「视频」量子密码学的实现（上）爱因斯坦的困惑｜Artur Eker

导读

Artur Ekert是新加坡国立大学的量子技术中心主任和Lee Kong Chian百年教授。他还是英国牛津大学数学研究所的量子物理学教授。他是量子密码学的共同发明者之一，他目前的研究涉及量子力学系统中信息处理的大多数方面。他曾与多家公司和政府机构合作并提供咨询服务。他获得了包括1995年麦克斯韦勋章、物理学会奖、2007年皇家学会休斯奖章等多个奖项。2016年，他当选为皇家学会会员。在他的非学术生涯中，他还是一名狂热的潜水员和飞行员。

墨子沙龙 Artur Ekert（上）_【墨子沙龙】量子密码大会 Artur Ekert（上）_腾讯视频

文字版 中文

非常感谢

感谢主办方的邀请我从稍微不同的角度

不同的方式介绍一下量子密码学的实现

但在我开始之前

我想了解一下各位观众的情况

我有几个问题想问一下你们

我想知道你们有多少人真心喜欢数学

喜欢数学的请挥挥手 谢谢

你们有多少人讨厌数学呢 好的

你们有多少人真心喜欢物理呢

我看到听众中物理学家比数学家要多

那么你们有多少人不喜欢物理呢

看起来不是很多 最后

你们有多少人喜欢计算机科学呢

非常好 谢谢

Artur Ekert

这让我知道如何进行接下来的讲座了

在我的最后一张幻灯片中你会看到

数学家和物理学家的差异是非常重要的

我首先要讲的是

事实上Gilles刚才做了一个精彩的介绍

在此我就不过多解释一些必需的基本概念了

解决密钥建立中的密钥分发问题

大致的想法是我们需要Alice和Bob两个人

Alice和Bob | 图片来源：the solace of quantum

他们可能相隔千里

我们想让这他们最终拥有一串相同的0和1组成的随机序列

这个序列是完全没有含义并且完全随机的

但是Alice和Bob两端的序列完全相同

并且只有他们知道

一旦我们能实现这样的随机序列的产生和分发

我们就可以使用各种方式进行通讯了

Gilles刚才提到了一些用密钥来做保密通讯的例子

就安全性来讲

虽然一次性密码本并不高效

它仍然是安全性最好的系统

这里给出一次性密码本的另外一种解释

当Alice和Bob最后有一个密钥时

这个密钥在这里是红色背景的这串序列

此时Alice有一串0和1组成的序列

看起来很像James Bond的Bob

此时也有一串0和1的序列

这样Alice就可以通过

诸如二进制加法等方法

将信息转化为一串有含义的0和1的序列

从而实现信息的加密

那么她取1加上密钥中的0

就得到这里的1了

在这个二进制加法中1加1等于0

这和通常的十进制加法有所区别

但是其他部分都与我们通常的算数相同

0加0等于0 同样的 0加0等于0 1加1等于0

0加1等于1

诸如此类

Gilles刚才提到过

可以统计字符出现的次数来破解非常简单的替换密钥

所以对于这段消息

尽管它是由0和1写成的序列

但它是字母 象形符号或者字符的某种已知的替换

所以存在某种统计规律使得任何密码学家都知道如何去解读

因此我们完全不把它视为加密过的信息

但是这个密钥是真正随机的

没有任何统计学的规律

它只是随机的噪声

当你把有意义的东西同无意义的相加

你就得到了无意义的内容 对吗

所以对于存在规律的东西

与完全随机的东西相加

你就得到了完全随机的密文

密文的随机性与本质上与密钥相同

如果把这个密文通过任何公开受保护的信道

由Alice发送给Bob

Bob收到了密文后 他就可以通过相同的密钥

将密钥的随机性从密文中扣除

也就是说Bob在有密文和密钥的情况下

通过相同的二进制加法就可以重构出原始的信息

其他不知道密钥的人没有办法解密

因为密文看起来是完全随机的

事实上Claude Shannon指出过

如果密钥是保密的并且完全随机的

与消息一样长 没有被重复使用过

那么它就是一个完美的密码

当然唯一的缺点就是这两个相距千里的人

需要不停地重新产生这个密钥

在这个例子当中 因为密钥与消息等长

如果他们想通讯越来越多的内容

他们就需要产生越来越多的密钥比特

但如何实现多比特密钥的产生还是一个有待解决的问题

也有可能现在已经有人已经解决了

Gilles讲过有一些方法可以解决这个问题

但是它们似乎没有一个是那么完美的

某一天,量子力学被引入了这个领域

游戏规则也因此发生了些变化

在我们看起来

在这场密码设计者和密码破译者之间的博弈中

由于量子效应的介入

密码设计者似乎占了上风

我想要说的是

Gilles讲过这个故事如何从Steven Wiesner开始到与Charles相识

以及他们设计第一个密钥分发方案的故事

正如他提到的

这项成果最初被发表在一个不出名的杂志上

那时候还没有互联网

人们获取信息并不方便

因此我对这个卓越的成就并不知情

但有时不知道反倒是件好事

因为你需要自己去解决它

因此我提出了另一个基于量子纠缠效应的系统

很有趣的是

这两个工作的结合推动了这个领域的许多其他的发展

然后接下来我要讲一下

建立量子密钥的另一个稍微不同的途径

这为密钥建立提供了一个方法

我的故事要从量子理论的早期开始

尤其是那个时期的Albert Einstein

他是对当时的量子物理很不满意的物理学家之一

Einstein真的相信自然是确定性的

也就是说应当有物理原理告诉你会发生什么

他非常不满意基础的理论只能给出统计上的预言

因此他后来说

也许我们只能给出统计意义上的预言

是由于我们不够聪明 没能找到正确的理论

也许这个理论的确存在

但只是我们做得不够好 还没弄明白

因此他认为量子物理是一种有点唯象的暂时的想法

他相信最终会有人提出并找到一个更好更精确的理论

可以做出准确的预言

众所周知 他说过上帝不会掷骰子

不可能有无缘无故发生的现象

就好像自然存在着一些固有的随机现象

有些随机是我们可以理解的

这些随机来自于我们不知道某些演化发生时精确的初始状态

或者来自于我们不知道这些演化是如何发生的

比如你抛硬币时

你没法提前知道它会是正面还是反面

但是你相信这个过程是确定性的

如果你有一个非常好的电脑

你也许可以考虑所有初始状态的变化和硬币的演化

最终以此来预测结果是正面还是反面

但是事实却并非如此

但是想象某种存在固有随机性的东西是件很奇怪的事情

至少Einstein也是这么想的

因此在他与他同事的讨论中

他提出了各种想法来说明为什么不应该是这样

他试图说服他的物理学家同事们自然不应该是随机的

通过越来越复杂的论证

Einstein最终开始考虑“实在性的本质是什么”的问题

他说 如果你严肃看待量子物理的话

你就会有关于实在性的问题

如果你思考一下 这是有点道理的

因为“真正的随机”意味着什么呢

它很可能意味着某种东西没有过去的历史

如果它没有过去

那这对于我们经典的思维来说有些反直觉

无论如何 在1935年

Einstein与两位年轻的同事一起写了一篇论文

他在文中提到 我对量子物理有些疑虑

我认为如果你认真看待这些讨论的话

你就会对“存在是依附于某种属性”的说法怀有疑问

他把这些属性称为物理量

这里有一段话

当我第一次读到这篇论文时觉得非常重要

那时我还是牛津大学的一个学生

在那些日子里 你需要去图书馆才能读到它

然后我就找到了这篇论文

我当时通读了整篇文章

这真的是一篇非常美妙的论文

文章非常简单

Einstein解释的非常清晰

爱因斯坦与波尔论战

在这篇论文中，Einstein试着反驳实在性的存在

他试图去说明 如果你严肃看待量子物理的话

就不能把事物的实在性或者说存在性

看作是依赖于某些物理属性的东西

如果你想定义它的含义

定义在幻灯片的这里

我打算读一下因为这句话对我影响很深

它大致在说 如果在不扰动系统的情况下

我们可以100%的概率确定地预测物理量的值

那么存在一个对应于这个物理量的物理实在的元素

他由此出发开始了进一步的论证

但是当我读到这句话时 我觉得这很有趣

对我而言 这听起来有点像密码系统场景中理想窃听

这恰恰就是窃听者想做的事

如果两个人通信

他们把有信息的物理载体从一个人发给另一个人

比如说光子

然后他们把信息编码到某些物理属性上

如果对于用来编码的物理属性的值

你可以确定地预测而不干扰这个系统

你就可以窃听而不被察觉

我觉得这很有趣

让我继续来讲这个故事

看看接下来发生了什么

我来用简单的术语解释一下Einstein和John Bell的论点

我希望你们能理解这些基本的想法

我不会用太多公式

但我会有一张有公式的幻灯片

这样想做一点作业的观众可以自己动手算一下

我们首先从非常简单的光子和极化的例子开始

Gilles已经告诉你们单光子的量子性

以及极化是光子的固有属性

所以极化是光子的性质

而且它不只是…

事实上我们可以去测量它

但是我们不能直接这样测量极化本身

通常测量时我们要选取一个极化方向

然后我们说我们测量了相对于某个方向的极化大小

这就是我们说的极化

在单光子极化的任意测量中

我们可以得到两个不同的值

我们可以将他们标记成0或1

但物理学家通常标记成-1和+1

所以像这里一样 当一个光子入射一个测量设备时，

你选择一个你想测量极化的方向

然后你的测量设备会告诉你是+1还是-1

从这个意义来说

当你问 极化存在吗？

你会说 当然存在

因为我可以测量极化啊

所以某种程度上你相信光子的极化在到达探测器前

就有一个事先存在的值

所以不明所以的

你会想相信光子携带了每个方向的极化值

因为一次这样的测量会揭示某个事先存在的值 对吗

因此当我们测量某个东西时

我们相信在测量前某种属性值已经存在了

然后测量会告诉你它是多少

当你看到一个公共汽车时

比如说 你看到它是红色

所以甚至在你看到车之前

车的红色就已经存在了

只是你“看”的这个动作揭示了某个事先已经存在的东西

Einstein就这点提出了疑问

他说 如果你认真看待量子物理的话

那么你就不能把”实在性”的要素

其中这个物理值也就是物理实在的元素之一把物理值赋予给一个物理实体

事实上爱因斯坦停在了某个层面上

没有为如何解决这个问题提供有效的方案

解决是之后的事了

正如你们所见

这是由爱尔兰物理学家John Bell解决的

他在1964年提出的设想将Einstein的观点变得更加具体

他说事实上爱因斯坦所陈述的问题可以通过实验解决

这是一个可检验的设想

通过实验可以测试粒子的某种属性是不是有事先存在的值

贝尔不等式

注：图是编辑从网上找的相关图片，了解更多请看视频。

文字版 英文

Thank you verymuch.And thank you forinvitation to give you a slightly different perspective.It's like adifferent way of implementing quantumcryptography.But before Istart my talk, I would like toknow a little bit more about my audience.So, here's a few questions that I have for you.

I would like toknow how many of you really like mathematics. So, wave yourhand if you like mathematics

Thank you.

And how many ofyou hate mathematics?Okay, that'sfine.How many of youreally like physics? I can see morephysicists than mathematicians in the audience.OK. How many ofyou don't like physics? Not so many.Right.Okay. Well, thelast one.

How many of youlike computer science?Excellent. Thankyou.

That gives mesome idea how to pitch my talk then.

And you'll seethat this distinction between hemathematicians and the physicists will be veryimportant with my last slide.Anyway, so let mestart with… Well, actuallyGilles made wonderful introductions.

So, I don't haveto explain many basic ideas that otherwise we would have to go through.You know thatwhat we are trying to do using quantum phenomena we are trying tosolve the key distribution of key establishment problem.So, the basicidea is that we would like two individuals, we call them Alice and Bob,and they could bemiles away from each other.

Then we wouldlike them to end up witha sequence of…arandom sequence of zeros and ones that are identical. and aremeaningless, completely meaningless completely random, but identical and known only toAlice and Bob.And once we havethis,we can use allkind of methods of communication.And Gilles wasgiving a few examples how we can then use the key for secure communication. So, the bestsystem as far as security is concerned, but not a veryefficient one,is the one timepad.

And here you haveyet again, another explanation of one-time pad,Once the twoindividuals, Alice and bob, end up with a secret key,and this secretkey, in this case is the sequence that you see on the on the red background.

So, we have Alicewho has, a sequence of zeros and ones.

And we have bobthat looks very similar to James Bond, by the way,that we have,another sequence of zeros and ones here.And Alice canencrypt message that can beconverted into a sequence of zeros and ones,a meaningful sequenceof zeros and ones by,for example,performing a binary addition.

So, she wouldjust take one and added to zero from the key. I will get onehere.And in thisbinary addition, one plus one is equal zero.So that'ssomewhat unusual.But everythingelse goes the same as a usual arithmetic.So, zero pluszero is zero. Again, zero pluszero is zero. One plus one iszero.Zero plus one isone,and so on, soforth.So, you see thething goes that, Gilles was telling you that people canuse the statistical occurrence of characters to break very simple substitutionkeys.So, if you if yougive this message,even though it'swritten as a sequence of zeros and ones, It's kind of aknown substitution for letters, pictogram or characters that are meaningful.So, there is acertain statistical pattern there that any cryptographer would know howto read.So, we don't evenconsider this as disguisinginformation.However,this key is truly random.There's nostatistical pattern there.It'sjust random noise.So, when you addsomething meaningful to rubbish,you get rubbish.Right?So,you take something that has a pattern.add intosomething that is completely random. You get acryptogram that is completely random. So, itis basically as random as the key here.

So then if youjust send this cryptogram over any open and protected channel, so, it goes fromAlice to bob,then bob receivesthe cryptogram having the samekey that he cansubtract this randomness from cryptograms.

So effectively, Bobjust takes the cryptogram, takes the cryptographic key,And by performingexactly the same binary addition would reconstruct the message.

And nobody whodoesn't know the key would be able to decipher this simply because this looks really truly random.And it was infact Claude Shannon, who showed that 06:05if the key is secret truly random,as long as themessage is never reused then this is aperfect cipher.

The only weakpoint, of course, is that having those two individuals miles away, they would needto regenerate, reestablish this key over and over again. Because the keyis as long as the message, in this particular case, if they want tocommunicate more and more, they have togenerate more and more secret bits and how to do itexactly is an open question, or used to be anopen question.And Gilles toldyou that there are several solutions to this problem,but none of themseems to be so perfect.And then at somepoint, quantum physics entered into this field.And that changeda little bit the rules of the game.And it seems tous that in thisbattle between the code makers and code breakers,it seems that,because of the quantum phenomena,the code makersmay have an upper hand.

So, I will tellyou…Gilles told youabout how it all started with and how he met Charlesand how theydesigned the first key distribution or key establishment scheme And as you know,as he showed that originallyappeared in a rather obscure journal and was beforeInternet and before easyaccess to information.So, I was notaware of this wonderful achievement, which is, youknow, sometimes it's good if you are not aware of something, because you haveto work it out yourself.So, I proposedanother system that was based on another quantum phenomenon called quantumentanglement.And it was theninteresting to see how the fusion ofthose two ideas contributed to many other developments in the field.So, what I'mgoing to tell you a little bit about 08:07is how a slightly different approach toquantum key establishment,you know, givesyou a way of establishing key.08:23My story goes into the early days ofquantum theory. 08:34and in particular, Albert Einstein,who was one of those physicists,who was neverreally quite happy with quantum physics, as it was presented at the time,Einstein really believed that the nature should be deterministic,that there shouldbe, that the laws of physics should really tell you what's going to happen.

He was veryunhappy with the fact that the fundamental theory can give you only statisticalpredictions.So, then he said,well, maybe thisstatistical prediction is because we arenot clever enough to find the right theory.

Maybe it just…itmaybe does exist, but we are simplynot good enough to figure this out. So, he thoughtthat the quantum physics was a little bit of a phenomenological, you know,provisional think that eventuallysomeone will come up and will find a better, more precise theory where you will beable to make sharp predictions. So, he's knownfor saying that god doesn't play dice.

You know, itcannot be the case that something happens for no reason just like that. You know, there'sinherent random phenomenon in nature.

There may berandomness that we perceive,because we don'tknow the exact initial conditions or how theevolution happens.For example, ifyou toss a coin,then you don'tknow in advance whether it’s going to be heads or tails.

But nonetheless,you believe that this process is deterministic.

If you had asuper-duper computer, you would be ableto take into account all the motion of the initial conditions, the evolution ofthis coin. And eventuallyyou would be able to predict whether it's heads or tails. it's not that it's known, so…But you know comeup with something that is inherently random is a little bit weird. And at leastEinstein thought it was weird. So… and he, indiscussion with the colleagues, came up with allkinds of ideas, why it shouldn't be the case.

So, he was tryingto persuade his colleagues, physicists that nature cannot be random. And by gettinginto more and more sophisticated arguments, Einsteineventually came up even with questioning the reality that the essence ofreality that whether…

He said, well,look, you really take quantum physics seriously,you may end upquestioning your reality, If you thinkabout it, that kind of makes sense because what doesit mean that something is truly random?

You know, that means probably that something doesn't have a history.And if it doesn'thave a history, so it's a bitcounter-intuitive to our classical mind.Anyway, soEinstein, in 1935,sided with twoyounger colleagues and wrote a paper where he said,well, you know, I'm worried about quantum physics. And I think ifyou take arguments seriously,then you willhave issues with attributing existence to certain properties.He called themquantities.

There was this one paragraph thereor one sentence that for me wasvery important when I was reading this paper for the first time I was a studentin Oxford at the time. And in those olddays, you had to go to library to read it.And I just foundthis paper.And I was goingthrough this paper.

(It’s) a beautiful paper really.It's really verysimple.Einstein was very, very clear in the way he was explaining things.

And in this paperEinstein was trying to, you know, argue against the reality. He was trying tosay, you know, if you take the quantum physics seriously that you may notbe able to attribute reality or existence to certainphysical properties. And then he wantedto define what it means. And there's thisdefinition,which I'm goingto read because this sentence had an impact on me. It basicallysaid, if without in any way of disturbing a system we can predict withcertainty, that is with probability equal to unity, the value of physicalquantity, then there existsan element of physical reality corresponding to this physical quantity.

Now, for him, youknow, it’s the starting point for some further arguments But when I readit, I thought, well, that's kind of interesting.That sounds to mea little bit like ideal eavesdropping in cryptographic scenario.So, this isexactly what the eavesdropper would like to do. If you have twopeople communicating,they sendphysical carriers of information from one to the other,for example,photons.

And they encodeinformation in certain physical properties. So, if you canpredict with certainty the value of this physical property that is used forencoding without disturbing the system, that you may beable to eavesdrop without beingnoticed.So, that wasinteresting, I thought So, let's takethis story farther. And let's seewhat happened later So, let meexplain Einstein, and then John Bell's argument in very simple terms. And I hope youwill be able to follow the basic idea. I will not gointo equations,but I will havemaybe one slide with equations for those of youwho want to do a little bit of homework and work it out for yourself. But anyway, solet's start with a very simple example of a photon and polarization.

Gilles alreadytold you about individual quantum of light and thepolarization is as the intrinsic property of a photon. So, polarization is something that aphoton has,and it's justnot… We can actuallymeasure it. But we don'tmeasure polarization as such.We usually justchoose one direction. And we say wemeasure polarization with respect of that particular direction.So that's polarization. And in anymeasurements of polarization, on a single photon, we can get twodifferent values.We can label themeither zero or one.

But physicistsusually label them as minus one and plus one.

So, you send aphoton like here into a measuring device. You choose the orientationalong which you want to measure your polarization.

And then yourmeasuring device will tell you plus one or minus one So, in this sense, when you ask aquestion: Does polarization exist? You say, ofcourse it does Because I canmeasure it, you know And you kind ofbelieve that the photon has a preexisting value of this polarization

when it comes tothis detector. So somehow youwant to believe that the photoncarries the value of polarization along every single direction, because ameasurement as such is something that will uncover preexisting values of something, right? So, when wemeasure something, we believe thatthat something exists prior to our measurement. And themeasurement only tells you what it is.

So, when you lookat a bus, for example. And you see thisbus is red. So, thecolor red existed even before youlook at it. It's just youract of looking is revealing something that is pre-existing to it So, you know,Einstein was questioning this argument. He said, well, if you take quantum physics seriously. Then it may notbe the case that you will be able to attribute the physical…this element ofreality, this physical value to a physical object. And Einsteinactually stops at some level where he didn'tactually give any effective prescription how to resolve this issue. And that happenedlater So, this personthat you can see is an Irishphysicist, John Bell, who in 1964 cameup with the idea to make Einstein ideas so they’re more tangible.

He said thatactually, you know, what Einstein said can be resolved by experiment. It’s a testable proposition, whether theparticles have pre-existing values of certain properties or not.

关于“墨子沙龙”

墨子沙龙是由中国科学技术大学上海研究院主办、上海市浦东新区科学技术协会及中国科大新创校友基金会协办的公益性大型科普论坛。沙龙的科普对象为对科学有浓厚兴趣、热爱科普的普通民众，力图打造具有中学生学力便可以了解当下全球最尖端科学资讯的科普讲坛。