the ring only once, Eve can easily determine whether any given
station is rotating the photon polarization, by measuring the photon state
before and after that station. The photon will be rotated either by 0
degrees or 90 degrees, and Eve can distinguish these based on whether
the second measurement has the same or the perpendicular orientation
to the first. Therefore circulation count of 1 is an easy target for
Eve (assuming she can tolerate her eavesdropping being detected with
probability approximately 1/2, as was shown earlier).
With circulation count of 2, her problem is harder. She can make
measurements before and after the station on both circulations of the
photon. Each measurement yields some information about how much the
station is rotating the photon. Combining the information from both
rotations, she can use probability theory to estimate the chances that
the station's two rotations add to an even or odd multiple of 90.
For concreteness, call the orientation into which Eve collapses the photon
before the station, vertical, or zero degrees. After the station Eve
will either measure the photon as vertical or as horizontal. The former
case is a *measured* rotation of 0 degrees, and the latter is a *measured*
rotation of 90 degrees. This does not mean that the station has rotated
by exactly this amount, but probability theory can allow us to create
a probability distribution for how much the rotation probably was.
By the physics of polarization, the probability distribution will be
proportional to cosine squared of the difference between the measured and
actual rotation. This means that if the measured rotation is 0 degrees,
the actual rotation can be expressed by a probability distribution
proportional to cos^2 of the rotation angle. If the measured rotation
is 90 degrees, the actual rotation can be expressed by a probability
distribution proportional to sin^2 of the rotation angle.
This tells Eve what the probability distribution is after each individual
measurement. In the case of a circulation count of 2, she will have
two such measurements, each giving a probability distribution for
the two angles that were used. She can use these to then calculate
the probability that the two angles sum to 90 or to 180 degrees.
(An equivalent way to say this is that the sum, modulo 180 degrees,
will be 0 or 90.) This will produce relative probabilities for the two
possible bit values being emitted by that station.
Call the probability distributions for the two measurements f0(w0) and
f1(w1), where w0 and w1 are the two rotation angles and f0 and f1 are
either cos^2 or sin^2. The probability that a given angle x is the sum
of w0 and w1 (mod 180 degrees) will be proportional to the integral from
0 to 180 degrees of f0(w)f1(x-w)dw. That is, for each possible first
angle w, the second angle must be x-w in order for them to add to x, and
the probabilty of this happening is the product of f0(w) times f1(x-w).
We want to evaluate this for x = 90 degrees and x = 0 degrees, and
compare the two results. There are a number of symmetries of cos^2 and
sin^2 which simplify this:
cos^2(0-x) = cos^2(x)
sin^2(0-x) = sin^2(x)
cos^2(90-x) = sin^2(x)
sin^2(90-x) = cos^2(x)
Putting all this together, we can consider the four possible cases for the
measured rotations. Each rotation is measured as 0 degrees or 90 degrees,
which correspond to bit values of 0 or 1. In each case we can calculate
the probability p(0) and p(1) that the station was emitting a 0 or 1 by
using the following integrands:
Measured p(0) p(1)
-------------------------------------
0 0 cos^2 cos^2 cos^2 sin^2
0 1 cos^2 sin^2 cos^2 cos^2
1 0 sin^2 cos^2 sin^2 sin^2
1 1 sin^2 sin^2 sin^2 cos^2
The p(0) and p(1) entries are integrated from 0 to 180 degrees. Note that
these are all ignoring a constant factor of proportionality, which won't
affect the final results. I calculated these manually but checked them
with Mathematica, and the results are:
Measured p(0) p(1)
-------------------------------------
0 0 3 pi / 8 1 pi / 8
0 1 1 pi / 8 3 pi / 8
1 0 1 pi / 8 3 pi / 8
1 1 3 pi / 8 1 pi / 8
Since we know that the actual rotation is either the 0 or 1 amount, the
ratios between these probabilities are the actual relative probabilities
of the two possible outcomes:
Measured p(0) p(1)
-------------------------------------
0 0 3/4 1/4
0 1 1/4 3/4
1 0 1/4 3/4
1 1 3/4 1/4
This is the final result. If we measure 0 rotations both times, there is
a 3/4 probability that the station is emitting a 0 and only 1/4 that it
is emitting a 1. The same result is true if we measure a 1 both times.
However if we get opposing results on the two measurements, there is a
3/4 chance that the station is emitting a 1.
Eve is therefore able to make a good guess about the actual data being
emitted by the particular station, with a 3/4 chance of success, when
the circulation count is 2.
Extending the analysis to larger circulation counts is similar. I will
skip the math here, and show the results (along with the ones from above):
Circulation count Highest prob Lowest prob
-------------------------------------------------
1 1 0
2 3/4 1/4
3 5/8 3/8
4 9/16 7/16
5 17/32 15/32
This is as far as I have calculated it, using Mathematica. However the
pattern is clear: the denominator multiplies by 2 each time, and the
two alternative numerators are the odd numbers which make the values
closest to 1/2.
Thus we see that each addition of one to the circulation count reduces
Eve's advantage by a factor of 2. At the same time her chance of being
caught remains about 1/2 per eavesdropping attempt. By increasing the
circulation count, the risk to Eve of gaining any specific amount of
information can therefore be made arbitrarily large.
Hal
