# E91: Ekert's Entanglement-Based QKD Protocol **Source**: https://quantumsequrity.com/blog/e91-protocol-explained **Category**: Quantum Algorithms --- [← Back to Blog](../../blog.html) Quantum Algorithms # E91: Ekert's Entanglement-Based QKD Protocol 11 min read In 1991, a young Polish physicist named Artur Ekert published a paper that took quantum key distribution in a strikingly different direction from BB84. Where Bennett and Brassard had used non-orthogonal single-photon polarizations and the no-cloning theorem to detect eavesdroppers, Ekert proposed using entangled photon pairs and the violation of Bell's inequality. Where BB84 sees an eavesdropper as someone who introduces measurement errors, E91 sees an eavesdropper as someone who breaks the strange statistical correlations of quantum entanglement. This shift from "no-cloning" to "Bell violation" is more than aesthetic. It connects quantum cryptography to the deepest experimental tests of quantum mechanics and opens the door to device-independent security. ## Why E91 Matters Picture two boxes that always agree when asked the same question, but disagree in a peculiar pattern when asked different questions. Albert Einstein, Boris Podolsky, and Nathan Rosen argued in 1935 that such correlations would require either faster-than-light influence or "hidden variables" inside the boxes. John Bell showed in 1964 that quantum mechanics predicts correlations stronger than any hidden-variable theory allows. Decades of experiments (Aspect 1982, Hensen 2015, Giustina 2015) have confirmed the quantum predictions. Ekert's insight was that this strange behavior could be turned into a key-distribution protocol whose security rests on Bell violation rather than on computational hardness. ### The 1991 paper Artur Ekert published "Quantum cryptography based on Bell's theorem" in Physical Review Letters 67, 661-663, on August 5, 1991. The paper proposed sharing entangled pairs between Alice and Bob and using a Bell test to verify that no eavesdropper has tampered with them. The paper has been cited over 6,000 times and remains the foundational document of entanglement-based QKD. ## The Setup Imagine a central source that produces pairs of mysterious correlated coins. Alice gets one coin from each pair; Bob gets the other. The coins are coins in name only: their behavior depends on how each player chooses to measure them. ### Entangled photon pairs The standard E91 implementation uses pairs of photons in the singlet state: |psi-> = (|HV> - |VH>) / sqrt(2) This state has the property that if Alice measures her photon in any basis, Bob's photon collapses to the opposite outcome in the same basis. The correlation is perfect when bases match and follows a precise quantum mechanical pattern when bases differ. ### Three measurement bases Each party chooses randomly from three measurement bases for each photon. In the simplest version: | Party | Basis 1 | Basis 2 | Basis 3 | |---|---|---|---| | Alice | 0 deg | 22.5 deg | 45 deg | | Bob | 22.5 deg | 45 deg | 67.5 deg | The angles are chosen to maximize the Bell parameter S in the CHSH inequality. ## How E91 Works A safety inspector walks through a factory and randomly samples products at different stations. Most samples are used for production checks; a small fraction is sent to a special lab that tests for tampering. E91 has the same structure: most measurements feed the shared key; a special subset tests for eavesdropping via Bell violation. ### Step by step 1. A central source emits entangled photon pairs, sending one photon to Alice and the other to Bob. 2. Alice randomly chooses one of three measurement bases for each photon she receives. 3. Bob does the same with his three bases. 4. After all photons are measured, Alice and Bob announce their basis choices over a public, authenticated channel. 5. They sort their results into two groups: matching-basis events (used for the key) and non-matching-basis events (used for the Bell test). 6. They publicly compare the non-matching-basis results to compute the CHSH Bell parameter S. 7. If S exceeds 2 sqrt(2) by a sufficient margin, no eavesdropper could have tampered with the photons. The matching-basis bits are accepted, error-corrected, and privacy-amplified into a shared key. 8. If S falls below the threshold, the protocol aborts. The Bell test is the key innovation. It does not just detect errors; it verifies the quantum origin of the correlations. ## Bell's Inequality and CHSH A statistician studying classical correlations finds that no matter how cleverly correlated two random variables are, certain combinations of expectations cannot exceed 2 in absolute value. Quantum mechanics predicts up to 2 sqrt(2) ~ 2.828. ### The CHSH parameter For binary measurements with outcomes +/- 1 in two bases each, define S = E(A1, B1) + E(A1, B2) + E(A2, B1) - E(A2, B2) where E is the expectation of the product of outcomes. CHSH proved in 1969 (Physical Review Letters 23, 880-884) that for any local hidden variable theory, |S| <= 2. Quantum mechanics predicts |S| up to 2 sqrt(2). Experiments have confirmed quantum predictions in many laboratories worldwide, including the Hensen-Bas-Dreau-Reiserer-Kalb-Blok-Ruitenberg loophole-free Bell test in 2015 (Nature 526, 682-686). ### Why this matters for security If Eve has tampered with the photons (for example, by intercepting and re-emitting them based on her own measurements), the quantum correlations weaken and S falls. Specifically, any local model of Eve's intervention reduces S to at most 2. Conversely, if S exceeds 2, Eve cannot have a complete local description of the correlations, which means she cannot have full information about the secret key. ## Difference from BB84 A locksmith uses different mechanisms in different lock designs. BB84's mechanism is the no-cloning theorem; E91's is Bell violation. Both lead to information-theoretically secure key distribution, but they differ in significant ways. ### Comparison table | Feature | BB84 | E91 | |---|---|---| | Photon source | Alice prepares states | Central entangled source | | Security primitive | No-cloning theorem | Bell inequality violation | | Number of bases | 2 (rectilinear and diagonal) | 3 (varied for Bell test) | | Detection of Eve | QBER threshold (~11%) | CHSH parameter S < threshold | | Trust in source | Alice's source | Both parties' detectors | | Device independence | No | Conceptual basis for DI-QKD | ### Practical consequences Because E91 uses Bell violation, the security argument can in principle be extended to a setting where the parties do not need to trust their measurement devices. This is called device-independent QKD (DI-QKD), proposed by Mayers-Yao 1998 and developed by Acin-Brunner-Gisin-Massar-Pironio-Scarani 2007. Real DI-QKD experiments are extraordinarily challenging because they require loophole-free Bell tests, but progress is being made. ## Hardware Demonstrations A bridge engineer designs a model bridge before building the real one. Entanglement-based QKD has been demonstrated in laboratory and field experiments since the early 1990s. ### Notable experiments - Tittel-Brendel-Zbinden-Gisin 1998 in Geneva (10 km of installed fiber) - Jennewein-Simon-Weihs-Weinfurter-Zeilinger 2000 in Vienna - Ursin et al. 2007 over 144 km free-space (La Palma to Tenerife, Nature Physics 3, 481-486) - Yin et al. 2017 satellite-distributed entanglement (Micius satellite, Science 356, 1140-1144) The Micius experiment is particularly notable: it distributed entangled photon pairs from a satellite at 500 km orbit to two ground stations 1200 km apart, achieving secure E91-style key distribution at intercontinental distances. ## Limitations A specialty tool has its own limitations. E91 shares many of BB84's practical limitations and adds some of its own. ### Distance and rate Entangled photon sources are typically less efficient than single-photon sources, so E91 has lower key rates than BB84 over comparable channels. Distance limitations are similar (~200 km fiber for direct, longer for satellite-distributed). ### Hardware requirements E91 needs an entangled photon source, polarization-stable channels to both parties, and high-quality detectors. Engineering these to high fidelity is harder than for BB84. Commercial E91-based systems exist but are less common than BB84-based ones. ### Authentication still required Like BB84, E91 requires an authenticated classical channel for basis comparison. Without authentication, Eve could impersonate one of the parties. The authentication key must be pre-shared or derived via classical PKC. ## Device-Independent QKD A vault with a safe inside it adds defense in depth. Device-independent QKD does the same: even if the cryptographic devices are partially controlled by the adversary, the protocol can still be secure as long as Bell violation is observed. ### Why it works Bell violation is a statistical property of measurement outcomes. If the outcomes pass the Bell test, no local model (including any model of the adversary's manipulation) can explain them. So the parties can be confident that the bits they share are unknown to the adversary, regardless of whether the hardware was honest. ### Practical status Device-independent QKD demonstrations exist (Nadlinger et al. 2022 in trapped ions, Nature 607, 682-686) but key rates are very low and the engineering is at the edge of feasibility. DI-QKD remains a research topic; commercial deployments use trusted-device QKD. ## E91 vs Post-Quantum Cryptography The same NSA Cybersecurity Advisory that discourages BB84 deployment for general use also applies to E91. The central concerns (specialized hardware, distance limits, authentication requirements, hardware attacks, network scaling) are independent of which QKD protocol is used. ### Where QNSQY fits QNSQY is post-quantum cryptography software, not QKD. It uses NIST-standardized algorithms (ML-KEM, ML-DSA, SLH-DSA, FN-DSA, HQC, LMS) in hybrid mode with X25519 and Ed25519. It runs on standard hardware (laptops, servers, embedded devices), works across the global internet, scales without specialized infrastructure, and provides authentication via post-quantum digital signatures. For most users, the choice is clear: PQC for general-purpose secure communications and file storage, QKD for the niche scenarios where physical fiber control and acceptance of distance/rate limits make it economic. ## Frequently Asked Questions ### Is E91 more secure than BB84? In an idealized setting, both are information-theoretically secure. E91's Bell-violation argument is conceptually different from BB84's no-cloning argument; whether one is "more secure" depends on the threat model. In practice, real implementations are vulnerable to hardware side channels, and engineering matters more than the protocol choice. ### Does E91 require a trusted central source? In standard E91, the source is assumed to produce true entangled pairs. If the source is compromised (for example, sending photons that are not actually entangled), security is lost. Device-independent QKD generalizes E91 to remove this assumption, but at the cost of vastly more demanding engineering. ### Has Bell violation actually been demonstrated rigorously? Yes. Loophole-free Bell tests have been performed since 2015 in multiple physics laboratories (Hensen et al. 2015 with electron spins; Giustina et al. 2015 with photons; Shalm et al. 2015 with photons). These experiments rule out all local hidden variable explanations and confirm quantum mechanics's predictions. ### Why is E91 less common than BB84 in commercial deployments? E91 requires entangled photon sources, which are technically harder to engineer and operate than the single-photon-prepared states BB84 needs. Most commercial QKD vendors (Toshiba, ID Quantique) use BB84 or its variants because the hardware is more mature. E91 sees use mainly in research and in specific entanglement-distribution contexts. ### Does QNSQY relate to E91 or Bell tests in any way? No. QNSQY is a software product that uses post-quantum cryptography algorithms standardized by NIST. It does not use entanglement, Bell tests, or any quantum mechanical primitive. Its security rests on computational hardness assumptions for lattice and hash problems, plus hybrid combination with classical primitives. ## Sources 1. Ekert, A. K. "Quantum cryptography based on Bell's theorem." Physical Review Letters 67, 661-663, 1991. 2. Bell, J. S. "On the Einstein Podolsky Rosen Paradox." Physics 1, 195-200, 1964. 3. Clauser, J. F., Horne, M. A., Shimony, A., Holt, R. A. "Proposed Experiment to Test Local Hidden-Variable Theories." Physical Review Letters 23, 880-884, 1969. 4. Hensen, B. et al. "Loophole-free Bell inequality violation using electron spins separated by 1.3 kilometres." Nature 526, 682-686, 2015. 5. Yin, J. et al. (Pan Jianwei's group). "Satellite-based entanglement distribution over 1200 kilometers." Science 356, 1140-1144, 2017. 6. NSA. "Quantum Key Distribution (QKD) and Quantum Cryptography (QC) Cybersecurity Advisory." https://media.defense.gov/2021/Aug/04/2002821837/-1/-1/1/Quantum_FAQs_20210804.PDF ## Related Articles - [BB84 protocol explained](../bb84-protocol-explained.html) - [B92 protocol explained](../b92-protocol-explained.html) - [SARG04 protocol explained](../sarg04-protocol-explained.html) - [What is post-quantum cryptography?](../what-is-post-quantum-cryptography.html) - [Why quantum threatens classical encryption](../why-quantum-threatens-classical-encryption.html) --- ### Protect Your Data Before Q-Day Arrives QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats. [Try QNSQY](../../pricing.html)