This message analyzes the Shining Cryptographers network in terms of how much information Eve the eavesdropper can hope to get by measuring the photon state before and after it is rotated. See earlier messages for more detail about how the SC Net works. This analysis will focus on one particular kind of attack. Eve will make measurements of the photon polarization angle as it travels through the network and attempt to deduce information about the signals being sent by the participants. Her measurements are analyzed as idealized "strong" measurements; weak measurements would reduce the chance of being detected at the cost of providing less information per measurement. We also assume that she is measuring only the linear polarization; measuring circular or elliptical polarization would appear to provide less useful information. We further assume that she is only able to send a single photon through the network; stations may be equipped with mechanisms to prevent multiple-photon attacks. It is conceivable that more subtle attacks are possible using advanced quantum-mechanical mechanisms. Despite these limitations and simplifying assumptions, the data presented here do provide concrete figures on how effective Eve can be with an attack of this kind. Somewhat surprisingly, she can deduce a significant amount of information with low-circulation-count networks. Skip to the bottom to see the results, if you are not interested in the mathematical derivation. If we were using circulation count of 1, meaning that the photon goes around the ring only once, Eve can easily determine whether any given station is rotating the photon polarization, by measuring the photon state before and after that station. The photon will be rotated either by 0 degrees or 90 degrees, and Eve can distinguish these based on whether the second measurement has the same or the perpendicular orientation to the first. Therefore circulation count of 1 is an easy target for Eve (assuming she can tolerate her eavesdropping being detected with probability approximately 1/2, as was shown earlier). With circulation count of 2, her problem is harder. She can make measurements before and after the station on both circulations of the photon. Each measurement yields some information about how much the station is rotating the photon. Combining the information from both rotations, she can use probability theory to estimate the chances that the station's two rotations add to an even or odd multiple of 90. For concreteness, call the orientation into which Eve collapses the photon before the station, vertical, or zero degrees. After the station Eve will either measure the photon as vertical or as horizontal. The former case is a *measured* rotation of 0 degrees, and the latter is a *measured* rotation of 90 degrees. This does not mean that the station has rotated by exactly this amount, but probability theory can allow us to create a probability distribution for how much the rotation probably was. By the physics of polarization, the probability distribution will be proportional to cosine squared of the difference between the measured and actual rotation. This means that if the measured rotation is 0 degrees, the actual rotation can be expressed by a probability distribution proportional to cos^2 of the rotation angle. If the measured rotation is 90 degrees, the actual rotation can be expressed by a probability distribution proportional to sin^2 of the rotation angle. This tells Eve what the probability distribution is after each individual measurement. In the case of a circulation count of 2, she will have two such measurements, each giving a probability distribution for the two angles that were used. She can use these to then calculate the probability that the two angles sum to 90 or to 180 degrees. (An equivalent way to say this is that the sum, modulo 180 degrees, will be 0 or 90.) This will produce relative probabilities for the two possible bit values being emitted by that station. Call the probability distributions for the two measurements f0(w0) and f1(w1), where w0 and w1 are the two rotation angles and f0 and f1 are either cos^2 or sin^2. The probability that a given angle x is the sum of w0 and w1 (mod 180 degrees) will be proportional to the integral from 0 to 180 degrees of f0(w)f1(x-w)dw. That is, for each possible first angle w, the second angle must be x-w in order for them to add to x, and the probabilty of this happening is the product of f0(w) times f1(x-w). We want to evaluate this for x = 90 degrees and x = 0 degrees, and compare the two results. There are a number of symmetries of cos^2 and sin^2 which simplify this: cos^2(0-x) = cos^2(x) sin^2(0-x) = sin^2(x) cos^2(90-x) = sin^2(x) sin^2(90-x) = cos^2(x) Putting all this together, we can consider the four possible cases for the measured rotations. Each rotation is measured as 0 degrees or 90 degrees, which correspond to bit values of 0 or 1. In each case we can calculate the probability p(0) and p(1) that the station was emitting a 0 or 1 by using the following integrands: Measured p(0) p(1) ------------------------------------- 0 0 cos^2 cos^2 cos^2 sin^2 0 1 cos^2 sin^2 cos^2 cos^2 1 0 sin^2 cos^2 sin^2 sin^2 1 1 sin^2 sin^2 sin^2 cos^2 The p(0) and p(1) entries are integrated from 0 to 180 degrees. Note that these are all ignoring a constant factor of proportionality, which won't affect the final results. I calculated these manually but checked them with Mathematica, and the results are: Measured p(0) p(1) ------------------------------------- 0 0 3 pi / 8 1 pi / 8 0 1 1 pi / 8 3 pi / 8 1 0 1 pi / 8 3 pi / 8 1 1 3 pi / 8 1 pi / 8 Since we know that the actual rotation is either the 0 or 1 amount, the ratios between these probabilities are the actual relative probabilities of the two possible outcomes: Measured p(0) p(1) ------------------------------------- 0 0 3/4 1/4 0 1 1/4 3/4 1 0 1/4 3/4 1 1 3/4 1/4 This is the final result. If we measure 0 rotations both times, there is a 3/4 probability that the station is emitting a 0 and only 1/4 that it is emitting a 1. The same result is true if we measure a 1 both times. However if we get opposing results on the two measurements, there is a 3/4 chance that the station is emitting a 1. Eve is therefore able to make a good guess about the actual data being emitted by the particular station, with a 3/4 chance of success, when the circulation count is 2. Extending the analysis to larger circulation counts is similar. I will skip the math here, and show the results (along with the ones from above): Circulation count Highest prob Lowest prob ------------------------------------------------- 1 1 0 2 3/4 1/4 3 5/8 3/8 4 9/16 7/16 5 17/32 15/32 This is as far as I have calculated it, using Mathematica. However the pattern is clear: the denominator multiplies by 2 each time, and the two alternative numerators are the odd numbers which make the values closest to 1/2. Thus we see that each addition of one to the circulation count reduces Eve's advantage by a factor of 2. At the same time her chance of being caught remains about 1/2 per eavesdropping attempt. By increasing the circulation count, the risk to Eve of gaining any specific amount of information can therefore be made arbitrarily large. Hal

- Re: The Shining Cryptographers Net hal
- Re: The Shining Cryptographers Net Jaap-Henk Hoepman

- Re: The Shining Cryptographers Net hal
- Re: The Shining Cryptographers Net hal
- Re: The Shining Cryptographers Net Bill Stewart

- Re: The Shining Cryptographers Net hal
- Re: The Shining Cryptographers Net Ray Dillinger
- Re: The Shining Cryptographers Net John Denker

- Re: The Shining Cryptographers Net hal
- Re: The Shining Cryptographers Net hal
- Re: The Shining Cryptographers Net hal
- Re: The Shining Cryptographers Net John Denker

- Re: The Shining Cryptographers Net hal