in conventional information theory and cryptography , it is taken for granted that a digital message can always be copied easily , even by someone ignorant of its meaning .
analog messages ( e.g.  handwritten signatures ) are somewhat harder to copy , but not really infeasible , and digital data can be protected to a considerable extent by interposing a restrictive hardware interface between the data and the outside world ( e.g.  smart credit cards ) ; but in both these cases , the difficulty of copying is only technological , not fundamental
. however , when elementary quantum systems such as polarized photons are used as the transmission medium , routine copying of messages is no longer possible even in principle . in particular , there are ways of encoding messages so that they can be copied reliably only with the help of certain key information used in forming the message .
quantum coding was first described in  [ w ] , along with two applications : making money that is in principle impossible to counterfeit , and multiplexing two or three messages in such a way that only one can be read .
more recently [ bbbw ] , quantum coding has been used in conjunction with public key cryptographic techniques to yield several schemes for unforgeable subway tokens . here
we show that quantum coding considerably enhances the usefulness of another standard cryptographic device , the one - time pad .
mathematically , a polarized photon acts like a two - bit read - once memory one of whose bits ( k ) serves as a read key for the other ( m ) . querying the memory with the correct k yields the correct value of m. querying with the wrong k yields a random bit instead of m , and in either case querying resets the memory so that subsequent queries yield no new information .
even after a query , it is generally impossible to infer the initial state of either bit , because the memory gives no indication of whether its response was the correct response to the correct key or a random response to the wrong key . because it represents the behavior of an elementary quantum system , this kind of restricted - access memory
should be thought of as a natural information - processing primitive , not as a complex technological device that could probably be circumvented in principle . ordinarily , when one thinks of a technological restricted - access memory , one has in mind an information - storage device .
photons can also be stored ( e.g.  between mirrors , or in a closed optical fiber ) , but they can not in practice be stored for very long , and their natural application is in the transmission of information .
we thus have a situation in which restricted - access memory , as a storage device , is possible in practice but not in principle via conventional technology , and in principle but not in practice via storage of polarized photons . on the other hand ,
restricted - access transmissions , which can be read or copied only with the help of a key , are possible both in principle and in practice using polarized photons .
polarized light can be produced by sending ordinary light through a polarizing apparatus such as a polaroid filter or nicol prism .
a  beam of polarized light is characterized by its polarization axis , which is determined by the orientation of the polarizing apparatus in which the beam originates .
although polarization is a continuous variable , and in principle can be measured as accurately as desired by passing the polarized beam through a second polarizing apparatus , the uncertainty principle forbids measurements on any single photon from revealing more than one bit about the beam s polarization . in particular ,
if a beam with polarization axis  is sent into a polarizer oriented at angle  , the individual photons behave dichotomously and probabilistically , being transmitted with probability \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$\cos ^2(\alpha - \beta ) $ $ \end{document } and absorbed with the complementary probability \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$\sin ^2 ( \alpha - \beta ) $ $ \end{document}. the photons behave deterministically only when the two axes are parallel ( certain transmission ) or perpendicular ( certain absorption ) . if the two axes are not perpendicular , so that some photons are transmitted , one might hope to learn additional information about  by measuring the transmitted photons again with a polarizer oriented at some third angle ; but this is to no avail , because the transmitted photons , in passing through the  polarizer , emerge with exactly  polarization , having lost all memory of their previous polarization . any other elementary two - state quantum system , such as a spin-1/2 atom , behaves similarly dichotomously and probabilistically .
another way one might hope to learn more than one bit from a single photon would be not to measure it directly , but rather somehow amplify it into a clone of identically polarized photons , then perform measurements on these ; but this hope is also vain , because such cloning can be shown to be inconsistent with the foundations of quantum mechanics  [ wz ] .
in order to encode a message bit m into a photon that can be read or copied reliably only with the help of a key bit k , we generate a photon with a selected one of the four polarization directions 0 , 45 , 90 and 135 degrees . [
generating a single photon of known polarization is possible by variation of the einstein - podolsky - rosen setup  [ bo ] , in which a decaying atom emits two oppositely polarized photons . by polarizing and counting one photon ,
the other s presence is assured and its polarization fixed without measuring it directly . ] if the key bit is a 0 , then the photon is polarized rectilinearly , i.e.  0 or 90 degrees according to whether the message bit is 0 or 1 . if the key bit is a 1 , then the photon is polarized diagonally , i.e.  45 or 135 degrees according to the message bit .  
the quantum encoding\documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$q_k ( m)$$\end{document } of a message m by a key k of equal length is the train of photons obtained by applying the above procedure bitwise to m and k. to read a quantum - encoded message with the help of its key , one simply reads each photon with a polarizer oriented so as to cause it to behave deterministically , for example , reading the rectilinear photons with a 0-degree polarizer and the diagonal photons with a 45-degree polarizer .
an attempt to read a photon with the wrong key causes it to behave randomly , losing its stored information .
for example , if a 45- or 135-degree photon is read with a 0-degree polarizer , it will be transmitted with 50 per cent probability in either case , and all evidence of its original polarization will be lost .
suppose an eavesdropper intercepts and attempts to read a quantum transmission \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$q_k(m)$$\end{document } without being detected .
consider first the case in which the message m and key k are both random .
not knowing k , the eavesdropper makes the wrong measurement on half the photons , and thus obtains a message \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$m'$$\end{document } differing from m in 1/4 of its bit positions ( of course the eavesdropper does not know which ones ) .
having destroyed the original transmission by reading it , the eavesdropper must now , in order to remain undetected , inject a forged transmission designed to approximate the intercepted one as well as possible . not knowing which measurements are wrong , the eavesdropper s best strategy is to produce a new train of photons in agreement with the results of the measurements , as if they had all been right .
half of the photons in such a forged transmission will be correct ; the other half have wrong key values ( i.e.  will be diagonal when they should be rectilinear , or vice versa ) , and when subsequently measured with the correct key by the intended receiver , these will give wrong answers half the time .
thus the error probability is 1/4 per bit , both for reading the quantum transmission without knowing its key , and for having a forged replacement agree with what the original message would have said when decoded by the intended receiver .
of course , if the intended receiver knew only k but had no prior knowledge of m , the eavesdropping would still1 go undetected , since a random message with random errors still looks random .
quantum money  [ w ] corresponds to the case where the intended receiver ( the bank ) has perfect knowledge of both m and k , while the counterfeiter knows neither .
the usual message m sent over communication channels is intermediate between these extremes : the receiver has partial prior knowledge of it ( e.g.  expecting it to be in english ) .
simply encoding an arbitrary message m with a random quantum key k has two disadvantages : 1 )  if  the message is too random the receiver wo nt be able to detect eavesdropping , for the reason mentioned above ; 2 )  if  the message is too redundant ( e.g.  english ) , eavesdropping will be detected , but by then the eavesdropper will have gained significant information about the message , perhaps even enough to decrypt it uniquely , because eavesdropping induces errors in only 1/4 of the bits .
( in this respect quantum coding differs from ordinary one - time pad encryption , where ignorance of the key prevents the eavesdropper from learning anything about the encrypted message,2 though of course it can be freely copied . )
the trick is to make the message redundant with an error - detecting code \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$m \rightarrow e(m)$$\end{document } , then hide the redundancy from the eavesdropper by an ordinary one - time pad j , before applying quantum coding .
for any error - detecting code e ( assumed known to the eavesdropper ) let the strongquantum code\documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$s^e$$\end{document } be defined as follows : let j and k be two random key strings of length \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$|e(m)|$$\end{document } not known to the eavesdropper.3 then the strong quantum encoding\documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$s^e_{j , k}(m)$$\end{document } of message m is the train of photons \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$q_k(j { \text { xor } } e(m))$$\end{document}. it is obvious ( because of the one - time pad j ) that the eavesdropper can learn nothing about m from \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$s^e_{j , k}(m)$$\end{document}. moreover , for suitable error - correcting codes,4 eavesdropping incurs a high risk of being detected .
even the rudimentary code of repeating the message twice \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$e(m)=mm$$\end{document } suffices to detect eavesdropping with probability at least \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$1 - 0.79^k$$\end{document } when k photons have been intercepted , quite close to the optimum \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$1 - 0.75^k$$\end{document } implied by the independent , probabilistic nature of eavesdropping - induced errors .
although the simple code \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$e(m)=mm$$\end{document } is nearly optimal for eavesdropping - detection , a more complex code would be preferable for another reason : the detection of deliberate message alteration .
although randomly quantum - coded photons can not be read reliably , they can be altered reliably .
for example , the polarization axis of a photon can be rotated by 90 degrees , without measuring or otherwise disturbing it , by passing the photon through an appropriate sequence of mirrors ( or , more mysteriously , through a sugar solution ) .
if this manipulation were applied to the first and \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$(n+1)$$\end{document}st photons of a \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$2n$$\end{document}-photon transmission coded as above , both would be altered with certainty in such a way as to induce an undetected alteration in the message .
a  more complex error - detecting code , e.g.  concatenating mm with a check sum of the addresses of the ones in m , would make such alterations unlikely to escape detection . in the next section , where quantum transmissions are used to carry key information for future transmissions
, it will be necessary to use an error - correcting code5 that provides some 
diffusion , in the sense of making each bit of \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$e(m)$$\end{document } depend on many bits of  m. this prevents the eavesdropper who has luckily guessed a few bits of the present key from thereby efficiently inferring any bits of future keys . finally , in section  5 , we will need a code e that corrects errors as well as detecting them , to make up for photons that arrive at the receiver but fail to be detected .
we consider a situation in which two users of an insecure communications channel , who initially share a finite secret key , wish to communicate secretly as long as they can . in a classical setting , where eavesdropping is undetectable in principle
, they must assume that all their communications are being listened to , and the volume of safe communication is only linear in the size of the key , unless they resort to pseudorandom key - expansion schemes  [ bm , y ] , which are at best ( assuming \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$\text { p } \ne \text { np}$$\end{document } ) only computationally secure .
we show that by strongly quantum - coding their messages with suitable error - detecting codes , the sender and receiver can safely reuse the same \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$j$$\end{document } and \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$k$$\end{document } keys indefinitely until an eavesdrop is detected .
there is an exponentially small chance ( \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$o(2^{-|k|})$$\end{document } ) that the eavesdropper , having guessed the entire quantum key \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$k$$\end{document } correctly , will be able to eavesdrop on all the transmissions without detection and go on to break the reused \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$j$$\end{document } key in the usual manner , as well as a moderate chance for the eavesdropper to learn a few bits of the \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$k$$\end{document } key correctly and go on to intercept and decrypt a few bits of each message ; but these risks do not increase with the number of times an apparently secure key is reused . ) an eavesdropper who tampers with or suppresses messages will also be detected with high probability , as will one who injects false messages .
when an eavesdrop is detected , the sender and receiver can go on communicating with only slightly diminished safety by replacing their compromised keys by fresh random information sent over the channel in previous uncompromised transmissions . with high probability
they will be able to continue communicating in this fashion for an exponential ( \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$2^{o(|k|)}$$\end{document } ) number of key changes,6 unless the eavesdrops become so frequent before then that they are forced to use up key information faster than they can replace it , in which case they will ( with high probability ) be able to cease communication before any of their transmissions have become uniquely decodable by the eavesdropper . because the replacement keys are truly random , rather than being pseudorandomly computed from an original seed , the security of the scheme would not be reduced by allowing the eavesdropper unlimited computing power .
the scheme does incorporate one technologically unrealistic assumption , viz . that photons can be detected with perfect efficiency ( cf .  section  5 , where this assumption is not made ) .
the ability to send many messages without loss of security ( when no eavesdropping is detected ) follows from the exponential decline of the probability of escaping detection with the number of distinct bit positions ever subjected to eavesdropping , whether these bit positions are listened to all at once , or a few at a time over the course of many transmissions .
for this reason , a quantum channel could even be used to safely send arbitrarily many copies of the same strongly coded transmission , without the eavesdropper being able to forge it accurately , provided the copies were sent one at a time , each only on confirmation that the preceding one had apparently not been listened to . by contrast , if many identical transmissions were sent all at once , the eavesdropper could intercept them all , reliably determine each polarization by multiple measurements , and then escape detection by forging many trains of photons with the now known sequence of polarizations . in order to be sure that no key is reused after a detected eavesdropping , the two communicating parties must alternate strictly in their use of each key .
otherwise the eavesdropper could , for example , intercept and absorb a message from a without forwarding it to b and then wait for b to use the same key on a subsequent message .
the effect of absorbing a message is thus the same as that of spoiling it through eavesdropping : neither party reuses the key with which it was sent . if the initial body of shared key information included several keys reserved for first use by a and several for first use by b , the parties could alternate in the use of each key without strictly alternating transmissions . of course if multiple keys were in use , and particularly if some transmissions were being absorbed by the eavesdropper , the communicating parties would have to prefix each quantum transmission by a ( cleartext ) indication of which key it was encoded with , to avoid reading a message with the wrong quantum key and spoiling it .
the ability to change keys without serious loss of security depends on using a somewhat diffusive error - detecting code when new key information is transmitted . with the simple non - diffusive code \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$e(m)=mm$$\end{document } , an eavesdropper who by good luck has correctly guessed the first and \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$(n+1)$$\end{document}st bits of the current \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$j$$\end{document } and \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$k$$\end{document }
keys will know what measurements to make to reliably read and forge the corresponding bits of a fresh pair of random keys \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$j'$$\end{document } , \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$k'$$\end{document } when these are sent through the channel in four transmissions strongly encoded by \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$j$$\end{document } and \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$k$$\end{document } ; as well as confirming , by the consistency of decoding of the error - detecting code , that the guessed bits of \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$j$$\end{document } and \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$k$$\end{document } are indeed correct .
subsequent lucky guessing on further generations of keys ( along with unlucky guessing causing some keys to be rejected due to detected eavesdropping ) could be used to discover additional bits until , in linear time , some pair of keys \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$j''$$\end{document } and \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$k''$$\end{document } became entirely known . to delay this collapse for an expected exponential number7 of key changes \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$2^{o(n)}$$\end{document } , it suffices to use an error - detecting code that diffuses information about each bit of its argument \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$m$$\end{document } among many bits of its value \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$e(m)$$\end{document } ; so that knowledge , say , of any \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$n/4$$\end{document } bits of \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$e(m)$$\end{document } reveals little or nothing about any bit of \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$m$$\end{document}. many error - detecting codes have this property , e.g.  a  random mapping from \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$n$$\end{document}-bit strings to \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$2n$$\end{document}-bit strings , or the linear code obtained by mod-\documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$2$$\end{document } multiplying \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$mm$$\end{document } by an appropriate nonsingular matrix . with a diffusive code ,
knowledge of a few bits of \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$j$$\end{document } and \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$k$$\end{document } would not enable the eavesdropper to make reliable measurements of any bits of the replacement keys \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$j'$$\end{document } and \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$k'$$\end{document}.
although visible light photons can be polarized with nearly perfect efficiency ( e.g.  a  nicol prism can split a beam into two beams , very nearly perfectly polarized at right angles to each other , whose total intensity is scarcely less than that of the incoming beam ) , and transmitted with nearly perfect efficiency ( in a vacuum the only significant losses are due to diffraction , and these can be made negligible by using a beam diameter considerably greater than the square root of the product of the transmission distance and the wavelength of light ) , current technology allows them to be detected with only about thirty per cent efficiency.8 fortunately , the scheme of the preceding section can be modified to accommodate finite detector efficiency , at the cost of using a more complicated error - correcting code \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$m \rightarrow e(m)$$\end{document } in place of the error - detecting code , and a more complicated criterion for key rejection than the detection of a single error on decoding \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$e(m)$$\end{document}. somewhat surprisingly , the modified scheme remains secure against an eavesdropper with a more efficient , or even perfectly efficient , photon detector .
the volume of safe communication for this scheme is more than linear , but may be less than exponential , in the initial key size .
the main modification is to use standard faint pulses of polarized light instead of single photons , each pulse being of such a size that when it is sent into a detector of the given efficiency ( e.g.  30 per cent ) , or split into several fainter pulses ( e.g.  by  a half - silvered mirror or a nicol prism ) and sent into several such detectors , the total number of photons detected obeys a poisson distribution of mean  1 .
such a standard faint pulse can easily be produced by filtering a standard bright pulse of polarized light to reduce its intensity by the requisite constant factor .
a standard faint pulse of a given polarization resists copying nearly as well as a single photon would .
the best strategy for an eavesdropper to copy a faint pulse is to use a half silvered mirror and two nicol prisms to split the incoming pulse into four beams , one of each canonical polarization , and monitor each beam by a photon detector .
most of the time , only one of the detectors will register a photon , and the eavesdropper will be no better off than in the single photon case . occasionally two or three detectors will register , yielding more information .
only when three detectors register will the pulse s polarization be known unambiguously ( e.g.  if  both diagonal detectors and the vertical detector register , then the pulse must have been vertically polarized ) .
the faint pulse works well because the chance of three detectors responding to the same pulse is only about 2 per cent ( for a poisson distribution of mean~1 ) .
the other 98 per cent of the time , the eavesdropper does not learn the pulse s polarization unambiguously , and , as with single photons , can not reliably copy  it . even a technologically advanced eavesdropper , with perfectly efficient photon detectors , could not copy faint pulses reliably .
for example , if the advanced eavesdropper uses 100 per cent detectors to analyze a pulse intended for 30 per cent detectors , an average of 3.3 photons will be detected per pulse , but the chance that these will appear in three different beams , and thus reveal the pulse s polarization unambiguously , would still be only about 25 per cent .
the converse phenomenon , namely statistical failure to detect even one photon when a pulse arrives , requires that the rejection test be made more complicated .
even if a transmission is not subjected to eavesdropping , about \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$1/e$$\end{document } of its light pulses go undetected , due to normal bad luck at the detectors .
the rejection test must begin by deciding whether the number of missing light pulses is so great as to raise the suspicion of eavesdropping ( a wise eavesdropper now might not bother to forge replacements for the intercepted pulses , but instead let them remain missing , hoping to pass them off as pulses that arrived but were not detected ) .
if the number of missing pulses is not too great , the error - correcting code must reliably restore the data they would have carried , as well as checking for polarization errors , which as before would indicate interception and forgery of some of the pulses .
a  convolutional code [ g ] appears most suitable for achieving the desired high efficiency of error - correction in a channel with a large number of erasures ( \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$1/e$$\end{document } ) .
depending on the purity of polarization available from the nicol prisms , the code could be made to tolerate and correct a small number of polarization errors , but reject a larger number as evidence of forgery . since the capacity of a binary channel with \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				
\usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$1/e$$\end{document } erasure probability is 0.632 , a four - fold expansion in \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$e(m)$$\end{document } offers ample room for efficient error detection and correction .
this in turn means that eight transmissions , each containing n fresh key bits , would have to be accepted to replace the \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$8n$$\end{document } bits sacrificed in a rejection .
the most problematical aspect of the modified scheme is the decision of when to reject a transmission and change keys .
by contrast with the scheme of the previous section , it is now necessary to change keys periodically ( at least every \documentclass[12pt]{minimal } 
				 \usepackage{amsmath } 
				 \usepackage{wasysym } 
				 \usepackage{amsfonts } 
				 \usepackage{amssymb } 
				 \usepackage{amsbsy } 
				 \usepackage{mathrsfs } 
				 \usepackage{upgreek } 
				 \setlength{\oddsidemargin}{-69pt } 
				 \begin{document}$$n^{1/2}$$\end{document } transmissions ) even in the absence of any evidence of eavesdropping , in order to prevent an eavesdropper from intercepting all of the bit positions , a few at a time , over the course of many apparently safe transmissions .
the expected number of safe key changes has not been worked out , but it is not implausible that it is still exponential in the key size.9
 when elementary quantum systems , such as polarized photons , are used to transmit digital information , the uncertainty principle gives rise to novel cryptographic phenomena unachievable with traditional transmission media , e.g.  a  communications channel on which it is impossible in principle to eavesdrop without a high probability of being detected . 
 with such a channel , a one - time pad can safely be reused many times as long as no eavesdrop is detected , and , planning ahead , part of the capacity of these uncompromised transmissions can be used to send fresh random bits with which to replace the one - time pad when an eavesdrop finally is detected . 
 unlike other schemes for stretching a one - time pad , this scheme does not depend on complexity - theoretic assumptions such as the difficulty of factoring . 