E91: Entanglement-Based QKD

E91: Entanglement-Based QKD

The E91 protocol, proposed by Artur Ekert in 1991, is a fundamentally different approach to quantum key distribution. Where BB84 uses prepare-and-measure with individual qubits, E91 uses entangled Bell pairs as its core resource. The security proof rests not on the no-cloning theorem but on the violation of Bell inequalities.

Bell Pairs and Entanglement Correlation

An E91 source continuously emits Bell pairs in the singlet state:

|Ψ−⟩ = (|01⟩ − |10⟩) / √2

One qubit of each pair goes to Alice; the other goes to Bob. This pair has a remarkable property: the correlation between Alice's and Bob's outcomes is set by the angle between their measurement directions. For the singlet state, E(a, b) = −cos(θ_a − θ_b), where θ_a and θ_b are their measurement angles. When they measure in the same basis (θ_a = θ_b), the outcomes are perfectly anti-correlated (Alice gets 0, Bob gets 1, or vice versa), and these matching rounds supply the raw key. When their settings differ by 45°, the outcomes are partially correlated, E = −1/√2 ≈ −0.71; these mismatched rounds are kept on purpose because they feed the CHSH test that certifies security (letting S reach 2√2). Only when the settings are orthogonal (90° apart) does E = 0 and the results become genuinely uncorrelated.

This correlation can be used to generate a shared secret key: after measurement and basis reconciliation, Alice can flip her bits to match Bob's, creating a shared key from the anti-correlations.

The CHSH Inequality and Security

The key innovation of E91 is using Bell inequalities to verify security. As you saw in the previous lesson, the CHSH (Clauser-Horne-Shimony-Holt) inequality states that for any classical (local hidden variable) theory:

|E(a,b) − E(a,b') + E(a',b) + E(a',b')| ≤ 2

where E(x,y) is the correlation coefficient between Alice's measurement in direction x and Bob's in direction y.