The E91 Protocol, Entanglement-Based Quantum Key Distribution

Quantum SecurityThe E91 ProtocolArtur Ekert’s 1991 protocol that builds a secret key from entangled particles and certifies its security with a Bell test, the entanglement-based answer to BB84.Artur Ekert, 1991Entanglement-based QKDBell’s inequalityDevice-independent securityIn this articleFrom BB84 to entanglementHow E91 worksSecurity from Bell’s inequalityCatching an eavesdropperE91 compared with BB84E91 in the real worldThe lasting influenceFrequently asked questionsE91 at a glanceProposedArtur Ekert, 1991TypeEntanglement-based quantum key distributionSecured byThe violation of Bell’s inequalityDetectsEavesdropping, as weakened correlationsLed toDevice-independent quantum cryptographyE91 is the protocol that taught quantum cryptography to draw its security from entanglement itself. Proposed by Artur Ekert in 1991, it offered a strikingly different route to a shared secret key from the one Bennett and Brassard had taken seven years earlier. Where the earlier approach leaned on the impossibility of copying a quantum state, E91 grounds its safety in the strange correlations of entangled particles and the famous theorem of John Bell.This guide explains what the E91 protocol is, how it builds a key out of entanglement, and why a result from the foundations of physics turns out to guarantee its security. It also sets E91 beside its older cousin and looks at how the idea has grown into some of the most ambitious schemes in modern quantum communication.From BB84 to entanglementBy 1991 quantum key distribution already existed, thanks to the BB84 protocol, in which one party prepares photons and sends them to another. Artur Ekert, then a doctoral student at Oxford, asked whether the same goal could be reached from a completely different starting point, using pairs of entangled particles shared between the two parties. The answer reshaped how physicists thought about the security of these schemes.In this protocol there is no sender preparing a message, only a shared source of entanglement feeding both parties at once. The diagram below shows the arrangement, with entangled photons streaming from a central source to Alice on one side and Bob on the other. Each of them measures their photon independently, and the key emerges from the correlations between their results.Ekert’s motivation was partly philosophical. He wanted the security of a key to follow from the most rigorously tested predictions of quantum mechanics, the very correlations that Einstein had found so troubling. By rooting cryptography in those correlations, he tied the practical business of keeping secrets to one of the deepest debates in physics.The E91 protocol. A shared source sends entangled photons to Alice and Bob, whose correlated measurements form a key while a Bell test certifies that no eavesdropper is present.How the E91 protocol worksAt the heart of E91 is a source that produces pairs of entangled particles, sending one of each pair to Alice and the other to Bob. Entanglement means the two particles share a single quantum state, so that measurements on them are correlated in a way no independent objects could match. Neither party can predict their own result, yet the results are deeply linked.This shared origin is the crucial difference from the prepare-and-measure approach. There is no message in transit that an eavesdropper might copy, only a pair of particles whose link was forged at the source. Security becomes a question about the quality of that link rather than the secrecy of a transmission.For each particle Alice and Bob independently choose, at random, one of several angles at which to measure, much as the parties in BB84 choose bases. Afterwards they announce their measurement choices over a public channel, again without revealing the outcomes. When they happened to choose compatible settings their results are perfectly correlated, and from those cases they distil a shared string of bits known only to them.The remaining cases, where their settings did not match, are not simply thrown away as they would be in a prepare-and-measure scheme. Instead, those mismatched measurements are put to a second and quite different use, one that turns the foundations of quantum theory into a security guarantee.Security from Bell’s inequalityThe genius of E91 is that it borrows its security from Bell’s theorem, the deep result showing that the correlations of entangled particles are stronger than any theory based on hidden local properties could ever produce. Alice and Bob use their mismatched measurements to compute a quantity that, in ordinary physics, can never exceed a fixed limit, yet for genuinely entangled particles it does.If their data violate Bell’s inequality in the way quantum mechanics predicts, they can be confident their particles were truly entangled and their key is sound. The security of the protocol therefore does not rest on assumptions about the equipment so much as on a testable fact about nature. This is a subtler and in some ways stronger guarantee than the no-cloning argument behind earlier protocols.The precise quantity they compute is known as the CHSH value, which classical physics caps at two but quantum mechanics can push as high as roughly two point eight. Seeing a value above two is the signature of genuine entanglement, and the closer it climbs to the quantum maximum the more secure the key. It is a number with a double life, settling a foundational argument and guarding a secret at once.This is why E91 is sometimes described as cryptography resting on the laws of physics in the most literal sense. The very experiments that vindicated quantum mechanics against Einstein’s doubts now certify that a key is safe. A debate about the nature of reality became, decades later, a practical tool.Crucially, the test uses data the parties were going to set aside anyway, so the security check costs them almost nothing. The mismatched measurements that a prepare-and-measure scheme simply discards become, in this design, the very evidence that the channel is safe. Nothing is wasted.How E91 catches an eavesdropperAn eavesdropper who tampers with the particles faces an unavoidable difficulty. Any attempt to gain information about the outcomes disturbs the delicate entanglement, and weakened entanglement produces weaker correlations. The result is that the eavesdropper drives the Bell quantity back down toward the ordinary classical limit.Alice and Bob notice this immediately, because the violation of Bell’s inequality that should appear in clean data fades when someone is listening. A full violation is a certificate that the line is secure, while a diminished one is a clear warning to abandon the key. In this protocol the same measurements that build the key also continuously police it.There is a deeper principle at work here called the monogamy of entanglement, the rule that if two particles are maximally entangled with each other they cannot be strongly entangled with anything else. An eavesdropper who tried to share in the correlations would necessarily weaken them, so strong entanglement between Alice and Bob is itself proof that no third party is involved. Physics simply does not allow the secret to be shared three ways.E91 compared with BB84The two foundational protocols of quantum key distribution reach the same destination by different roads. BB84 is a prepare-and-measure scheme, simple to implement, in which Alice actively encodes and sends each photon, and it remains the most widely deployed protocol in practice. the other is entanglement-based, requiring a shared source of entangled pairs, which is harder to build but conceptually richer.Their security arguments differ in flavour too, with BB84 resting on the no-cloning theorem and E91 resting on the violation of Bell’s inequality. The kinship runs deep, and within a year of Ekert’s paper Charles Bennett and others showed that an entanglement-based protocol can be converted into an equivalent prepare-and-measure one, clarifying that the two were views of a single underlying idea. Together they define the landscape that every later quantum cryptography scheme has built upon.E91 in the real worldPutting the protocol into practice is demanding, because distributing entangled pairs over long distances is far harder than sending single photons. Entanglement is fragile and degrades quickly in optical fibre, so for years the protocol was more admired than used. Improvements in entangled-photon sources and detectors have steadily changed that.Key rates remain a practical hurdle, since usable entangled pairs arrive far less often than single photons can be sent, and much current effort goes into brighter sources and faster detectors to close that gap. The trajectory is encouraging, but entanglement-based systems still trail simpler schemes in raw throughput. Trust is the compensating prize, because security that flows from a measured Bell violation can tolerate equipment that is only partly trusted.These trade-offs explain why entanglement-based and prepare-and-measure systems are often built side by side. A network can use the simpler protocol for everyday links and reserve the entanglement-based one for connections where the strongest possible guarantee is worth the cost. The two are partners as much as rivals.The most dramatic demonstration came from the Micius satellite, which distributed entangled photons to ground stations more than a thousand kilometres apart and used them for entanglement-based key distribution. That experiment showed that the ideas behind it can in principle reach across continents, a crucial step toward a genuine quantum internet built on shared entanglement.The lasting influence of E91The deepest legacy of E91 is an idea it made thinkable, that the security of a cryptographic system could be certified by a Bell test rather than by trusting the hardware. This grew into device-independent quantum key distribution, an approach that aims to guarantee secrecy even if the equipment was built by an adversary. It is one of the most beautiful ideas in the field.It also quietly changed what cryptographers were willing to assume. Rather than trusting that a device behaves as advertised, they could demand that it prove its own honesty through the statistics of its outputs. That shift from trust to proof is among the most consequential the field has seen.The same machinery points toward quantum repeaters, devices that would extend entanglement across long distances by stitching shorter links together, and if they can be built the entanglement-based vision that began here could span the globe. Entanglement-based thinking now runs through the wider vision of a quantum internet, in which shared entanglement, distributed by repeaters and satellites, underpins secure communication and much else besides. It was the moment that vision began, the point at which entanglement stopped being a curiosity and became a resource for keeping secrets. Its influence reaches well beyond the protocol that bears its number.It is striking how much of modern quantum communication traces back to a single insight about entangled pairs. The protocol gave the field both a working method and a new way of thinking about trust, and few graduate-student papers have aged so well. The number in its name has come to stand for an entire way of securing the world.That is a heavy load for two characters to carry, yet the protocol has earned it. Every device-independent scheme and every plan for an entanglement-powered network is, in some sense, a continuation of the argument Ekert began in 1991. The idea has proved far larger than its first description.Read more on Quantum ZeitgeistThe BB84 protocol explainedWhat is quantum entanglementPeter Shor and the threat to encryptionWhat is quantum supremacyFrequently asked questionsWhat is the E91 protocol?E91 is a quantum key distribution protocol proposed by Artur Ekert in 1991. It uses pairs of entangled particles shared between two parties and derives its security from the violation of Bell’s inequality, rather than from the no-cloning theorem used by BB84.How does E91 work?A source sends entangled particles to Alice and Bob, who each measure at randomly chosen angles. When their settings are compatible their outcomes are perfectly correlated and form a shared key, while the other measurements are used to test Bell’s inequality and confirm security.How is E91 different from BB84?BB84 is a prepare-and-measure protocol in which Alice sends prepared photons to Bob, whereas E91 is entanglement-based, with a shared source feeding both parties. BB84 is simpler to build, while E91’s security rests on a Bell test rather than on no-cloning.Who invented the E91 protocol?E91 was proposed by Artur Ekert in 1991, while he was a doctoral student at the University of Oxford. The name comes from his initial and the year of publication.Why is E91 important?E91 introduced the idea that the security of quantum cryptography could be certified by the violation of Bell’s inequality. This led to device-independent quantum key distribution and shaped the entanglement-based vision of a future quantum internet.originhowbellevevsreallegacyfaqBB84 protocolquantum entanglementPeter Shorquantum supremacyE91 quantum key distributionBell’s theorem Stay current. See today’s quantum computing news on Quantum Zeitgeist for the latest breakthroughs in qubits, hardware, algorithms, and industry deals.