Distinguishability and Disturbance in the Quantum Key Distribution Protocol Using the Mean Multi-Kings’ Problem

Abstract

We introduce a quantum key distribution protocol using mean multi-kings’ problem. Using this protocol, a sender can share a bit sequence as a secret key with receivers. We consider a relation between information gain by an eavesdropper and disturbance contained in legitimate users’ information. In BB84 protocol, such relation is known as the so-called information disturbance theorem. We focus on a setting that the sender and two receivers try to share bit sequences and the eavesdropper tries to extract information by interacting legitimate users’ systems and an ancilla system. We derive trade-off inequalities between distinguishability of quantum states corresponding to the bit sequence for the eavesdropper and error probability of the bit sequence shared with the legitimate users. Our inequalities show that eavesdropper’s extracting information regarding the secret keys inevitably induces disturbing the states and increasing the error probability.

1. Introduction

In the quantum state discrimination problems, one tries to discriminate the quantum states by performing the single measurement. Several strategies exist, e.g., in [1,2,3] and Section 9.1.4 in [4]. On the other hand, in the mean-king’s problem [5], one can use not the single measurement but also post-information. Specific setting of the mean-king’s problem is often told as a tale [6] of a king and a physicist Alice. In the tale, Alice prepares a qubit in an initial state at first. The king performs a measurement with one of observables ${\sigma }_x,{\sigma }_y,{\sigma }_z$ on the qubit and obtains an outcome. Then, Alice obtains an outcome by performing a measurement on the qubit. After the measurement, the king reveals the observable he has measured as the post-information. Then, Alice tries to guess king’s outcome by using her outcome and the post-information. A solution to the problem is a pair of the initial state and Alice’s measurement such that she can guess king’s outcome correctly. Using Aharonov–Bergman–Lebowitz rule [7], a solution which consists of Bell state and a measurement on a bipartite system has been shown [5]. As an application of the solution to the mean-king’s problem, a quantum key distribution protocol (QKD) has been shown [8]. In this protocol, Alice and the king employ the guessing result as a secret key, and security analysis of the protocol has been considered [8,9,10,11].

A QKD protocol by using mean multi-kings’ problem has been shown [12] (see Section 2 for details). In this protocol, Alice and kings (called King${}_1$, King${}_2$, …, King${}_n$) are legitimate users. Alice guesses each king’s measurement outcome by using her measurement outcome and post-information from each king; then, each guessing result is shared as a secret key between Alice and each king. The protocol has superior aspects, such as the number of measurements, state preparation and key discarding, to several realizations (whose components are the QKD protocol by using the mean-king’s problem or BB84 protocol [13]) for Alice and each king to share the secret key. In the case of $n=2$, security analysis against a simple attack so called intercept-resend attack has been considered and error rate of bits shared between Alice and the kings has been shown.

In this paper, we consider a relation between information gain by an eavesdropper (called Eve) and disturbance contained in the legitimate users’ information in the QKD protocol by using the mean multi-kings’ problem. In BB84 protocol, such relation is known as the so-called information disturbance theorem [14,15,16,17,18]. According to the theorem, Eve’s information gain in a basis inevitably induces disturbance contained in the legitimate users’ information in the conjugate basis. Therefore, the theorem is also regarded as an information theoretical version of the uncertainty relation. The theorem also plays an important role in the proof of the unconditional security [19]. We consider that Eve tries to extract information by employing an attack which she performs any measurement on her quantum system at any time after interacting the quantum system with kings’ qubits after their measurements in the case of $n=2$. In this setting, we give trade-off inequalities between distinguishability of quantum states corresponding to the bit sequences for Eve and error probability of the bit sequences shared with Alice and the kings. Our inequalities show that Eve’s extracting information regarding the secret keys inevitably induces disturbing the states of kings’ qubits and increasing the error probability even though the post-information and Alice’s qubit are used in the guessing step, unlike BB84 protocol.

This paper is organized as follows. In the next section, we review a description of the quantum key distribution protocol by using the mean multi-kings’ problem. In Section 3, we give the description of the protocol in the case of $n=2$. In Section 4, we give the outline of the attack and the trade-off inequalities between distinguishability and disturbance. Finally, we summarize this paper in Section 5.

2. Protocol

Let us start by introducing the essence of the mean multi-kings’ problem and the QKD by using it. Alice and King${}_1$, King${}_2$, …, King${}_n$ are the characters in this problem. The problem can be summarized as follows. Alice prepares a composite system, which consists of her system and n systems for kings, in an initial state. Each king performs a measurement on his system and obtains an outcome. After kings’ measurement, Alice performs a measurement on the composite system and obtains an outcome. Furthermore, each king reveals post-information: the measurement type he has performed. Immediately, Alice guesses kings’ outcomes by using her outcome and the post-information from each king. A solution to the problem is defined as a three-tuple of the initial state, Alice’s measurement, and a guessing function such that she can guess kings’ outcomes correctly. In this problem, the initial state will be changed depending on the kings’ measurements and outcomes. In general, it is impossible to distinguish the changed states correctly. Therefore, Alice tries to get some potential answers by performing the measurement and to narrow down the correct outcome from them by using the guessing function of her outcome and the post-information.

We can construct the QKD protocol by using a setting of the mean multi-kings’ problem and a solution to it, i.e., Alice and each king share the guessing result as a secret key. Figure 1 is a graphically demonstrated protocol. Let us consider a setting that Alice prepares a composite system which consists of $n+1$ qubits and each king performs one of two fixed measurements on his qubit. Then, two solutions where the initial states are multipartite entangled states can be shown as described below; therefore, we can also construct the QKD protocol by using those solutions. In the QKD, Alice and each king try to share secret keys while she switches the solutions.

Before introducing details of the QKD protocol, we introduce some preliminary definitions, the setting of the mean multi-kings’ problem, and the solutions to it. Define

$$Z_0:=|0\rangle \langle 0|,Z_1:=|1\rangle \langle 1|,X_0:=|\overline{0}\rangle \langle \overline{0}|,X_1:=|\overline{1}\rangle \langle \overline{1}|$$

(1)

for $|0\rangle :={(1,0)}^T,|1\rangle :={(0,1)}^T,|\overline{0}\rangle :=\frac{1}{\sqrt{2}}{(1,1)}^T,|\overline{1}\rangle :=\frac{1}{\sqrt{2}}{(1,-1)}^T$. Define an outcome set

$$\mathcal{K}:=\{(s_1,t_1,s_2,t_2,\dots ,s_n,t_n)\mid s_j,t_j\in \{0,1\}\},$$

(2)

operators for $(s_1,t_1,s_2,t_2,\dots ,s_n,t_n)\in \mathcal{K}$

$$\begin{array}{ccc}\hfill E_{(s_1,t_1,s_2,t_2,\dots ,s_n,t_n)}^{(Z)}& :=& X_{s_1}{Z}_{t_1}\otimes X_{s_2}{Z}_{t_2}\otimes \cdots \otimes X_{s_n}{Z}_{t_n},\hfill \end{array}$$

(3)

$$\begin{array}{ccc}\hfill E_{(s_1,t_1,s_2,t_2,\dots ,s_n,t_n)}^{(X)}& :=& Z_{s_1}{X}_{t_1}\otimes Z_{s_2}{X}_{t_2}\otimes \cdots \otimes Z_{s_n}{X}_{t_n},\hfill \end{array}$$

(4)

and an index set

$$S_{{(J_j,i_j)}_{j=1}^n}^{(W)}=S_{(J_1,i_1,J_2,i_2,\dots ,J_n,i_n)}^{(W)}:=S_{(J_1,i_1)}^{(W)}\times S_{(J_2,i_2)}^{(W)}\times \cdots \times S_{(J_n,i_n)}^{(W)}$$

(5)

($W\in \{Z,X\}$) which consists of direct product of

$$\begin{array}{c}\hfill S_{(J,i)}^{(Z)}:=\left\{\begin{array}{c}\{(0,i),(1,i)\}(J=0,i\in \{0,1\})\hfill \\ \{(i,0),(i,1)\}(J=1,i\in \{0,1\}),\hfill \end{array}\right.\end{array}$$

(6)

$$\begin{array}{c}\hfill S_{(J,i)}^{(X)}:=\left\{\begin{array}{c}\{(i,0),(i,1)\}(J=0,i\in \{0,1\})\hfill \\ \{(0,i),(1,i)\}(J=1,i\in \{0,1\}).\hfill \end{array}\right.\end{array}$$

(7)

We define the setting of the mean multi-kings’ problem. Alice prepares the composite system ($n+1$ qubits) $\tilde{\mathcal{H}}:={\mathcal{H}}_A\otimes {\mathcal{H}}_{K_1}\otimes {\mathcal{H}}_{K_2}\otimes \cdots \otimes {\mathcal{H}}_{K_n}\simeq {({\mathbb{C}}^2)}^{\otimes n+1}$ in an initial state. Each King${}_j$ performs one of the measurements on ${\mathcal{H}}_{K_j}$

$$\begin{array}{c}\hfill M^{(J_j)}=(M_0^{(J_j)},M_1^{(J_j)})(J_j\in \{0,1\}),\end{array}$$

(8)

where $M^{(0)}:=(M_0^{(0)}:=Z_0,M_1^{(0)}:=Z_1)$ and $M^{(1)}:=(M_0^{(1)}:=X_0,M_1^{(1)}:=X_1)$, and obtains an outcome $i_j\in \{0,1\}$. Alice performs a measurement on $\tilde{\mathcal{H}}$ and obtains an outcome. After Alice’s measurement, the kings reveal ${(J_j)}_{j=1}^n$ as the post-information. Then, Alice tries to guess kings’ outcomes by using her outcome and the post-information.

Here, we show two solutions to the problem. In this case, Alice can guess the kings’ outcomes correctly by employing one of

$$\begin{array}{c}\hfill |{\Phi }^{(Z)}\rangle :=\frac{1}{\sqrt{2}}(|00\cdots 0\rangle +|11\cdots 1\rangle )\end{array}$$

(9)

$$\begin{array}{c}\hfill |{\Phi }^{(X)}\rangle :=\frac{1}{\sqrt{2}}(|\overline{0}\overline{0}\cdots \overline{0}\rangle +|\overline{1}\overline{1}\cdots \overline{1}\rangle )\end{array}$$

(10)

as an initial state, a measurement depending on the initial state $|{\Phi }^{(W)}\rangle$

$$P^{(W)}:={\left(P_k^{(W)}:=2^{n+1}|(\mathbb{I}\otimes E_k^{(W)}){\Phi }^{(W)}\rangle \langle (\mathbb{I}\otimes E_k^{(W)}){\Phi }^{(W)}|\right)}_{k\in \mathcal{K}}$$

(11)

and a guessing function $s(k,{(J_j)}_{j=1}^n,{\Phi }^{(W)})$ of her outcome $k\in \mathcal{K}$, the post-information ${(J_j)}_{j=1}^n$, and the initial state $|{\Phi }^{(W)}\rangle$, where $s(k,{(J_j)}_{j=1}^n,{\Phi }^{(W)})$ is defined as ${(i_j)}_{j=1}^n$ satisfying $k\in S_{{(J_j,i_j)}_{j=1}^n}^{(W)}$ (we regard $k=(s_1,t_1,s_2,t_2,\dots ,s_n,t_n)$ in the same light as $((s_1,t_1),(s_2,t_2),\dots ,(s_n,t_n))$).

We clear the number of non-zero matrices in her measurement and their orthogonality. We can observe

$$\begin{array}{ccc}|(\mathbb{I}\otimes E_k^{(Z)}){\Phi }^{(Z)}\rangle \hfill & =\hfill & (\mathbb{I}\otimes X_{s_1}{Z}_{t_1}\otimes \cdots \otimes X_{s_n}{Z}_{t_n})\frac{1}{\sqrt{2}}(|00\cdots 0\rangle +|11\cdots 1\rangle )\hfill \\ \hfill & =\hfill & \frac{1}{\sqrt{2}}({\delta }_{t_{1}0}\cdots {\delta }_{t_{n}0}|0\rangle X_{s_1}|0\rangle \otimes X_{s_2}|0\rangle \otimes \cdots \otimes X_{s_n}|0\rangle \hfill \\ \hfill & \hfill & +{\delta }_{t_{1}1}\cdots {\delta }_{t_{n}1}|1\rangle \otimes X_{s_1}|1\rangle \otimes X_{s_2}|1\rangle \otimes \cdots \otimes X_{s_n}|1\rangle ).\hfill \end{array}$$

(12)

Then, the number of non-zero vectors is equal to $2^{n+1}$. It leads to the conclusion that the number of non-zero matrices in $P^{(Z)}$ is equal to $2^{n+1}$. Furthermore, we observe

$$\begin{array}{ccc}\hfill & \hfill & \langle (\mathbb{I}\otimes E_k^{(Z)}){\Phi }^{(Z)}|(\mathbb{I}\otimes E_{k^{\prime }}^{(Z)}){\Phi }^{(Z)}\rangle \hfill \\ \hfill & =\hfill & \langle (\mathbb{I}\otimes X_{s_1}{Z}_{t_1}\otimes \cdots \otimes X_{s_n}{Z}_{t_n}){\Phi }^{(Z)}|(\mathbb{I}\otimes X_{s_1^{\prime }}{Z}_{t_1^{\prime }}\otimes \cdots \otimes X_{s_n^{\prime }}{Z}_{t_n^{\prime }}){\Phi }^{(Z)}\rangle \hfill \\ \hfill & =\hfill & \frac{1}{2^{n+1}}({\delta }_{t_{1}0}{\delta }_{t_{2}0}\cdots {\delta }_{t_{n}0}+{\delta }_{t_{1}1}{\delta }_{t_{2}1}\cdots {\delta }_{t_{n}1}){\delta }_{k{k}^{\prime }}.\hfill \end{array}$$

(13)

It implies that $P^{(Z)}$ is an orthogonal measurement on $\tilde{\mathcal{H}}$. When Z is switched to X, we have the same result in the case of $W=X$.

Next, we show that Alice can correctly guess kings’ outcomes. We observe

$$\begin{array}{c}\hfill S_{{(J_j,i_j)}_{j=1}^n}^{(W)}\cap S_{{(J_j,i_j^{\prime })}_{j=1}^n}^{(W)}=\varnothing \end{array}$$

(14)

for any $J_j$ and $(i_1,i_2,\dots ,i_n)\ne (i_1^{\prime },i_2^{\prime },\dots ,i_n^{\prime })$, and

$$\begin{array}{c}\hfill M_{i_1}^{(J_1)}\otimes M_{i_2}^{(J_2)}\otimes \cdots \otimes M_{i_n}^{(J_n)}=\sum _{k\in S_{{(J_j,i_j)}_{j=1}^n}^{(W)}}{E}_k^{(W)}\end{array}$$

(15)

holds for any $J_j$ and $i_j$. When King${}_j$ performs the measurement $M^{(J_j)}$ and obtains an outcome $i_j$, by Equation (15), the post-measurement state is proportional to

$$\begin{array}{c}\hfill |(\mathbb{I}\otimes M_{i_1}^{(J_1)}\otimes M_{i_2}^{(J_2)}\otimes \cdots \otimes M_{i_n}^{(J_n)}){\Phi }^{(W)}\rangle \in \underset{k\in S_{{(J_j,i_j)}_{j=1}^n}^{(W)}}{⨁}{\mathcal{A}}_k,\end{array}$$

(16)

where ${\mathcal{A}}_k$ is a subspace spanned by $|(\mathbb{I}\otimes E_k^{(W)}){\Phi }^{(W)}\rangle$. ${\mathcal{A}}_k$ and ${\mathcal{A}}_{k^{\prime }}$ are orthogonal for any $k\ne k^{\prime }$ and $P^{(W)}$ is composed of orthogonal projections onto each subspace ${\mathcal{A}}_k$ by Equation (13). If Alice obtains an outcome k by performing $P^{(W)}$ and the post-information ${(J_j)}_{j=1}^n$ from the kings, then kings’ outcomes ${(i_j)}_{j=1}^n$ should satisfy $k\in S_{{(J_j,i_j)}_{j=1}^n}^{(W)}$. However, by Equation (14), such ${(i_j)}_{j=1}^n$ uniquely exists. Thus, Alice can correctly guess kings’ outcomes.

A description of the QKD protocol by using the mean multi-kings’ problem is as follows.

• Alice prepares a composite system ($n+1$ qubits) $\tilde{\mathcal{H}}={\mathcal{H}}_A\otimes {\mathcal{H}}_{K_1}\otimes {\mathcal{H}}_{K_2}\otimes \cdots \otimes {\mathcal{H}}_{K_n}\simeq {({\mathbb{C}}^2)}^{\otimes n+1}$ in the initial state $|{\Phi }^{(W)}\rangle$ ($W\in \{Z,X\}$) with probability $\frac{1}{2}$. Then, she sends the qubit ${\mathcal{H}}_{K_j}$ to King${}_j$ ($j=1,2,\dots ,n$).
• Each King${}_j$ performs the measurement $M^{(J_j)}=(M_0^{(J_j)},M_1^{(J_j)})$ ($J_j\in \{0,1\}$) with probability $\frac{1}{2}$ on ${\mathcal{H}}_{K_j}$ and obtains an outcome $i_j\in \{0,1\}$. After the measurement, each King${}_j$ returns ${\mathcal{H}}_{K_j}$ to Alice.
• Alice performs the measurement $P^{(W)}={(P_k^{(W)})}_{k\in \mathcal{K}}$ ($W\in \{Z,X\}$) on $\tilde{\mathcal{H}}$ when the initial state was $|{\Phi }^{(W)}\rangle$. Then, she obtains an outcome $k\in \mathcal{K}$.
• After the measurement, each King${}_j$ announces post-information $J_j$ to Alice.
• Alice obtains a sequence $s(k,{(J_j)}_{j=1}^n,{\Phi }^{(W)})$ from the outcome k, the post-information ${(J_j)}_{j=1}^n$, and the initial state $|{\Phi }^{(W)}\rangle$.
• They repeat the above process. After that, Alice randomly chooses sequences ${(i_j^{\prime 1})}_{j=1}^n,{(i_j^{\prime 2})}_{j=1}^n,\dots ,{(i_j^{\prime r})}_{j=1}^n$ from all sequences. Similarly, kings work together to choose sequences ${(i_j^1)}_{j=1}^n,{(i_j^2)}_{j=1}^n,\dots ,{(i_j^r)}_{j=1}^n$ which are the same positions as the positions Alice chose. Then, Alice and kings work together to calculate error rate $\frac{{\sum }_{u=1}^r(1-{\delta }_{{(i_j^{\prime u})}_{j=1}^n{(i_j^u)}_{j=1}^n})}{r}$.

The rest of the process is the same as for ordinary QKD protocols, such as BB84 protocol. If the error rate is too large, the protocol is aborted. Otherwise, the leftover sequences are performed with error-correction and privacy amplification [20].

Remark that Alice and each King${}_j$ can share the secret key when they employ the QKD protocol using the mean-king’s problem or BB84 protocol. In the case of employing the QKD using the mean-king’s problem (see left hand side of Figure 2), Alice prepares 2 qubits in the Bell state and performs a single measurement on the 2 qubits for each King${}_j$. Therefore, she needs to prepare $2n$ qubits and perform n measurements to share the secret key with n kings. On the other hand, in the QKD protocol using the mean multi-kings’ problem, Alice only prepares $n+1$ qubits in $|{\Phi }^{(Z)}\rangle$ or $|{\Phi }^{(X)}\rangle$ and performs the single measurement $P^{(Z)}$ or $P^{(X)}$. In the case where the BB84 protocol is employed (see right hand side of Figure 2), Alice just prepares n qubits in one of the states $|0\rangle ,|1\rangle ,|\overline{0}\rangle ,|\overline{1}\rangle$ and no performing the measurement is required. Then, Alice and King${}_j$ discard the raw key where their bases do not match before calculating error rate. On the other hand, in the QKD protocol using the mean multi-kings’ problem, there is not such discarding step before calculating error rate.

3. Protocol: n = 2

We describe the working of the protocol in the case of $n=2$ by focusing on the case of $W=Z$ to reduce cumbersome notations.

By Equation (2), the index set takes the following form,

$$\mathcal{K}=\{(s_1,t_1,s_2,t_2)\mid s_j,t_j\in \{0,1\}\}.$$

(17)

And by Equation (3), the operator $E_k^{(Z)}$ for $k\in \mathcal{K}$ takes the following form,

$$E_k^{(Z)}=E_{(s_1,t_1,s_2,t_2)}^{(Z)}=X_{s_1}{Z}_{t_1}\otimes X_{s_2}{Z}_{t_2}(k=(s_1,t_1,s_2,t_2)\in \mathcal{K}).$$

(18)

Similarly, we can observe the operators for $W=X$. By Equation (5), we observe the index sets $S_{(J_1,i_1,J_2,i_2)}^{(W)}$ for $J_1=0,J_2=0,i_1,i_2\in \{0,1\}$, and $W=Z$:

$$\begin{array}{ccc}\hfill S_{(0,0,0,0)}^{(Z)}& =& S_{(0,0)}^{(Z)}\times S_{(0,0)}^{(Z)}\hfill \\ & =& \{((0,0),(0,0)),((0,0),(1,0)),((1,0),(0,0)),((1,0),(1,0))\}\hfill \\ & =& \{(0,0,0,0),(0,0,1,0),(1,0,0,0),(1,0,1,0)\}\hfill \end{array}$$

(19)

$$\begin{array}{ccc}\hfill S_{(0,0,0,1)}^{(Z)}& =& S_{(0,0)}^{(Z)}\times S_{(0,1)}^{(Z)}\hfill \\ & =& \{((0,0),(0,1)),((0,0),(1,1)),((1,0),(0,1)),((1,0),(1,1))\}\hfill \\ & =& \{(0,0,0,1),(0,0,1,1),(1,0,0,1),(1,0,1,1)\}\hfill \end{array}$$

(20)

$$\begin{array}{ccc}\hfill S_{(0,1,0,0)}^{(Z)}& =& S_{(0,1)}^{(Z)}\times S_{(0,0)}^{(Z)}\hfill \\ & =& \{((0,1),(0,0)),((0,1),(1,0)),((1,1),(0,0)),((1,1),(1,0))\}\hfill \\ & =& \{(0,1,0,0),(0,1,1,0),(1,1,0,0),(1,1,1,0)\}\hfill \end{array}$$

(21)

$$\begin{array}{ccc}\hfill S_{(0,1,0,1)}^{(Z)}& =& S_{(0,1)}^{(Z)}\times S_{(0,1)}^{(Z)}\hfill \\ & =& \{((0,1),(0,1)),((0,1),(1,1)),((1,1),(0,1)),((1,1),(1,1))\}\hfill \\ & =& \{(0,1,0,1),(0,1,1,0),(1,1,0,1),(1,1,1,1)\},\hfill \end{array}$$

(22)

where we regard $((l_1,l_2),(l_3,l_4))$ in the same light as $(l_1,l_2,l_3,l_4)$. Similarly, we can observe the index sets for other $J_1,J_2,i_1,i_2$, and W.

Let us consider that Alice prepares the qubits $\tilde{\mathcal{H}}={\mathcal{H}}_A\otimes {\mathcal{H}}_{K_1}\otimes {\mathcal{H}}_{K_2}$ in the initial state

$$|{\Phi }^{(Z)}\rangle =\frac{1}{\sqrt{2}}(|000\rangle +|111\rangle ).$$

(23)

Let us consider that King${}_1$ and King${}_2$ choose the same measurement $M^{(0)}$ and obtain the same outcome 0, i.e., $J_1=0,J_2=0$ and $i_1=0,i_2=0$. After kings’ measurement, Alice performs the measurement $P^{(Z)}={(P_k^{(Z)})}_{k\in \mathcal{K}}$ on $\tilde{\mathcal{H}}$, where

$$\begin{array}{ccc}{P}_k^{(Z)}\hfill & =\hfill & 8|(\mathbb{I}\otimes E_k^{(Z)}){\Phi }^{(Z)}\rangle \langle (\mathbb{I}\otimes E_k^{(Z)}){\Phi }^{(Z)}|r\hfill \\ \hfill & =\hfill & 8|(\mathbb{I}\otimes X_{s_1}{Z}_{t_1}\otimes X_{s_2}{Z}_{t_2}){\Phi }^{(Z)}\rangle \langle (\mathbb{I}\otimes X_{s_1}{Z}_{t_1}\otimes X_{s_2}{Z}_{t_2}){\Phi }^{(Z)}|.\hfill \end{array}$$

(24)

After the measurement, King${}_1$ and King${}_2$ announce the post-information $J_1=0$ and $J_2=0$ to Alice. When Alice obtains an outcome $k=(0,0,0,0)$, she is assured that kings’ outcome $(i_1,i_2)$ is $(0,0)$, because $(i_1,i_2)$ satisfying $k=(0,0,0,0)\in S_{(J_1,i_1,J_2,i_2)}^{(W)}=S_{(0,i_1,0,i_2)}^{(Z)}$ is $(0,0)$. In

Table 1. The relationship among kings’ measurements $J_1,J_2$, Alice’s outcome k, and kings’ outcomes $i_1,i_2$ when she chooses $|{\Phi }^{(W)}\rangle$. In this table, NA means that probability of obtaining the corresponding outcome k is zero unless Eve performs an attack because the corresponding matrix $P_k^{(W)}$ is a zero matrix. An example of Alice’s guessing: Alice is assured that kings’ outcome $(i_1,i_2)$ is $(0,0)$ when $W=Z,J_1=0,J_2=0$, and $k=(0,0,0,0)$.

$\mathit{W}=\mathit{Z},{\mathit{J}}_{\mathbf{1}}=\mathbf{0},{\mathit{J}}_{\mathbf{2}}=\mathbf{0}$		$\mathit{W}=\mathit{Z},{\mathit{J}}_{\mathbf{1}}=\mathbf{0},{\mathit{J}}_{\mathbf{2}}=\mathbf{1}$		$\mathit{W}=\mathit{Z},{\mathit{J}}_{\mathbf{1}}=\mathbf{1},{\mathit{J}}_{\mathbf{2}}=\mathbf{0}$		$\mathit{W}=\mathit{Z},{\mathit{J}}_{\mathbf{1}}=\mathbf{1},{\mathit{J}}_{\mathbf{2}}=\mathbf{1}$
$\mathit{W}=\mathit{X},{\mathit{J}}_{\mathbf{1}}=\mathbf{1},{\mathit{J}}_{\mathbf{2}}=\mathbf{1}$		$\mathit{W}=\mathit{X},{\mathit{J}}_{\mathbf{1}}=\mathbf{1},{\mathit{J}}_{\mathbf{2}}=\mathbf{0}$		$\mathit{W}=\mathit{X},{\mathit{J}}_{\mathbf{1}}=\mathbf{0},{\mathit{J}}_{\mathbf{2}}=\mathbf{1}$		$\mathit{W}=\mathit{X},{\mathit{J}}_{\mathbf{1}}=\mathbf{0},{\mathit{J}}_{\mathbf{2}}=\mathbf{0}$
$\mathit{k}$	$({\mathit{i}}_{\mathbf{1}},{\mathit{i}}_{\mathbf{2}})$	$\mathit{k}$	$({\mathit{i}}_{\mathbf{1}},{\mathit{i}}_{\mathbf{2}})$	$\mathit{k}$	$({\mathit{i}}_{\mathbf{1}},{\mathit{i}}_{\mathbf{2}})$	$\mathit{k}$	$({\mathit{i}}_{\mathbf{1}},{\mathit{i}}_{\mathbf{2}})$
$(0,0,0,0)$	$(0,0)$	$(0,0,0,0)$	$(0,0)$	$(0,0,0,0)$	$(0,0)$	$(0,0,0,0)$	$(0,0)$
$(0,0,0,1)$ NA	——	$(0,0,0,1)$ NA	——	$(0,0,0,1)$ NA	——	$(0,0,0,1)$ NA	——
$(0,0,1,0)$	$(0,0)$	$(0,0,1,0)$	$(0,1)$	$(0,0,1,0)$	$(0,0)$	$(0,0,1,0)$	$(0,1)$
$(0,0,1,1)$ NA	——	$(0,0,1,1)$ NA	——	$(0,0,1,1)$ NA	——	$(0,0,1,1)$ NA	——
$(0,1,0,0)$ NA	——	$(0,1,0,0)$ NA	——	$(0,1,0,0)$ NA	——	$(0,1,0,0)$ NA	——
$(0,1,0,1)$	$(1,1)$	$(0,1,0,1)$	$(1,0)$	$(0,1,0,1)$	$(0,1)$	$(0,1,0,1)$	$(0,0)$
$(0,1,1,0)$ NA	——	$(0,1,1,0)$ NA	——	$(0,1,1,0)$ NA	——	$(0,1,1,0)$ NA	——
$(0,1,1,1)$	$(1,1)$	$(0,1,1,1)$	$(1,1)$	$(0,1,1,1)$	$(0,1)$	$(0,1,1,1)$	$(0,1)$
$(1,0,0,0)$	$(0,0)$	$(1,0,0,0)$	$(0,0)$	$(1,0,0,0)$	$(1,0)$	$(1,0,0,0)$	$(1,0)$
$(1,0,0,1)$ NA	——	$(1,0,0,1)$ NA	——	$(1,0,0,1)$ NA	——	$(1,0,0,1)$ NA	——
$(1,0,1,0)$	$(0,0)$	$(1,0,1,0)$	$(0,1)$	$(1,0,1,0)$	$(1,0)$	$(1,0,1,0)$	$(1,1)$
$(1,0,1,1)$ NA	——	$(1,0,1,1)$ NA	——	$(1,0,1,1)$ NA	——	$(1,0,1,1)$ NA	——
$(1,1,0,0)$ NA	——	$(1,1,0,0)$ NA	——	$(1,1,0,0)$ NA	——	$(1,1,0,0)$ NA	——
$(1,1,0,1)$	$(1,1)$	$(1,1,0,1)$	$(1,0)$	$(1,1,0,1)$	$(1,1)$	$(1,1,0,1)$	$(1,0)$
$(1,1,1,0)$ NA	——	$(1,1,1,0)$ NA	——	$(1,1,1,0)$ NA	——	$(1,1,1,0)$ NA	——
$(1,1,1,1)$	$(1,1)$	$(1,1,1,1)$	$(1,1)$	$(1,1,1,1)$	$(1,1)$	$(1,1,1,1)$	$(1,1)$

, we summarize Alice’s guessing rule by using her outcome and the post-information from the kings.

In the case of $n=2$, the following simple attack so called intercept-resend attack can be considered. An eavesdropper (called Eve) intercepts ${\mathcal{H}}_{K_j}$ returned to Alice from King${}_j$ (step 2 in the protocol) and performs the measurement $M^{(0)}$ or $M^{(1)}$ probabilistically on ${\mathcal{H}}_{K_j}$. After the measurement, she resends ${\mathcal{H}}_{K_j}$ to Alice. When Eve performs the intercept-resend attack to only ${\mathcal{H}}_{K_1}$, the probability which the error occurs is $\frac{1}{8}$, where the error means the event: ${\delta }_{{(i_j^{\prime u})}_{j=1}^2{(i_j^u)}_{j=1}^2}=0$. When Eve performs the intercept-resend attack to both ${\mathcal{H}}_{K_1}$ and ${\mathcal{H}}_{K_2}$, the probability which the error occurs is $\frac{1}{32}(p_1+p_2-2p_1{p}_2+7)$, where $p_j$ denotes the probability, which Eve performs the measurement $M^{(0)}$ on ${\mathcal{H}}_{K_j}$ ($j\in \{1,2\}$). The minimum value of the probability is $0.21875$ when $(p_1=1,p_2=1)$ or $(p_1=0,p_2=0)$ and the maximum value of the probability is $0.25$ when $(p_1=1,p_2=0)$ or $(p_1=0,p_2=1)$.

4. Distinguishability vs. Disturbance

In this section, let us consider two types of the attacks and let us see whether Eve can extract information by employing the attacks without disturbing contained in legitimate users’ information in the case of $n=2$. First, Eve tries to gain information from the qubit returned to Alice by King${}_1$ (step 2 in the protocol) by interacting the qubit ${\mathcal{H}}_{K_1}$ with her quantum system ${\mathcal{H}}_E$ (see Figure 3). Second, she tries to gain information from the qubits ${\mathcal{H}}_{K_j}$ returned to Alice by King${}_j$ (step 2 in the protocol) by interacting ${\mathcal{H}}_{K_1}\otimes {\mathcal{H}}_{K_2}$ with her quantum system ${\mathcal{H}}_E$ (see Figure 4). In both of the attacks, Eve performs any measurement on her quantum system ${\mathcal{H}}_E$ at any time.

We can consider an attack that Eve interacts her quantum system with the qubits sent to the kings by Alice. However, in this attack, the qubits are not encoded because the kings have not measured the qubits. Especially, in the case of $n=1$, the setting of the attack can be considered as monogamy of entanglement [21,22]. Moreover, we can also consider an attack that Eve interacts her quantum system with both of the qubits sent to the kings by Alice and the qubits returned to Alice by the kings. However, the setting of the attack is different from one for discussing the information disturbance theorem. In the setting for the theorem, Eve tries to information extract from only the encoded qubits. Therefore, we concentrate on the above two attacks that Eve tries to extract information from the qubits sent to Alice by the kings.

In the beginning, we define error probability which represents probability that Alice cannot guess king’s outcomes correctly by using her outcome and the post-information. Remark that the error probability is different from the error rate (step 6 in the protocol). Let $P^{(W)}(k\mid J_1;i_1,J_2;i_2)$ be the probability that Alice obtains an outcome k when she chooses $|{\Phi }^{(W)}\rangle$ and King${}_j$ obtains an outcome $i_j$ with the measurement $M^{(J_j)}$ ($j\in \{1,2\}$). We define

$$P_{\mathrm{suc}(J_1;i_1,J_2;i_2)}^{(W)}:=\sum _{k\in S_{{(J_j,i_j)}_{j=1}^2}^{(W)}}{P}^{(W)}(k\mid J_1;i_1,J_2;i_2)$$

(25)

and

$$P_{\mathrm{suc}(J_1;i_1,J_2;i_2)}:=\frac{1}{2}\sum _{W\in \{X,Z\}}{P}_{\mathrm{suc}(J_1;i_1,J_2;i_2)}^{(W)}.$$

(26)

Then, we define the error probability when King${}_j$ obtains an outcome $i_j$ with the measurement $M^{(J_j)}$:

$$P_{\mathrm{err}(J_1;i_1,J_2;i_2)}:=1-P_{\mathrm{suc}(J_1;i_1,J_2;i_2)}.$$

(27)

Equation (27) represents probability that Alice’s sequence and kings’ sequence do not match when King${}_j$ obtains an outcome $i_j$ with the measurement $M^{(J_j)}$, i.e., Alice cannot guess kings’ outcomes correctly by using her outcome and the post-information.

Let us consider that Eve tries to extract information from ${\mathcal{H}}_{K_1}$. Eve prepares her own quantum system ${\mathcal{H}}_E$ in a quantum state $\Omega$. She intercepts ${\mathcal{H}}_{K_1}$ in the state ${\rho }^{(K_1)}$ returned to Alice by King${}_1$ and interacts it with ${\mathcal{H}}_E$. Let us denote the interaction by

$$T^{*}({\rho }^{(K_1)}):=U{\rho }^{(K_1)}\otimes \Omega U^{†},$$

(28)

where U is a unitary operator on ${\mathcal{H}}_{K_1}\otimes {\mathcal{H}}_E$. Moreover, we denote the local state of ${\mathcal{H}}_E$ (resp. ${\mathcal{H}}_{K_1}$) by partial trace over the ${\mathcal{H}}_{K_1}$ (resp. ${\mathcal{H}}_E$)

$$T_E^{*}({\rho }^{(K_1)}):={\mathrm{tr}}_{{\mathcal{H}}_{K_1}}{T}^{*}({\rho }^{(K_1)})\left(\mathrm{resp}.T_{K_1}^{*}({\rho }^{(K_1)}):={\mathrm{tr}}_{{\mathcal{H}}_{K_E}}{T}^{*}({\rho }^{(K_1)})\right).$$

(29)

Let us consider that King${}_1$ obtains an outcome i with a measurement $M^{(1)}$. Then, the state of ${\mathcal{H}}_{K_1}$ before the interaction is ${\rho }^{(K_1)}=|\overline{i}\rangle \langle \overline{i}|$. Eve tries to extract information regarding to the secret key by distinguishing $T_E^{*}(|\overline{0}\rangle \langle \overline{0}|)$ and $T_E^{*}(|\overline{1}\rangle \langle \overline{1}|)$.

We employ trace distance as a measure for distinguishability of the states. Trace norm between a state $\rho$ and a state $\sigma$ is defined as $\left|\right|\rho -{\sigma \left|\right|}_1:={sup}_{\left|\right|A\left|\right|=1}\left|\mathrm{tr}(\rho -\sigma )A\right|$, where $\left|\right|·\left|\right|$ denotes operator norm. Trace distance is defined as follows,

$$D(\rho ,\sigma ):=\frac{1}{2}\left|\right|\rho -{\sigma \left|\right|}_1.$$

(30)

It takes a value from 0 to 1. In addition, $D(\rho ,\sigma )=0$ if and only if $\rho =\sigma$, and $D(\rho ,\sigma )=0$ if and only if $\mathrm{tr}(\rho \sigma )=0$. Let us remind the definition of fidelity [23,24]. Fidelity between $\rho$ and $\sigma$ is defined as $F(\rho ,\sigma ):=\mathrm{tr}\sqrt{{\rho }^{1/2}\sigma {\rho }^{1/2}}$. The following alternative expression of fidelity [25,26] has been shown,

$$\begin{array}{c}\hfill F(\rho ,\sigma )=\underset{{(M_a)}_a:\mathrm{POVM}}{inf}\sum _a\sqrt{p(a\mid \rho )p(a\mid \sigma )},\end{array}$$

(31)

where $p(a\mid \rho )$ and $p(a\mid \sigma )$ are defined as $p(a\mid \rho ):=\mathrm{tr}(M_a\rho )$ and $p(a\mid \sigma ):=\mathrm{tr}(M_a\sigma )$.

Lemma 1.

The following relation between trace distance and fidelity holds,

$$\begin{array}{c}\hfill \frac{1}{2}\left|\right|T_E^{*}(|\overline{0}\rangle \langle \overline{0}|)-T_E^{*}(|\overline{1}\rangle \langle \overline{1}|){\left|\right|}_1\le F(T_{K_1}^{*}(|0\rangle \langle 0|),T_{K_1}^{*}(|1\rangle \langle 1|)).\end{array}$$

(32)

Proof of Lemma 1.

From Lemma 3 in [27], we have

$$|\langle 0|T(\mathbb{I}\otimes A)|1\rangle |\le \left|\right|A\left|\right|F(T_{K_1}^{*}(|0\rangle \langle 0|),T_{K_1}^{*}(|1\rangle \langle 1|))$$

(33)

for any operator A on ${\mathcal{H}}_E$, where T is defined as $\mathrm{tr}{T}^{*}(\rho )X=\mathrm{tr}\rho T(X)$. By using Equation (33), we observe

$$\begin{array}{ccc}\left|\mathrm{tr}\left[\left\{T_E^{*}(|\overline{0}\rangle \langle \overline{0}|-T_E^{*}\left(\frac{1}{2}\mathbb{I}\right)\right\}A\right]\right|\hfill & =\hfill & \left|\mathrm{tr}\left\{\left(|\overline{0}\rangle \langle \overline{0}|-\frac{1}{2}\mathbb{I}\right)T(\mathbb{I}\otimes A)\right\}\right|\hfill \\ \hfill & =\hfill & \left|\mathrm{tr}\left\{\frac{1}{2}(|0\rangle \langle 1|+|1\rangle \langle 0|)T(\mathbb{I}\otimes A)\right\}\right|\hfill \\ \hfill & \le \hfill & \frac{1}{2}\left\{\right|\langle 1\left|T(\mathbb{I}\otimes A)\right|0\rangle |+|\langle 0|T(\mathbb{I}\otimes A)|1\rangle |\}\hfill \\ \hfill & \le \hfill & \left|\right|A\left|\right|F(T_{K_1}^{*}(|0\rangle \langle 0|),T_{K_1}^{*}(|1\rangle \langle 1|)).\hfill \end{array}$$

(34)

Then,

$$\begin{array}{ccc}\frac{1}{2}\left|\right|T_E^{*}(|\overline{0}\rangle \langle \overline{0}|)-T_E^{*}(|\overline{1}\rangle \langle \overline{1}|){\left|\right|}_1\hfill & =\hfill & \left|\right|T_E^{*}(|\overline{0}\rangle \langle \overline{0}|)-T_E^{*}\left(\frac{1}{2}\mathbb{I}\right)|{|}_1\hfill \\ \hfill & =\hfill & \underset{\left|\right|A\left|\right|=1}{sup}\left|\mathrm{tr}\left[\left\{(T_E^{*}(|\overline{0}\rangle \langle \overline{0}|)-T_E^{*}\left(\frac{1}{2}\mathbb{I}\right)\right\}A\right]\right|\hfill \\ \hfill & \le \hfill & F(T_{K_1}^{*}(|0\rangle \langle 0|),T_{K_1}^{*}(|1\rangle \langle 1|))\hfill \end{array}$$

(35)

holds. □

Theorem 1.

The following trade-off inequality holds,

$$\begin{array}{ccc}\hfill D(T_E^{*}(|\overline{0}\rangle \langle \overline{0}|),T_E^{*}(|\overline{1}\rangle \langle \overline{1}|))& \le & \sqrt{2P_{\mathrm{err}(0;0,0;0)}}+\sqrt{2P_{\mathrm{err}(0;1,0;1)}}.\hfill \end{array}$$

(36)

The left hand side of the inequality represents distinguishability for Eve, and the right hand side is the sum of the error probabilities which represent probability that Alice’s sequence and kings’ sequence are not equal when the kings obtain the corresponding outcomes with the corresponding measurements, i.e., Alice cannot guess kings’ sequence correctly by using her outcome and the post-information. This theorem shows that Eve’s extracting information regarding King${}_1$’s key related with the measurement $M^{(1)}$ inevitably induces disturbing the states and increases the error probability when both of kings choose the measurement $M^{(0)}$. This implies that the more Eve extracts information, the more possibility for Alice and the kings to detect the existence of the attack increases. In particular, Eve cannot extract information about the key at all (i.e., trace distance is zero) when the corresponding error probabilities are zero. Remark that similar inequalities between distinguishability of other pairs of states and the error probabilities can be proven in the similar way as below.

Proof of Theorem 1.

Before obtaining the inequalities, let us observe the error probability. Define ${\rho }_i:=T_{K_1}^{*}(|i\rangle \langle i|)$. By direct calculations (see Appendix A for details), we have the following probability,

$$\begin{array}{c}\hfill P_{\mathrm{err}(0;i,0;i)}=\frac{1}{2}(1-\langle i|{\rho }_{i}i\rangle ).\end{array}$$

(37)

By using Equations (31) and (37), we have

$$\begin{array}{ccc}F({\rho }_0,{\rho }_1)\hfill & =\hfill & {inf}_{{(M_a)}_a:\mathrm{POVM}}{\sum }_a\sqrt{\mathrm{tr}(M_a{\rho }_0)\mathrm{tr}(M_a{\rho }_1)}\hfill \\ \hfill & \le \hfill & \sqrt{\mathrm{tr}(|0\rangle \langle 0|{\rho }_0)\mathrm{tr}(|0\rangle \langle 0|{\rho }_1)}+\sqrt{\mathrm{tr}(|1\rangle \langle 1|{\rho }_0)\mathrm{tr}(|1\rangle \langle 1|{\rho }_1)}\hfill \\ \hfill & =\hfill & \sqrt{\langle 0|{\rho }_{0}0\rangle (1-\langle 1|{\rho }_{1}1\rangle )}+\sqrt{(1-\langle 0|{\rho }_{0}0\rangle )\langle 1|{\rho }_{1}1\rangle }\hfill \\ \hfill & \le \hfill & \sqrt{1-\langle 1|{\rho }_{1}1\rangle }+\sqrt{1-\langle 0|{\rho }_{0}0\rangle }\hfill \\ \hfill & =\hfill & \sqrt{2P_{\mathrm{err}(0;0,0;0)}}+\sqrt{2P_{\mathrm{err}(0;1,0;1)}},\hfill \end{array}$$

(38)

where we employ $(|0\rangle \langle 0|,|1\rangle \langle 1|)$ as a POVM in the first inequality. Then, we have the trade-off inequality by the definition of trace distance, Equations (32) and (38). □

Let us consider that Eve tries to extract information from ${\mathcal{H}}_{K_1}$ and ${\mathcal{H}}_{K_2}$. Eve prepares a quantum systems ${\mathcal{H}}_E$ in a quantum state $\Omega$. She intercepts ${\mathcal{H}}_{K_1}\otimes {\mathcal{H}}_{K_2}$ in the state ${\rho }^{(K_1,K_2)}$ returned to Alice by King${}_1$ and King${}_2$. Then, she interacts both systems with ${\mathcal{H}}_E$. Let us denote the interaction by

$$K^{*}({\rho }^{(K_1,K_2)}):=V{\rho }^{(K_1,K_2)}\otimes \Omega V^{†},$$

(39)

where V is a unitary operator on ${\mathcal{H}}_{K_1}\otimes {\mathcal{H}}_{K_2}\otimes {\mathcal{H}}_E$. And we denote the local state of ${\mathcal{H}}_E$ (resp. ${\mathcal{H}}_{K_1}\otimes {\mathcal{H}}_{K_2}$) by partial trace over the ${\mathcal{H}}_{K_1}\otimes {\mathcal{H}}_{K_2}$ (resp. ${\mathcal{H}}_E$)

$$\begin{array}{c}\hfill K_E^{*}({\rho }^{(K_1,K_2)}):={\mathrm{tr}}_{{\mathcal{H}}_{K_1}\otimes {\mathcal{H}}_{K_2}}{K}^{*}({\rho }^{(K_1,K_2)})\left(\mathrm{resp}.K_{K_1,K_2}^{*}({\rho }^{(K_1{K}_2)}):={\mathrm{tr}}_{{\mathcal{H}}_{K_E}}{K}^{*}({\rho }^{(K_1,K_2)})\right).\end{array}$$

(40)

Let us consider that King${}_1$ and King${}_2$ perform the same measurement $M^{(1)}$ and obtain the same outcome i. Then, the state of ${\mathcal{H}}_{K_1}\otimes {\mathcal{H}}_{K_2}$ before the interaction is $|\overline{i}\overline{i}\rangle \langle \overline{i}\overline{i}|$. Eve tries to extract information regarding to the secret key by distinguishing $K_E^{*}(|\overline{0}\overline{0}\rangle \langle \overline{0}\overline{0}|)$ and $K_E^{*}(|\overline{1}\overline{1}\rangle \langle \overline{1}\overline{1}|)$.

Lemma 2.

The following relation between trace distance and fidelity holds,

$$\begin{array}{ccc}\left|\right|K_E^{*}(|\overline{0}\overline{0}\rangle \langle \overline{0}\overline{0}|)-K_E^{*}(|\overline{1}\overline{1}\rangle \langle \overline{1}\overline{1}|){\left|\right|}_1\hfill & \le \hfill & {\sum }_{i\in \{0,1\}}F(K_{K_1{K}_2}^{*}(|ii\rangle \langle ii|),K_{K_1{K}_2}^{*}(|01\rangle \langle 01|)\hfill \\ \hfill & \hfill & +{\sum }_{i\in \{0,1\}}F(K_{K_1{K}_2}^{*}(|ii\rangle \langle ii|),K_{K_1{K}_2}^{*}(|10\rangle \langle 10|).\hfill \end{array}$$

(41)

Proof of Lemma 2.

From Lemma 3 in [27], we have

$$|\langle i_1{i}_2\left|K(I\otimes A)\right|i_1^{\prime }{i}_2^{\prime }\rangle |\le \left|\right|A\left|\right|F(K_{K_1{K}_2}^{*}(|i_1{i}_2\rangle \langle i_1{i}_2|),K_{K_1{K}_2}^{*}(|i_1^{\prime }{i}_2^{\prime }\rangle \langle i_1^{\prime }{i}_2^{\prime }|))$$

(42)

for any operator A on ${\mathcal{H}}_E$, where K is defined as $\mathrm{tr}{K}^{*}(\rho )X=\mathrm{tr}\rho K(X)$. By using Equation (42), we observe

$$\begin{array}{ccc}\left|\mathrm{tr}\right[\{K_E^{*}(|\overline{0}\overline{0}\rangle \langle \overline{0}\overline{0}|)-K_E^{*}(|\overline{1}\overline{1}\rangle \langle \overline{1}\overline{1}|)\}A\left]\right|\hfill & =\hfill & \left|\mathrm{tr}\right\{(|\overline{0}\overline{0}\rangle \langle \overline{0}\overline{0}|-|\overline{1}\overline{1}\rangle \langle \overline{1}\overline{1}|)K(\mathbb{I}\otimes A)\left\}\right|\hfill \\ \hfill & =\hfill & \left|\mathrm{tr}\right\{\frac{1}{2}(|00\rangle \langle 01|+|00\rangle \langle 10|+|01\rangle \langle 00|+|01\rangle \langle 11|\hfill \\ \hfill & \hfill & +|10\rangle \langle 00|+|10\rangle \langle 11|+|11\rangle \langle 01|+|11\rangle \langle 10|)K(\mathbb{I}\otimes A)\}|\hfill \\ \hfill & \le \hfill & {\sum }_{i\in \{0,1\}}|\langle ii|K(I\otimes A)|01\rangle |+{\sum }_{i\in \{0,1\}}|\langle ii|K(\mathbb{I}\otimes A)|10\rangle |\hfill \\ \hfill & \le \hfill & \left|\right|A\left|\right|\{\sum _{i\in \{0,1\}}F(K_{K_1{K}_2}^{*}(|ii\rangle \langle ii|),K_{K_1{K}_2}^{*}(|01\rangle \langle 01|)\hfill \\ \hfill & \hfill & +{\sum }_{i\in \{0,1\}}F(K_{K_1{K}_2}^{*}(|ii\rangle \langle ii|),K_{K_1{K}_2}^{*}(|10\rangle \langle 10|)\}.\hfill \end{array}$$

(43)

In Equation (43), we take supreme over all A such that $\left|\right|A\left|\right|=1$, then we have Equation (41). □

Theorem 2.

The following trade-off inequality holds,

$$\begin{array}{ccc}\hfill D(K_E^{*}(|\overline{0}\overline{0}\rangle \langle \overline{0}\overline{0}|),K_E^{*}(|\overline{1}\overline{1}\rangle \langle \overline{1}\overline{1}|))& <& \sum _{i_1,i_2\in \{0,1\}}\sqrt{2P_{\mathrm{err}(0;i_1,0;i_2)}}.\hfill \end{array}$$

(44)

Although Eve tries to distinguish the states on ${\mathcal{H}}_{K_1}\otimes {\mathcal{H}}_{K_2}$, this theorem gives the same claim as the one of Theorem 1. This theorem shows that Eve’s extracting information regarding kings’ keys related with the measurement $M^{(1)}$ inevitably induces disturbing the states and increases the error probability when both of kings choose the measurement $M^{(0)}$. Remark that similar inequalities between distinguishability of other pairs of states and the error probabilities can be proven in the similar way as below.

Proof of Theorem 2.

In the same manner, let us observe the error probability. Define ${\rho }_{i_1{i}_2}:=K_{K_1{K}_2}^{*}(|i_1{i}_2\rangle \langle i_1{i}_2|)$. By direct calculations (see Appendix B for details), we have the following probability,

$$\begin{array}{c}\hfill P_{\mathrm{err}(0;i_1,0;i_2)}=\left\{\begin{array}{c}\frac{1}{2}(1-\langle i_1{i}_2|{\rho }_{i_1{i}_2}|i_1{i}_2\rangle )(i_1=i_2)\hfill \\ 1-\frac{1}{2}\langle i_1{i}_2|{\rho }_{i_1{i}_2}|i_1{i}_2\rangle (i_1\ne i_2).\hfill \end{array}\right.\end{array}$$

(45)

By using Equations (31) and (45), we have

$$\begin{array}{ccc}F({\rho }_{00},{\rho }_{01})\hfill & =\hfill & {inf}_{{(M_a)}_a:\mathrm{POVM}}{\sum }_a\sqrt{\mathrm{tr}(M_a{\rho }_{00})\mathrm{tr}(M_a{\rho }_{01})}\hfill \\ \hfill & \le \hfill & \sqrt{\mathrm{tr}\{(|11\rangle \langle 11|+|01\rangle \langle 01|){\rho }_{00}\left\}\mathrm{tr}\right\{(|00\rangle \langle 00|+|01\rangle \langle 01|){\rho }_{01}\}}\hfill \\ \hfill & \hfill & +\sqrt{\mathrm{tr}\{(|00\rangle \langle 00|+|10\rangle \langle 10|){\rho }_{00}\left\}\mathrm{tr}\right\{(|00\rangle \langle 00|+|10\rangle \langle 10|){\rho }_{01}\}}\hfill \\ \hfill & <\hfill & \sqrt{\mathrm{tr}\{(|11\rangle \langle 11|+|01\rangle \langle 01|){\rho }_{00}\}}+\sqrt{\mathrm{tr}\{(|00\rangle \langle 00|+|10\rangle \langle 10|){\rho }_{01}\}}\hfill \\ \hfill & =\hfill & \sqrt{1-\langle 00|{\rho }_{00}|00\rangle -\langle 10|{\rho }_{00}|10\rangle }+\sqrt{1-\langle 01|{\rho }_{01}|01\rangle -\langle 11|{\rho }_{01}|11\rangle }\hfill \\ \hfill & <\hfill & \sqrt{1-\langle 00\left|{\rho }_{00}\right|00\rangle }+\sqrt{2-\langle 01\left|{\rho }_{01}\right|01\rangle }\hfill \\ \hfill & =\hfill & \sqrt{2P_{\mathrm{err}(0;0,0;0)}}+\sqrt{2P_{\mathrm{err}(0;0,0;1)}}.\hfill \end{array}$$

(46)

where we employ $(|11\rangle \langle 11|+|01\rangle \langle 01|,|00\rangle \langle 00|+|10\rangle \langle 10|)$ as a POVM in the first inequality. In the same manner, we have

$$\begin{array}{ccc}\hfill F({\rho }_{ii},{\rho }_{01})& <& \sqrt{2P_{\mathrm{err}(0;i,0;i)}}+\sqrt{2P_{\mathrm{err}(0;0,0;1)}},\hfill \end{array}$$

(47)

$$\begin{array}{ccc}\hfill F({\rho }_{ii},{\rho }_{10})& <& \sqrt{2P_{\mathrm{err}(0;i,0;i)}}+\sqrt{2P_{\mathrm{err}(0;1,0;0)}}(i\in \{0,1\}).\hfill \end{array}$$

(48)

Then, we have the trade-off inequality by the definition of trace distance, Equations (41) and (48). □

5. Summary

In this paper, we discussed the quantum key distribution protocol using the mean multi-kings’ problem. By using the protocol, Alice can share the secret key with King${}_j$ ($j=1,2,\dots ,n$). In the case of $n=2$, we considered whether Eve can extract information when she can performs the interaction between her own quantum system and the qubit returned by King${}_j$ and can performs any measurement on her quantum system at any time. We employed trace distance as a measure for distinguishability of the states for Eve. Furthermore, we gave the trade-off inequalities between trace distance of the quantum states corresponding to the secret key for Eve and the error probability which represents probability that the bit sequences shared by the legitimate users do not match. In BB84, such relation is know as the information disturbance theorem and the theorem is also regarded as an information theoretical version of the uncertainty relation. Our inequalities showed that Eve’s extracting information regarding kings’ keys inevitably induces disturbing the states and increases the error probability even though Alice can use the post-information to guess kings’ outcomes. This implies that the information gain by Eve increases possibility for the legitimate users to detect the existence of the attacks. In particular, when the corresponding error probability is zero, Eve cannot extract any information.