Standard quantum key distribution protocols are provably secure against eavesdropping attacks, if quantum theory is correct. It is theoretically interesting to know if we need to assume the validity of quantum theory to prove the security of quantum key distribution, or whether its security can be based on other physical principles. The question would also be of practical interest if quantum mechanics were ever to fail in some regime, because a scientifically and technologically advanced eavesdropper could perhaps use post-quantum physics to extract information from quantum communications without necessarily causing the quantum state disturbances on which existing security proofs rely. Here we describe a key distribution scheme provably secure against general attacks by a post-quantum eavesdropper who is limited only by the impossibility of superluminal signalling. The security of the scheme stems from violation of a Bell inequality. With the discoveries of quantum cryptography [1] and quantum key distribution [2, 3] , it is now well understood that cryptographic tasks can be guaranteed secure by physical principles. For example, we now have protocols for various important tasks, including key distribution, that are provably secure provided quantum theory is correct [4] . Protocols for bit commitment have been developed with security based only on the impossibility of superluminal signalling [5, 6] . The possibility of basing cryptographic security on known superselection rules has also recently been discussed [7, 8] . In this paper we investigate whether it is possible to devise a quantum key distribution scheme that is provably secure if superluminal signalling is impossible. We allow for eavesdroppers who can break the laws of quantum mechanics, as long as nothing they can do implies the possibility of superluminal signalling. In general, this will mean that the security proofs of existing quantum key distribution protocols are no longer valid, as we can no longer assume that quantum theory correctly predicts the tradeoff between the information that Eve can extract and the disturbance she must necessarily cause. As we show below, there is an intimate connection between the possibility of such a protocol and the violation of a Bell inequality [9, 10] . Non-local (in the sense of Bell inequality violating) correlations constitute an exploitable resource for this task, just as entanglement is a resource for conventional quantum key distribution. We present a quantum scheme, involving Bell violation, that is secure against general attacks by a non-signalling Eve. One motivation for this work is practical: existing security proofs assume the validity of quantum theory, and while quantum theory has been confirmed in an impressive range of experiments, it remains plausible that some future experiment will demonstrate a limit to its domain of validity. Admittedly, it is also conceivable that some future experiment could demonstrate the possibility of superluminal signalling. But the possibilities are logically independent: quantum theory could fail without violating standard relativistic causality, and vice versa. A cryptographic scheme that can be guaranteed secure by either of two physical principles is more trustworthy than one whose security relies entirely on one. There are also compelling theoretical motivations. Understanding which cryptographic tasks can be guaranteed secure by which physical principles improves our understanding of the relationship between information theory and physical theory. Our work also demonstrates a new way of proving security for quantum protocols, which may be useful in other contexts, and sheds new light on non-locality and its relation to secrecy. We assume that Alice and Bob have a noise-free quantum channel and an authenticated classical channel. Consider the following protocol, which we show below generates a single shared secret bit, guaranteed secure against general attacks by post-quantum eavesdroppers. Define the bases X r = {cos rπ 2N |0 + sin rπ 2N |1 , − sin rπ 2N |0 + cos rπ 2N |1 } for integer r. For each basis, we define outcomes 0 and 1 to correspond respectively to the projections onto the first and second basis elements. Thus X r+N contains the same basis states as X r with the outcome conventions reversed; i.e. we inter-
Barrett, Hardy, and Kent have shown in REF a protocol for QKD which is based only on the assumption that Alice and Bob cannot signal to each other.
No Signalling and Quantum Key Distribution
Phys. Rev. Lett. 95, 010503 (2005)
Medicine Physics Computer Science