E91: The Protocol That Turns Bell's Theorem Into an Eavesdropping Detector

The security of BB84 rests on a specific physical claim: any attempt to measure a quantum state disturbs it, and that disturbance is detectable. The argument is tight, but it requires you to trust your photon source, trust your detectors, and trust that the photons travelling through your optical fibre are genuinely in the polarisation states you prepared them in.

Artur Ekert’s 1991 protocol takes a different approach. Rather than using individual photons, E91 uses entangled photon pairs: pairs of particles whose quantum states are correlated in a way that has no classical explanation. Security is certified not by watching for measurement disturbances but by performing a Bell inequality test on the measurement outcomes. If the correlations between Alice’s and Bob’s results violate a specific mathematical inequality — the CHSH inequality — it proves that no local, classical eavesdropper could have interfered with the key exchange. The security proof is grounded in Bell’s theorem rather than in the physics of individual photon measurements.

This distinction matters beyond one protocol. E91’s approach leads directly to device-independent quantum cryptography — a regime where you do not need to trust your measurement devices at all, because the Bell violation itself certifies that the devices are producing genuine quantum correlations.

Bell States: The Raw Material

E91 requires entangled photon pairs — specifically, pairs in a Bell state, one of four maximally entangled two-qubit states:

• $|\Phi^+\rangle = (|00\rangle + |11\rangle)/\sqrt{2}$
• $|\Phi^-\rangle = (|00\rangle - |11\rangle)/\sqrt{2}$
• $|\Psi^+\rangle = (|01\rangle + |10\rangle)/\sqrt{2}$
• $|\Psi^-\rangle = (|01\rangle - |10\rangle)/\sqrt{2}$

Ekert’s original protocol uses the singlet state $|\Psi^-\rangle = (|01\rangle - |10\rangle)/\sqrt{2}$. This state has a remarkable property: when Alice and Bob both measure in the same basis, their outcomes are always perfectly anticorrelated — if Alice measures 0, Bob measures 1, and vice versa, regardless of which basis they choose. This anticorrelation is the source of the shared key.

Entangled pairs are produced experimentally by spontaneous parametric down-conversion (SPDC): a pump photon passing through a nonlinear crystal (typically BBO or KTP) is converted into two lower-energy photons with correlated polarisations. The pair emerges with their polarisations entangled, and the spatial modes are arranged so that one photon travels toward Alice and one toward Bob — who may be separated by metres, kilometres, or, in principle, arbitrary distances.

The Protocol: Three Bases, Two Functions

Each measurement round proceeds as follows:

1. The source emits an entangled pair and sends one photon to each party.
2. Alice independently and randomly selects one of three measurement angles: a₁ = 0°, a₂ = 45°, a₃ = 90°.
3. Bob independently and randomly selects one of three measurement angles: b₁ = 45°, b₂ = 90°, b₃ = 135°.
4. Both parties measure and record their outcomes (+1 for one polarisation, −1 for the other).
5. Over a public authenticated channel, they announce their chosen bases (but not their outcomes).
6. The rounds are split into two groups:
   • Key rounds: when Alice chose a₂ = 45° and Bob chose b₁ = 45°, or Alice chose a₃ = 90° and Bob chose b₂ = 90° — overlapping bases that give anticorrelated outcomes. Bob inverts his bits. The remaining correlated pairs form the raw key.
   • Test rounds: all other angle combinations. The outcomes of these rounds are publicly revealed and used to compute the CHSH correlator S.

The CHSH Inequality: A Bell Test as a Security Proof

The central mathematical object in E91 is the CHSH correlator, introduced by Clauser, Horne, Shimony, and Holt in 1969:

$$S = E(a_1, b_1) - E(a_1, b_3) + E(a_3, b_1) + E(a_3, b_3)$$

where $E(a_i, b_j)$ is the correlation coefficient for measurement settings $a_i$ and $b_j$:

$$E(a_i, b_j) = P(\text{same outcome}) - P(\text{different outcome})$$

Bell’s theorem states that for any local hidden variable theory — any classical model where Alice’s and Bob’s outcomes are determined by pre-existing values that do not depend on the other party’s measurement choice — the CHSH correlator satisfies:

$$|S| \leq 2$$

This is the CHSH inequality, one of the Bell inequalities. Quantum mechanics, however, allows violations of this bound. For the singlet state $|\Psi^-\rangle$ with optimal measurement settings:

With settings $a_1 = 0^\circ$, $a_3 = 90^\circ$, $b_1 = 45^\circ$, $b_3 = 135^\circ$, the correlations for $|\Psi^-\rangle$ are $E(a_i, b_j) = -\cos(a_i - b_j)$, giving:

$$\begin{aligned} S &= E(0^\circ, 45^\circ) - E(0^\circ, 135^\circ) + E(90^\circ, 45^\circ) + E(90^\circ, 135^\circ) \\ &= -\cos(-45^\circ) - (-\cos(-135^\circ)) + (-\cos(45^\circ)) + (-\cos(-45^\circ)) \\ &= -\tfrac{1}{\sqrt{2}} - \tfrac{1}{\sqrt{2}} - \tfrac{1}{\sqrt{2}} - \tfrac{1}{\sqrt{2}} = -2\sqrt{2} \end{aligned}$$

So $|S| = 2\sqrt{2} \approx 2.828$ — larger than 2. The CHSH inequality is violated, certifying that the correlations cannot have come from any classical local hidden variable model.

Why an Eavesdropper Cannot Hide

The security argument in E91 is elegant and physically direct. Suppose an eavesdropper Eve intercepts both photons, measures them in some basis, and resends replacement photons to Alice and Bob.

When Eve intercepts and measures a photon, she necessarily disturbs its quantum state — she collapses the entangled pair into a product state. After Eve’s intervention, Alice’s and Bob’s particles are no longer entangled with each other; at best, they are classically correlated by whatever information Eve’s measurements gave her. The correlations between Alice’s and Bob’s outcomes then obey classical statistics — and therefore must satisfy $|S| \leq 2$.

Alice and Bob compute S from their test rounds. If $|S| > 2$, the Bell inequality is violated — the correlations are provably non-classical, entanglement is intact, and no eavesdropper could have introduced the correlations they observe. They proceed to use the key rounds.

If $|S| \leq 2$, the violation has disappeared. This could mean Eve has intercepted; or that the channel is too noisy to maintain entanglement. Either way, Alice and Bob abort.

The security proof is not just heuristic — it is rooted in Bell’s theorem, one of the most thoroughly tested results in physics. Any eavesdropping strategy that preserves $|S| > 2$ while simultaneously extracting information is prohibited by quantum mechanics itself. This provides a fundamentally different security proof from BB84’s single-photon disturbance argument.

E91 vs BB84: Two Routes to the Same Destination

Both BB84 and E91 produce information-theoretically secure keys — keys whose security is guaranteed by physics, not by computational hardness. The choice between them is largely a hardware and architecture question.

BB84 requires Alice to prepare and send single photons in specific polarisation states. The source and Alice’s preparation apparatus must be trusted. If Eve tampers with Alice’s preparation device, the security proof may not hold. BB84 is simpler to implement — single photon sources are more mature than entangled pair sources — and is the dominant protocol in deployed QKD systems from Toshiba, ID Quantique, QuantumCTek, and others.

E91 requires a source of entangled pairs, which may be anywhere on the channel (including in an untrusted third party’s hands). If Alice and Bob observe Bell inequality violation, the security argument holds regardless of who generated the pairs. The source’s trustworthiness is irrelevant; physics certifies the security. This is a stronger guarantee than BB84.

Device-Independent Quantum Cryptography: E91’s Deeper Promise

The most significant theoretical advantage of E91 is its natural pathway to device-independent quantum key distribution (DIQKD).

In any quantum cryptography protocol, some level of device trust is required. In BB84, you must trust that your photon detector is operating correctly — that a “click” in detector 0 really corresponds to a |0⟩ polarisation measurement, not a signal being manipulated by a sophisticated adversary with access to your lab. Similarly, the photon source must behave as specified.

In E91, the Bell inequality test certifies the security purely from the observed statistics — no assumption about the internal workings of the detectors is required. If Alice and Bob observe $|S| > 2$ in a loophole-free Bell test (one where the detection and locality loopholes are both closed), then:

1. The correlations they observe cannot have been produced by any local classical mechanism — including a compromised device.
2. An eavesdropper who controlled both Alice’s and Bob’s devices, and also controlled the source, still cannot have produced $|S| > 2$ while extracting information about the key, because doing so would require either signalling faster than light or breaking quantum mechanics.

The security proof requires no assumptions about the devices beyond that they produce outcomes (±1) when a measurement setting is chosen. This is an extraordinary guarantee — the closest thing to “security from first principles” in cryptography.

The first experimental loophole-free Bell tests were performed in 2015 (Hensen et al., Delft using NV centres in diamond; and independently by groups in NIST and Vienna). The detection efficiencies and spatial separations required to close all loopholes simultaneously make DIQKD experiments extremely challenging. Practical DIQKD over metropolitan-scale fibre links remains a research target rather than a deployed technology.

The Entanglement Distribution Challenge

E91’s practical limitation is the difficulty of distributing entanglement over long distances. Entangled photon pairs are generated by SPDC sources, but photons carrying the entanglement suffer the same losses in optical fibre as BB84 photons — the transmission probability decays exponentially with distance, roughly halving every 15 km at telecom wavelengths. At 150 km, the raw pair transmission rate drops to around 2⁻¹⁰ ≈ 0.1% of the source rate, making key generation slow.

The solution at long distances is the quantum repeater — a device that extends quantum entanglement over long distances by creating short-range entanglement, swapping it through intermediate nodes, and eventually linking end nodes without transmitting photons the full distance. Building a practical quantum repeater requires quantum memories with long coherence times, high-fidelity Bell state measurements, and real-time classical feed-forward. No fully functional quantum repeater network has been demonstrated at the scale needed for metropolitan QKD; this remains an active research area.

Satellite-based QKD sidesteps the fibre loss problem by distributing entangled pairs through free space. The Chinese Micius satellite, launched in 2016, demonstrated entanglement distribution over 1200 km and has since enabled intercontinental QKD experiments — using E91-like entanglement verification to certify the key distribution. Satellite QKD is the current frontier for long-distance entanglement-based cryptography.

What E91 Means for the Field

E91 matters beyond the specific protocol for two reasons.

First, it demonstrated that quantum entanglement — which Einstein dismissed as “spooky action at a distance” and which many physicists viewed as philosophically troubling but practically useless — is directly useful for information-theoretic security. The correlations that troubled Einstein are precisely the correlations that make E91 secure. Bell’s theorem, originally a philosophical statement about the completeness of quantum mechanics, became an operational tool for certifying the security of a cryptographic key exchange.

Second, E91 opened the conceptual framework of device-independent cryptography, which has since expanded into device-independent randomness generation, device-independent quantum computing verification, and self-testing of quantum states. The idea that physical correlations can be used to certify the behaviour of untrusted devices — without looking inside them — has become one of the most productive concepts in quantum information theory.

Post-quantum cryptography (ML-KEM, ML-DSA) and quantum key distribution (BB84, E91) address the same cryptographic threat — secure key exchange in a world with quantum computers — through entirely different means. PQC is classical software running on classical hardware, secure against quantum computers. QKD is quantum hardware producing information-theoretically secure keys, secure against any adversary regardless of computational power. E91 specifically is QKD with the additional property that the security argument extends even to adversaries who supply the cryptographic hardware.

These approaches are not in competition. A system running ML-KEM for key exchange and E91 for long-term key material distribution would be secure against both a CRQC breaking RSA and a classical adversary exploiting side-channels in the PQC implementation. The two approaches are complementary, and understanding both requires understanding the physics that makes each one possible.

Sources & Further Reading

1. Artur K. Ekert. Quantum Cryptography Based on Bell's Theorem. Physical Review Letters 67, 661 (1991)
2. John S. Bell. On the Einstein Podolsky Rosen Paradox. Physics Physique Физика 1, 195 (1964)
3. John F. Clauser, Michael A. Horne, Abner Shimony, Richard A. Holt. Proposed Experiment to Test Local Hidden-Variable Theories. Physical Review Letters 23, 880 (1969)
4. B. Hensen, H. Bernien, et al.. Loophole-Free Bell Inequality Violation Using Electron Spins Separated by 1.3 Kilometres. Nature 526, 682; arXiv:1508.05949 (2015)

Discussion

← All articles