量子密码学的实现（下）像物理学家一样思考｜Artur Ekert

​

导读

Artur Ekert是新加坡国立大学的量子技术中心主任和Lee Kong Chian百年教授。他还是英国牛津大学数学研究所的量子物理学教授。他是量子密码学的共同发明者之一，他目前的研究涉及量子力学系统中信息处理的大多数方面。他曾与多家公司和政府机构合作并提供咨询服务。他获得了包括1995年麦克斯韦勋章、物理学会奖、2007年皇家学会休斯奖章等多个奖项。2016年，他当选为皇家学会会员。在他的非学术生涯中，他还是一名狂热的潜水员和飞行员。

视频

墨子沙龙Artur Ekert （下）_【墨子沙龙】量子密码大会 Artur Ekert（下）_腾讯视频

文字版 中文

图片里展现的就是在欧洲核子研究组织工作的John Bell

他当时正研究大型对撞机

这是他真正的工作

而不是研究基础物理

但是如今 他却因为在基础物理方面的贡献而闻名世界

我们对他研究大型对撞机了解不多

当然可能知道他在设计大型对撞机的加速器

但是他却并不因此而闻名

这件事给我们传递了一个信息

你应该做你真正热爱的事情

即使你需要你的日常工作来谋生

如果你真的热爱某件事情

那就放手去做吧

因为几年后

你也许就因为你下班后的事而闻名

当然 我这么说

并不是在教唆你们不要好好做你手头的工作

○ John Bell 1964

回到我们的话题

John Bell想出了一个办法解决Einstein的问题

这或许是我这次报告中公式最多的一张幻灯片了

热爱数学和物理的观众们

可以把这张幻灯片拍下来

或者很可能在网上也能找到这些公式

你们可以自己推导一下

John Bell考虑了这样一种方案

方案中有两个人

分别叫做Alice和Bob

他们俩被要求各自测量从同一个光源发射出来的光子的极化

这个光源每次可以发射出两个光子

分别被发给了Alice和Bob

同时Alice只能沿着A1或者A2的极化方向去进行测量

而Bob只能沿着B1或者B2的极化方向进行测量

我们在这不需要考虑太多的实验细节

我们只需要考虑如果是沿着A1测量极化

其数值只能为+1或者-1

沿着A2 B1或者B2测量极化也是如此

那么你可以通过概率论知道

这些随机变量的特定线性组合只有两个数值

要么是+2要么是-2

那么如果我们进行这样的实验

你做了所有的极化测量

其结果的平均值也一定在-2到2之间

○ 贝尔不等式

这是经典情况下我们得到的结论

如果你懂一些概率论

那么如今被人们所知晓的贝尔不等式的内容

就只需要一张幻灯片就足够了

由此可见贝尔不等式涉及到的都是非常简单的计算

这些是现今高中生都能够处理的计算

这样看某种程度上

就数学上来说 贝尔不等式很平凡

但是如果我告诉你大自然并不满足不等式

你就会发现贝尔不等式并不简单

要知道大自然并不知道要不要遵循贝尔不等式

如果你考虑量子力学的话

你也许会说

明明有一些物体之间的关联是满足贝尔不等式的啊

这些关联确确实实是满足贝尔不等式

也就是S的数值小于2

○ Correlations galore

但是也存在纯粹的量子关联是违背贝尔不等式的

在这些关联中实测得的S值事实上可能会大于2

让我们来从物理学家的角度考虑这件事

物理学家需要通过实验来弄清楚这个问题

确实也有一些实验

其中的一些实验并没能给出确定性的结论

但是也许对我们大多数来说

第一个最漂亮也是最令人信服的实验

是由位于奥赛的光学研究所的Alain Aspect

于上世纪八十年代完成的

也就是在John Bell那篇贝尔不等式论文的二十年后

○ Alain Aspect

Alain Aspect实验测量了 S的数值

并且其实验结果出乎大多数人的意料之外

他测得的S数值是大于2的

我相信这很可能是二十世纪最重要的实验之一

因为它告诉我们关于物理实在性的非常深刻的东西

它告诉我们Einstein关于实在性的想法是对也是错

Einstein得到了一个正确的结论

也就是当我们认真考虑量子力学框架的时候

你会碰到无法给特定物理属性赋予物理值的情况

就像我们前面提到的实验结果中

S大于2的情况

如果你可以赋值给特定的物理属性的话

那S应当小于或者等于2

好吧 我们聊到哪了

我们接着来吧

Einstein对此很担心

○ 担心中的爱因斯坦

但是我们还是讲一个充满希望

而不是充满忧虑的故事吧

因为在自然界确实存在

这种无法赋予物理值给特定物理属性的情况

那么为什么我们不去利用它呢

我们为什么不利用这个John Bell设计的测试呢

为什么不直接用它

比如我们可以把它用来消灭通讯线路中的窃听者

发现没

如果无法赋值的话

他所说的我之前已经讨论过了

如果在某些实验当中光子没有事先确定的极化值

也就是说这些值在测量之前不存在

那么谁都无法得到其极化值

包括窃听者

也就是说如果这些物理值不存在的话

那它就是不存在的

如果你接触并读取了这个物理值

那这个物理值就存在了

同样的 如果存在干涉通讯过程的窃听者的话

这些物理值就会存在

如果它们不存在的话

Alice和Bob之后会通过测试贝尔不等式的违背来测试物理属性的不存在

这也等价于测试是否存在窃听

因而结论是

我们为什么不利用贝尔测试或者贝尔不等式的违背

来确保通讯线路中没有窃听者

想法基本上就是这样

Gilles和Charles很快之后也有了他们的方案

他们在IBM成功实现了他们自己的量子密钥分发

那个时候我还是牛津大学的一名学生

顺便说一下

这个工作某种程度上也是我的博士课题之外的

但是我有一个非常好的导师David Deutsch

他基本上允许我做我想做的工作或者我觉得有趣的工作

当我需要评估这个方案是否具有实用价值时

我不得不找到了在国防研究机构Malvern工作的同事

John Rarity和Paul Tapster实现了这个方案

对我提出的方案进行了各种原理性验证

但当时他们遇到了各种各样的困难

主要是因为当时管理部门的阻挠

这发生在当时的英国

关于国防研究机构究竟应该做什么还存在一定的分歧

如果你的经费来源于国防部

那么基本上你是不能做密码学相关的研究的

由于一些历史原因密码学是由外交部提供经费的

所以John当时不能做这个研究

但让大家都没想到的是

Charles Gilles和我三个人就在《科学美国人》杂志上

一起发表了阐述量子密码学的文章

所以从某种层面来说

对相关机构的管理人员而言

他们没必要假装这些都是绝密

毕竟每个人都能够看到

所以他们得以继续做这个实验

确实事实也是这样的

○ DRA Malvern – Oxford

幻灯片上显示的是John Rarity在Malvern实验室拍摄的照片

画面中央显示的是如何产生两个纠缠光子

两个光子被分别送给Alice和Bob

整个实验都只是原理验证

当然现今你能看到

可以通过各种不同的方式来实现量子密码系统

对我而言

在1991年设计这个系统的时候

我从未认真地想过它最终会被实现

○ 墨子实验卫星

我原以为这只是一项远在天边的基础研究

但最终确实也成为了一个远在天边的研究

（注释：blue-sky双关，有“没有什么实际价值的”和“远在天边”两重意思，后者暗指“墨子号”量子卫星上天）

就像中国同行告诉我的

基于真正的纠缠的空间量子密钥分发实验

可能将会在明年在卫星墨子号上实现

这对我来很棒

因为在我学生时代

在满是灰尘的图书馆写出这些小文章

想出这些点子

从来没有非常认真地考虑过最终实现的事情

我从没想到这个最终会成为商业提案

我也从来没想到卫星将会参与进来

能目睹这一切真的很开心

在我最后一张幻灯片当中

也许我应该讲讲

经常被问到的问题

密码学长久以来一直

被认为是计算机科学和纯数学的领域

物理学家怎么突然对这个领域做出了贡献

并且从完全不同的角度解决了密钥分发的问题？

也许对于这个问题最好的答案就在于这个小谜题

我接下来就讲讲这个谜题

在我告诉你这个谜题之前

我也会告诉你那个问题的答案

这个谜题可以用来区分你是更像一个数学家还是物理学家

因为数学家将会觉得这个谜题非常困难

理论物理学家也有可能觉得这个谜题很困难

但是如果你是实验物理学家或者是工程师

你将会发现这个谜题很容易

在这区别背后会得出我想要强调的要点

那么我来讲讲这个谜题

○ 像物理学家一样思考

你现在站在两个房间前

其中一个房间在你的右边

里面有三个关着的电子开关

在你左边的房间里面有三盏关着的灯泡

你并不知道三盏灯泡和三个开关之间的对应关系

你只知道每个开关只能打开一盏灯

但是你并不知道到底是哪一盏

现在游戏规则是你只能进去每个房间一次

一旦你离开房间

你就不能再返回刚才进过的房间了

你在一个房间内并不能看到另一个房间的情况

在这些限制条件下你能知晓这三盏灯泡和三个开关之间的对应关系吗

如果你是一个擅长理论思考的的人

如果你喜欢抽象的东西

你思考过后可能会说

不 想要找到对应关系绝对是不可能的

为什么呢

首先得去在你右手边有开关的房间

才说的过去 对吧

因为你可以这样做

假设你将其中的一个开关打开

然后跑到第二个有灯泡的房间里面

你能看到其中一个灯泡是亮着的

但是另外两个灯泡都是关着的

我们没办法确定这两个灯泡和剩下的两个开关之间的对应关系

所以这不是好的答案

如果你先打开第一个房间里面的任意两个开关

这也不是一个好的答案

因为你就不能确定两个亮着的灯泡究竟对应哪个开关了

所以如果你抽象地考虑这件事情

你会很容易说服自己没有办法解出这个谜题

在这些限制条件下这是不可能的

但是如果你是一个实验物理学家

或者你真实地考虑问题

比如你就想着这个是真实发生的事情

而不是一个抽象的谜题

你是真真切切地就在现场

也许你会很容易想到答案

接下来我公布答案了

你来到第一个房间

也就是在你右手边的房间

你将一个开关打开

不妨假设你将左边第一个开关打开

然后将中间的开关打开五分钟然后再关闭

接着你跑到有灯泡的房间

你会发现一个灯泡是关着的

一个灯泡是开着的

还有一个灯泡是温着的

因为等即使关了也会有残存的温度的

因为这样的灯泡会发热

你就知道开关和灯泡之间的对应关系了

但是为什么你可以做到呢

你可以做到因为你使用的是完整的物理世界

而不是只用了谜题里面的抽象模型

物理学家能够在密码学的抽象领域做出贡献

或多或少也是因为这样

因为我们物理学家考虑量子力学

就像考虑谜题中灯泡发热一样

所以当你将物理现象考虑进去的时候

你会意识到真实情况下通讯是一个物理过程

你也可以通过额外的知识

来解决这类其他途径不可能解决的问题

就像这个谜题里面

如果你把你自己局限在谜题的抽象模型里面

你是无法解决它的

但是如果你认真地把它当做物理的实体

你就可以解决这个谜题

因为你考虑到了发热

当然这需要额外的假设

我们需要假设灯泡能够产生足够的热量我们才能解决这个谜题

但无论如何这也仅仅是个谜题而已

你是否是个数学家或者物理学家并不是非常的重要

就像前面Gilles的报告中说的很清楚了

即使这个领域有一定的历史了

在许多有趣的方向它真的发展的很快

总是有办法推动这个领域前

无论从数学还是物理的视角出发

所以即使你是对数学 物理或是计算机有所偏好

我还是鼓励你来这个领域挑战试试

也许你真的会发现更有趣的

基于量子现象的加密方法

或者你会通过别的方式对这一领域做出贡献

还有很多杰出的工作等着被发现

请允许我借这个机会给大家一个挑战

上网去搜索学习一下

在这一领域中国有很多杰出的工作

所以量子的未来是靠你们的

紧紧的把握住机会拥抱未来吧

非常感谢你们的聆听

量子计算 姚期智系列

【视频】量子计算跟经典计算有什么不同？

【视频】量子计算机是如何加速计算的？

【视频】实现量子计算有哪些可能方案？

文字版 英文

And you can see here JohnBell at CERN, he was workingon huge collider.

So that was hisreal job.He was notsupposed to be working on the foundations of physics, but somehow,you know, today he's known for his contribution to the foundations of physics.And we don'tknow that much.

Well, ofcourse, especially he’s known about his contribution to designing accelerators,but he's notfamous for that,which is, youknow, one message to all of you that you shouldbe doing what you really like.You know, evenif your daily job is something that you have to do to make a living,if you have apassion to do something that you really like,just do it.Because whoknows, you know, a few years later,you may beknown for you did after hours not during your (work).Not that I’mgoing to, you know, say something that youshouldn't be doing your work properly to...Anyway,so, John Bellcame up with idea how to resolve Einstein.

This isprobably the most technical slide I’m going to have.And for thoseof you who like mathematics and physics,you can justtake a picture of the slide,or you know itwill be probably somewhere on the Internet

and work it outyourself.But basicallyJohn Bell considered the scenario where you havetwo individuals.One is calledAlice, and one is called Bob. And Alice andBob are asked to measure different polarizations coming from a source of …

so, there issome kind of a source of photons that emits two photons. One photon willgo to Alice, another photon will go to Bob.And Alice wouldjust measure polarization along the direction A1 or along some other direction,A2.

And Bob willmeasure polarization along two other directions. Anyway, nevermind that details of what's going to happen here.

But basically,if the values of polarization, A1, along the direction A1, are plus one orminus one. And the samefor A2, and the same for B1, and the same for B2. Then you canuse a regular probability theory to show that a certainlinear combination of those random variables as can only have two values, namely plus twoand minus two.And therefore,the average value, if you imagine this experiment going on. and you performall those measurements,the averagevalue will have to be somewhere between minus two and two.So that's whata common classical sense dictates. If you knowprobability,then somethingthat is known today as the Bell’s inequality is just oneslide.

And it's a verysimple algebra.And anyone inthe high school can do this today.

And you know,this is kind of…mathematically speaking, it’s trivial.But it's nottrivial if I tell you that nature somehow doesn't conform to this, nature doesn'tknow this.Because then if you take quantum physics seriously,then you willsay,well you know,there are correlations that really confirm to the Bell’s inequalities.They really aresuch that that this valueof S is smaller than

But there arealso correlations purely of quantum origin that may violate those inequalities. And this value,this figure of merit S can be actually greater than

Well, we'll dophysicists do. Physicists haveto set up experiments to resolve this. And there are afew experiments.Some of themwere inconclusive. but perhaps formost of us, the mostbeautiful and the most conclusive first experiment was carried outby this person Alain Aspect,in institutd’Optique in Orsay 21:17in the eighties about,you know,twenty years after John Bell’s paper.and AlainAspect showed he measured this value S And he showedmuch to, sort of, some people’s surprise that S isgreater than two.

And you know,this is probably one of the most important experiments ever made in 21:40the twentieth century, I believe.Because ittells us something very very profound about the nature of reality.It says that,you know, Einstein kind of was wrong and right.So he drew theright conclusions that if youtake quantum physics seriously,then you mayhave situations where you cannot attribute physical values to certainphysicalproperties,as demonstratedby the fact that this S can begreater than two.If you can,then,S will bealways smaller or equal to two. So, where weare, you know, let's… Einstein wasworried about it.But you know let's turn the sort of the storyof worrying

to the story of hope.Because if itis indeed the case that there are situations in nature where youcannot attribute physical values to certain physical properties,then why don'twe just use it?

Why (don’t weuse)the test, John Bell design?Why don't weuse it,for example, forlack of eavesdropping on the line? You see? If there is no value, so, he wasbasically in my argument that I had.So, if photonsdo not carry predetermine values of polarization in some experiments, at least, So, ifthe values do not exist prior to measurement, they're notavailable to anybody,includingeavesdroppers.

You see if something doesn't exist,it doesn'texist. If you touchand read it,

it does exist. So, ifeavesdroppers want to intervene, those valueswould exist.

But if theydon't exist, and Alice and Bob are testing for non-existence of certain physical properties then by testing for the violation of Bell’sinequalities, theyeffectively testing for eavesdropping,So, thenconclusions are, okay,why don't weuse the Bell test or violation of Bell’s inequalitiesfor the purposeof making sure that there was no eavesdropper on the line. And you know,so that basically was the idea. And Gilles and Charles soon after, they came up with their ideas. They managed toset up their own quantum key distribution at IBM. At the time, Iwas a student in Oxford and this wasalso by the way done, and sort of wasnot really supposed to be my PhD, but I had avery good supervisor David Deutsch,who kind ofbasically let me do whatever I wanted to do or whatever I found interesting. And when itcame, however, to see whether this has any real practical value, I had to talkto my colleagues who were working in this place called Defense Research AgencyMalvern.

So, John Rarityand Paul Tapster implemented this scheme all of theproof of the principle of the scheme that I was proposing.But they hadmany kinds of difficulties to do it,mostly becausethe management at the time didn't allow them to do this.As it happenedin the United Kingdom,there is adivision between what the Defense Research Agency is supposed to be doing.

If you’refunded by the Ministry of Defense, you don't docryptography basically.Cryptographyfor some historical reason is funded by the Foreign Office.And so John wasnot supposed to be doing this.But as ithappened,Charles, Gillesand I published a paper in the Scientific American to getherexplaining quantum cryptography.So, at somepoint, you know,there was nopoint for those guys to pretend thatthis is sort of a top-secret thing that,

you know,everyone could read about it.So, they couldactually go on and set up this experiment. And that indeed happened. So, you can see here a picture that was taken by John Rarity in Malvern lab.You know, what you see in the middle is how those two entangled photons were generated.And they werethen sent to Alice and Bob. And the wholeexperiment was demonstrating the proof of principle.But of course,you know,today you can see quantumcryptography implemented in all kinds of different ways.

And I thinkthat for me, when I designedthis system back in the 1991,I never reallythought seriously that it will beimplemented that actually I'll take them very seriously. And it turnedout to be a really blue sky research, as I’m told bymy Chinese colleaguesthat this true entanglement-basedquantum QKD from space will beimplemented by the satellite Micius probably next year.So, this isactually wonderful for me because somehow from my student days, you know, doingall these scribblings somewhere in the dusty library and thinkingabout those ideas,never reallytaking this so seriously.I never thoughtit's going to be any commercial proposition.I never thoughtthere will be a satellite involved.Seeing this happening is actually a fascinating thing.So, then in mylast slide,and perhaps Ishould refer to,you know, quiteoften, I’m asked,how did ithappen that cryptography that for such a long period of time was consideredas the area of computer science or pure mathematics…How did thathappen that physicists somehow contributed to this and found asolution to the key distribution problem from a completely differentperspective? And perhaps thebest answer to this question is… there's a little puzzle.I'll tell youthis puzzle.And you can seebefore I tell you the puzzle, I also tell youthe solutions.But, you see,this puzzle will tell you whether you’re more a mathematician or a physicist. Because mathematicians will find this puzzle very difficult. While, thephysicist, if you are a theoretical physicist, you also find it difficult.

But if you'rean experimental physicist or an engineer,you willactually find it easyBut there is apoint I want to make.So, let me justfirst tell you the puzzle.

So, here youare in front of two rooms. One room on theright, you have threeelectric switches, all initially in position off In the room onyour left, there are three light bulbs, initially switched-off.

You don't knowabout one-to-one correspondence between the light bulbs and switches.You know thateach switch would only switch on the one light bulb.

But you don'tnecessarily know which one.Now, the ruleof the game is you are allowed to enter each room only once. Once you leavethe room,you are notallowed to go back to the same room.And you don'tsee from one room to the other or the situation in the other room is.So, can yousolve or tell what is this one-to-onecorrespondence under those conditions?

Now, if you'rea theoretical-minded person,if you likeabstraction,you think aboutit and will say,well, no, it's not possible.Why? Well, it onlymakes sense to go to theroom on the right with the switches first, right? Because you cando something like this.So, suppose you switch, put one switch in position on,and you go tothe, then to the second room with light bulbs,you see thatone light bulb is on,but the othertwo are off.So, there is ambiguity about the other two.So that's not agood solution.So, if you put,say, two switches, any two switches in position on, in the first room,that's also notgood,because therewill be ambiguity about the two light bulbs that are on.So, if youthink about it in the abstract theorems,you can easily convince yourself that you cannot solve this puzzle,that this is impossible under those conditions.But you know,if you're an experimental physicist,or if you think about this for real,like, thinkabout this as a really happening,not as anabstract puzzle,but that youare really there,then you canperhaps come up with a solution.And thesolution is this:You go to thefirst room,to the room onthe right,you take oneswitch, put it in position on,say, the firstone on the left.Take the middleswitch, put it in position on for about five minutes and switch it off.And then you goto the room with light bulbs.One is off;one is on;and one is warmbecause, youknow, even though it's off, it's still warmbecause it was…so you know, with those kinds of light bulbs,you can tell,well, you can really solve out this one-to-one correspondence.But why couldyou do that?You could do itbecause you use the physicsas the whole.You were notusing an abstract model of this puzzle

So, the reasonphysicists manage to contribute to an abstract area of cryptographyis more or lesslike this. Because when (wephysicists)think about quantum phenomena as kind of aheat dissipation in this puzzle.So, when youtake quantum phenomena into account,and you realizethat it's all for real that that communication is a physical process.Then obviouslyyou can use this extra knowledge to do somethingthat is impossible otherwise.Like here, youknow,if you restrictyourself only to an abstract model of this puzzle,

you cannotsolve it.But if you takeit seriously as a physical thing,then you can.Because youtake heat dissipation into account.So of course,you know that requires an extra assumption that the lightbulbs of the type that generate enough heat for this to solve.But anyway,thisis only just this puzzle.And whetheryou're a mathematician or a physicist, it doesn't really matter.

Because thisfield, as I think it was also clear from Gilles’ talk, even though it has a history,is actuallygoing really fast in many interesting directions.And there's away to contribute to this field,be it from themathematical or physical point of view.So even if youhave some predilection for mathematics or physics or computerscience,I do encourageyou to take this as a challenge,

perhaps youwill actually discover even more interesting methods of encryption based onquantum phenomena.Maybe youcontribute in some other ways.There’s lots of(work)there to be discovered. and let me takethis opportunity to put it as a challenge to you. Go on Internet,search, learn about it.

There's lots ofwonderful work going on in China in this field.So, the quantumfuture is effectively for you and take thisopportunity to embrace it

Thank you very much

关于“墨子沙龙”

墨子沙龙是由中国科学技术大学上海研究院主办、上海市浦东新区科学技术协会及中国科大新创校友基金会协办的公益性大型科普论坛。沙龙的科普对象为对科学有浓厚兴趣、热爱科普的普通民众，力图打造具有中学生学力便可以了解当下全球最尖端科学资讯的科普讲坛。