View source for SARG04

'''SARG04''' (named after Valerio Scarani, Antonio Acín, Gregoire Ribordy, and Nicolas Gisin) is a 2004 quantum cryptography protocol  derived from the first protocol of that kind, [[BB84]].
==Origin==
Researchers built SARG04 when they noticed that by using the four states of [[BB84]] with a different information encoding they could develop a new protocol which would be more robust, especially against the [[Quantum key distribution#Photon number splitting attack|photon-number-splitting attack]], when attenuated [[Physics:Laser|laser]] pulses are used instead of [[Physics:Single-photon source|single-photon source]]s.  SARG04 was defined by Scarani et al. in 2004 in [[Physics:Physical Review Letters|Physical Review Letters]] as a prepare and measure version (in which it is equivalent to BB84 when viewed at the level of quantum processing).<ref name="branciard">{{cite journal |author=Cyril Branciard |author2=Nicolas Gisin |author3=[[Biography:Barbara Kraus|Barbara Kraus]] |author4=Valerio Scarani |year=2005 |title=Security of two quantum cryptography protocols using the same four qubit states  |journal=[[Physical Review A]] |volume=72 |issue=3 |page=032301 |arxiv=quant-ph/0505035 |bibcode= 2005PhRvA..72c2301B|doi=10.1103/PhysRevA.72.032301}}</ref>

An [[Quantum entanglement|entanglement]]-based version has been defined as well.<ref name="branciard"/>

==Description==

In the SARG04 scheme, Alice wishes to send a private key to Bob. She begins with two strings of [[Bit|bit]]s, <math>a</math> and <math>b</math>, each <math>n</math> bits long. She then encodes these two strings as a string of <math>n</math> [[Qubit|qubit]]s,

<math>|\psi\rangle = \bigotimes_{i=1}^{n}|\psi_{a_ib_i}\rangle.</math>

<math>a_i</math> and <math>b_i</math> are the <math>i^\mathrm{th}</math> bits of <math>a</math> and <math>b</math>, respectively. Together, <math>a_ib_i</math> give us an index into the following four qubit states:

<math>|\psi_{00}\rangle = |0\rangle</math>

<math>|\psi_{10}\rangle = |1\rangle</math>

<math>|\psi_{01}\rangle = |+\rangle = \frac{1}{\sqrt{2}}|0\rangle + \frac{1}{\sqrt{2}}|1\rangle</math>

<math>|\psi_{11}\rangle = |-\rangle = \frac{1}{\sqrt{2}}|0\rangle - \frac{1}{\sqrt{2}}|1\rangle.</math>

Note that the bit <math>b_i</math> is what decides which basis <math>a_i</math> is encoded in (either in the computational basis or the Hadamard basis). The qubits are now in states which are not mutually orthogonal, and thus it is impossible to distinguish all of them with certainty without knowing <math>b</math>.

Alice sends <math>|\psi\rangle</math> over a public [[Quantum channel|quantum channel]] to Bob. Bob receives a state <math>\varepsilon\rho = \varepsilon|\psi\rangle\langle\psi|</math>, where <math>\varepsilon</math> represents the effects of noise in the channel as well as eavesdropping by a third party we'll call Eve. After Bob receives the string of qubits, all three parties, namely Alice, Bob and Eve, have their own states. However, since only Alice knows <math>b</math>, it makes it virtually impossible for either Bob or Eve to distinguish the states of the qubits.

Bob proceeds to generate a string of random bits <math>b'</math> of the same length as <math>b</math>, and uses those bits for his choice of basis when measuring the qubits transmitted by Alice. At this point, Bob announces publicly that he has received Alice's transmission. For each qubit sent, Alice chooses one computational basis state and one Hadamard basis state such that the state of the qubit is one of these two states. Alice then announces those two states. Alice will note whether the state is the computational basis state or the Hadamard basis state; that piece of information makes up the secret bit that Alice wishes to communicate to Bob. Bob now knows that the state of his qubit was one of the two states indicated by Alice. To determine the secret bit, Bob must distinguish between the two candidate states. For each qubit, Bob can check to see whether his measurement is consistent with either possible state. If it is consistent with either state, Bob announces that the bit is invalid, since he cannot distinguish which state was transmitted based on the measurement. If on the other hand, one of the two candidate states was inconsistent with the observed measurement, Bob announces that the bit is valid since he can deduce the state (and therefore the secret bit).

Consider for example the scenario that Alice transmits <math>|\psi_{00}\rangle</math> and announces the two states <math>|\psi_{00}\rangle</math> and <math>|\psi_{01}\rangle</math>. If Bob measures in the computational basis, his only possible measurement is <math>|\psi_{00}\rangle</math>. This outcome is clearly consistent with the state having been <math>|\psi_{00}\rangle</math>, but it would also be a possible outcome if the state had been <math>|\psi_{01}\rangle</math>. If Bob measures in the Hadamard basis, either <math>|\psi_{01}\rangle</math> or <math>|\psi_{11}\rangle</math> could be measured, each with probability ½. If the outcome is <math>|\psi_{01}\rangle</math> then again this state is consistent with either starting state. On the other hand, an outcome of <math>|\psi_{11}\rangle</math> cannot possibly be observed from a qubit in state <math>|\psi_{01}\rangle</math>. Thus in the case that Bob measures in the Hadamard basis and observes state <math>|\psi_{11}\rangle</math> (and only in that case), Bob can deduce which state he was sent and therefore what the secret bit is.

From the remaining <math>k</math> bits where both Bob's measurement was conclusive, Alice randomly chooses <math>k/2</math> bits and discloses her choices over the public channel. Both Alice and Bob announce these bits publicly and run a check to see if more than a certain number of them agree. If this check passes, Alice and Bob proceed to use [[Quantum key distribution#Privacy amplification and information reconciliation|privacy amplification and information reconciliation]] techniques to create some number of shared secret keys. Otherwise, they cancel and start over.

The advantage of this scheme relative to the simpler [[BB84]] protocol is that Alice never announces the basis of her bit. As a result, Eve needs to store more copies of the qubit in order to be able to eventually determine the state than she would if the basis were directly announced.

==Intended use==
The intended use of SARG04 is in situations where the information is originated by a Poissonian source producing weak pulses (this means: mean number of photons < 1) and received by an imperfect detector, which is when attenuated laser pulses are used instead of single photons. Such a SARG04 system can be reliable up to a distance of about 10 km.<ref name="branciard"/>

==Modus operandi==
The [[Social:Modus operandi|modus operandi]] of SARG04 is based on the principle that the hardware must remain the same (as prior protocols) and the only change must be in the protocol itself.<ref name="branciard"/>

In the original "prepare and measure" version, SARG04's two conjugated bases are chosen with equal [[Probability|probability]].<ref name="branciard"/>

Double clicks (when both detectors click) are important for comprehending SARG04: double clicks work differently in BB84 and SARG04. In BB84, their item is discarded because there is no way to tell what bit Alice has sent. In SARG04, they are also discarded, "for simplicity", but their occurrence is monitored to prevent eavesdropping. See the paper for a full quantum analysis of the various cases.<ref name="branciard"/>

==Security==
Kiyoshi Tamaki and Hoi-Kwong Lo were successful in proving security for one and two-photon pulses using SARG04.<ref name="branciard"/>

It has been confirmed that SARG04 is more robust than BB84 against incoherent PNS attacks.<ref name="branciard"/>

Unfortunately an incoherent attack has been identified which performs better than a simple phase-covariant cloning machine, and SARG04 has been found to be particularly vulnerable in single-photon implementations when Q >= 14.9%.<ref name="branciard"/>

==Comparison with BB84==
In single-photon implementations, SARG04 was theorised to be equal with BB84, but experiments have shown that it is inferior.<ref name="branciard"/>

==References==
{{reflist}}

===Bibliography===
* {{cite journal |author1=Valerio Scarani |author2=Antonio Acín |author3=Grégoire Ribordy |author4=Nicolas Gisin |year=2004 |title=Quantum Cryptography Protocols Robust against Photon Number Splitting Attacks for Weak Laser Pulse Implementations |journal=[[Physics:Physical Review Letters|Physical Review Letters]] |volume=92 |issue=5 |page=057901 |arxiv=quant-ph/0211131 |bibcode=2004PhRvL..92e7901S |doi=10.1103/PhysRevLett.92.057901 |pmid=14995344}}
* {{cite journal |author1=Chi-Hang Fred Fung |author2=Kiyoshi Tamaki |author3=Hoi-Kwong Lo |year=2006 |title=Performance of two quantum-key-distribution protocols|journal=[[Physical Review A]] |volume=73 |issue=1 |page=012337 |arxiv= quant-ph/0510025|bibcode=2006PhRvA..73a2337F |doi=10.1103/PhysRevA.73.012337}}
* {{cite journal |author1=Branciard, Cyril |author2=Gisin, Nicolas |author3=Kraus, Barbara |author4=Scarani, Valerio |title=Security of two quantum cryptography protocols using the same four qubit states |journal=[[Physical Review A]] |volume=72 |page=32301 |year=2005  |arxiv= quant-ph/0505035|bibcode=2005PhRvA..72c2301B  |doi=10.1103/physreva.72.032301}}

==See also==
*[[Quantum cryptography]]
*[[BB84]] protocol

{{quantum_computing}}

[[Category:Quantum cryptography]]
[[Category:Quantum cryptography protocols]]

{{Sourceattribution|SARG04}}