The E91 Protocol

Ekert's 1991 protocol (E91) reaches the same goal as BB84 — a shared secret key — but from a strikingly different starting point: shared entanglement. Instead of Alice preparing and sending states, a source distributes entangled pairs, and the correlations of their measurements both generate the key and certify, via a Bell inequality, that no eavesdropper is present.

The entangled resource

A source produces pairs in a maximally entangled Bell state — Ekert used the singlet

sending one qubit to Alice and one to Bob. The singlet is rotationally invariant: measured along the same axis, Alice and Bob get perfectly anti-correlated outcomes, no matter which axis they choose. (The triplet $|\Phi^+\rangle$ works identically up to a relabeling and gives perfect correlation.)

Measurement settings

Each party independently picks, at random, one of several measurement axes in the $x$–$z$ plane, specified by angles. For the security test we use the CHSH-optimal settings:

• Alice: $a = 0,\ a' = \tfrac{\pi}{2}$.
• Bob: $b = \tfrac{\pi}{4},\ b' = \tfrac{3\pi}{4}$.

The protocol also includes a shared axis (e.g. both parties offer the direction $\tfrac{\pi}{4}$) for generating key. After all measurements, they publicly announce settings (never outcomes) and partition the rounds:

• Key rounds — settings where Alice and Bob used the same axis. Here their outcomes are perfectly anti-correlated, so Bob's bit (flipped) equals Alice's: these rounds form the raw key.
• Test rounds — the remaining setting combinations are used to evaluate a CHSH correlation.

The correlation function

For the singlet, the expectation of the product of two $\pm1$-valued spin measurements along directions separated by angle $\theta$ is

(The minus sign is the singlet's anti-correlation; along a common axis $a=b$ gives $E=-1$.) Plug the test-round angles into the CHSH quantity

With the angles above, every relevant axis separation is $\pi/4$ or $3\pi/4$, so each correlator has magnitude $\cos(\pi/4) = 1/\sqrt2$, and the signed sum adds constructively to

the Tsirelson bound — the maximum quantum value, well above the classical/local-hidden-variable limit of $2$.

Why violation means security

Any local hidden-variable description — including one where Eve has secretly predetermined the outcomes, or holds a third system correlated with the pair — obeys $|S| \le 2$. Observing $|S| = 2\sqrt2$ certifies that Alice and Bob's qubits were genuinely entangled and not entangled with any third party. A maximally entangled pair is monogamous: if Alice and Bob's correlations saturate Tsirelson's bound, the pair is pure and Eve is decoupled — she can hold no correlated ancilla. Thus the same data that violates CHSH also bounds Eve's information to zero.

Try it

Compute the CHSH value $|S|$ for the singlet at Ekert's optimal test angles, using the correlation function $E(a,b) = -\cos(a-b)$. The grader checks that $|S| = 2\sqrt2 \approx 2.8284$ — a Bell violation, hence a secure round.

Sign in on the full site to ask questions and join the discussion.