E91 Quantum Key Distribution

Overview

The E91 protocol, proposed by Artur Ekert, is a quantum key distribution scheme based on entanglement. A source distributes entangled photon pairs, with one photon going to Alice and the other to Bob. Each measures their photon in one of several randomly chosen bases, and a statistical test, the CHSH Bell inequality, checks that the correlations are quantum. If the test passes, the matching measurements give a shared secret key.

Where BB84 relies on the fact that measurement disturbs a quantum state, E91 relies on the fact that no local hidden-variable theory can reproduce quantum correlations. A violation of Bell's inequality certifies the entanglement and limits what an eavesdropper can know.

The problem it solves

Establishing a shared secret key with security based directly on the foundational properties of quantum entanglement.

History and background

Ekert published the protocol in Physical Review Letters in 1991, three years after he began working on entanglement-based cryptography at Oxford. It connected the foundations of quantum mechanics, namely John Bell's 1964 theorem and the CHSH inequality of Clauser, Horne, Shimony, and Holt in 1969, with a practical application. A year later, Bennett, Brassard, and Mermin showed that a simpler entanglement-based variant, BBM92, is equivalent to BB84.

Experiments followed. Jennewein and colleagues demonstrated entanglement-based QKD in 2000, and in 2020 a team led by Jian-Wei Pan distributed entangled photons from the Micius satellite to ground stations 1,120 kilometers apart and used them for key distribution. The 2022 Nobel Prize in Physics, awarded to Alain Aspect, John Clauser, and Anton Zeilinger, recognized the experimental Bell tests that make such protocols credible.

How it works

Distributes entangled particle pairs to both parties; measuring them in different bases and checking for Bell inequality violations both generates the key and detects eavesdropping.

Bell's theorem says that if the outcomes of measurements were determined by hidden variables prepared at the source, then a certain combination of correlations, the CHSH quantity S, could not exceed 2. Quantum mechanics predicts S can reach 2 times the square root of 2, about 2.83, for entangled particles measured at specific angles. Experiments confirm values above 2.

For key distribution, the connection is that a large violation means the outcomes are not predetermined, so no eavesdropper could have known them in advance. If Eve interacts with the photons to learn the results, she reduces the correlations and lowers S. Alice and Bob measure S from a random subset of their data, and if it is high enough, the remaining data is secret.

In the original protocol, Alice chooses among three measurement angles and Bob among three different ones. Where their angles are the same, the results are perfectly correlated and form the key. Where the angles differ, the results are used to compute S. This ties the key rate to a test of nature itself.

Step by step

1. A source, which may be controlled by Alice, Bob, or an untrusted third party, emits entangled photon pairs in a singlet or Bell state and sends one photon to each party.
2. Alice measures each photon along one of three randomly chosen directions, and Bob along one of three directions, two of which coincide with Alice's.
3. After all measurements, they publicly announce which directions they used for each pair, but not the results.
4. Pairs with matching directions give correlated or anti-correlated bits, which form the raw key. Pairs with other directions are used to compute the CHSH value S.
5. If S is above 2 by a sufficient margin, the channel is certified as quantum and secure. If not, they abort.
6. They carry out error correction and privacy amplification, as in BB84, to obtain the final key.

A worked example

For polarization-entangled photons in a maximally entangled state, the correlation between results measured at analyzer angles a and b is the cosine of 2 times (a minus b). Take Alice at 0 and 45 degrees and Bob at 22.5 and 67.5 degrees. The four correlations have magnitude 0.707, three positive and one negative, and the CHSH combination of them gives S equal to 4 times 0.707, which is 2 times the square root of 2, about 2.83.

If an eavesdropper intercepts photons and replaces them with photons in a fixed state, the correlations become classical and S falls to 2 or below. Alice and Bob measure S, see that it is no longer above 2, and discard the key.

Complexity and resources

What hardware it needs

• A high-quality entangled photon source, typically spontaneous parametric down-conversion in a nonlinear crystal.
• Polarization or time-bin analyzers and single-photon detectors on both sides.
• Low loss, since Bell tests need a high detection efficiency to avoid loopholes.

Applications

• Key distribution over satellite links where the source can be placed on an untrusted platform.
• Quantum networks that distribute entanglement as a resource for multiple applications.
• Foundational tests of quantum mechanics.
• A basis for device-independent protocols that make fewer assumptions about the hardware.

Limitations and caveats

• Entanglement sources and detectors with high efficiency are more demanding than the simple sources used for BB84.
• Key rates are lower than for BB84 at the same distance.
• The full device-independent security proof requires closing detection and locality loopholes.

Common misconceptions

• E91 does not send information faster than light. The measurement results are random, and the key emerges only after classical communication.
• A Bell violation does not mean the key is secret by itself. Error correction and privacy amplification are still required.

How it compares

• BB84 uses prepared single photons, while E91 uses entangled pairs. BBM92 shows that the two are equivalent in security for ideal devices.
• Device-independent QKD strengthens E91 by requiring a loophole-free Bell test and making no assumptions about the devices.
• Teleportation also consumes entanglement but sends a quantum state.

Real-world impact

Connects practical cryptography directly to the foundational tests of quantum mechanics (Bell's theorem), and underlies some modern device-independent QKD schemes.

Why it matters

E91 shows that a test of the foundations of physics can be a security guarantee. It also opened the way for entanglement-based networks, satellite links, and device-independent cryptography.

It is a good protocol to study for anyone interested in why entanglement is a resource, since it makes clear that the same property that violates Bell's inequality also provides secrecy.

Frequently asked questions

Keep learning

• Related algorithm: BB84 Quantum Key Distribution
• Related algorithm: Device-Independent Quantum Key Distribution
• Related algorithm: Quantum Teleportation Protocol
• Related algorithm: Six-State Quantum Key Distribution (Bruß Protocol)

This page is written for educational purposes. Complexity statements describe the best known results at the time of review (September 30, 2026), and research in this area moves quickly, so check recent papers before relying on a specific bound.

← Back to Algorithms Database