In 1991 Artur Ekert proposed using quantum entanglement itself to distribute a secret cryptographic key. Alice and Bob share singlet pairs |ψ⁻⟩ = (|01⟩ − |10⟩)/√2 and each independently measures with one of three randomly chosen analyser angles. Runs where they happened to pick the same angle give perfectly anti-correlated outcomes and become the shared key; the rest are used to test a CHSH Bell inequality that certifies — with no assumptions about the detectors — that no eavesdropper touched the channel. Real satellite experiments such as China's Micius mission have used this exact idea for intercontinental quantum-secured video calls.
E(a,b) = −cos(a − b) — correlation predicted by
quantum mechanics for a singlet measured at angles a and b.
S = |E(a1,b1) − E(a1,b3) + E(a3,b1) + E(a3,b3)| — the
CHSH combination; local hidden-variable theories require S ≤ 2,
while quantum mechanics allows up to the Tsirelson bound
2√2 ≈ 2.828.
Ekert's E91 paper linked, for the first time, quantum cryptography directly to Bell's theorem: the very act of testing for eavesdropping is a Bell test. If S ever drops toward 2, the channel cannot be trusted — no matter how sophisticated the eavesdropper, the laws of quantum mechanics themselves give the alarm.
The E91 protocol, proposed by Artur Ekert in 1991, is one of two founding approaches to quantum cryptography (alongside the prepare-and-measure BB84 protocol). Instead of sending individually prepared qubits, Alice and Bob share pairs of entangled photons in the singlet state |ψ⁻⟩ = (|01⟩ − |10⟩)/√2, each independently choosing one of three random measurement angles. Runs where their angles happen to coincide give perfectly anti-correlated results and become the raw key; the remaining runs feed a CHSH Bell-inequality test that certifies, from statistics alone, whether the entangled channel was tampered with.
This simulation reproduces the sampling exactly as quantum mechanics predicts: Alice's outcome is drawn uniformly at random, and Bob's outcome is drawn to reproduce E(a,b) = −cos(a−b) for every angle pair. The live CHSH statistic S climbs toward the Tsirelson bound of 2√2 ≈ 2.828 for a clean channel, and collapses toward the classical limit of 2 the moment an intercept-resend eavesdropper is switched on — exactly the security guarantee that makes entanglement-based QKD attractive for real satellite links such as China's Micius mission.
What makes E91 different from BB84?
BB84 sends individually prepared qubits from Alice to Bob and relies on the no-cloning theorem. E91 instead distributes entangled pairs from a shared source and relies on violating a Bell inequality: the security proof comes directly from quantum non-locality rather than from the difficulty of copying an unknown state.
Why do matching angles produce the secret key?
When Alice and Bob happen to choose the same measurement angle, the singlet state guarantees perfectly anti-correlated outcomes. Bob simply flips his bit, and the two sides end up with identical strings without ever having communicated the actual bit values over a public channel.
What does the CHSH value S actually detect?
S measures how strongly the non-matching-basis outcomes violate the classical bound of 2, which any theory based on predetermined local values must obey. An untouched singlet reaches up to 2√2 ≈ 2.828. Any real disturbance of the entangled state — including an eavesdropper's measurement — pulls S back down toward or below 2.
For each pair, Alice's outcome A is drawn as +1 or −1 with equal probability, matching the fact that individual measurement outcomes on a maximally entangled state are always random. Bob's outcome is then drawn so that P(B = −A) = cos²(δ/2) and P(B = +A) = sin²(δ/2), where δ is the angle difference. Averaging A·B over many trials reproduces E(a,b) = −cos(δ) exactly, the correlation predicted by quantum mechanics for a singlet.
When the Eve toggle is on, Eve intercepts each photon and measures it in a randomly guessed angle from the combined angle set, since she does not know which basis Alice and Bob will actually use. That measurement is itself a real Malus-law draw against Alice's outcome. Eve then resends a definite state at her guessed angle, and Bob's outcome is a second, independent Malus-law draw against Eve's resent state — two genuine quantum sampling steps that measurably reduce the correlation and hence S.
The Tsirelson bound of 2√2 ≈ 2.828 is only reached for a perfectly preserved entangled state. Any intercept-resend attack necessarily disturbs the correlations, because Eve cannot measure in the correct basis every time. A threshold around 2.3 gives a safety margin above the classical limit of 2 while still catching a real attacker well before S falls all the way to the classical bound.
Yes. Every non-matching-basis pair updates running sums and counts for its specific angle combination. The four values needed for the CHSH formula — E(a1,b1), E(a1,b3), E(a3,b1), E(a3,b3) — are recomputed live from these accumulated averages each time new pairs are generated; nothing is hard-coded or faked.
China's Micius satellite has distributed entangled photon pairs to ground stations over a thousand kilometres apart, demonstrating intercontinental quantum-secured communication. Fibre-based entanglement QKD links are also being trialled in metropolitan quantum networks as a complement to prepare-and-measure protocols like BB84.
Artur Ekert is a physicist who, as a PhD student in 1991, published the entanglement-based protocol described here, showing that quantum non-locality itself could guarantee cryptographic security — a conceptual bridge between the foundations of quantum mechanics and practical secure communication that had not been made so directly before.