E91 Protocol

Every quantum key distribution scheme must answer one question: what makes the key secret? BB84 answers with the no-cloning theorem — a sender prepares nonorthogonal states, and an eavesdropper cannot copy them without leaving fingerprints. The E91 protocol, published by Artur Ekert in 1991, gives a deeper answer that throws away the trusted sender entirely. A source in the middle — which may belong to your adversary — emits pairs of entangled qubits, conventionally the spin singlet $|\Psi^-\rangle$ , and mails one to Alice and one to Bob. Each measures their qubit along a randomly chosen axis. When the axes match, the perfect anticorrelation of the singlet hands them a shared random bit — the raw key. When they differ, the data is not discarded: it feeds a Bell inequality. That Bell test is the whole security argument. The Clauser–Horne–Shimony–Holt combination $S$ of their mismatched-basis correlations obeys $|S|\le2$ for any theory in which the outcomes were fixed in advance by local instructions — including one where an eavesdropper pre-loaded the source with classical answers or kept a copy of the qubits. Quantum mechanics allows $S$ up to Tsirelson's bound $2\sqrt2\approx2.828$ , and only a nearly pure singlet, shared by nobody else, reaches it. So a maximal violation does double duty: it certifies that Alice and Bob hold genuine entanglement, and — through the monogamy of entanglement — that no third party is correlated with their key. The device can be a black box; the number $S$ is the guarantee. This is the seed of the entire device-independent programme, whose machinery this article makes rigorous.

Key takeaways

E91 (Ekert 1991) distributes a key by sharing entangled pairs — singlets $|\Psi^-\rangle$ — instead of transmitting prepared single-photon states as in BB84; matched-basis outcomes become the key, mismatched ones test a Bell inequality.
Security comes from violating the CHSH inequality: any local-hidden-variable or eavesdropped model obeys $|S|\le2$ , while the ideal singlet reaches $S=2\sqrt2$ ; a value pushed toward $2$ signals tampering.
Tsirelson's bound $|S|\le2\sqrt2$ caps quantum correlations, and saturating it forces the state to be a pure maximally entangled pair — pinned down up to a local isometry (self-testing).
Monogamy of entanglement turns the Bell violation into a privacy guarantee: a state that saturates Tsirelson's bound cannot be correlated with Eve, so $I(A\!:\!E)=0$ in the ideal case.
Because the guarantee is a measured statistic rather than trust in the hardware, E91 is the direct ancestor of device-independent QKD, demonstrated loophole-free only in 2022.
Key idea: replace "trust the source" with "measure the nonlocality" — the observed CHSH value $S$ both certifies that Alice and Bob share a genuine singlet and, via Tsirelson's bound and the monogamy of entanglement, upper-bounds any eavesdropper's correlation with the key.

Where this lives today

For three decades E91 was mostly a conceptual landmark — harder to run than BB84 because it needs a bright source of high-fidelity entanglement and detectors good enough to close the loopholes a device-independent proof cannot ignore. That changed in 2022, when three groups reported the first loophole-free demonstrations of device-independent QKD, the full-strength descendant of E91: a trapped-ion pair at Oxford (Nadlinger and colleagues), a two-atom link in Munich, and a photonic experiment in Nanjing all distributed key certified purely by an observed Bell violation, with no assumptions about the internals of their devices. The same self-testing logic — that $S=2\sqrt2$ pins the state and measurements down to a local isometry — now underpins device-independent randomness expansion and certified random-number generators, where nonlocal correlations guarantee bits no adversary could have predicted. E91's entanglement-first architecture is also the natural protocol layer for quantum networks and repeaters: a central untrusted source, or a chain of nodes linked by entanglement swapping, can serve many user pairs who each run their own local Bell test. The open frontier is rate and distance — closing the detection loophole demands near-unit efficiency, so pushing device-independent key rates toward practical throughput over deployed fibre is the active problem Ekert's 1991 idea set in motion.

The physical picture

Think of the entangled source as a referee who hands Alice and Bob two halves of a coin that has no value until each looks at it along a chosen axis. Look along the same axis and they always disagree — the singlet's perfect anticorrelation — and that shared, private randomness is the key. Look along cleverly chosen different axes, and the strength of their statistical agreement, distilled into the single number $S$ , reveals whether the coin was genuinely quantum or whether someone had slipped in pre-arranged classical answers. The first figure lays out the split: a central source, two random analyzer settings per side, and two jobs for the data — key when the axes match, Bell test when they do not.

Figure

E91 layout: a central singlet source sends one qubit each to Alice and Bob. When their analyzer axes match at 45° or 90° the singlet gives perfect anticorrelation E = −1 and the bit becomes key; when they differ the correlation E = −cos θ feeds the CHSH test, which reaches S = 2√2 ≈ 2.828 for the true singlet

Now the eavesdropper's dilemma. To learn the key bits Eve must correlate herself with the outcomes — but the monogamy of entanglement forbids a maximally entangled pair from sharing its correlations with a third party. The more Eve correlates with the singlet, the more she degrades it, and the degradation shows up as a drop of $S$ toward $2$ . Perfect privacy and maximal nonlocality are two faces of one coin: at $S=2\sqrt2$ there is nothing left for Eve. The second figure makes this quantitative for the standard noisy-source model, the Werner state, whose Bell parameter falls linearly as $S=2\sqrt2\,p$ and crosses the classical bound exactly at visibility $p=1/\sqrt2$ .

Figure

The security threshold as a real number. For a Werner state with singlet fraction p the CHSH value is S = 2√2 p, a straight line. It exceeds the classical bound S = 2 only for p > 1/√2 ≈ 0.707 (shaded), and reaches Tsirelson's bound S = 2√2 ≈ 2.828 at p = 1. Below the threshold the state admits a local model and no key can be certified

The core equations

Everything begins with the shared resource: the source distributes the spin singlet, the unique two-qubit state that is antisymmetric under exchange and rotationally invariant — the same state in every measurement direction.

|\Psi^-\rangle=\tfrac{1}{\sqrt2}\big(|01\rangle-|10\rangle\big) \qquad (1)

where: $|0\rangle,|1\rangle$ — computational basis (horizontal/vertical polarization, or spin up/down); $|\Psi^-\rangle$ — the spin-singlet Bell state, one qubit each to Alice and Bob. Reading it: pick the same axis and the two outcomes are always opposite. The measurable content of the singlet is its correlation function: measure Alice's qubit along axis $\hat a$ and Bob's along $\hat b$ , multiply the $\pm1$ outcomes, and average. The result depends only on the angle between the axes.

E(\hat a,\hat b)=\langle \Psi^-|\,(\hat a\!\cdot\!\vec\sigma)\otimes(\hat b\!\cdot\!\vec\sigma)\,|\Psi^-\rangle=-\,\hat a\!\cdot\!\hat b=-\cos\theta_{ab} \qquad (2)

where: $\hat a,\hat b$ — measurement axes on the Bloch sphere; $\vec\sigma=(\sigma_x,\sigma_y,\sigma_z)$ — Pauli vector; $\theta_{ab}$ — angle between the axes. Reading it: aligned axes give $E=-1$ (perfect anticorrelation), orthogonal axes give $E=0$ . This one cosine law generates the entire protocol. Operationally, that expectation is built from the four joint-outcome probabilities the parties actually tally from their coincidence counts.

E(\hat a,\hat b)=P_{++}+P_{--}-P_{+-}-P_{-+} \qquad (3)

where: $P_{\pm\pm}$ — joint probability that Alice gets the first sign and Bob the second; $E$ — expectation of the product of the two $\pm1$ outcomes. Reading it: "agree minus disagree", between $-1$ and $+1$ , estimated straight from the raw counts. The security test bundles four such correlators — Alice's two test axes crossed with Bob's two — into the CHSH combination, the quantity the parties compute over a public channel.

S=E(\hat a_1,\hat b_1)-E(\hat a_1,\hat b_3)+E(\hat a_3,\hat b_1)+E(\hat a_3,\hat b_3) \qquad (4)

where: $\hat a_1,\hat a_3$ — Alice's outer analyzer settings; $\hat b_1,\hat b_3$ — Bob's outer settings; $S$ — the CHSH parameter. Reading it: three correlators add and one subtracts, arranged so a maximally entangled state makes them reinforce. The reason $S$ is a security witness is a theorem, not a convention: every local-hidden-variable model — the mathematical stand-in for "the outcomes were decided in advance, possibly by Eve" — is trapped below $2$ .

|S|\le 2\qquad\text{(local hidden variables)} \qquad (5)

where: $2$ — the classical CHSH bound respected by any local-realistic model, including intercept-resend and pre-shared classical instructions. Reading it: no violation, no certified security — full stop. Quantum mechanics can beat that bound, but not without limit: Tsirelson's bound caps quantum correlations a factor $\sqrt2$ above the classical ceiling, and the singlet at the right angles saturates it.

S_{\mathrm{QM}}\le 2\sqrt2\approx 2.828\qquad\text{(Tsirelson's bound)} \qquad (6)

where: $2\sqrt2$ — the largest CHSH value any quantum state can produce. Reading it: the gap between $2$ and $2.828$ is the room in which E91 operates. The maximum is reached at a specific, memorizable set of analyzer orientations — Ekert's original three-setting scheme, in which two of the three angles on each side coincide to make the key while the outer angles make the Bell test.

\text{Alice: }0^\circ,\,45^\circ,\,90^\circ;\quad \text{Bob: }45^\circ,\,90^\circ,\,135^\circ \qquad (7)

where: the shared angles $45^\circ$ and $90^\circ$ are the matched bases that generate key (relative angle $0^\circ$ , so $E=-1$ ); the outer set $\{0^\circ,90^\circ\}$ for Alice and $\{45^\circ,135^\circ\}$ for Bob feeds the CHSH sum with all relative angles $45^\circ$ . One apparatus, two functions, sorted after the fact by which announcements match. Turning the certified violation into secret bits uses the same post-processing as BB84: in the asymptotic limit the extractable secret-key fraction is set by the matched-basis error rate.

r_\infty \ge 1 - 2\,h_2(Q),\qquad h_2(Q)=-Q\log_2 Q-(1-Q)\log_2(1-Q) \qquad (8)

where: $r_\infty$ — secret bits per sifted bit, asymptotically; $Q$ — matched-basis QBER; $h_2$ — binary entropy. Reading it: the rate is positive only while $Q<11\%$ , where $h_2(Q)=\tfrac12$ . Finally, the statement that makes E91 more than a curiosity: at the Tsirelson point the key is provably Eve-proof, because monogamy leaves her nothing to hold.

S=2\sqrt2 \;\Longrightarrow\; I(A\!:\!E)=0 \qquad (9)

where: $I(A\!:\!E)$ — mutual information between Alice's key bit and Eve's quantum side-information. Reading it: maximal violation certifies zero leakage; for $2<S<2\sqrt2$ Eve's information is bounded by a decreasing function of $S$ , which device-independent proofs make quantitative.

Derivation AThe singlet correlation is minus the cosine of the analyzer angle

The goal is to prove equation (2) — that for the spin singlet the joint expectation of two spin measurements depends only on the relative analyzer angle, as $E(\hat a,\hat b)=-\cos\theta_{ab}$ — using only the rotational invariance of the state and two anchor values. This one law is load-bearing for the whole protocol: it fixes both the perfect anticorrelation that makes the key and the intermediate correlations that make the Bell test.

Step 1. Recall that $|\Psi^-\rangle$ is invariant under $U\otimes U$ for every single-qubit unitary $U$ : a joint rotation of both qubits leaves the singlet unchanged up to global phase. Why: invariance means the correlation cannot depend on the absolute orientation of the analyzers, only on their relative angle $\theta_{ab}$ — so $E$ is a function of one variable.

Step 2. Fix two anchor values. Aligned analyzers give $E(0)=-1$ : along the same axis the outcomes are always opposite, since the singlet has zero total spin. Orthogonal analyzers give $E(90^\circ)=0$ : Alice's result along $\hat a$ says nothing about Bob's along a perpendicular axis. Why: these two points, plus smoothness, pin the whole curve once its functional form is known.

Step 3. Evaluate directly to fix the form: averaging $(\hat a\!\cdot\!\vec\sigma)\otimes(\hat b\!\cdot\!\vec\sigma)$ in $|\Psi^-\rangle$ gives $-\hat a\!\cdot\!\hat b$ , and since $\hat a\!\cdot\!\hat b=\cos\theta_{ab}$ we obtain $E(\theta_{ab})=-\cos\theta_{ab}$ . Why: the dot product is the only rotationally invariant scalar built from two unit vectors, so invariance alone almost forces the cosine — the evaluation just fixes the sign consistent with the anchors. *The three anchor values confirm the law: $E(0)=-1$ , $E(90^\circ)=0$ , and $E(45^\circ)=-1/\sqrt2\approx-0.707$ .*

Go deeper · Derivation B · 1 minTsirelson's bound from the square of the CHSH operator

Derivation BTsirelson's bound from the square of the CHSH operator

The goal is to prove that no quantum state and no choice of dichotomic measurements can push the CHSH value above $2\sqrt2$ , by bounding the operator norm of the CHSH observable itself. This is the ceiling that gives E91 its finite security margin: the gap between the classical $2$ and the quantum $2\sqrt2$ is exactly the resource the protocol spends, and it is a hard limit, not the best value found so far. Let $A_1,A_3$ (Alice) and $B_1,B_3$ (Bob) be $\pm1$ -valued Hermitian observables, so $A_i^2=B_j^2=\mathbb{1}$ , with $[A_i,B_j]=0$ since the two sides act on separate systems.

Step 1. Define $\mathcal{S}=A_1B_1-A_1B_3+A_3B_1+A_3B_3=A_1(B_1-B_3)+A_3(B_1+B_3)$ . Since $\langle S\rangle=\langle\psi|\mathcal{S}|\psi\rangle\le\|\mathcal{S}\|$ for any state, it suffices to bound the operator norm. Why: an operator-norm bound proves the ceiling for every state at once, which is what a security guarantee demands.

Step 2. Square it. Expanding and using $A_i^2=B_j^2=\mathbb{1}$ collapses the diagonal terms to $4\,\mathbb{1}$ , while the cross terms, using $[A_i,B_j]=0$ , condense to a single product of commutators:

\mathcal{S}^2 = 4\,\mathbb{1} + [A_1,A_3]\,[B_1,B_3]

Why: for commuting classical values the commutators vanish and $\mathcal{S}^2=4$ , recovering $|S|\le2$ ; the entire quantum excess lives in that commutator product.

Step 3. Bound the commutators. For any two operators of unit norm, $\|[X,Y]\|\le2\|X\|\,\|Y\|=2$ , so $\|[A_1,A_3]\|\le2$ and $\|[B_1,B_3]\|\le2$ , giving

\|\mathcal{S}^2\|\le 4 + 2\cdot2 = 8 \;\Longrightarrow\; \|\mathcal{S}\|\le\sqrt8=2\sqrt2

Why: the norm of a product is at most the product of norms, so the commutator term adds at most $4$ to the $4$ already there — capping $\|\mathcal S\|$ at exactly $2\sqrt2$ , reached when the commutators are as large as quantum mechanics permits. *The bound $\sqrt8=2\sqrt2\approx2.828$ is saturated by the singlet at the angles of equation (7).*

Go deeper · Derivation C · 1 minWhy the singlet reaches S equals two root two at Ekert's angles

Derivation CWhy the singlet reaches S equals two root two at Ekert's angles

The goal is to plug the cosine law of equation (2) into the CHSH sum of equation (4) at Ekert's optimal angles and confirm the singlet reaches exactly $S=2\sqrt2$ , correcting a subtlety that trips up many first passes: with the spin convention $E=-\cos\theta$ , all four CHSH correlations sit at a relative angle of $45^\circ$ , not $22.5^\circ$ . Getting this arithmetic right certifies that the maximal violation is physically attainable, not merely an abstract bound. Take Alice's outer settings $\hat a_1=0^\circ,\ \hat a_3=90^\circ$ and Bob's $\hat b_1=45^\circ,\ \hat b_3=135^\circ$ .

Step 1. List the relative angles: $\theta_{a_1b_1}=45^\circ$ , $\theta_{a_1b_3}=135^\circ$ , $\theta_{a_3b_1}=45^\circ$ , $\theta_{a_3b_3}=45^\circ$ . Why: the geometry is engineered so three correlators land on $\cos45^\circ$ and the fourth on $\cos135^\circ$ , letting all four terms reinforce in $S$ .

Step 2. Evaluate each correlator with $E=-\cos\theta$ : $E(a_1,b_1)=-\cos45^\circ=-\tfrac{1}{\sqrt2}$ , $E(a_1,b_3)=-\cos135^\circ=+\tfrac{1}{\sqrt2}$ , $E(a_3,b_1)=-\tfrac{1}{\sqrt2}$ , $E(a_3,b_3)=-\tfrac{1}{\sqrt2}$ . Why: $\cos135^\circ=-\cos45^\circ$ flips the sign of the subtracted term, so after the minus sign it too adds constructively.

Step 3. Assemble the sum:

S=\Big(-\tfrac{1}{\sqrt2}\Big)-\Big(+\tfrac{1}{\sqrt2}\Big)+\Big(-\tfrac{1}{\sqrt2}\Big)+\Big(-\tfrac{1}{\sqrt2}\Big)=-\frac{4}{\sqrt2}=-2\sqrt2

so $|S|=2\sqrt2\approx2.828$ , saturating Tsirelson's bound. Why: four correlators each of magnitude $1/\sqrt2$ combine to $4/\sqrt2=2\sqrt2$ — the previous derivation's ceiling is reached exactly, confirming the singlet is the optimal CHSH resource. *The arithmetic checks out: $4\cos45^\circ=4/\sqrt2=2\sqrt2=2.82843$ , and the matched settings $45^\circ$ and $90^\circ$ give $E=-\cos0=-1$ , the perfect anticorrelation used for the key.*

Limiting cases

The observed CHSH value $S$ interpolates smoothly between "provably secure" and "provably useless", and the table reads the extremes.

Case	Result	Meaning
Ideal singlet (no Eve, no noise)	$S=2\sqrt2\approx2.828$	Tsirelson's bound saturated; matched-basis QBER is $0$ and Eve's information is zero by monogamy.
Classical / fully eavesdropped	$\|S\|\le2$	Any local-hidden-variable model — including intercept-resend or pre-shared instructions — obeys the CHSH bound; no violation means no certified security.
Noisy Werner state $\rho=p\,\|\Psi^-\rangle\langle\Psi^-\|+\tfrac{1-p}{4}\mathbb{1}$	$S=2\sqrt2\,p$	Violation requires visibility $p>1/\sqrt2\approx0.707$ ; below it the state admits an explicit local model and the protocol aborts.
Maximal algebraic value (unphysical)	$\|S\|_{\max}=4$	Reached only by hypothetical super-quantum PR-box correlations; quantum mechanics forbids anything above $2\sqrt2$ .

Common trapE91 is not "BB84 with extra steps" — the Bell test is the security, not a sanity check

The most common misconception is that the mismatched-basis data are optional quality-control and the "real" protocol is just the sifted key. In the device-independent reading it is the opposite: without a violation you cannot exclude a local model in which Eve pre-loaded the source with copies of the answers, so the Bell test is the security argument. A companion trap equates strong raw-key correlation with safety. A classical source that hands Alice and Bob identical pre-shared instruction sheets reproduces perfect anticorrelation in every matched basis — a flawless-looking raw key — yet gives $|S|\le2$ and leaves Eve a full copy. High matched-basis correlation is necessary but nowhere near sufficient; only the Bell violation rules out the pre-shared-instruction attack.

Worked examples

1 · The singlet reaches the Tsirelson bound (fully worked)

Alice measures at $\hat a_1=0^\circ$ and $\hat a_3=90^\circ$ ; Bob at $\hat b_1=45^\circ$ and $\hat b_3=135^\circ$ . Using the singlet law $E=-\cos\theta$ , compute the CHSH value and confirm the key bases are perfectly anticorrelated.

Step 1. Relative angles for the four CHSH pairs are all $45^\circ$ except $\theta_{a_1b_3}=135^\circ$ . Evaluate: $E(a_1,b_1)=-\cos45^\circ=-0.7071$ , $E(a_1,b_3)=-\cos135^\circ=+0.7071$ , $E(a_3,b_1)=-0.7071$ , $E(a_3,b_3)=-0.7071$ .

Step 2. Form the sum $S=-0.7071-0.7071-0.7071-0.7071=-2.8284$ , so $|S|=2\sqrt2\approx2.828$ — the Tsirelson maximum, comfortably above the classical $2$ .

Step 3. The key comes from the matched settings, where Alice's $45^\circ$ meets Bob's $45^\circ$ and Alice's $90^\circ$ meets Bob's $90^\circ$ : relative angle $0^\circ$ , so $E=-1$ , perfect anticorrelation. Alice (or Bob) flips her bit to turn the anticorrelation into an identical shared key. Sorted after the public announcement, the same runs deliver both the key and its security certificate.

2 · An intercept-resend eavesdropper is caught twice over

Eve intercepts each qubit, measures it along a random axis, records the result, and resends the matching eigenstate. What does she do to $S$ and to the matched-basis QBER?

Step 1. Once Eve measures and resends, the qubits carry only the definite classical values she recorded — a local-hidden-variable description. By equation (5) any such model obeys $S\le2$ : the Bell violation collapses to the classical bound.

Step 2. The key errors: on a matched-basis round, Eve's random axis coincides with the shared axis only some of the time, and when it is misaligned she randomizes the outcome she forwards. Averaging over her random-axis strategy gives a matched-basis error rate of about $Q\approx25\%$ , the same $25\%$ intercept-resend inflicts in BB84.

Step 3. Either signal alone condemns the channel: $S$ falling to $2$ (no certified nonlocality), or a QBER of $25\%$ (far above the $11\%$ ceiling). Alice and Bob abort, or — for milder tampering — apply privacy amplification scaled to the observed $S$ . Eve cannot both learn the key and stay hidden: gaining information forces $S\!\downarrow$ and $Q\!\uparrow$ .

3 · From a measured QBER to a secret-key rate

A real link reports a matched-basis QBER of $Q=2\%$ with a Bell violation safely above threshold. What asymptotic secret-key rate does the BB84-equivalent bound give, and how noisy could the channel get before the key dies?

Step 1. Binary entropy at $Q=0.02$ : $h_2(0.02)=-0.02\log_2 0.02-0.98\log_2 0.98=0.1211+0.0203=0.1414$ bits.

Step 2. Rate from equation (8): $r_\infty\ge1-2h_2(0.02)=1-0.2829=\mathbf{0.717}$ secret bits per sifted bit. About seven usable key bits for every ten matched-basis rounds — a healthy margin.

Step 3. The cutoff: $r_\infty=0$ when $h_2(Q)=\tfrac12$ , at $Q\approx\mathbf{11\%}$ . Above that, reconciliation and privacy amplification cost more than the raw information and no secret key survives — the same tolerance BB84 enjoys, reached here through certified entanglement rather than trusted preparation.

Physics of the portrait

The refractive index took two centuries to explain; E91's certificate took a different kind of patience — the willingness to found a technology on a theorem that Einstein himself hoped was a symptom of an incomplete theory.

Origins · 1 minArtur Ekert and how this was discovered

Artur Ekert

born 1961 · quantum cryptography and entanglement-based key distribution

Artur Ekert was born in Wrocław, Poland, in 1961, and was a doctoral student at the University of Oxford — working in the orbit of David Deutsch — when in 1991 he published "Quantum cryptography based on Bell's theorem" in Physical Review Letters. Bennett and Brassard's BB84 (1984) had already shown that quantum mechanics could distribute keys, but it leaned on a trusted sender preparing nonorthogonal states. Ekert asked whether the nonlocality of entanglement — the very feature Einstein, Podolsky and Rosen had raised in 1935 to argue quantum mechanics was incomplete, and that Bell had made testable in 1964 — could itself be the security mechanism. His answer: distribute singlets, and use the violation of Bell's inequality both to generate key bits and to catch any eavesdropper, since an eavesdropper is just another hidden variable and hidden variables cannot violate the bound. At first the community saw an elegant reformulation of BB84; only later was it clear that Ekert had planted the seed of device independence — security certified by observed statistics, with no trust in the hardware. He went on to found the Centre for Quantum Technologies in Singapore and hold a professorship at Oxford. What Einstein offered as an objection, Ekert turned into a guarantee.

History

1935

— Einstein, Podolsky and Rosen challenge the completeness of quantum mechanics using entangled pairs

1964

— Bell turns the EPR question into a testable inequality on correlations

1969

— Clauser, Horne, Shimony and Holt recast it in the experimentally usable CHSH form

1980

— Tsirelson proves quantum correlations cannot exceed 2√2

1991

— Ekert grounds key distribution in the violation of Bell's inequality

Going further

Texts. Ekert, "Quantum cryptography based on Bell's theorem", Phys. Rev. Lett. 67, 661 (1991) — the founding paper · Nielsen and Chuang, Quantum Computation and Quantum Information, 10th anniv. ed., §12.6 (quantum cryptography) · Preskill, Lecture Notes on Quantum Information, Ch. 4 (Bell inequalities) and Ch. 10 (QKD) · Cirel'son (Tsirelson), "Quantum generalizations of Bell's inequality", Lett. Math. Phys. 4, 93 (1980) · Wilde, Quantum Information Theory, 2nd ed. (private communication and monogamy) · Mermin, Quantum Computer Science, §6 (entanglement and Bell's theorem). The key results throughout this article are: (1) the singlet law $E(\hat a,\hat b)=-\cos\theta_{ab}$ from $U\otimes U$ invariance, with $E(0)=-1$ , $E(45^\circ)=-1/\sqrt2$ , $E(90^\circ)=0$ ; (2) Tsirelson's bound from $\mathcal S^2=4\,\mathbb1+[A_1,A_3][B_1,B_3]$ , giving $\|\mathcal S\|\le\sqrt8=2\sqrt2$ ; (3) the explicit value $|S|=4\cos45^\circ=2\sqrt2\approx2.828$ at Ekert's angles (Alice $0^\circ,90^\circ$ ; Bob $45^\circ,135^\circ$ ), with matched bases $45^\circ,90^\circ$ giving $E=-1$ ; (4) the $25\%$ intercept-resend QBER and the local bound $|S|\le2$ ; (5) the Werner threshold $p>1/\sqrt2\approx0.707$ from $S=2\sqrt2\,p$ ; (6) the key rate $r_\infty=1-2h_2(Q)$ with $h_2(0.02)=0.1414\Rightarrow r_\infty=0.717$ and cutoff $Q\approx11\%$ . Note: the widely copied claim " $S=3\cos22.5^\circ-\cos67.5^\circ=2\sqrt2$ " is numerically false ( $=2.389$ ); it confuses the spin convention $E=-\cos\theta$ with the photon convention $E=-\cos2\theta$ . This article uses the spin convention throughout, with $45^\circ$ relative angles.

Prerequisites. Bell-State Measurement · BB84 Protocol · Quantum Bit Error Rate and Sifting. Leads to. Information Reconciliation and Privacy Amplification · No-Cloning Theorem in Cryptography · Entanglement Swapping.

Ask the tutor: Ask me to walk through why a maximal Bell violation leaves an eavesdropper with literally zero information about the key, or to run the CHSH arithmetic at Ekert's angles step by step.

How is E91 actually different from entanglement-based BB84?

In the ideal noiseless case they produce the same correlations and their standard security proofs coincide — which is why E91 was first read as a repackaging of BB84. The difference is conceptual and becomes operational under attack. BB84's security is proved by reasoning about the states a trusted sender prepares and the no-cloning theorem that protects them; E91's security is read directly off a measured Bell parameter $S$ , with no assumption about the source or detectors. That shift — from trusting the device to trusting the statistics — is what makes E91, not BB84, the ancestor of device-independent QKD.

Why does violating a Bell inequality prove there is no eavesdropper?

Because an eavesdropper is a special case of a hidden variable. Any strategy in which Eve gains information about the key — measuring the qubits, keeping entangled copies, or pre-loading the source with classical instructions — makes Alice and Bob's outcomes depend on some extra system she holds. If that dependence let her predict the key, the outcomes would be pre-determined relative to her information, and pre-determined local outcomes obey $|S|\le2$ . So $S$ above $2$ certifies no such local explanation exists, and $S=2\sqrt2$ certifies, via monogamy, that Eve is fully decoupled from the key.

What is Tsirelson's bound and why is it exactly two root two?

Tsirelson's bound is the maximum CHSH value quantum mechanics allows: $|S|\le2\sqrt2$ , a factor $\sqrt2$ above the classical ceiling of $2$ . It comes from squaring the CHSH operator to get $\mathcal S^2=4\,\mathbb1+[A_1,A_3][B_1,B_3]$ ; each commutator has norm at most $2$ , so $\|\mathcal S^2\|\le8$ and $\|\mathcal S\|\le\sqrt8=2\sqrt2$ . The bound is tight — the singlet reaches it — and it is a hard wall, not a record. Correlations beyond $2\sqrt2$ (up to the algebraic maximum $4$ ) exist only in hypothetical super-quantum "PR-box" theories.

Why does the matched-basis QBER work out to about 25% under intercept-resend?

When Eve intercepts a qubit, measures along a random axis, and resends the eigenstate she found, she projects it onto her random basis. On a round where Alice and Bob later reveal they used the same axis, Eve's random choice aligns with theirs only partially, and averaged over her uniformly random axis the probability her resent state gives the wrong outcome relative to the singlet's perfect anticorrelation works out to one in four. This is the same $25\%$ intercept-resend error that appears in BB84, and it sits far above the $\sim11\%$ ceiling for a positive key rate — so even partial intercept-resend is easy to detect.

Does E91 need a Bell inequality violation, or just entanglement?

It needs the violation, not merely entanglement — the subtle heart of the protocol. Some Werner states with $p<1/\sqrt2$ are genuinely entangled yet admit a local-hidden-variable model for the CHSH measurements, so they cannot violate the inequality. For those states E91 cannot certify security device-independently, because Eve could reproduce the observed correlations with a classical model. Entanglement is necessary; a certified violation is what the security proof actually requires.

Can E91 close the gap to a fully device-independent guarantee in practice?

In principle yes — that is its whole point — but the loopholes matter. A rigorous device-independent proof cannot assume the detectors are efficient or the two wings truly separated, so a real demonstration must close the detection and locality loopholes at once, which demands near-unit detection efficiency that photons struggle to deliver over long fibre. The first loophole-free device-independent QKD demonstrations arrived only in 2022, using trapped ions and single atoms rather than photons, at very low key rates over short distances. Raising those rates and extending the distance is the open engineering problem between E91's promise and everyday use.