The Ekert E91 Protocol

In 1991 the physicist Artur Ekert published a startling idea: you can share a secret cryptographic key with a stranger over a public channel, and the laws of quantum mechanics will tell you if anyone listened in. The trick is not mathematics — it is physics.

The key ingredient is quantum entanglement. Two particles can be prepared so that their properties are correlated in a way that has no classical explanation. Measure one particle and the outcome is random; measure the other and you get a result that, when compared, reveals a shared pattern. But here is the crucial part — the correlations are so strong that they violate something called a Bell inequality, a limit that any classical, "hidden-variable" theory must obey.

An eavesdropper who intercepts the particles must measure them, and measurement in quantum mechanics disturbs the state. That disturbance weakens the Bell correlations. Alice and Bob simply run a Bell test on a sample of their pairs: if the correlations are strong, the line was clean; if they are weakened, someone was listening.

E91 is one of the founding protocols of quantum key distribution (QKD) — the field that uses quantum mechanics to make eavesdropping physically detectable rather than merely computationally hard. Unlike classical cryptography, its security does not depend on any assumption about an attacker's computational power.

The simulation below runs the core loop of E91. Alice and Bob each pick a random measurement basis for every entangled pair. After measuring, they publicly compare which bases they used (not their outcomes). Pairs where they chose compatible bases produce a shared bit; the rest are discarded. A final Bell test on a subset of pairs checks whether correlations are strong enough to rule out eavesdropping.

<!-- {{c_layout_comment}} -->
<div class="controls">
  <label>{{lbl_rounds}} <input type="number" id="nRounds" min="10" max="200" value="60" /></label>
  <label class="spy-wrap">
    <input type="checkbox" id="spyOn" />
    {{lbl_spy}}
  </label>
  <button id="btnRun" type="button">{{btn_run}}</button>
</div>
<div id="results" class="results hidden">
  <div class="stat-row">
    <span class="stat-label">{{lbl_key_bits}}</span>
    <span class="stat-val" id="valKeyBits">—</span>
  </div>
  <div class="stat-row">
    <span class="stat-label">{{lbl_bell_score}}</span>
    <span class="stat-val" id="valBell">—</span>
  </div>
  <div class="stat-row">
    <span class="stat-label">{{lbl_verdict}}</span>
    <span class="stat-val verdict" id="valVerdict">—</span>
  </div>
  <div class="key-display" id="keyDisplay"></div>
  <div class="bell-bar-wrap">
    <div class="bell-bar-bg">
      <div class="bell-bar-fill" id="bellBar"></div>
      <span class="bell-mark classical" title="{{title_classical_bound}}">2</span>
      <span class="bell-mark quantum" title="{{title_quantum_bound}}">2√2</span>
    </div>
    <div class="bell-labels">
      <span>0</span><span>{{lbl_bar_classical}}</span><span>{{lbl_bar_quantum}}</span>
    </div>
  </div>
</div>
<p class="footnote" id="footNote"></p>

/* {{c_css_comment}} */
* { box-sizing: border-box; }
body { font-family: system-ui, sans-serif; margin: 0; color: #1d2433; font-size: 14px; }
.controls { display: flex; flex-wrap: wrap; gap: .6rem; align-items: center; margin-bottom: .8rem; }
.controls label { display: flex; align-items: center; gap: .3rem; font-size: .88rem; }
.controls input[type=number] { width: 64px; padding: .25rem .4rem; border: 1px solid #adb5c0; border-radius: 6px; font-size: .88rem; }
.spy-wrap { background: #fff3cd; border-radius: 6px; padding: .25rem .55rem; border: 1px solid #e9c46a; }
button { font: 600 13px system-ui; padding: .4rem .85rem; background: #1d3557; color: #fff; border: none; border-radius: 8px; cursor: pointer; }
button:hover { background: #2a4a75; }
.results { margin-top: .4rem; }
.hidden { display: none; }
.stat-row { display: flex; justify-content: space-between; align-items: baseline; border-bottom: 1px solid #e8eef3; padding: .28rem 0; }
.stat-label { color: #4a5568; }
.stat-val { font-weight: 700; }
.verdict.ok { color: #0a7d33; }
.verdict.warn { color: #c92f3c; }
.key-display { font: 600 12px ui-monospace, monospace; background: #e8eef3; border-radius: 6px; padding: .45rem .6rem; margin: .55rem 0; word-break: break-all; color: #1d3557; min-height: 1.8em; letter-spacing: .05em; }
.bell-bar-wrap { margin-top: .55rem; }
.bell-bar-bg { position: relative; height: 22px; background: #dde3eb; border-radius: 6px; overflow: visible; }
.bell-bar-fill { height: 100%; border-radius: 6px; background: #1d3557; transition: width .5s; }
.bell-mark { position: absolute; top: -18px; font-size: .75rem; font-weight: 700; transform: translateX(-50%); }
.bell-mark.classical { left: 50%; color: #c92f3c; }
.bell-mark.quantum   { left: 88.4%; color: #0a7d33; }
.bell-labels { display: flex; justify-content: space-between; font-size: .72rem; color: #666; margin-top: 2px; }
.footnote { font-size: .78rem; color: #666; margin: .5rem 0 0; line-height: 1.45; }

// Code not found

Notice: the key bits come only from the rounds where both parties' bases matched. The Bell-test rounds use the mismatched pairs — not to extract key bits but to detect any spy. If you enable the eavesdropper, the Bell score drops below the classical bound and the protocol aborts.

For a purely classical channel the same trick is impossible: there is no classical correlation that simultaneously yields shared random bits and violates Bell inequalities. The security is a direct consequence of quantum physics, not computational complexity.

Classical key exchange (like Diffie–Hellman) is secure only as long as factoring large numbers is hard — a guarantee that quantum computers could break. E91's security is of a fundamentally different kind.

• Bell inequality as a security proof. The CHSH form of Bell's inequality states that for any local hidden-variable theory, a correlation quantity $S$ satisfies $|S| \le 2$. Quantum entanglement achieves $|S| = 2\sqrt{2} \approx 2.83$. Any eavesdropper who touches the particles reduces $|S|$ toward 2 — a measurable drop that Alice and Bob detect.
• Information-theoretic security. The key's secrecy does not rest on computational hardness. Even an attacker with unlimited computing power cannot extract information without disturbing the Bell test — because the disturbance is physical, not computational.
• Device independence. Because the Bell test certifies the correlations from the outside (just statistics), in principle Alice and Bob do not even need to trust that their quantum devices are properly built. A sufficiently strong Bell violation rules out any local hidden-variable strategy, including a malicious device.
• Key rate. In practice, only the fraction of rounds with compatible bases contribute key bits. With two bases each, roughly $\frac{1}{2}$ of rounds are sifted; additional losses come from error correction and privacy amplification. The Shor algorithm would shatter RSA; E91 gives a key-distribution method that no quantum computer can break.
• Open engineering challenge. While the theory is settled, building a practical E91 system — fiber links, satellite channels, high-efficiency entangled photon sources — remains a major engineering challenge. Photon loss in fiber limits distance, and detector dark counts add noise that pushes $|S|$ down.

E91 and its descendants are not just theoretical curiosities — they drive an entire engineering ecosystem:

• Quantum networks: metropolitan quantum networks in Geneva, Tokyo, and Beijing already carry QKD traffic. E91-style entanglement distribution is the long-term blueprint for a global quantum internet.
• Satellite QKD: China's Micius satellite demonstrated entanglement-based key distribution over 1,200 km in 2017, approaching the inter-continental distances where fiber losses make terrestrial QKD impractical.
• Device-independent QKD: the Bell-test security proof points toward protocols that remain secure even if the hardware was built by an adversary — relevant for supply-chain security in high-stakes environments.
• Post-quantum standards: while NIST's post-quantum algorithms address the threat of quantum computers breaking classical crypto, QKD (and E91 in particular) offers a physics-layer alternative that is independent of any hardness assumption. See also Shor's algorithm and discrete logarithm for the classical problems it threatens.
• Quantum repeaters: extending E91 links beyond a few hundred kilometers requires quantum repeaters — devices that entangle remote nodes without a direct photon path, one of the central open problems in quantum networking.

Ekert's E91 protocol turns a deep theorem of physics — the violation of Bell inequalities by entangled particles — into a practical security guarantee. Any eavesdropper must touch the particles, touching disturbs the correlations, and the disturbance shows up in the Bell test. The key is not hidden inside a hard mathematical problem; it is protected by the structure of reality itself.

Classical cryptography asks: "can the attacker compute fast enough?" E91 asks instead: "can the attacker measure without disturbing?" Quantum mechanics answers that second question with a resounding no — making E91 one of the few security proofs that will survive any future advance in computing, including the arrival of large-scale quantum computers.

Curious how a quantum computer might crack classical keys in the first place? See Shor's algorithm and Grover's search.