Let me follow up on the Shining Cryptographers idea with a more careful
analysis of the last proposal I made in my earlier posting.
To recap, a group of cryptographers wants to communicate anonymously,
without the sender of a message being traced. They do so by circulating
a photon around a ring which passes through stations controlled by
each cryptographer. Within the station the cryptographers control
equipment which can rotate the photon's polarization by a desired amount.
The photon is injected with some particular polarization, and at the end
the polarization is measured. If the polarization has not changed the
group is sending a 0 (which includes the possibility of sending nothing
at all). If the polarization is turned by 90 degrees someone in the
group is sending a 1.
In some variants the photon travels around the group multiple times before
it is measured. Let us call this number of times the "circulation count".
We assume that each cryptographer can rotate the photon by separate
amounts each circulation.
The proposal is that if a cryptographer wants to send a 0, he rotates
the photon by amounts which add up to an even multiple of 90 degrees,
and if he wants to send a 1 he rotates the photon by amounts which add
to an odd multiple of 90 degrees. If the circulation count is 1 this
means that he rotates the photon by exactly 90 degrees to send a 1, and
not at all to send a 0. (Note that rotating a photon by 180 degrees is
the same as not rotating it at all.)
In the case of circulation counts greater than 1, each individual rotation
can be chosen in such a way that it is uniformly distributed between 0
and 180 degrees. With a circulation count of n, the first n-1 rotations
can be chosen independently, and the last one is then determined by the
requirement to add to the proper multiple of 90 degrees. Because all
the others are chosen uniformly, the result is that the nth rotation
amount is also uniformly randomly distributed in the 0-180 range.
Hence each individual rotation considered on its own will be unbiased,
when the circulation count is greater than 1. This is the algorithm
the cryptographers use.
Henceforth we will assume circulation count is greater than 1 except
where noted.
Now we asssume that Eve, the eavesdropper, has corrupted some of the
cryptographers and is able to make them behave improperly. She wants
to determine who is sending a given message by making extra measurements
on the photon as it passes through the stations she has corrupted.
Note that photon polarization is a two-state system. Once a basis has
been chosen for measuring the polarization, any such measurement collapses
the photon into one of the two pure states of that basis. Eve has the
power to choose the basis she will use for her measurement, but she cannot
avoid collapsing the photon state.
The first result I have is that any such measurement by Eve (where she
does not already know the input) will change the final measured photon
state with probability 1/2. This is true regardless of how she chooses
her basis.
Once the photon has been rotated by an agent not controlled by Eve, she
does not have any information about its polarization state. As noted
above, the individual rotations are completely random. Hence any such
measurement will collapse the wave function into the basis state chosen
by Eve.
Once she makes such a measurement, subsequent rotations will be based on
the new state into which the photon was collapsed by Eve, rather than the
state before it was measured. When the photon reaches the end and is
measured, it will be rotated compared to what it was supposed to be, and
the amount of rotation is exactly the amount by which Eve perturbed the
photon by measuring.
It follows, then, that Eve's effect on the photon does not depend on where
she makes the measurement, and for simplicity we can consider the case
where the measures the photon immediately before it is measured by the
final cryptographer. In that case the photon enters Eve's apparatus in a
pure state for the final cryptographer measurement. Eve measures it into
a randomly rotated state, and it is then measured by the cryptographer.
It is simple to show that in this case the chance that the proper result
will occur is 1/2.
Therefore any measurement made by Eve will perturb the result with
probability 1/2. Essentially this means that the final cryptographer
measurement might as well be made on a random photon. In effect, all of
the information carried by the photon is lost.
This is good news and bad news for Eve. The bad news is that any attempt
she makes to measure the photon state will be detected with probability
1/2. She will therefore not be able to make very many measurements
without being caught. (In the sequel we will see how effective her
measurements can be.) The good news for Eve is that she can make as
many measurements as she wants without making things worse for herself.
Making even a single measurement effectively randomizes the results.
Making multiple measurements can't randomize them any further, as
you can't get any more random on a two state measurement than 50-50.
Therefore, as long as Eve is intervening, she should feel free to bring
all the power she can to bear on a single photon, measuring it at every
opportunity, to extract the maximum information possible.
In a subsequent message I will analyze how much information Eve obtains
by doing measurements immediately before and after a target cryptographer
has rotated the photon on each circulation.
Hal
