E91: A Secret Key Guarded by Bell's Inequality

A different idea for quantum-secure keys

Most people meet quantum cryptography through BB84 (1984): Alice sends Bob single photons, each randomly prepared in one of two conjugate bases, and their security rests on the fact that measuring a photon in the wrong basis disturbs it. Artur Ekert's 1991 protocol, E91, takes a structurally different approach. Instead of one party sending prepared states to another, a source generates pairs of entangled photons and sends one photon of each pair to Alice and the other to Bob. Neither photon has a defined polarization on its own - only the pair, together, has a well-defined quantum state, the singlet state.

Random bases, then a public split

For each pair received, Alice and Bob each independently and randomly choose one of several measurement angles and record the outcome. After many pairs have been measured, they publicly announce - over an ordinary, unencrypted channel - which angle they used for each measurement, but never the outcome itself. The pairs where they happened to choose the same (or a complementary) angle become the raw key material, since the singlet state guarantees those outcomes are perfectly correlated or anti-correlated. The pairs where they chose different, non-matching angles are set aside for a completely different purpose: testing Bell's inequality.

The CHSH inequality as a burglar alarm

Bell's theorem says that any theory in which each photon secretly carries a predetermined answer for every possible measurement angle - a "local hidden variable" theory, the classical, no-real-magic explanation for correlated outcomes - is bound by an inequality. The CHSH form (Clauser, Horne, Shimony, Holt) combines correlations E(a,b) measured at four angle combinations into a single number S:

S = E(a1,b1) - E(a1,b2) + E(a2,b1) + E(a2,b2)

local hidden variables (classical) :  |S| ≤ 2        (Bell's bound)
quantum mechanics, singlet state   :  |S| ≤ 2√2 ≈ 2.828   (Tsirelson's bound)

The pairs Alice and Bob measured at mismatched angles let them compute S from real data. If the source genuinely delivered entangled singlet pairs and nobody tampered with the channel, quantum mechanics predicts S should come out near 2√2, comfortably violating the classical bound of 2. That violation is not a side note - it is the entire security argument. A value of S close to 2√2 is only reachable by a state that is genuinely entangled at the moment of measurement; it cannot be reproduced by pre-programmed particles carrying a hidden answer sheet, no matter how cleverly an eavesdropper tries to fake it.

Why eavesdropping and entanglement cannot coexist

Suppose an eavesdropper, Eve, intercepts a photon in transit, measures it to learn something, and forwards a new photon onward. The no-cloning theorem guarantees she cannot make a perfect, undetectable copy of an unknown quantum state - measurement is unavoidably invasive. Her interception breaks the delicate entanglement between the original pair; the photon she forwards is no longer part of a singlet, and Alice and Bob's measurements are no longer as strongly correlated as pure quantum mechanics predicts. That degradation shows up directly as a drop in the measured CHSH value: any eavesdropping strategy provably pulls S down toward the classical bound of 2. Alice and Bob simply check, after the fact, whether their measured S is close enough to 2√2. If it is, the key generated from the matched-angle pairs is provably secret; if S has fallen noticeably, they discard the run and try again over a cleaner channel.

From correlated bits to a usable key

Passing the Bell test does not by itself hand Alice and Bob a finished key - real channels have noise, so the raw correlated bits still need error reconciliation (a public, information-minimizing protocol that fixes the small number of mismatches) followed by privacy amplification, which compresses the reconciled string through a hash function so that even the small amount of information Eve might have picked up before detection becomes negligible. What is left is a string of bits Alice and Bob both hold, nobody else can predict, and whose secrecy rests on the CHSH test rather than on trusting the equipment that prepared the photons in the first place - a property called device-independent security that BB84-style protocols do not offer as directly.

Frequently asked questions

Try it live

Everything above runs in your browser - open E91 Quantum Key Distribution and change the parameters while it is running. Nothing is installed, nothing is uploaded, the whole model lives in one tab.