E91 and Entanglement-Based QKD

E91 is the entanglement-based quantum key distribution protocol proposed by Artur Ekert in 1991. A source distributes one system from each entangled pair to Alice and the other to Bob. They choose local measurement settings at random. Some setting pairs produce anticorrelated raw-key bits; other pairs estimate a Bell parameter that tests whether the observed correlations admit a Bell-local explanation.

A Bell violation is a test of correlations, not a finished secret key. The protocol also needs authenticated communication, a justified treatment of loss and statistical uncertainty, reconciliation, verification and privacy amplification. This page derives the ideal three-setting schedule and explains which conclusions depend on characterized qubit measurements.

Required background. Quantum key distribution defines correctness and secrecy, including acceptance probabilities. BB84 supplies bit and phase errors; Bell states supplies the singlet, and the CHSH inequality supplies the local correlation bound.

Singlet Correlations

The ideal E91 resource is the two-qubit singlet

$$\lvert\Psi^-\rangle = \frac{ \lvert0\rangle_A\lvert1\rangle_B - \lvert1\rangle_A\lvert0\rangle_B }{\sqrt2}.$$

The useful singlet property is its correlation tensor

$$\langle\Psi^-\rvert \sigma_j\otimes\sigma_k \lvert\Psi^-\rangle =-\delta_{jk}.$$

Choose coplanar Bloch-sphere directions and define binary observables

$$\begin{aligned} A(\alpha) &=\cos\alpha\,\sigma_z+\sin\alpha\,\sigma_x,\\ B(\beta) &=\cos\beta\,\sigma_z+\sin\beta\,\sigma_x. \end{aligned}$$

Their eigenvalues are $a,b\in\{-1,+1\}$, with projectors

$$\Pi_a(\alpha)=\frac{I+aA(\alpha)}2, \qquad \Pi_b(\beta)=\frac{I+bB(\beta)}2.$$

The ideal joint distribution is

$$\begin{aligned} P(a,b\mid\alpha,\beta) &= \operatorname{Tr}\!\left[ \lvert\Psi^-\rangle\!\langle\Psi^-\rvert \Pi_a(\alpha)\otimes\Pi_b(\beta) \right]\\ &=\frac14 \left[1-ab\cos(\alpha-\beta)\right]. \end{aligned}$$

The correlator is consequently

$$E(\alpha,\beta) =\sum_{a,b=\pm1}ab\,P(a,b\mid\alpha,\beta) =-\cos(\alpha-\beta).$$

When the directions agree, $E(\alpha,\alpha)=-1$: Alice and Bob always obtain opposite signs. Either party can apply a fixed relabeling so that these become matching raw-key bits. Each local marginal remains uniform,

$$P(a\mid\alpha)=P(b\mid\beta)=\frac12,$$

so neither endpoint controls the ideal outcome in advance.

For polarization qubits, a physical linear-polarizer angle corresponds to half the corresponding angle on the linear-polarization great circle because polarization probabilities contain a double angle. Stating which convention is in use prevents a common factor-of-two error when translating spin-direction formulas to optical analyzers.

Original Three-Setting Schedule

One convenient qubit form of Ekert’s (1991) schedule uses three settings per party:

Party	Setting	Bloch angle	Principal role
Alice	$\alpha_1$	$0$	Bell test
Alice	$\alpha_2$	$\pi/4$	key with $\beta_1$
Alice	$\alpha_3$	$\pi/2$	key with $\beta_2$ and Bell test
Bob	$\beta_1$	$\pi/4$	key with $\alpha_2$ and Bell test
Bob	$\beta_2$	$\pi/2$	key with $\alpha_3$
Bob	$\beta_3$	$3\pi/4$	Bell test

The nine setting pairs are classified as follows:

	$\beta_1$	$\beta_2$	$\beta_3$
$\alpha_1$	test	discard	test
$\alpha_2$	key	discard	discard
$\alpha_3$	test	key	test

“Discard” describes this schedule. A modern proof may use more of the observed data, but it must declare that estimator before looking at the transcript.

With independent uniform choices, the ideal classification probabilities are

$$p_{\mathrm{key}}=\frac29, \qquad p_{\mathrm{test}}=\frac49, \qquad p_{\mathrm{discard}}=\frac39.$$

These are probabilities of setting choices before any setting-dependent selection. A detected fraction need not have the same weights. The low key fraction is not fundamental. Biased setting probabilities can favor key settings while reserving enough randomly selected trials for a statistically sound Bell estimate.

Angles are Bloch-vector angles from $z$ toward $x$. Alice and Bob share two directions for raw-key measurements. The Bell expression uses Alice’s first and third settings with Bob’s first and third settings. Outcomes along a shared axis are anticorrelated for the singlet.

Bit convention

For a key round, define

$$x=\frac{1-a}{2}, \qquad y=\frac{1+b}{2}.$$

The sign in Bob’s map performs the fixed singlet anticorrelation flip. If $b=-a$, then $x=y$. Other bit conventions are equally valid, but changing a convention requires changing the expected correlations consistently.

From trials to key and test data

The source may be controlled by Eve. Alice and Bob independently choose private settings, measure and retain the outcome and detection status for every trial. A trial rule may use a clock or a valid earlier herald; it must not be chosen after inspecting favorable outcomes.

They authenticate the setting announcements, classify eligible trials by the table above, and reveal the Bell-test outcomes. A random sample of key rounds estimates key disagreement. If the data support a positive key length under the selected proof, they reconcile their remaining strings, verify equality and use a fresh independent public hash seed for privacy amplification. Otherwise they abort.

The public transcript is visible to Eve. Revealed outcomes, syndromes and tags enter the entropy and error bounds. Timing, no-clicks and double clicks also matter when they affect which trials enter those estimates.

Bell-Test Calculation

For a fixed setting pair, let $N_{ab}(\alpha,\beta)$ be the number of eligible trials with outcomes $a,b\in\{-1,+1\}$. The empirical correlator is

$$\widehat E(\alpha,\beta) = \frac{ N_{++}+N_{--}-N_{+-}-N_{-+} }{ N_{++}+N_{--}+N_{+-}+N_{-+} }.$$

For the angle table above, use the sign convention

$$S= E(\alpha_1,\beta_1) -E(\alpha_1,\beta_3) +E(\alpha_3,\beta_1) +E(\alpha_3,\beta_3).$$

The four ideal singlet correlators are

$$\begin{aligned} E(\alpha_1,\beta_1)&=-\frac1{\sqrt2},& E(\alpha_1,\beta_3)&=+\frac1{\sqrt2},\\ E(\alpha_3,\beta_1)&=-\frac1{\sqrt2},& E(\alpha_3,\beta_3)&=-\frac1{\sqrt2}. \end{aligned}$$

Therefore

$$S_{\Psi^-}=-2\sqrt2.$$

Every Bell-local model with independent settings in this two-setting, two-outcome scenario satisfies (Clauser et al., 1969)

$$\lvert S\rvert\leq2,$$

whereas quantum theory permits $\lvert S\rvert\leq2\sqrt2$. Consistent relabeling of outputs and settings gives equivalent CHSH inequalities. Flipping all of one party’s output signs reverses $S$ without changing its magnitude. A calculation should never combine correlators from one convention with a threshold from another.

Finite data produce a confidence interval, not an exact $S$. The acceptance test must account for random setting counts, temporal correlations allowed by the model, heralding, and any stopping rule. Reporting only a point estimate and a Gaussian-looking error bar is not by itself a cryptographic proof.

From Anticorrelations to Raw Key

After Bob’s fixed outcome flip, define the key-basis quantum bit error rate by

$$Q = \Pr(x\neq y\mid\mathrm{key}) = \Pr(a=b\mid\mathrm{same\ direction}).$$

For ideal singlets, $Q=0$. Noise, misalignment, multipair emission, detector effects, or Eve’s intervention can raise it. Alice and Bob do not reveal every key-round bit to estimate $Q$; they either sacrifice a random sample or use a proof that bounds the relevant error from designated test statistics.

Under a justified independent-state asymptotic model, one-way reconciliation gives a rate bound involving $H(X\mid E)-H(X\mid Y)$ (Devetak and Winter, 2005). The first term quantifies Eve’s uncertainty and the second the reconciliation cost. A Bell statistic is useful only insofar as the chosen proof connects it, or the underlying correlators, to that entropy. Finite blocks need additional statistical and hashing analysis.

Three Security Interpretations

The phrase “security from Bell’s theorem” is used for several inequivalent claims. Keeping them separate is essential.

Original Bell-correlation intuition

If Eve replaces the source with pairs carrying locally preassigned outcomes, the resulting correlations obey a Bell inequality. A strong E91 violation therefore rules out that simple local strategy under the Bell assumptions. It also reflects a monogamy tradeoff: correlations that are nearly ideal between Alice and Bob cannot simultaneously be copied perfectly to Eve.

This is powerful intuition, but it is not a complete modern proof. Eve may use quantum systems, coherent attacks, device side channels, memory across rounds, or loss-dependent strategies. Bell-test sampling and classical postprocessing must be integrated into one theorem.

Device-dependent entanglement-based QKD

In a standard entanglement-based proof, Eve may control the pair source and the channel while Alice’s and Bob’s measurement models are characterized. Security can be expressed through complementary bit and phase errors, an entropic uncertainty relation, or virtual entanglement distillation. A common asymptotic one-way bound per sifted key round is

$$r_{\mathrm{EB}} \geq \max\{0,1-h_2(e_b)-h_2(e_p)\},$$

where $e_b$ is the key-basis bit error and $e_p$ is a justified phase-error bound, both taken in $[0,1/2]$. The binary entropy $h_2$ and this bound are derived on the BB84 page. Under a symmetric reduction $e_b=e_p=Q$,

$$r_{\mathrm{EB}}\geq\max\{0,1-2h_2(Q)\}.$$

This security route need not observe a Bell violation. BBM92 (Bennett, Brassard and Mermin, 1992), for example, is an entanglement-based counterpart of BB84 that uses complementary-basis errors without making a Bell inequality the operational certificate.

For the present E91 angles, the phase error must still be inferred; the same-direction key QBER alone is insufficient. With the exact characterized qubit observables above, write $E_{ij}=E(\alpha_i,\beta_j)$. The four test correlators determine, for example,

$$\langle Z\otimes Z\rangle=\frac{E_{11}-E_{13}}{\sqrt2}.$$

This supplies the complementary correlation for the $X$-axis key pair $(\alpha_3,\beta_2)$. Exercise 6 also reconstructs the complementary correlation for the other key axis. These identities assume that the setting subsets sample a common state, with independent choices and a valid acceptance model. They are not device-independent statements. In a finite experiment, uncertainty in all contributing correlators propagates into the phase-error bound; treating the two key classes separately avoids assuming identical noise on them.

Device-independent QKD

Device-independent QKD treats the endpoint measurement boxes primarily by their classical inputs and outputs rather than by a trusted internal Hilbert-space model. A loophole-aware Bell violation then bounds Eve’s information. This stronger conclusion still assumes authenticated communication, secure and isolated laboratories, sufficiently independent random settings, a valid trial structure, and no unauthorized output leakage.

Acín et al. (2007) derived a representative Bell-to-entropy bound against collective attacks. Device-independent QKD explains that bound and the additional sequential and finite-data reasoning required beyond that model. Removing source trust and removing measurement trust are distinct changes; neither removes the need for private settings, isolation and authentication.

Worked Noise Model: Werner Pairs

Consider the two-qubit Werner family

$$\rho_v =v\lvert\Psi^-\rangle\!\langle\Psi^-\rvert +(1-v)\frac{I_4}{4}, \qquad 0\leq v\leq1.$$

The white-noise component has zero correlators, so

$$E_v(\alpha,\beta)=-v\cos(\alpha-\beta), \qquad \lvert S_v\rvert=2\sqrt2\,v.$$

On the same-direction key settings,

$$Q_v=\frac{1-v}{2}.$$

Thus Bell violation occurs when

$$v>\frac1{\sqrt2} \quad\Longleftrightarrow\quad Q_v<\frac{1-1/\sqrt2}{2} \approx14.64\%.$$

That $14.64\%$ number is a Bell-violation boundary for this state and these settings, not a secret-key threshold. The simple symmetric device-dependent bound becomes positive only below approximately $11.00\%$. A device-independent key threshold must be obtained from the particular Bell-to-entropy and finite-key proof. The condition $\lvert S\rvert>2$ alone does not specify a positive-key boundary.

For example, at $v=0.9$,

$$Q=0.05, \qquad \lvert S\rvert=1.8\sqrt2\approx2.546.$$

The illustrative device-dependent asymptotic fraction is

$$r_{\mathrm{bound}}=1-2h_2(0.05)\approx0.427.$$

It is per sifted key round under idealized reconciliation assumptions and does not include the $2/9$ uniform-setting factor, pair-production rate, losses, finite statistics, authentication consumption, or detector effects. The same $Q$ and $S$ can be entered into a particular DIQKD theorem only after its trial, loss, attack, and finite-data assumptions have been verified.

Entanglement does not authenticate identities. Without authentication, Eve can run separate E91 sessions while impersonating the other endpoint, producing excellent correlations on each separate link. The QKD overview describes the resulting attack and the authentication resources needed to prevent it.

Loss, No-Clicks, and Postselection

Loss does not by itself identify eavesdropping, but it changes what the observed sample can certify. An adversarial source may correlate whether a detector clicks with hidden variables and measurement settings. If Alice and Bob compute $S$ only from a favorable detected subset under an unjustified fair-sampling assumption, a local strategy can imitate a Bell violation. This is the detection loophole, demonstrated in data-rejection models by Pearle (1970). Exercise 8 gives a finite, exactly calculable example.

Two broad treatments must not be mixed.

• In device-dependent QKD, characterized source and detector models can place vacuum, loss, double-click, and efficiency terms inside a security proof. Detector side channels still have to match that model.
• In device-independent QKD, no-click behavior must be included in the input-output analysis, or an event-ready herald must define the trial before the private measurement settings are chosen. Outcome-dependent deletion is not legitimate postprocessing.

Coincidence windows also matter. A rule that pairs detections using timestamps can bias the sample if timing depends on setting or outcome. The protocol must predefine the window, resolve multiple detections, and retain the rejected-event counts needed to test that rule.

From correlations to delivered key rate

Let $f_{\rm try}$ be the trial rate, and let $P_{ij}$ be the joint probability of an accepted herald and both detections, conditioned on settings $(i,j)$. With independent setting probabilities $p_i,q_j$, the raw-key coincidence rate is

$$R_{\rm raw}=f_{\rm try}\bigl(p_2q_1P_{21}+p_3q_2P_{32}\bigr).$$

For stationary trials this counts events per second; it is not a secrecy theorem. The simpler product $f_{\rm try}p_h\eta_A\eta_Bp_{\rm key}$ additionally assumes the relevant setting independence and conditional independence of the two detections. Common source failures or timing selection can violate those assumptions. Multipair emission and false heralds can change both the count rate and the conditional state.

Only after testing, reconciliation, finite-key compression and authentication costs does the raw coincidence rate become a net secret-key rate. Keeping those costs separate also clarifies the relation to BBM92 and BB84: they use related complementarity arguments, but their physical sources, losses and trusted measurements can differ.

Exercises

1. Derive the singlet joint distribution

Starting from $\Pi_a(\alpha)=[I+aA(\alpha)]/2$, derive

$$P(a,b\mid\alpha,\beta) =\frac14[1-ab\cos(\alpha-\beta)].$$

Solution

Expand the product of projectors:

$$\Pi_a\otimes\Pi_b =\frac14\left[ I\otimes I +aA\otimes I +bI\otimes B +abA\otimes B \right].$$

The singlet’s local Bloch vectors vanish, so the middle two terms have zero expectation. Its correlation tensor gives

$$\langle A(\alpha)\otimes B(\beta)\rangle =-\cos(\alpha-\beta).$$

Substitution yields the stated probability. Summing over either outcome gives $1/2$, and setting $\alpha=\beta$ leaves only $a=-b$ with nonzero probability.

2. Check every CHSH sign

Evaluate all four correlators in the page’s definition of $S$ and verify $S=-2\sqrt2$.

Solution

Using $E(\alpha,\beta)=-\cos(\alpha-\beta)$,

$$\begin{aligned} E(0,\pi/4)&=-1/\sqrt2,\\ E(0,3\pi/4)&=+1/\sqrt2,\\ E(\pi/2,\pi/4)&=-1/\sqrt2,\\ E(\pi/2,3\pi/4)&=-1/\sqrt2. \end{aligned}$$

The second correlator enters with a minus sign, so all four contributions to $S$ equal $-1/\sqrt2$. Their sum is $-2\sqrt2$. The magnitude is the invariant comparison with the local bound.

3. Setting probabilities

Let Alice choose $\alpha_i$ with probabilities $p_i$ and Bob choose $\beta_j$ with probabilities $q_j$. Find the probabilities of key and CHSH test rounds. Recover the uniform values.

Solution

The key cells are $(\alpha_2,\beta_1)$ and $(\alpha_3,\beta_2)$, so

$$p_{\mathrm{key}}=p_2q_1+p_3q_2.$$

The CHSH cells are $(\alpha_1,\beta_1)$, $(\alpha_1,\beta_3)$, $(\alpha_3,\beta_1)$, and $(\alpha_3,\beta_3)$, giving

$$p_{\mathrm{test}} =p_1q_1+p_1q_3+p_3q_1+p_3q_3.$$

For $p_i=q_j=1/3$, these become $2/9$ and $4/9$. The remaining probability is $1/3$.

4. Werner-state boundaries

For $\rho_v$, derive the QBER and find the largest QBER compatible with a CHSH violation in the stated settings.

Solution

White noise gives equal probability to all four outcome pairs. On a same-axis round it therefore produces the wrong, equal-sign outcomes with probability $1/2$, while the singlet never does. Hence

$$Q_v=\frac{1-v}{2}.$$

Because $\lvert S_v\rvert=2\sqrt2v$, violation requires $v>1/\sqrt2$. Eliminating $v$ gives

$$Q_v<\frac{1-1/\sqrt2}{2}\approx0.14645.$$

This is not yet a positive-key condition.

5. Bell violation and a key bound

At $v=0.9$, calculate $Q$, $\lvert S\rvert$, the symmetric device-dependent fraction $1-2h_2(Q)$, and explain why these values do not by themselves establish a positive finite device-independent key.

Solution

The observed parameters are

$$Q=0.05, \qquad \lvert S\rvert=2\sqrt2(0.9)\approx2.5456.$$

Using $h_2(0.05)\approx0.28640$ gives

$$r_{\mathrm{bound}}=1-2h_2(0.05) \approx0.4272.$$

The value $\lvert S\rvert>2$ excludes Bell-local correlations only under a valid trial and causal model. A finite DIQKD claim additionally needs a protocol-specific entropy tradeoff, a one-sided statistical margin, treatment of no-clicks and memory, reconciliation leakage, verification, privacy amplification, and authentication. The point estimates alone do not supply that security analysis.

6. Reconstruct the phase correlations

Assume the characterized observables and a common two-qubit state. Set $U=(Z+X)/\sqrt2$ and $V=(Z-X)/\sqrt2$. Show how $E_{11},E_{13},E_{31},E_{33}$ determine the complementary correlations for the $X$-axis and $U$-axis key classes.

Solution

Bob’s observables are $B_1=(Z+X)/\sqrt2$ and $B_3=(-Z+X)/\sqrt2$. Thus

$$\begin{aligned} \langle Z\otimes Z\rangle&=\frac{E_{11}-E_{13}}{\sqrt2},\\ \langle Z\otimes X\rangle&=\frac{E_{11}+E_{13}}{\sqrt2},\\ \langle X\otimes Z\rangle&=\frac{E_{31}-E_{33}}{\sqrt2},\\ \langle X\otimes X\rangle&=\frac{E_{31}+E_{33}}{\sqrt2}. \end{aligned}$$

The $X$ key uses $Z$ as its complementary basis. The $U$ key uses $V$, which is perpendicular to $U$. Expanding $V\otimes V$ gives

$$\langle V\otimes V\rangle=\frac{E_{33}-E_{13}}{\sqrt2}.$$

With the singlet convention, a phase error means equal signs rather than the expected opposite signs. Therefore

$$e_p^{(X)}=\frac{1+\langle Z\otimes Z\rangle}{2},\qquad e_p^{(U)}=\frac{1+\langle V\otimes V\rangle}{2}.$$

For an ideal singlet both correlations are $-1$, giving zero phase errors. For $\rho_v$ both are $-v$, giving $(1-v)/2$. Arbitrary noise need not give equal values. This reconstruction uses the calibrated operator relations and cannot be assumed for uncharacterized boxes.

7. Correlated detections

Given a herald, each detector has marginal click probability $0.8$. If either both click or neither clicks, what is the double-click probability? Compare it with multiplying the marginals.

Solution

Perfectly correlated detection flags give $\Pr(D_A,D_B\mid h)=0.8$. The product $0.8^2=0.64$ assumes conditional independence and is incorrect here. In general, the joint probability can range from $0.6$ to $0.8$ with these two marginals. Thus the marginal efficiencies alone do not determine a raw coincidence rate.

8. A local model with postselected CHSH equal to four

Restrict attention to the two settings per party used for CHSH, labeled $x,y\in\{0,1\}$. Each trial draws independent uniform values $x_*,y_*$ and a sign $r=\pm1$, shared by the devices but independent of the actual settings. Alice clicks only if $x=x_*$ and then outputs $r$. Bob clicks only if $y=y_*$ and then outputs $c_{x_*y_*}r$, where

$$(c_{xy})=\begin{pmatrix}-1&+1\\-1&-1\end{pmatrix}.$$

Find the CHSH value after discarding noncoincidences. Is the model nonlocal?

Solution

For each chosen setting pair, both devices click with probability $1/4$. Conditioned on that event, $x_*=x$ and $y_*=y$, so the outcome product is exactly $c_{xy}$. The retained correlations give

$$S_{\rm kept}=E_{00}-E_{01}+E_{10}+E_{11}=-4.$$

Yet each device uses only its own setting and the shared variables. Bob’s use of $x_*$ does not communicate Alice’s actual setting: $x_*$ was fixed independently beforehand. The model is local; the apparent violation comes from selecting a different hidden-variable subset for each setting pair.

If every no-click is instead assigned $+1$, each full-trial correlator is $(c_{xy}+1)/4$ and the same CHSH expression gives $S=-1/2$, inside the local bound. This simple example shows why equal coincidence rates across settings do not justify fair sampling. A valid device-independent proof must include no-click outcomes or use an appropriate earlier event-ready selection.

References

• A. Acín, N. Brunner, N. Gisin, S. Massar, S. Pironio, and V. Scarani, “Device-Independent Security of Quantum Cryptography against Collective Attacks,” Physical Review Letters 98, 230501 (2007), doi:10.1103/PhysRevLett.98.230501.
• C. H. Bennett, G. Brassard, and N. D. Mermin, “Quantum Cryptography without Bell’s Theorem,” Physical Review Letters 68, 557–559 (1992), doi:10.1103/PhysRevLett.68.557.
• J. F. Clauser, M. A. Horne, A. Shimony, and R. A. Holt, “Proposed Experiment to Test Local Hidden-Variable Theories,” Physical Review Letters 23, 880–884 (1969), doi:10.1103/PhysRevLett.23.880.
• I. Devetak and A. Winter, “Distillation of Secret Key and Entanglement from Quantum States,” Proceedings of the Royal Society A 461, 207–235 (2005), doi:10.1098/rspa.2004.1372.
• A. K. Ekert, “Quantum Cryptography Based on Bell’s Theorem,” Physical Review Letters 67, 661–663 (1991), doi:10.1103/PhysRevLett.67.661.
• P. M. Pearle, “Hidden-Variable Example Based upon Data Rejection,” Physical Review D 2, 1418–1425 (1970), doi:10.1103/PhysRevD.2.1418.