crypto-lab-e91

What It Is

An interactive simulation of E91 (Ekert 1991), the entanglement-based quantum key distribution protocol. A source emits polarization-entangled photon pairs in the singlet state; Alice and Bob each measure their half at independently chosen analyzer angles; the joint statistics are checked against the CHSH form of Bell's inequality. Quantum mechanics allows |S| to reach the Tsirelson bound 2√2 ≈ 2.828, while any classical (local hidden-variable) theory is stuck at |S| ≤ 2. The modeled intercept-resend attack destroys the violation; observing or losing a violation alone is not a secret-key security verdict.

The protocol is the cousin of BB84 in the sibling crypto-lab-bb84 demo. This page contrasts their tests: BB84 estimates bit errors; E91 estimates a Bell statistic. The engine is implemented from scratch in TypeScript using the standard textbook quantum-mechanical predictions for the singlet state, plus three additional channel models (depolarizing noise, analyzer misalignment, photon loss) so the demo can show that a missing 2√2 is not by itself proof of an eavesdropper — noise and calibration error can produce the same signature.

This is an idealized educational simulation, not a model of real photon-counting hardware. There is no detector dark-count model, no finite-key correction, no decoy-state analysis, no side-channel attacks. The math you see is the standard textbook math, decorated with sample-size-aware statistics (descriptive plug-in standard errors and conservative joint confidence bounds on |S|) so the Bell-test outcome depends on the data rather than a hard-coded threshold.

When to Use It

• Teaching how entanglement detects eavesdroppers — the singlet's correlation exceeds anything a classical theory can produce, and Eve's measurement drags it back to classical.
• Comparing E91 and BB84 — both distribute candidate key bits and sample correlations or errors. BB84 uses QBER to test disturbance; E91 tests CHSH correlations. Neither statistic by itself establishes a secret key.
• Introducing CHSH, Tsirelson's bound, and Bell-test statistics — including the lesson that the answer is a confidence interval, not a single number.
• Distinguishing attack from ordinary degradation — noise and misalignment can reduce |S| without Eve; independent, fair loss retains the expected correlation while reducing the sample and widening its interval.
• Setting up device-independent QKD intuition — DI-QKD descends directly from E91, but a Bell violation alone is insufficient for the key-security guarantee of a specific protocol.
• Do NOT use this as a model of a real quantum channel. It is faithful to the textbook idealization, not to lab hardware.
• Do NOT confuse QKD with post-quantum cryptography. QKD addresses key distribution over a quantum channel; it does not replace the larger PQC migration story (see the rest of the suite for that).

Live Demo

systemslibrarian.github.io/crypto-lab-e91

Inside the page:

• Scenario chip strip — five channel models you can flip between: ideal, intercept-resend Eve, depolarizing noise, misaligned analyzer, lossy channel. Each scenario has a one-line story and an expectation for |S| and key agreement; the parameterised ones (noise level, misalignment angle, detection efficiency) expose a slider.
• Selective detection — a separate exact eight-instruction local classical model compares all emitted rounds (|S| = 2) with a biased two-click sample (apparent |S| = 4, with only 25% of each setting pair retained). The detector gates use only local settings and a shared preassigned instruction. It illustrates the fair-sampling assumption, not a real-device attack or a QKD security proof.
• Statistical Bell-test panel — Bell violation observed / below classical bound / inconclusive, with the 95% interval for |S| spelled out. These labels classify the modeled Bell test, not a key.
• CHSH gauge with confidence band — visual marker for the measured |S|, dashed CI box, and labelled ticks at the classical bound (2) and Tsirelson's bound (2√2).
• Expected vs measured correlation table — the four E(aᵢ,bⱼ) with their theoretical value, measured value, simultaneous confidence bounds, descriptive plug-in standard error, and sample size. A ! badge marks a model expectation outside the simultaneous bounds.
• Candidate sifted-bit panel — Alice / Bob bit strings from the dedicated 45° key setting, per-bit agreement coloring, measured vs expected agreement percentage. The bits are not a final secret key.
• Round-by-round transcript (optional) — first 50 rounds with bucket (CHSH / key), analyzer indices, angles in degrees, ±1 outcomes, and the product A·B.
• The Bell test explained — concept cards, the singlet correlation curve E(Δ) = −cos(2Δ) with CHSH points marked, and the five-step protocol flow.
• E91 vs BB84 — six-row comparison table linking the sibling demo.
• In the real world — Bell (1964), Aspect (1982), Ekert (1991), loophole-free Bell (2015), Micius (2017), device-independent QKD (2022).
• Sources & further reading — primary references with DOIs, plus a "what this simulation does and does not model" caveat box.

Shareable runs: the rounds, scenario, scenario knob value, seed, and transcript flag are mirrored to the URL hash. The "Copy link to this run" button gives you a deterministic URL that reproduces the exact run; "Copy results (CSV)" exports the summary and transcript to clipboard.

What Can Go Wrong

• A missing 2√2 is ambiguous. A measured |S| below the classical bound can be caused by an eavesdropper or by ordinary noise, misalignment, or loss; from |S| alone you cannot tell which, so a degraded key is discarded either way.
• A Bell pass is not a key. The five-step panel displays candidate sifted bits from a preselected shared 45° setting and tests separate CHSH rounds. Its confidence interval addresses the modeled correlations under independent-trial and fair-sampling assumptions; it neither certifies an untrusted source nor establishes a finite-key secret. Real QKD needs authenticated public discussion, error reconciliation, privacy amplification with an entropy bound, and a security proof for its devices and protocol.
• Finite-key effects. Real E91 needs finite-key security corrections and enough rounds for the CI to tighten; a small sample can leave the verdict inconclusive or misleading (this demo models the statistics but not full finite-key proofs).
• Detector side-channels (real hardware). Physical implementations face detector-blinding, timing, and efficiency-loophole attacks that an idealized simulation does not capture.
• Unauthenticated classical channel. The public discussion/sifting channel must be authenticated; without it, a man-in-the-middle can defeat QKD regardless of the Bell test.
• The detection-efficiency (loss) loophole. Low detection efficiency can let a local hidden-variable model fake a Bell violation, so loss must be accounted for in any real security claim.
• Fair loss and selective loss differ. The channel slider discards pairs independently of settings and outcomes, which leaves expected |S| unchanged. The separate exact classical model filters coincidences by local detector rules and can fake an apparent violation on a biased subset. See Larsson, Loopholes in Bell Inequality Tests of Local Realism (2014); a loophole-aware protocol must handle missing rounds, and real device-independent QKD needs much more than this comparison.

Real-World Usage

• Device-independent QKD. E91 is a conceptual ancestor of DI-QKD. Formal security also depends on the protocol, observed errors, reconciliation, finite-key bounds and physical assumptions; a violation by itself is not sufficient.
• Entanglement-based QKD experiments. Laboratory and field demonstrations distribute entangled photon pairs and verify CHSH violation as the security test.
• Satellite QKD. The Micius satellite distributed entangled photons over ~1200 km, demonstrating entanglement-based key distribution at intercontinental scale.
• Loophole-free Bell tests. Experiments such as Hensen et al. (2015) closed the detection and locality loopholes, underpinning the security argument E91 relies on.
• Bell-test-certified randomness. The same Bell-violation certificate used in E91 is used to certify randomness in device-independent randomness expansion.

How to Run Locally

git clone https://github.com/systemslibrarian/crypto-lab-e91
cd crypto-lab-e91
npm install
npm run dev

Related Demos

• crypto-lab-bb84 — the sibling QKD protocol whose alarm is QBER from no-cloning, not a Bell violation.
• crypto-lab-shor — Shor's algorithm, the quantum attack that motivates quantum-safe key distribution.
• crypto-lab-grover — Grover's algorithm and quantum search against symmetric keys.
• crypto-lab-pq-families — the five post-quantum families, the computational alternative to QKD.

Statistical interpretation of S

The CHSH parameter S = E(a₁,b₁) + E(a₁,b₂) + E(a₂,b₁) − E(a₂,b₂) combines four sample means. Each ±1 product becomes a Bernoulli observation via X = (A·B + 1)/2. Hoeffding's inequality gives P(|p̂ − p| > ε) ≤ 2 exp(−2nε²). Allocate .05/4 error to each setting, choose ε = √(ln(160)/(2n)), and transform p̂ ± ε back to correlation bounds, intersected with the known domain [-1,1].

The union bound gives at least 95% simultaneous coverage of all four correlations. Add the first three lower/upper endpoints and subtract the fourth upper/lower endpoints to get signed S bounds; then map that whole interval through absolute value, using zero as the lower bound if it crosses zero. This is a conservative finite-sample interval, not a clipped Wald approximation or a claim of exactly 95% coverage. All-identical finite samples keep nonzero width. An unobserved setting retains [-1,1]; its measured value and standard error are unobserved, exported as empty CSV cells, and the verdict is inconclusive. The gauge spans the algebraic bound 4, so a sparse estimate above the expected quantum bound remains visible.

The Bell-test outcome compares these bounds with 2: “Bell violation observed” requires the lower bound above 2, “Below classical bound” the upper bound below 2, and “Inconclusive” otherwise or whenever a setting is missing. Noise and misalignment can lose the violation too; this does not identify Eve. The engine retains legacy internal identifiers secure and compromised for compatibility; they mean only the stated interval comparison. CSV exports use bell_test_outcome and scoped values. The retained plug-in SE(E) = √((1 − E²)/n) and root-sum-square SE(S) are descriptive, never confidence radii. A zero plug-in SE is not certainty.

Coverage assumes independent observations in a fixed run, conditioned on setting counts with the simulator's setting/outcome-independent loss. It does not apply to arbitrary detector selection, adversarial device memory, or repeatedly testing until a favorable result appears. Seeded runs are reproducible controls, not random coverage experiments. This remains a teaching model, not a finite-key or device-independent QKD security proof. See Bartlett's lecture 12, §4.2 for the concentration bound.

Testing

scripts/engine.test.mjs is the source of truth. It covers:

• The singlet correlation function returns textbook values.
• The theoretical S for each scenario matches the textbook closed form (2√2, √2 under intercept-resend at π/8, (1−p)·2√2 under depolarizing noise, 2√2·cos(2δ) under misalignment, and unchanged under loss).
• The theoretical key agreement at aligned bases matches its closed form per scenario.
• runE91 converges to the predicted |S| within 0.05 for 30k seeded rounds across all five scenarios.
• The confidence-aware Bell-test outcome classifies seeded runs on opposite sides of the classical bound, and the legacy eve: true / false flag still selects the right scenario.
• The transcript respects its cap, labels CHSH vs key buckets, and records consistent product = A·B.
• Joint confidence bounds stay nondegenerate at finite all-identical samples; missing/partial settings and the supported sparse-loss example are inconclusive. Exact binomial enumeration checks the per-setting noncoverage budget over small sample sizes; this numerical control supplements the Hoeffding/union-bound derivation. Impossible counts are rejected.
• Per-correlation descriptive standard errors and S confidence bounds are populated; browser controls check table/verdict/gauge/CSV agreement, algebraic limits and model-discrepancy badges.
• effectiveRounds for the lossy channel matches rounds · η² to within sampling noise.
• resolveScenario accepts both ID strings and partial-override objects.

One workflow does both. .github/workflows/deploy.yml has a build job that runs npm test, npm run build and the Chromium accessibility gate on every push and pull request, and a deploy job that ships dist/ to GitHub Pages on push to main and names build in needs:. The Dependabot auto-merge names the same job, so a bump cannot merge against a lighter gate than the one the deploy runs.

Sources

Primary references are also listed on the live page with DOIs. The most load-bearing:

• J. S. Bell. On the Einstein Podolsky Rosen paradox. Physics 1, 195 (1964).
• J. F. Clauser, M. A. Horne, A. Shimony, R. A. Holt. Proposed experiment to test local hidden-variable theories. PRL 23, 880 (1969).
• B. S. Cirel'son. Quantum generalizations of Bell's inequality. Lett. Math. Phys. 4, 93 (1980).
• A. K. Ekert. Quantum cryptography based on Bell's theorem. PRL 67, 661 (1991).
• B. Hensen et al. Loophole-free Bell inequality violation. Nature 526, 682 (2015).
• J. Yin et al. Satellite-based entanglement distribution over 1200 km. Science 356, 1140 (2017).
• D. P. Nadlinger et al. Experimental QKD certified by Bell's theorem. Nature 607, 682 (2022).
• W. Zhang et al. A device-independent QKD system for distant users. Nature 607, 687 (2022).

Standard textbook treatment: Nielsen & Chuang, Quantum Computation and Quantum Information (Cambridge), Chapters 2 and 12. For QKD security proofs beyond the idealization, see Renner's 2005 thesis arxiv.org/abs/quant-ph/0512258.

For why nonlocality alone does not imply a key from standard device-independent protocols, see Farkas et al., Bell Nonlocality Is Not Sufficient for the Security of Standard Device-Independent Quantum Key Distribution Protocols, Physical Review Letters 127, 050503 (2021). Their result is conditional on the protocols and reconciliation studied; it does not say that all DI-QKD is impossible.

---

Part of the Crypto Lab suite.

"So whether you eat or drink or whatever you do, do it all for the glory of God." — 1 Corinthians 10:31