2 3 S ep 2 01 6 A Comment on the One Step Quantum Key Distribution Based on EPR Entanglement

Recently, in Sci. Rep. 6 (2016) 28767, Li et al., have proposed a scheme for quantum key distribution using Bell states. This comment provides a proof that the proposed scheme of Li et al., is insecure as it involves leakage of information. Further, it is also shown that all the error rates computed in the Li et al.’s paper are incorrect as the authors failed to recognize the fact that any eavesdropping effort will lead to entanglement swapping. Finally, it is established that Li et al.’s scheme can be viewed as an incrementally (but incorrectly) modified version of the existing schemes based on Goldenberg Vaidman (GV) subroutine. Recently, Li et al. 1 have proposed a one step scheme for quantum key distribution (QKD) using a Bell states. The scheme is not secure and the claims made by the authors unfortunatel y appear to be inaccurate for various reasons as elaborated i n this comment. Firstly, they claimed their scheme to be novel and tried to support their claim by stating “Compared with the “Pingpong” protocol involving two steps, the proposed p rotocol does not need to store the qubit and only involves one step”. This is a comparison of an apple with an orange, as the P ingpong protocol is designed for quantum secure direct communication (QSDC), where information can be transmitte d using quantum resources without the prior generation of ke ys. Naturally, a scheme of QKD should not be compared with a schem e of QSDC. To visualize the naiveness of their claim and part of the exercises followed in their paper, one may note th at even the well known BB84 2 and B923 protocols for QKD do not require quantum memory, if one wishes to design BB84 type scheme using EPR states, Alice can simply prepare some copies of Bell states (say |φ+〉 = 1 √ 2 (|00〉+ |11〉) = 1 √ 2 (|++〉+ |−−〉), and send the second qubits of all the Bell pairs to Bob, who subsequently randomly measures his qubit in X basis orZ basis. Alice also performs the same measurement and they keep all those cases where the measurement basis use d by them are the same. For eavesdropping check they may compare half the results, if no signature for eavesdropping is found their key will be exactly correlated. A scheme equiv alent to this scheme, which is one step and uses EPR state, is discus sed by some of the present authors as Protocol 2 in, 4 where to increase the efficiency, Bob used to announce his basis and Al ice used to subsequently measure in the same basis. However, such a scheme is neither efficient (as it uses costly quantum r esou ce, like entanglement, which is not required) nor nove l (as the scheme is equivalent to BB84). The one step EPR-based sch me proposed by Li et al., is slightly different from this simple minded EPR-based one step scheme of QKD described abo ve s in this case Bob performs Bell measurement. In what follows we would show that security of such a scheme appears f rom entanglement swapping. Unfortunately, Li et al., misse d this point and analyzed the security of their protocol in ana logy with BB84 scheme, and naturally such an incorrect analy sis led to incorrect values of error rates. Before, we continue w ith our comments and analysis, for the sake of completeness o f this comment, we would like to briefly describe Li et al.’s pro tocol. Analysis of Li et al.’s protocol Let us first summarize the first QKD protocol of Li et al., which requires memory. In fact, the protocol is nothing but a DSQC protocol proposed in the recent past by some of the prese nt authors, 5 where Alice is sending random bits instead of a meaningful message. Specifically, Alice prepares a Bell sta te corresponding to each 2-bits of her key, i.e., |φ+〉, |φ−〉, |ψ+〉 and|ψ−〉 for sending 00, 01, 10, 11, respectively. This can also be vie wed as Alice preparing2 copies of|φ+〉 and applying Pauli operationsI, Z, X and iY to encode 00, 01, 10, 11, respectively. Subsequently, she pe rmut s the string of encoded particles and sends it to Bob, who uses memory to store the qub its other than decoy qubits. They proceed for final key generation only if the channel is ensured safe. It is worth no ting here that a QKD protocol can be modified to a direct communication protocol by incorporating memory, whereas a direct communication protocol can always be converted to a QKD protocol if the sender sends random key rather sending a m eaningful message. The second protocol is a modification of the first protocol to c ircumvent the use of memory. Specifically, the authors tried