Distinguishability and Disturbance in the Quantum Key Distribution Protocol Using the Mean Multi-Kings’ Problem

We introduce a quantum key distribution protocol using mean multi-kings’ problem. Using this protocol, a sender can share a bit sequence as a secret key with receivers. We consider a relation between information gain by an eavesdropper and disturbance contained in legitimate users’ information. In BB84 protocol, such relation is known as the so-called information disturbance theorem. We focus on a setting that the sender and two receivers try to share bit sequences and the eavesdropper tries to extract information by interacting legitimate users’ systems and an ancilla system. We derive trade-off inequalities between distinguishability of quantum states corresponding to the bit sequence for the eavesdropper and error probability of the bit sequence shared with the legitimate users. Our inequalities show that eavesdropper’s extracting information regarding the secret keys inevitably induces disturbing the states and increasing the error probability.


Introduction
In the quantum state discrimination problems, one tries to discriminate the quantum states by performing the single measurement. Several strategies exist, e.g., in [1][2][3] and Section 9.1.4 in [4]. On the other hand, in the mean-king's problem [5], one can use not the single measurement but also post-information. Specific setting of the mean-king's problem is often told as a tale [6] of a king and a physicist Alice. In the tale, Alice prepares a qubit in an initial state at first. The king performs a measurement with one of observables σ x , σ y , σ z on the qubit and obtains an outcome. Then, Alice obtains an outcome by performing a measurement on the qubit. After the measurement, the king reveals the observable he has measured as the post-information. Then, Alice tries to guess king's outcome by using her outcome and the post-information. A solution to the problem is a pair of the initial state and Alice's measurement such that she can guess king's outcome correctly. Using Aharonov-Bergman-Lebowitz rule [7], a solution which consists of Bell state and a measurement on a bipartite system has been shown [5]. As an application of the solution to the mean-king's problem, a quantum key distribution protocol (QKD) has been shown [8]. In this protocol, Alice and the king employ the guessing result as a secret key, and security analysis of the protocol has been considered [8][9][10][11].
A QKD protocol by using mean multi-kings' problem has been shown [12] (see Section 2 for details). In this protocol, Alice and kings (called King 1 , King 2 , ..., King n ) are legitimate users. Alice guesses each king's measurement outcome by using her measurement outcome and post-information from each king; then, each guessing result is shared as a secret key between Alice and each king. The protocol has superior aspects, such as the number of measurements, state preparation and key discarding, to several realizations (whose components are the QKD protocol by using the mean-king's problem or BB84 protocol [13]) for Alice and each king to share the secret key. In the case of n = 2, security analysis against a simple attack so called intercept-resend attack has been considered and error rate of bits shared between Alice and the kings has been shown.
In this paper, we consider a relation between information gain by an eavesdropper (called Eve) and disturbance contained in the legitimate users' information in the QKD protocol by using the mean multi-kings' problem. In BB84 protocol, such relation is known as the so-called information disturbance theorem [14][15][16][17][18]. According to the theorem, Eve's information gain in a basis inevitably induces disturbance contained in the legitimate users' information in the conjugate basis. Therefore, the theorem is also regarded as an information theoretical version of the uncertainty relation. The theorem also plays an important role in the proof of the unconditional security [19]. We consider that Eve tries to extract information by employing an attack which she performs any measurement on her quantum system at any time after interacting the quantum system with kings' qubits after their measurements in the case of n = 2. In this setting, we give trade-off inequalities between distinguishability of quantum states corresponding to the bit sequences for Eve and error probability of the bit sequences shared with Alice and the kings. Our inequalities show that Eve's extracting information regarding the secret keys inevitably induces disturbing the states of kings' qubits and increasing the error probability even though the post-information and Alice's qubit are used in the guessing step, unlike BB84 protocol. This paper is organized as follows. In the next section, we review a description of the quantum key distribution protocol by using the mean multi-kings' problem. In Section 3, we give the description of the protocol in the case of n = 2. In Section 4, we give the outline of the attack and the trade-off inequalities between distinguishability and disturbance. Finally, we summarize this paper in Section 5.

Protocol
Let us start by introducing the essence of the mean multi-kings' problem and the QKD by using it. Alice and King 1 , King 2 , ... , King n are the characters in this problem. The problem can be summarized as follows. Alice prepares a composite system, which consists of her system and n systems for kings, in an initial state. Each king performs a measurement on his system and obtains an outcome. After kings' measurement, Alice performs a measurement on the composite system and obtains an outcome. Furthermore, each king reveals post-information: the measurement type he has performed. Immediately, Alice guesses kings' outcomes by using her outcome and the post-information from each king. A solution to the problem is defined as a three-tuple of the initial state, Alice's measurement, and a guessing function such that she can guess kings' outcomes correctly. In this problem, the initial state will be changed depending on the kings' measurements and outcomes. In general, it is impossible to distinguish the changed states correctly. Therefore, Alice tries to get some potential answers by performing the measurement and to narrow down the correct outcome from them by using the guessing function of her outcome and the post-information.
We can construct the QKD protocol by using a setting of the mean multi-kings' problem and a solution to it, i.e., Alice and each king share the guessing result as a secret key. Figure 1 is a graphically demonstrated protocol. Let us consider a setting that Alice prepares a composite system which consists of n + 1 qubits and each king performs one of two fixed measurements on his qubit. Then, two solutions where the initial states are multipartite entangled states can be shown as described below; therefore, we can also construct the QKD protocol by using those solutions. In the QKD, Alice and each king try to share secret keys while she switches the solutions. Before introducing details of the QKD protocol, we introduce some preliminary definitions, the setting of the mean multi-kings' problem, and the solutions to it. Define and an index set We define the setting of the mean multi-kings' problem. Alice prepares the composite system (n + 1 qubits)H := HA ⊗ HK 1 ⊗ HK 2 ⊗ · · · ⊗ HK n ( C 2 ) ⊗n+1 in an initial state. Each King j performs one of the measurements on HK j := X 1 ), and obtains an outcome i j ∈ {0, 1}. Alice performs a measurement onH and obtains an outcome. After Alice's measurement, the kings reveal (J j ) n j=1 as the post-information. Then, Alice tries to guess kings' outcomes by using her outcome and the post-information.
Here, we show two solutions to the problem. In this case, Alice can guess the kings' outcomes correctly by employing one of as an initial state, a measurement depending on the initial state |Φ (W) and a guessing function s(k, (J j ) n j=1 , Φ (W) ) of her outcome k ∈ K , the post-information (J j ) n j=1 , and the initial state (we regard k = (s 1 , t 1 , s 2 , t 2 , . . . , s n , t n ) in the same light as ((s 1 , t 1 ), (s 2 , t 2 ), . . . , (s n , t n ))).
We clear the number of non-zero matrices in her measurement and their orthogonality. We can observe Then, the number of non-zero vectors is equal to 2 n+1 . It leads to the conclusion that the number of non-zero matrices in P (Z) is equal to 2 n+1 . Furthermore, we observe It implies that P (Z) is an orthogonal measurement onH. When Z is switched to X, we have the same result in the case of W = X.
Next, we show that Alice can correctly guess kings' outcomes. We observe for any J j and (i 1 , i 2 , . . . , i n ) = (i 1 , i 2 , . . . , i n ), and holds for any J j and i j . When King j performs the measurement M (J j ) and obtains an outcome i j , by Equation (15), the post-measurement state is proportional to where A k is a subspace spanned by |( I ⊗E . A k and A k are orthogonal for any k = k and P (W) is composed of orthogonal projections onto each subspace A k by Equation (13). If Alice obtains an outcome k by performing P (W) and the post-information (J j ) n j=1 from the kings, then kings' outcomes . However, by Equation (14), such (i j ) n j=1 uniquely exists. Thus, Alice can correctly guess kings' outcomes.
A description of the QKD protocol by using the mean multi-kings' problem is as follows.

Each King
3. Alice performs the measurement P (W) = (P (W) k ) k∈K (W ∈ {Z, X}) onH when the initial state was |Φ (W) . Then, she obtains an outcome k ∈ K . 4. After the measurement, each King j announces post-information J j to Alice. 5. Alice obtains a sequence s(k, (J j ) n j=1 , Φ (W) ) from the outcome k, the post-information (J j ) n j=1 , and the initial state |Φ (W) . 6. They repeat the above process.
After that, Alice randomly chooses sequences (i 1 j ) n j=1 , (i 2 j ) n j=1 , . . . , (i r j ) n j=1 from all sequences. Similarly, kings work together to choose sequences (i 1 j ) n j=1 , (i 2 j ) n j=1 , . . . , (i r j ) n j=1 which are the same positions as the positions Alice chose.
Then, Alice and kings work together to calculate error rate The rest of the process is the same as for ordinary QKD protocols, such as BB84 protocol. If the error rate is too large, the protocol is aborted. Otherwise, the leftover sequences are performed with error-correction and privacy amplification [20].
Remark that Alice and each King j can share the secret key when they employ the QKD protocol using the mean-king's problem or BB84 protocol. In the case of employing the QKD using the mean-king's problem (see left hand side of Figure 2), Alice prepares 2 qubits in the Bell state and performs a single measurement on the 2 qubits for each King j . Therefore, she needs to prepare 2n qubits and perform n measurements to share the secret key with n kings. On the other hand, in the QKD protocol using the mean multi-kings' problem, Alice only prepares n + 1 qubits in |Φ (Z) or |Φ (X) and performs the single measurement P (Z) or P (X) . In the case where the BB84 protocol is employed (see right hand side of Figure 2), Alice just prepares n qubits in one of the states |0 , |1 , |0 , |1 and no performing the measurement is required. Then, Alice and King j discard the raw key where their bases do not match before calculating error rate. On the other hand, in the QKD protocol using the mean multi-kings' problem, there is not such discarding step before calculating error rate.

Protocol: n = 2
We describe the working of the protocol in the case of n = 2 by focusing on the case of W = Z to reduce cumbersome notations.
By Equation (2), the index set takes the following form, And by Equation (3), the operator E (Z) k for k ∈ K takes the following form, Similarly, we can observe the operators for W = X. By Equation (5), we observe the index sets S where we regard ((l 1 , l 2 ), (l 3 , l 4 )) in the same light as (l 1 , l 2 , l 3 , l 4 ). Similarly, we can observe the index sets for other J 1 , J 2 , i 1 , i 2 , and W. Let us consider that Alice prepares the qubitsH = HA ⊗ HK 1 ⊗ HK 2 in the initial state Let us consider that King 1 and King 2 choose the same measurement M (0) and obtain the same outcome 0, i.e., J 1 = 0, J 2 = 0 and i 1 = 0, i 2 = 0. After kings' measurement, Alice performs the measurement P (Z) = (P After the measurement, King 1 and King 2 announce the post-information J 1 = 0 and J 2 = 0 to Alice. When Alice obtains an outcome k = (0, 0, 0, 0), she is assured that kings' outcome (i 1 , i 2 ) is (0, 0), because (i 1 , i 2 ) satisfying k = (0, 0, 0, 0) ∈ S (W) (J 1 ,i 1 ,J 2 ,i 2 ) = S (Z) (0,i 1 ,0,i 2 ) is (0, 0). In Table 1, we summarize Alice's guessing rule by using her outcome and the post-information from the kings. Table 1. The relationship among kings' measurements J 1 , J 2 , Alice's outcome k, and kings' outcomes i 1 , i 2 when she chooses |Φ (W) . In this table, NA means that probability of obtaining the corresponding outcome k is zero unless Eve performs an attack because the corresponding matrix P (W) k is a zero matrix. An example of Alice's guessing: Alice is assured that kings' outcome (i 1 , i 2 ) is (0, 0) when W = Z, J 1 = 0, J 2 = 0, and k = (0, 0, 0, 0).
In the case of n = 2, the following simple attack so called intercept-resend attack can be considered. An eavesdropper (called Eve) intercepts HK j returned to Alice from King j (step 2 in the protocol) and performs the measurement M (0) or M (1) probabilistically on HK j . After the measurement, she resends HK j to Alice. When Eve performs the intercept-resend attack to only HK 1 , the probability which the error occurs is 1 8 , where the error means the event: When Eve performs the intercept-resend attack to both HK 1 and HK 2 , the probability which the error occurs is 1 32 (p 1 + p 2 − 2p 1 p 2 + 7), where p j denotes the probability, which Eve performs the measurement M (0) on HK j (j ∈ {1, 2}). The minimum value of the probability is 0.21875 when (p 1 = 1, p 2 = 1) or (p 1 = 0, p 2 = 0) and the maximum value of the probability is 0.25 when (p 1 = 1, p 2 = 0) or (p 1 = 0, p 2 = 1).

Distinguishability vs. Disturbance
In this section, let us consider two types of the attacks and let us see whether Eve can extract information by employing the attacks without disturbing contained in legitimate users' information in the case of n = 2. First, Eve tries to gain information from the qubit returned to Alice by King 1 (step 2 in the protocol) by interacting the qubit HK 1 with her quantum system HE (see Figure 3). Second, she tries to gain information from the qubits HK j returned to Alice by King j (step 2 in the protocol) by interacting HK 1 ⊗ HK 2 with her quantum system HE (see Figure 4). In both of the attacks, Eve performs any measurement on her quantum system HE at any time.
We can consider an attack that Eve interacts her quantum system with the qubits sent to the kings by Alice. However, in this attack, the qubits are not encoded because the kings have not measured the qubits. Especially, in the case of n = 1, the setting of the attack can be considered as monogamy of entanglement [21,22]. Moreover, we can also consider an attack that Eve interacts her quantum system with both of the qubits sent to the kings by Alice and the qubits returned to Alice by the kings. However, the setting of the attack is different from one for discussing the information disturbance theorem. In the setting for the theorem, Eve tries to information extract from only the encoded qubits. Therefore, we concentrate on the above two attacks that Eve tries to extract information from the qubits sent to Alice by the kings.  In the beginning, we define error probability which represents probability that Alice cannot guess king's outcomes correctly by using her outcome and the post-information. Remark that the error probability is different from the error rate (step 6 in the protocol). Let P (W) (k | J 1 ; i 1 , J 2 ; i 2 ) be the probability that Alice obtains an outcome k when she chooses |Φ (W) and King j obtains an outcome i j with the measurement M (J j ) (j ∈ {1, 2}). We define Equation (27) represents probability that Alice's sequence and kings' sequence do not match when King j obtains an outcome i j with the measurement M (J j ) , i.e., Alice cannot guess kings' outcomes correctly by using her outcome and the post-information.
Let us consider that Eve tries to extract information from HK 1 . Eve prepares her own quantum system HE in a quantum state Ω. She intercepts HK 1 in the state ρ (K 1 ) returned to Alice by King 1 and interacts it with HE . Let us denote the interaction by where U is a unitary operator on HK 1 ⊗ HE . Moreover, we denote the local state of HE (resp. HK 1 ) by partial trace over the HK 1 (resp. HE ) T * E (ρ (K 1 ) ) := tr HK 1 T * (ρ (K 1 ) ) resp. T * K 1 (ρ (K 1 ) ) := tr HK E T * (ρ (K 1 ) ) .

Lemma 1.
The following relation between trace distance and fidelity holds, Proof of Lemma 1. From Lemma 3 in [27], we have for any operator A on HE , where T is defined as tr T * (ρ)X = tr ρT(X). By using Equation (33), we observe Then, holds.

Theorem 1.
The following trade-off inequality holds, The left hand side of the inequality represents distinguishability for Eve, and the right hand side is the sum of the error probabilities which represent probability that Alice's sequence and kings' sequence are not equal when the kings obtain the corresponding outcomes with the corresponding measurements, i.e., Alice cannot guess kings' sequence correctly by using her outcome and the post-information. This theorem shows that Eve's extracting information regarding King 1 's key related with the measurement M (1) inevitably induces disturbing the states and increases the error probability when both of kings choose the measurement M (0) . This implies that the more Eve extracts information, the more possibility for Alice and the kings to detect the existence of the attack increases. In particular, Eve cannot extract information about the key at all (i.e., trace distance is zero) when the corresponding error probabilities are zero. Remark that similar inequalities between distinguishability of other pairs of states and the error probabilities can be proven in the similar way as below.
Proof of Theorem 1. Before obtaining the inequalities, let us observe the error probability. Define ρ i := T * K 1 (|i i|). By direct calculations (see Appendix A for details), we have the following probability, By using Equations (31) and (37), we have where we employ (|0 0|, |1 1|) as a POVM in the first inequality. Then, we have the trade-off inequality by the definition of trace distance, Equations (32) and (38).
Let us consider that Eve tries to extract information from HK 1 and HK 2 . Eve prepares a quantum systems HE in a quantum state Ω. She intercepts HK 1 ⊗ HK 2 in the state ρ (K 1 ,K 2 ) returned to Alice by King 1 and King 2 . Then, she interacts both systems with HE . Let us denote the interaction by where V is a unitary operator on HK 1 ⊗ HK 2 ⊗ HE . And we denote the local state of HE (resp. HK 1 ⊗ HK 2 ) by partial trace over the HK 1 ⊗ HK 2 (resp. HE ) K * E (ρ (K 1 ,K 2 ) ) := tr HK 1 ⊗H K 2 K * (ρ (K 1 ,K 2 ) ) resp. K * K 1 ,K 2 (ρ (K 1 K 2 ) ) := tr HK E K * (ρ (K 1 ,K 2 ) ) .
Let us consider that King 1 and King 2 perform the same measurement M (1) and obtain the same outcome i. Then, the state of HK 1 ⊗ HK 2 before the interaction is |īī īī |. Eve tries to extract information regarding to the secret key by distinguishing K * E (|00 00 |) and K * E (|11 11 |).

Lemma 2.
The following relation between trace distance and fidelity holds, Proof of Lemma 2. From Lemma 3 in [27], we have for any operator A on HE , where K is defined as tr K * (ρ)X = tr ρK(X). By using Equation (42), we observe In Equation (43), we take supreme over all A such that ||A|| = 1, then we have Equation (41).
The following trade-off inequality holds, Although Eve tries to distinguish the states on HK 1 ⊗ HK 2 , this theorem gives the same claim as the one of Theorem 1. This theorem shows that Eve's extracting information regarding kings' keys related with the measurement M (1) inevitably induces disturbing the states and increases the error probability when both of kings choose the measurement M (0) . Remark that similar inequalities between distinguishability of other pairs of states and the error probabilities can be proven in the similar way as below.
Then, we have the trade-off inequality by the definition of trace distance, Equations (41) and (48).

Summary
In this paper, we discussed the quantum key distribution protocol using the mean multi-kings' problem. By using the protocol, Alice can share the secret key with King j (j = 1, 2, . . . , n). In the case of n = 2, we considered whether Eve can extract information when she can performs the interaction between her own quantum system and the qubit returned by King j and can performs any measurement on her quantum system at any time. We employed trace distance as a measure for distinguishability of the states for Eve. Furthermore, we gave the trade-off inequalities between trace distance of the quantum states corresponding to the secret key for Eve and the error probability which represents probability that the bit sequences shared by the legitimate users do not match. In BB84, such relation is know as the information disturbance theorem and the theorem is also regarded as an information theoretical version of the uncertainty relation. Our inequalities showed that Eve's extracting information regarding kings' keys inevitably induces disturbing the states and increases the error probability even though Alice can use the post-information to guess kings' outcomes. This implies that the information gain by Eve increases possibility for the legitimate users to detect the existence of the attacks. In particular, when the corresponding error probability is zero, Eve cannot extract any information.
we have the following probabilities, where we can find out the index set S in Table 1. By the definition of P suc(J 1 ;i 1 ,J 2 ;i 2 ) , we have the following probabilities, Then, we can observe the error probabilities from these probabilities.