The Code Book: The Science of Secrecy from Ancient Egypt to Quantum Cryptography

by Simon Singh

  To understand the difficulty of measuring the polarization of photons, we need to consider how we would go about trying to perform such a measurement. The only way to learn anything about the polarization of a photon is by using a Polaroid filter. To measure the polarization of the photon in a particular light trap, the counterfeiter selects a Polaroid filter and orients it in a particular way, say vertically, . If the photon emerging from the light trap happens to be vertically polarized, it will pass through the vertical Polaroid filter and the counterfeiter will correctly assume that it is a vertically polarized photon. If the emerging photon is horizontally polarized, it will not pass through the vertical Polaroid filter, and the counterfeiter will correctly assume that it is a horizontally polarized photon. However, if the emerging photon happens to be diagonally polarized ( or ), it might or might not pass through the filter, and in either case the counterfeiter will fail to identify its true nature. A photon might pass through the vertical Polaroid filter, in which case the counterfeiter will wrongly assume that it is a vertically polarized photon, or the same photon might not pass through the filter, in which case he will wrongly assume that it is a horizontally polarized photon. Alternatively, if the counterfeiter chooses to measure the photon in another light trap by orientating the filter diagonally, say , then this would correctly identify the nature of a diagonally polarized photon, but it would fail to accurately identify a vertically or horizontally polarized photon.

  Figure 74 Stephen Wiesner’s quantum money. Each note is unique because of its serial number, which can be seen easily, and the 20 light traps, whose contents are a mystery. The light traps contain photons of various polarizations. The bank knows the sequence of polarizations corresponding to each serial number, but a counterfeiter does not.

  The counterfeiter’s problem is that he must use the correct orientation of Polaroid filter to identify a photon’s polarization, but he does not know which orientation to use because he does not know the polarization of the photon. This catch-22 is an inherent part of the physics of photons. Imagine that the counterfeiter chooses a -filter to measure the photon emerging from the second light trap, and the photon does not pass through the filter. The counterfeiter can be sure that the photon was not -polarized, because that type of photon would have passed through. However, the counterfeiter cannot tell whether the photon was -polarized, which would certainly not have passed through the filter, or whether it was or -polarized, either of which stood a fifty-fifty chance of being blocked.

  This difficulty in measuring photons is one aspect of the uncertainty principle, developed in the 1920s by the German physicist Werner Heisenberg. He translated his highly technical proposition into a simple statement: “We cannot know, as a matter of principle, the present in all its details.” This does not mean that we cannot know everything because we do not have enough measuring equipment, or because our equipment is poorly designed. Instead, Heisenberg was stating that it is logically impossible to measure every aspect of a particular object with perfect accuracy. In this particular case, we cannot measure every aspect of the photons within the light traps with perfect accuracy. The uncertainty principle is another weird consequence of quantum theory.

  Wiesner’s quantum money relied on the fact that counterfeiting is a two-stage process: first the counterfeiter needs to measure the original note with great accuracy, and then he has to replicate it. By incorporating photons in the design of the dollar bill, Wiesner was making the bill impossible to measure accurately, and hence creating a barrier to counterfeiting.

  A naive counterfeiter might think that if he cannot measure the polarizations of the photons in the light traps, then neither can the bank. He might try manufacturing dollar bills by filling the light traps with an arbitrary sequence of polarizations. However, the bank is able to verify which bills are genuine. The bank looks at the serial number, then consults its confidential master list to see which photons should be in which light traps. Because the bank knows which polarizations to expect in each light trap, it can correctly orient the Polaroid filter for each light trap and perform an accurate measurement. If the bill is counterfeit, the counterfeiter’s arbitrary polarizations will lead to incorrect measurements and the bill will stand out as a forgery. For example, if the bank uses a ↕-filter to measure what should be a ↕-polarized photon, but finds that the filter blocks the photon, then it knows that a counterfeiter has filled the trap with the wrong photon. If, however, the bill turns out to be genuine, then the bank refills the light traps with the appropriate photons and puts it back into circulation.

  In short, the counterfeiter cannot measure the polarizations in a genuine bill because he does not know which type of photon is in each light trap, and cannot therefore know how to orient the Polaroid filter in order to measure it correctly. On the other hand, the bank is able to check the polarizations in a genuine bill, because it originally chose the polarizations, and so knows how to orient the Polaroid filter for each one.

  Quantum money is a brilliant idea. It is also wholly impractical. To start with, engineers have not yet developed the technology for trapping photons in a particular polarized state for a sufficiently long period of time. Even if the technology did exist, it would be too expensive to implement it. It might cost in the region of $1 million to protect each dollar bill. Despite its impracticality, quantum money applied quantum theory in an intriguing and imaginative way, so despite the lack of encouragement from his thesis adviser, Wiesner submitted a paper to a scientific journal. It was rejected. He submitted it to three other journals, and it was rejected three more times. Wiesner claims that they simply did not understand the physics.

  It seemed that only one person shared Wiesner’s excitement for the concept of quantum money. This was an old friend by the name of Charles Bennett, who several years earlier had been an undergraduate with him at Brandeis University. Bennett’s curiosity about every aspect of science is one of the most remarkable things about his personality. He says he knew at the age of three that he wanted to be a scientist, and his childhood enthusiasm for the subject was not lost on his mother. One day she returned home to find a pan containing a weird stew bubbling on the cooker. Fortunately she was not tempted to taste it, as it turned out to be the remains of a turtle that the young Bennett was boiling in alkali in order to strip the flesh from the bones, thereby obtaining a perfect specimen of a turtle skeleton. During his teenage years, Bennett’s curiosity moved from biology to biochemistry, and by the time he got to Brandeis he had decided to major in chemistry. At graduate school he concentrated on physical chemistry, then went on to do research in physics, mathematics, logic and, finally, computer science.

  Figure 75 Charles Bennett. (photo credit 8.2)

  Aware of Bennett’s broad range of interests, Wiesner hoped that he would appreciate quantum money, and handed him a copy of his rejected manuscript. Bennett was immediately fascinated by the concept, and considered it one of most beautiful ideas he had ever seen. Over the next decade he would occasionally reread the manuscript, wondering if there was a way to turn something so ingenious into something that was also useful. Even when he became a research fellow at IBM’s Thomas J. Watson Laboratories in the early 1980s, Bennett still could not stop thinking about Wiesner’s idea. The journals might not want to publish it, but Bennett was obsessed by it.

  One day, Bennett explained the concept of quantum money to Gilles Brassard, a computer scientist at the University of Montreal. Bennett and Brassard, who had collaborated on various research projects, discussed the intricacies of Wiesner’s paper over and over again. Gradually they began to see that Wiesner’s idea might have an application in cryptography. For Eve to decipher an encrypted message between Alice and Bob, she must first intercept it, which means that she must somehow accurately perceive the contents of the transmission. Wiesner’s quantum money was secure because it was impossible to accurately perceive the polarizations of the photons trapped in the dollar bill. Bennett and Brassard wondered what w
ould happen if an encrypted message was represented and transmitted by a series of polarized photons. In theory, it seemed that Eve would be unable to accurately read the encrypted message, and if she could not read the encrypted message, then she could not decipher it.

  Bennett and Brassard began to concoct a system based on the following principle. Imagine that Alice wants to send Bob an encrypted message, which consists of a series of 1’s and 0’s. She represents the 1’s and 0’s by sending photons with certain polarizations. Alice has two possible schemes for associating photon polarizations with 1 or 0. In the first scheme, called the rectilinear or +-scheme, she sends to represent 1, and to represent 0. In the other scheme, called the diagonal or ×-scheme, she sends to represent 1, and to represent 0. To send a binary message, she switches between these two schemes in an unpredictable way. Hence, the binary message 1101101001 could be transmitted as follows:

  Alice transmits the first 1 using the +-scheme, and the second 1 using the ×-scheme. Hence, 1 is being transmitted in both cases, but it is represented by differently polarized photons each time.

  If Eve wants to intercept this message, she needs to identify the polarization of each photon, just as the counterfeiter needs to identify the polarization of each photon in the dollar bill’s light traps. To measure the polarization of each photon Eve must decide how to orient her Polaroid filter as each one approaches. She cannot know for sure which scheme Alice will be using for each photon, so her choice of Polaroid filter will be haphazard and wrong half the time. Hence, she cannot have complete knowledge of the transmission.

  An easier way to think of Eve’s dilemma is to pretend that she has two types of Polaroid detector at her disposal. The +-detector is capable of measuring horizontally and vertically polarized photons with perfect accuracy, but is not capable of measuring diagonally polarized photons with certainty, and merely misinterprets them as vertically or horizontally polarized photons. On the other hand, the ×-detector can measure diagonally polarized photons with perfect accuracy, but cannot measure horizontally and vertically polarized photons with certainty, misinterpreting them as diagonally polarized photons. For example, if she uses the ×-detector to measure the first photon, which is , she will misinterpret it as or . If she misinterprets it as , then she does not have a problem, because this also represents 1, but if she misinterprets it as then she is in trouble, because this represents 0. To make matters worse for Eve, she only gets one chance to measure the photon accurately. A photon is indivisible, and so she cannot split it into two photons and measure it using both schemes.

  This system seems to have some pleasant features. Eve cannot be sure of accurately intercepting the encrypted message, so she has no hope of deciphering it. However, the system suffers from a severe and apparently insurmountable problem-Bob is in the same position as Eve, inasmuch as he has no way of knowing which polarization scheme Alice is using for each photon, so he too will misinterpret the message. The obvious solution to the problem is for Alice and Bob to agree on which polarization scheme they will use for each photon. For the example above, Alice and Bob would share a list, or key, that reads + × + × × × + + × ×. However, we are now back to the same old problem of key distribution-somehow Alice has to get the list of polarization schemes securely to Bob.

  Of course, Alice could encrypt the list of schemes by employing a public key cipher such as RSA, and then transmit it to Bob. However, imagine that we are now in an era when RSA has been broken, perhaps following the development of powerful quantum computers. Bennett and Brassard’s system has to be self-sufficient and not rely on RSA. For months, Bennett and Brassard tried to think of a way around the key distribution problem. Then, in 1984, the two found themselves standing on the platform at Croton-Harmon station, near IBM’s Thomas J. Watson Laboratories. They were waiting for the train that would take Brassard back to Montreal, and passed the time by chatting about the trials and tribulations of Alice, Bob and Eve. Had the train arrived a few minutes early, they would have waved each other goodbye, having made no progress on the problem of key distribution. Instead, in a eureka! moment, they created quantum cryptography, the most secure form of cryptography ever devised.

  Their recipe for quantum cryptography requires three preparatory stages. Although these stages do not involve sending an encrypted message, they do allow the secure exchange of a key which can later be used to encrypt a message.

  Stage 1. Alice begins by transmitting a random sequence of 1’s and 0’s (bits), using a random choice of rectilinear (horizontal and vertical) and diagonal polarization schemes. Figure 76 shows such a sequence of photons on their way to Bob.

  Stage 2. Bob has to measure the polarization of these photons. Since he has no idea what polarization scheme Alice has used for each one, he randomly swaps between his +-detector and his ×-detector. Sometimes Bob picks the correct detector, and sometimes he picks the wrong one. If Bob uses the wrong detector he may well misinterpret Alice’s photon. Table 27 covers all the possibilities. For example, in the top line, Alice uses the rectilinear scheme to send 1, and thus transmits ↕; then Bob uses the correct detector, so he detects ↕, and correctly notes down 1 as the first bit of the sequence. In the next line, Alice does the same thing, but Bob uses the incorrect detector, so he might detect or which means that he might correctly note down 1 or incorrectly note down 0.

  Stage 3. At this point, Alice has sent a series of 1’s and 0’s and Bob has detected some of them correctly and some of them incorrectly. To clarify the situation, Alice then telephones Bob on an ordinary insecure line, and tells Bob which polarization scheme she used for each photon-but not how she polarized each photon. So she might say that the first photon was sent using the rectilinear scheme, but she will not say whether she sent or . Bob then tells Alice on which occasions he guessed the correct polarization scheme. On these occasions he definitely measured the correct polarization and correctly noted down 1 or 0. Finally, Alice and Bob ignore all the photons for which Bob used the wrong scheme, and concentrate only on those for which he guessed the right scheme. In effect, they have generated a new shorter sequence of bits, consisting only of Bob’s correct measurements. This whole stage is illustrated in the table at the bottom of Figure 76.

  Figure 76 Alice transmits a series of 1’s and 0’s to Bob. Each 1 and each 0 is represented by a polarized photon, according to either the rectilinear (horizontal/vertical) or diagonal polarization scheme. Bob measures each photon using either his rectilinear or his diagonal detector. He chooses the correct detector for the leftmost photon and correctly interprets it as 1. However, he chooses the incorrect detector for the next photon. He happens to interpret it correctly as 0, but this bit is nevertheless later discarded because Bob cannot be sure that he has measured it correctly.

  These three stages have allowed Alice and Bob to establish a common series of digits, such as the sequence 11001001 agreed in Figure 76. The crucial property of this sequence is that it is random, because it is derived from Alice’s initial sequence, which was itself random. Furthermore, the occasions when Bob uses the correct detector are also random. The agreed sequence does not therefore constitute a message, but it could act as a random key. At last, the actual process of secure encryption can begin.

  Table 27 The various possibilities in stage 2 of photon exchange between Alice and Bob.

  This agreed random sequence can be used as the key for a onetime pad cipher. Chapter 3 described how a random series of letters or numbers, the onetime pad, can give rise to an unbreakable cipher-not just practically unbreakable, but absolutely unbreakable. Previously, the only problem with the onetime pad cipher was the difficulty of securely distributing the random series, but Bennett and Brassard’s arrangement overcomes this problem. Alice and Bob have agreed on a onetime pad, and the laws of quantum physics actually forbid Eve from successfully intercepting it. It is now time to put ourselves in Eve’s position, and then we will see why she is unable to intercept the key.

  As Alice
transmits the polarized photons, Eve attempts to measure them, but she does not know whether to use the +-detector or the ×-detector. On half the occasions she will choose the wrong detector. This is exactly the same position that Bob is in, because he too picks the wrong detector half the time. However, after the transmission Alice tells Bob which scheme he should have used for each photon and they agree to use only the photons which were measured when Bob used the right detector. However, this does not help Eve, because for half these photons she will have measured them using the incorrect detector, and so will have misinterpreted some of the photons that make up the final key.

  Another way to think about quantum cryptography is in terms of a pack of cards rather than polarized photons. Every playing card has a value and a suit, such as the jack of hearts or the six of clubs, and usually we can look at a card and see both the value and the suit at the same time. However, imagine that it is only possible to measure either the value or the suit, but not both. Alice picks a card from the pack, and must decide whether to measure the value or the suit. Suppose that she chooses to measure the suit, which is “spades,” which she notes. The card happens to be the four of spades, but Alice knows only that it is a spade. Then she transmits the card down a phone line to Bob. While this is happening, Eve tries to measure the card, but unfortunately she chooses to measure its value, which is “four.” When the card reaches Bob he decides to measure its suit, which is still “spades,” and he notes this down. Afterward, Alice calls Bob and asks him if he measured the suit, which he did, so Alice and Bob now know that they share some common knowledge-they both have “spades” written on their notepads. However, Eve has “four” written on her notepad, which is of no use at all.