\documentclass[prb,preprint]{revtex4-1} 
\usepackage{amsmath}  % needed for \tfrac, \bmatrix, etc.
\usepackage{amsfonts} % needed for bold Greek, Fraktur, and blackboard bold
\usepackage{multirow}
\usepackage{graphicx} % needed for figures
\usepackage[utf8]{inputenc}
\usepackage{braket}
\usepackage{longtable}
\usepackage{url}

\begin{document}
\title{A Hands-On Quantum Cryptography Workshop For Pre-University Students}
\author{Adrian Nugraha Utama}
\email{adrian\_utama@u.nus.edu} % optional
\author{Lee Jianwei}
\author{Mathias Alexander Seidler}
\affiliation{Centre for Quantum Technologies, National University of Singapore, Block S15, 3 Science Drive 2, 117543}

\date{\today}

\begin{abstract}
%%JW AWESOME CV
We developed a modified version of a conventional (BB84) quantum key distribution protocol that can be understood and implemented by students at a pre-university level. 
We intentionally introduce a subtle but critical simplification to the original protocol, allowing the experiment to be assembled at the skill level appropriate for the students, at the cost of creating a security loophole.
The security vulnerability is then exploited by student hackers, allowing the participants to think deeper about the underlying physics that makes the protocol secure in its original form.
%%JW AWESOME CV

% This article describes a modified version of the BB84 quantum key distribution protocol that can be understood and implemented by students at a pre-university level. Students assemble the opto-mechanical components, detection circuits and implement the protocol through classical and quantum channels in ways similar to the original protocol. The protocol follows BB84 exactly except that we use macroscopic intensity levels. This allows a simpler assembly and operation of the experiment. More importantly, distributing the keys at macroscopic levels also allow the implementation of a 'side-channel attack' where the quantum channel is eavesdropped without interrupting the protocol, unlike the case where the protocol is implemented at the level of single photons. The apparent failure of the protocol forces the learner to revisit the principle underlying the success of the BB84, which is the quantum no-cloning theorem.
\end{abstract}

\maketitle 

\section{Introduction}
% With ever-growing emphasis on data security, cryptography based on quantum physics is attractive as it promises unconditional security~\cite{qkdreview}. 
Quantum cryptography promises information-theoretic security based on quantum mechanics.~\cite{qkdreview} 
% Typically, in cryptography, 
% a key distributed between two parties allows them to encode and decode a private message.
Secure communication between two parties typically consists of two steps. First, a key is distributed between two parties. Second, parties use the key to encrypt their messages. 
% Typically, in cryptography, 
% a key distributed between two parties allows them to encode and decode a private message.
Classical cryptography ~\cite{rsa} relies on either ``safely" distributed keys (e.g. via smart cards), or computational complexity (e.g. factorization), and requires trusting the courier, or can be compromised with either increased computational power 
or with quantum algorithms.~\cite{niel} 
%HISTORY%
% On the other hand, 
However, quantum cryptography does not have these shortcomings, as it provides a framework, based on quantum mechanics, to determine if a would-be adversary has gained enough information to compromise the secrecy of distributed keys.~\cite{bb84proof, bb84proof2}

In 1984, Bennett and Brassard invented a scheme~\cite{bb84} to distribute symmetric keys securely between two parties. The security is based on the no-cloning theorem~\cite{nocloning}: an eavesdropper cannot create identical copies of an arbitrary unknown quantum state. This quantum key distribution (QKD) protocol is known as the BB84 protocol.
In 1991, Artur Ekert introduced another important QKD scheme~\cite{ekert} which utilizes entanglement~\cite{entg} 
and a Bell violation measurement~\cite{bell} to guarantee privacy.
These inventions spurred considerable interest from both the computer science and physics communities, and QKD is now an emerging technology.~\cite{exp1, exp2, exp3} Based on counter-intuitive, quantum-physical concepts, QKD also intrigues the general public. 
There now exist several QKD demonstrations for non-experts which focus on the key distribution step of the protocol.~\cite{momentum, brazildemo, choco, entangleme, interactivesims, interactivetuts}
However, since QKD and encryption are both non-trivial concepts, 
a session that implements both steps facilitates learners to arrive at a holistic understanding of how quantum cryptography is used to transmit a private message.
% we feel learners will achieve a holistic understanding of quantum cryptography by implementing both steps in the same session and witness a successful transmission of a private message.
% There now exists several QKD demonstrations which focus on the QKD aspect of the protocol to non-experts~\cite{momentum, brazildemo, choco, interactivesims,interactivetuts}.

% To introduce QKD to a wider audience, 
%  several pedagogical demonstrations with classical optics~\cite{momentum, brazildemo}, chocolate balls~\cite{choco}, 
%  and software simulations~\cite{interactivesims,interactivetuts} are available. 

% QKD has intrigued the general public as it is based on quantum physics, which is often counter-intuitive. 
% To make the protocol more understandable to non-specialists, 

% However, none of them provides a hands-on demonstration of the full protocol, which includes not just key generation and distribution, but also message encryption and transmission. 
% We feel that by providing a hands-on experience in both creating the secret key and using it to encrypt messages, students are provided with a concrete understanding of both procedures.

% \textbf{CRAPPY: However, we feel that it is more pedagogical to actually use the f**king key to actually really encrypt the f**kiong msg or else the kids don't know why they went through all that crap to distribute the key in the first place. Right?}

% , including key generation and distribution, followed by message encryption and transmission. 
% abstract to concrete nature is our advantage (pedagogical reason), esp for encryption where kids are not so familiar with a cypher

% Due to the abstract nature of both the key distribution and encryption procedure, we feel that it is important to teach both aspects of the protocol for students to arrive at a holistic understanding of 

% Due to the abstract nature of both the key distribution and encryption procedure, we feel that it is important for students to implement both aspects in order to witness the protocol functioning in its entirety.
% **juxtaposition of classical and qm.

% In this work, we develop a hands-on demonstration which allows students to implement both the key distribution and implementation, both of which are important to a cryptographic protocol. 
% We feel that it is important that students experience both cryptography and distribution to understanding the full protocol.

% 1. understand KD + ENCRYP
% 2. implement KD + ENCRYP
% 3. because both are nontrivial concepts
% 4. Point out how Q is important

% To introduce QKD to a wider audience, 
%  several pedagogical demonstrations with classical optics~\cite{momentum, brazildemo}, chocolate balls~\cite{choco}, 
%  and software simulations~\cite{interactivesims,interactivetuts} are available. 
% While there are demonstrations on QKD but they do not show the full cryptographic protocol.
% However, both QKD and encryption are non-trivial concepts, and we feel students will benefit if they implement both aspects in the same session and witness a successful transmission of a private message. 
% Since both QKD and encryption are non-trivial concepts, we feel that students will benefit if they implement both aspects in the same session and witness a successful transmission of a private message. 

% However both key distribution and message encryption are non-trivial concepts, and we feel both can be put together in a concrete setting for a comprehensive understanding.
% However as both key distribution and message encryption are non-trivial concepts, we feel both shoud be put together in a scenario where \textbf{}a message is secretly transmitted.
% We do this by fully implementing and witnessing a successful transmission of a private message.
% 1.They focus on QKD alone.

% There are works demonstrating key distribution (ref nums)
% however, both key distribution and encryption are non-trivial concepts, thus we feel that students will benefit if they implement both aspects in the same session and witness a successful transmission of a private message. 


In this work, we present a quantum cryptography workshop developed for pre-university students (age 15 to 19). 
Our aim is to go from abstract to concrete; 
from understanding quantum-mechanical concepts, 
to implementing a working setup in the laboratory.
% Our aim is to go from understanding abstract quantum-mechanical concepts to a concrete implementation of the protocol, 
% through a guided assembly and operation of the entire apparatus.
% The aim of the session is to present concretely some of the abstract quantum-mechanical ideas behind QKD, through a guided assembly and operation of the entire apparatus.
% and introduce it to a classroom of Grade 11-12 students.
% The aim of the session is to give students a holistic flavor of a cryptography system. 
First, the students set up two communication channels: a classical channel based on infrared pulses, and a quantum channel based on polarization encoded photons. 
Second, they distribute a symmetric key between two parties with the BB84 protocol.~\cite{bb84} 
Finally, they use the key to encrypt secret messages and send them over to the other party via the classical channel. 
% In this way, students witness a concrete implementation of the protocol in its entirety.

The security of BB84 relies on the fact that a single quantum bit (qubit) cannot be copied.~\cite{bb84proof} When multiple qubits of the same state are distributed, security is compromised since a fraction of the qubits can be intercepted and measured by an adversary. To illustrate this concept, we use macroscopic laser beams instead of single photons, creating a security loophole.
% Security of BB84 relies on the fact that a single photon state can not be copied. To illustrate this, we don't use single photons but a laser beam exposing the setup to a side-channel attack. 
% To illustrate how the security of the protocol relies on quantum mechanics, we implement the system classically. This exposes it to a side-channel attack since security can only be guaranteed if only one copy of a quantum bit is sent ~\cite{bb84proof}. 
% For our demonstration, we deliberately ignore this requirement and send innumerable copies of quantum bits, which opens up a major security vulnerability. 
We task another group of students to retrieve the key and decode secret messages. 
% The apparent failure of the QKD system creates a cognitive conflict which has been shown to result in greater learning gains~\cite{cogconflict, cogconflict2}. 
This security breach allows the students to revisit the `no-cloning' theorem and its role in quantum cryptography.
% and to discuss about the importance of device-independent QKD protocols~\cite{diqkd, diqkd2}.

In subsequent sections, we describe the BB84 protocol and our modification which enables it to be implemented with commercial, off-the-shelf components. 
To facilitate educators in conducting the workshop, we have provided detailed schematics and programs used to control the experiment.
Our approach received good feedback from the students, who appreciated the hands-on nature of the learning experience, and the unexpected security loophole present in what they presumed to be a secure quantum key distribution system.
% Details of the experimental setup, and the accompanying programs that enable 
%%%%% PUT BELOW MR UTAMAMAMAMAMA!!!!
% As there is no need to generate or detect light at the single photon level, the setup is implemented in a cost-effective manner using standard off-the-shelf optical and mechanical components. The sensors and actuators are controlled with commercially available Arduino, which interfaces with Python programs to run experimental sequences. The codes are freely available on Github~\cite{github}. 


%\section{SBB84: Simplified - BB84 key distribution protocol}
%The goal of any key distribution protocol is to exchange a secret key between two parties, 
%such that the key is only known to them.
% Then the secret key is used to encrypt and decrypt sensitive information. 

%When information is encoded in a single quantum system, it cannot be perfectly copied onto another system. This is guaranteed by the quantum no-cloning theorem. Hence, an eavesdropper (Eve) is unable to intercept, copy and resend information without corrupting the original information. By quantifying the key error rates between the sender and the receiver, the eavesdropper can be detected.

% Several protocols have been proposed throughout...rhetoric and lists of protocols blah blah... Ekert has advantage of being device-independent... 

%We propose a simplified version of Bennett and Brassard's quantum key distribution protocol~\cite{bb84} (BB84), which uses four different polarization states for information encoding. 
% Unlike other protocols (eg. Ekert protocol~\cite{ekert}), BB84 does not require an entanglement source and is easier to implement.

% To further simplify experimental realization, we do not generate quantum states at the single-photon level, thus removing the requirement to focus light to millimeter-sized single-photon detectors (eg. avalanche-photodiodes). 
% Instead, we use a bright laser source and detect light with centimeter-sized, commercially available, Si-PIN photodiodes. 

% The motivation for this modification is four-fold: 
% First, students have the opportunity to build QKD infrastructure from the ground up, within a reasonable amount of time, by removing the additional training required for generating and detecting light at single-photon level. 
% Experimental realization of the protocol makes concrete abstract concepts such as the use of polarization encoding in the quantum channel, and basis matching via the classical channel.

% Second, Si-PIN detectors are much cheaper, easier to setup, and more easily understood than single-photon detectors.

% Third, students already have the pre-requisite experience working with light at macroscopic levels in high-school. By leveraging on this experience to realize a fully functioning key-distribution system, we provide an opportunity for students to demonstrate competence, which is an essential intrinsic motivating factor in any learning task.~\cite{ryan}

% Fourth and most importantly, using macroscopic levels of light to encode information subjects the QKD protocol to a security vulnerability. By subjecting Alice and Bob to a successful hacking attempt, we allow students the opportunity to identify the physical principle underlying the security loophole.

% In the following section, we briefly describe the SBB84 protocol and the nature of the security breach.

\section{BBB84 Protocol With a Twist}\label{sec:bb84}

\begin{figure}[ht!]
\includegraphics[width=8.6 cm]{img/protocol_summ2.pdf}
\caption{\label{figure:bb84}
    Summary of the BB84 protocol.
} 
\end{figure}

% --- Unadulterated section ---
In this section, we describe the BB84 protocol and its security assumption.
The protocol generates a symmetric encryption key between two parties, usually called Alice and Bob.
% It is customary to denote the sending party as Alice and the receiving party as Bob, and their respective protocols is described below: 
% --- Unadulterated section ---

\begin{enumerate}
    \item Alice's part of the protocol
    
% Similar to the original BB84 protocol, 
Alice generates a sequence of random bits $A = \{a_1, a_2, ..., a_n\}$, where $a_i\in[0,1]$ is the~$i\text{-th}$ bit. 
Next, she generates another random sequence $X = \{x_1, x_2, ..., x_n\}$, where $x_i\in[0,1]$ denotes the polarization basis used to encode $a_i$.
According to $A$ and $X$, Alice transmits a sequence of polarized photon pulses to Bob.
The encoding scheme is tabulated in Figure~\ref{figure:bb84}. 
% \begin{table}[h!]
% \begin{tabular}{|l|c|c|c|}
% \hline
% \multicolumn{2}{|l|}{\multirow{2}{*}{}}          & \multicolumn{2}{c|}{basis choice} \\ \cline{3-4} 
% \multicolumn{2}{|l|}{}                           & $x_i=0$             & $x_i=1$             \\ \hline
% \multicolumn{1}{|c|}{\multirow{2}{*}{Alice's bit}} & $a_i=0$ & H (Horizontal, $\phi = 0^{\circ}$)               & D (Diagonal, $\phi = 45^{\circ}$)               \\ \cline{2-4} 
% \multicolumn{1}{|c|}{}                     & $a_i=1$ & V (Vertical, $\phi = 90^{\circ}$)               & A (Anti-diagonal, $\phi = 135^{\circ}$)               \\ \hline
% \end{tabular}
% \caption{Polarization of each transmitted photon pulse depends on the value of Alice's bit $a_i$ and basis choice $x_i$. The angle of the polarization axis is denoted by $\phi$.}\label{tab:encoding}
% \end{table}

\item Bob's part of the protocol

Similar to Alice, Bob generates a random sequence of polarization measurement bases $Y = \{y_1, y_2, ..., y_n\}$. 
He projects the incoming polarization according to $Y$, and measures the corresponding light intensity. The intensity values are categorized into low and high values and recorded as $B = \{b_1, b_2, ..., b_n\}$, with $b_i\in[0,1]$. 

\item Establishing the final key

Thereafter, Alice and Bob communicate their basis choices over a classical channel. 
When $x_i\neq y_i$, $b_i$ does not provide any information about $a_i$, since the measurement bases are mutually unbiased - these results are discarded. 
Alice and Bob keep only outcomes when their basis choice agree to generate a shared secret key. 
In the literature, this procedure is known as ``key sifting''.
\end{enumerate}
% \subsubsection{Side channel attack}
% AUSTRIA
In the original BB84, each bit is encoded by a single photon. Security is ensured by two quantum mechanical concepts. First, a single photon is a quantum state which cannot be cloned. Second, to learn about the state transmitted to Bob, Eve would have to perform a measurement which inadvertently disturbs the state. 

We guide students to build a working implementation of the protocol -- with a twist, which breaks the security of the protocol. We use laser pulses containing many copies of the same quantum state, which allows for a side-channel attack: An eavesdropper (Eve) can analyse a fraction of the transmitted signal and get full information about the state.

% to Consequently, Eve cannot learn about a state transmitted to Bob without disturbing it and therefore disclosing her presence.

% 1. No info can be gained from a state without disturbing it.
% 2. The state cannot be cloned.




% This prevents Eve from reconstructing Alice's quantum state while ensuring the same state is sent to Bob, which would require Eve to clone the quantum state, a task prohibited by the no-cloning theorem. 

% - Only 1 q.state available.
% - Eve cannot copy q.state. 
% - Eve needs to learn the q.state sent for key reconstruction. But don't have states to learn.

% To eavesdrop successfully, an adversary will have to create multiple copies of the same quantum state in order to reconstruct Alice's state. 
% However, the no-cloning theorem renders this attack impossible.

% If we instead encode with laser pulses containing many copies of the same quantum state, an eavesdropper is able to perform a side-channel attack, sifting off a fraction of the transmitted signal.

% To highlight the central role of quantum mechanics, we follow the protocol to the letter except that we use multiple photons to encode a single bit, exposing the protocol to a side-channel attack. 
% In the following section, we describe how students can build a working QKD setup and execute a side-channel attack.
% In the original BB84, each bit is encoded by a single photon. This prevents an eavesdropper to perform side-channel attacks - she cannot gain any information about the quantum state without disturbing it. Furthermore, since an individual quantum state cannot be cloned~\cite{nocloning}, this allows Bob to detect any eavesdropper who performs an intercept and resend attack. To elucidate this concept further, we follow the protocol to the letter except that we use multiple photons to encode a single bit, exposing the protocol to a side-channel attack. This little twist breaks the security of the entire protocol.

% - the critical failure created by this single omission elucidates the central role of the no-cloning theorem in BB84. 

% Use of single photons prevents side-channel attack.
% Demonstrate no-cloning thm to kiddos by using macro beams.
% When an eavesdropper (Eve) intercepts Alice's photon and measures its polarization, she projects the photon into her choice of measurement basis, which might not coincide with Bob's basis choice. 
% This results in Bob getting wrong measurement outcomes. 
% Furthermore, due to the no-cloning theorem~\cite{nocloning}, Eve could not make a copy the quantum state of Alice's photon perfectly, and measure it independently. In any case, the presence of Eve is detectable by monitoring the error rates in the measurement outcomes.
% Thus, at times involuntarily projects Alice's photon into the other basis. 
% Furthermore, if Eve resends the photon to Bob, she might do so in a basis choice different from Alice, which results in the wrong measurement outcome at Bob even in the event when Alice and Bob have matching basis choices. 
% This is also known as the ``no-cloning'' theorem and underpins the security of all quantum cryptographic protocols. 
% By monitoring the error in the measurement outcomes we are able to detect the presence of Eve. 
% This results in mismatch between Alice and Bob's key, which prompts them to conclude that an eavesdropper is present.
% However,
% Instead of using single photons, we encode each bit with a macroscopic number of photons which allows us to conveniently measure the photon polarization with a normal photodetector.

% Our modification instead of single photon, each pulse contain innumerable number of photons. This allows us to conveniently measure the photon polarization with a normal photodetector in the linear regime, rather than single-photon detectors.

% Our implementation departs from the standard BB84 protocol with a small modification: instead of single photon, each pulse contain innumerable number of photons. This allows us to conveniently measure the photon polarization with a normal photodetector in the linear regime, rather than single-photon detectors.

% FROM INTRODUCTION : The security of BB84 relies on the fact that a single quantum bit (qubit) cannot be copied~\cite{bb84proof}. When multiple qubits of the same state are distributed, security is compromised since a fraction of the qubits can be intercepted and measured by an adversary. To illustrate this concept, we use macroscopic laser beams instead of single photons, creating a security loophole.

% Unfortunately, this also opens up a major security loophole:  Eve is able to redirect a sample of these photons (eg. with a beam-splitter) and measure them independently without affecting the polarization state of the remaining photons sent to Bob. 




\begin{figure}[ht!]
\includegraphics[width=8.6cm]{img/schematic.eps}
\caption{\label{figure:setup}
BB84 setup -- quantum channel: Alice encodes a string of bits using different polarization choices set by her rotatable polarizer (RP). The quarter-wave plate (QWP) transforms the linearly polarized light from the laser diode into circular polarization such that the output from Alice's polarizer has equal intensity for all linear polarization choices. Bob projects Alice's photons into different polarization bases, and measures the corresponding intensity with a photodetector (PD). \newline
Classical channel: Using infrared transceivers (IR-TR), Alice and Bob communicate the matched bases and the encrypted message.
\newline
Side channel attack (SCA): 
Using a beam splitter (BS), Eve intercepts and measures some of Alice's photons in two different bases simultaneously. 
As Eve's basis choice is \textit{a priori} not aligned to Alice and Bob's, she may not be able to distinguish between polarization states optimally.
However, by measuring in more than one basis choice simultaneously, she improves her ability to identify distinct polarization states even in the presence of laser intensity noise (see main text).
She also intercepts the matched bases and encrypted message using her IR receiver from the classical channel. 
} 
\end{figure}

\begin{figure}[t]
\includegraphics[width=8.6cm]{img/setup_stu.png}
\caption{\label{figure:student_setup}
 BB84 setup as implemented in the workshop. Optical components for the quantum channel were placed and aligned on small optical breadboards on top of short wooden tables -- the beam height was below eye level to ensure safety. Students are seated in a diamond configuration enclosing the setup, preventing accidental misalignment. The dashed line indicates the laser beam path.
} 
\end{figure}


\section{\textbf{Experimental Implementation}}\label{sec:implementation}
We design a workshop for students to gain insight to the inner workings of the protocol by tasking them to construct and operate the modified version of the protocol, described in the previous section.
% The cryptography setup consists of quantum and classical channels
Students establish the quantum channel using polarization-encoded qubits by controlling laser diode systems, motorized polarization analyzers, and photodetection circuits.
They also establish a public classical channel using infrared (IR) pulses by assembling IR transmitting and receiving circuits. 
A separate group of students eavesdrop on these channels using a beamsplitter and additional IR devices.
Figure~\ref{figure:setup} shows the schematic for the entire setup.

% UTAMA PUT ON CAPTION OF PHOTO
% Optical components for the quantum channel were placed and aligned free-space on small optical breadboards, while the electronic components for the classical channel are placed on electrical breadboards.

% Addition
In the following, we describe the procedure for establishing the quantum and classical channels. The experimental sequence was largely automated as it requires synchronization between different elements, as well as for maintaining consistency in the generation of every bit. The sequence was executed using Arduino and Python programs. These are fully documented and available on Github~\cite{github}.
% To facilitate the implementation, we wrote several helper programs in Arduino and Python to automate the devices. The codes and the technical documentation are freely available on Github~\cite{github}. 
% % %

% Students establish the 
% Students assemble photodetectors and emitters, calibrate polarization devices, and run programs to automate some parts of the protocol. 
% Students gain insights to the inner-workings of the system by performing some of the essential steps manually before using the programs to automate those steps. The relevant programs and technical documents are freely available on Github~\cite{github}. As this is not a coding or optics lab bootcamp, students were not required to write any of the programs nor align any of the optical components. 

% To expose students to the inner workings of the protocol, we design a workshop where students are guided to construct 
% We designed a workshop for the students with the following learning objectives.
% The workshop was designed in order to expose students to 
% Students were required to assemble critical components implementing the BB84 key distribution protocol.
% Learning Objectives
% 1. Students to be able to assemble and operate experimental apparatus to distribute encrypted messages with keys obtained from BB84 -- students assemble electronic circuits...
% 2. Students should be able to identify underlying operating principle of QKD - no-cloning theorem.

% 1. Experience how it is like to realize a working system -- give a glimpse of how an experimental physicist works.
% 2. Abstract to concrete bridging by a hands on activity.

% We designed the workshop to accommodate around 20 students of Grade 11-12, consisting of 4 teams with around 2-5 player each, representing Alice, Bob, Eve-classical, Eve-quantum.
% The students attended a series of quantum physics lectures~\cite{qcamp}  providing them with the theoretical background of QKD.

% A facilitator was assigned to each group. 
% The workshop was approximately three hours.
%  The students were split into two sessions (morning and afternoon), 
% Students are grouped to perform different tasks: two teams (Alice and Bob) establish the classical and `quantum' channel, and
% two other teams (Eve-classical and Eve-quantum) eavesdrop on the established channels and work together to decrypt the message.
% (Figure~\ref{figure:setup})The setup  consists of a classical channel for communicating measurement bases and encrypted messages in the form of infrared (IR) pulses, a `quantum' channel for exchanging polarized light, and a side channel for eavesdropping on both channels. 

% The cryptography setup consists of quantum and classical channels, and a side channel used to eavesdrop on the transmitted signals. 

\subsection{Quantum Channel}
\begin{figure}[ht!]
\includegraphics[width=17.2cm]{img/quant_circuits.eps}
\caption{\label{figure:quantum_setup}
Schematic of the quantum channel. Alice transmits a series of polarized light pulses to Bob -- created using a laser diode and a motorized polarizer. Bob projects the incoming states with his motorized polarizer and measures its intensity with a photodetector. The motors and laser diode are operated via the digital output on the microcontroller (DIG pins), while the photodiode readout is recorded by the analog-to-digital converter (ADC) on the microcontroller (A pins). QWP: Quarter-wave plate. GND: Ground connection.
} 
\end{figure}

\begin{figure}[ht!]
\includegraphics[width=8.6cm]{img/quantum_pict.png}
\caption{\label{figure:quantum_pict}
 The quantum setup of Alice (top) and Bob (bottom). The laser beam path is provided as a guidance.
} 
\end{figure}



Figure~\ref{figure:quantum_setup} illustrates the quantum channel.
Alice prepares different polarization states using laser diode pulses and a motorized polarizer: 
a quarter-wave plate (QWP) converts linear-polarized light from the laser diode to circular-polarized light, 
which is subsequently projected into  one of the four polarization states (H, V, D, A) using a motorized polarizer.
% The polarizer then projects this into one of the four polarization states (H, V, D, A) with equal intensity.
To perform a measurement on the incoming polarization state,
Bob chooses one of two measurement bases (H/V or D/A) at random, 
implements his choice with a motorized polarizer, 
and measures the corresponding light intensity. 

% Figure~\ref{figure:quantum_setup} shows the schematic for the quantum channel consisting of a motorized polarizer operated 
% The quantum channel (Figure~\ref{figure:quantum_setup}) is used to send polarized photons as described in Section~\ref{sec:bb84}. 
% For our experimental setup, the orientation of the transmission axis of our polarizers corresponding to H-polarization was not tied to. 

Before using the quantum channel,
both parties need to agree on a common coordinate system for their polarization states.
This is performed using a visibility measurement. 
First, Alice chooses an arbitrary rotation angle for her polarizer to fix the orientation of H-polarization. 
Then, she transmits a macroscopic beam with this polarization to Bob as a reference.
To arrive on a common coordinate system with Alice, 
Bob rotates his polarizer 
and identifies the position that maximises the transmission of the reference beam with the H-polarization.
% This is very educational for the students.
% We use this procedure as it does not rely on an external reference e.g. the direction parallel to the optical table, which has to be independently measured. 
% Adrian's comment: we probably should focus on the fact that the students need to perform the calibration as is expected in experimental physics.
% The protocol begins after the polarizers are calibrated.

Alice begins her portion of the BB84 protocol by using an Arduino microcontroller to produce random binary strings $A$ and $X$ 
-- the strings determine the sequence of polarization states to be transmitted.~\cite{entropy}  
To generate each polarization qubit, 
Alice's microcontroller rotates her polarizer to the corresponding angle,  
and transmits through it a 200\,ms-long laser diode pulse. 
% through the polarizer. 
The overall duration required to generate each qubit (1.5\,s) is limited by our stepper motors (see Appendix B),
which have a maximum rotation speed of about 10\,rpm.

In our implementation, Alice transmits a sequence of 16 qubits. 
She precedes each transmission with a prearranged laser pulse sequence -- a header -- marking the beginning of each qubit sequence.
Due to the clock-stability of the microcontroller ($\sim10^{-4}$), 
the uncertainty of the transmission time for each qubit is less than 2.4\,ms.
% \footnote{The uncertainty of transmission time for the 16-th qubit is $16\times1.5\times10^{-4} = 2.4$\,ms.}. 
The uncertainty is small compared to the duration of each qubit, 
allowing Bob to predict the arrival times of the qubits after receiving the header pulse sequence.
A random binary string $Y$ generated by Bob beforehand determines the bases used for projecting the transmitted qubits. 
The predictability of the arrival times allows him to rotate his polarizer to the corresponding position between each qubit pulse. 
For each qubit, the light intensity measured after the polarizer is compared with a predetermined threshold value. 
This produces two intensity classes: high and low, allowing the measurement to be encoded as a binary number. 
Measuring the entire sequence generates a binary string $B$.
% The longest sequence that can be generated ($\sim10^3$\,qubits) is limited by the clock-stability of the microcontroller ($\sim10^{-4}$),
% which affects Bob's ability to predict the arrival time of the transmitted photons. 

% so that the generation and measurement of each light pulse remains synchronized ($\lesssim 1$\,ms) throughout the sequence.

% this determines the timing uncertainty of the pulses,
% which is in the order of the pulse duration of each qubit.

% To expedite the experiment, we generated sequences of only 16 qubits.

% To enable Bob to measure each qubit at the correct time,
% Alice sends a pre-arranged initialization signal which marks the beginning of the qubit sequence.

% Every sequence contains 16 qubits.

% We chose this length by considering the clock-stability of the microcontroller ($\sim10^{-4}$), so that timing uncertainty of the generation time of the last qubit is about 2\,ms or 1\,\% of the duration of each qubit.

% (takes around $\sim$1.2\,s, due to the maximum rotation speed of the cheap stepper motor of $\sim$12\,rpm) 
% Thus, each qubit takes approximately 1.5\,s to generate and send.

% Before the start of the sequence, Alice sends an short light pulse which Bob can trigger to synchronize their timings. 
% Even though the stability of Arduino crystal oscillator is on the order of $\sim10^{-4}$, to be on the safe side, we set each sequence to consist of only 16 qubits and perform the synchronization procedure every sequence. Each sequence takes approximately 25\,s to transmit all 16 qubits, all automated. 

%f a string of qubits that are to be transmitted to Bob.
% which sets the polarization of the sequence of qubits that are to be generated. 
% Likewise, Bob's microcontroller generates a random string Y 
% which determines the sequence of bases used for projecting the transmitted qubits.
%The strings A and X are sent to a microcontroller which generates the corresponding string of qubits... (automation)
%To transmit each qubit, Alice rotates her motorized polarizer using a micro-controller.
% uses a micro-controller to rotate a motorized polarizer, 
% aligning its transmission axis to the appropriate angle.
%Then, she supplies current to her laser diode with a transistor, 
%creating a light pulse $\sim$200\,msec long.
% To measure each qubit,
% Bob's microcontroller rotates his polarizer to the position determined by Y, 
% measures the transmitted light intensity,
% and categorizes it as one of two binary values. 
% The results of consecutive measurements are stored in string B.



%The key generation rate over the `quantum' channel ($\sim$0.3~bits/second), is limited by (i) the rotation speed of the stepper motor ($\sim12$~rpm), (ii) the stability of Arduino crystal oscillators ($\sim10^{-4}$) which limits the measurement window before re-synchronization needs to be performed, and (iii) the key sifting process in BB84 which drops approximately half of the key.

%The procedure ends when XX number of pulses are transmitted.
%THe number of pulses was determined from XX considerations...

% to discover the orientation of Alice's polarizer 
% -- this position corresponds to the maximum transmission detected by Bob.
% This procedure does not require an external reference e.g. the direction parallel to the optical table, and is therefore much more convenient.
% we do not use the direction parallel to the optical table, upon which the apparatus is mounted, as a reference.
% Hence, both parties will need to agree on a common rotation angle of their polarizers, $\theta_0$, corresponding to the transmission of H-polarized light. 

% students are required to align the transmission axis of their polarizers so that
% the orientation of the EM-field of the polarization states is the same for both parties.
% This was performed via a visibility measurement. First, Alice chooses an arbitrary orientation of the polarizer which defines the H polarisation state and transmits a macroscopic beam to Bob. Next, Bob rotates his polarizer to discover the orientation of Alice's polarizer -- this position corresponds to the maximum transmission detected by Bob.

% This step is necessary for Alice and Bob to agree on 
% the same coordinate system which defines the orientation of the polarization states.


% Students start by constructing the secret key manually. 
% Alice's microcontroller generates random numbers A and X, and sends polarised light as described in Section~\ref{sec:bb84}, while Bob's microcontroller measures the light intensity B with the random basis choice Y. 

\subsection{Classical Channel}\label{sec:classical}
\begin{figure}[ht!]
\includegraphics[width=8.6cm]{img/class_circuits2.pdf}
\caption{\label{figure:classical_setup}
Schematic of the classical channel. 
A series of IR pulses enables Alice and Bob to communicate with each other. 
This enables them to exchange classical information e.g. basis choices, encrypted messages.
Information, encoded as binary strings, is translated into pulse sequences. 
A microcontroller uses the pulse sequences to switch the state of an IR LED to transmit the message.
An IR receiver detects the pulses and decodes it with a microcontroller.
% Classical channel: Students assemble IR circuits to send and receive messages, including plain text, basis choices and encrypted messages. 
% An Arduino controls a transistor, creating IR pulses representing messages in binary form.
% The IRremote Arduino library~\cite{irremote} is used to convert binary information into light pulses, according to the NEC protocol.
% The IR pulses were detected by an IR receiver and the messages are retrieved with another Arduino using the same library.
% Messages are encoded in string of 0 and 1 with some accepted encoding schemes, i.e. ASCII and HEX, which is then represented with different pulse on/off lengths. 
} 
\end{figure}

\begin{figure}[ht!]
\includegraphics[width=8.6cm]{img/class_pict.png}
\caption{\label{figure:classical_pict}
 Top: IR transmitter and receiver circuits are assembled on a solderless electrical breadboard. 
 Bottom: The circles indicate Alice and Bob's IR transceiver circuits, while the arrow indicates the location of Eve's IR receiver.
} 
\end{figure}

The next step of the protocol is for Alice and Bob to communicate their basis choice over a  classical channel. 
In our implementation, the channel is established with IR transmitters and receivers (Figure~\ref{figure:classical_setup}).
% messages, encoded in a binary string sequence, are translated into IR pulsed sequences using a microcontroller (Figure~\ref{figure:classical_setup}). 
Messages, encoded in a binary string sequence, are translated into IR pulsed sequences using the microcontroller~\cite{irremote}.

% Messages are encoded in binary strings and organized into 32 bit sequences.
% These sequences are compatible with a widely-used protocol~cite that translates them into IR pulses.
% We organize binary strings into 32 bit sequences and 

% We use the IRremote library to encode the logical 1 and 0 to IR pulses according to the NEC protocol. 
% THe NEC protocol originally allows for 32 bit binary sequence consisting of address and command, but we use all 32 bits to write our messages. 
% MEssages in binary, i.e. basis choices are encoded in binary, while messages in character strings are encoded using ASCII representation.

% Figure~\ref{figure:classical_setup} shows a schematic of the classical channel.
%%%%%%%%%%%%%%%%%%%%%%

% The classical channel described here is used to identify when qubits are transmitted and received using the same basis. It is also used to encode information after a key is established.

% Figure~\ref{figure:classical_setup} shows a schematic of the classical channel.
% Both parties establish a classical channel using IR transmitter and receivers.

To generate a key common to both parties using $A$ and $B$,
Alice sends her basis choices $X$ to Bob, who compares it with his basis choices $Y$.
He then transmits the mask $X = Y$ back to Alice.
The mask corresponds to them transmitting and measuring in the same basis.
Applying the mask on the strings $A$ and $B$ generates the key $K$.
This step concludes the key distribution protocol.
% To produce a key longer than 32-bit for encoding longer messages, 
% we use $K$ to seed a pseudo random number generator~\footnote{We used the PRNG library in Python.}. 
% To encode a long message, we derive an ``expanded'' key by seeding a pseudo random numbe generator (PRNG)
% @ADRIAN: This allows students to encode messages BLAH BLAH SOMETHING TO DO WITH HEXA?
% For our implementation, we aimed to obtain a 32-bit key @ADRIAN: so that...
% To achieve this, we repeated the above procedure 
% For our implementation, we aimed to obtain a 32-bit key $K$ and repeated the above procedure about four times.
% The average length is 8 bits as $P(X=Y) = 0.5$.
% For our implementation, we repeated the qubit transmission qubits a 32-bit key $K$.
% Consequently, 
% @ADRIAN The process is repeated until a key of XX bits is obtained ?
% The measured pol states 
% both parties use the mask to select measurement outcomes in $A$ and $B$ corresponding to them transmitting and measuring in the same basis.
% This allows them to obtain a common key.

% After Alice sends the qubit sequence to Bob, 
% both parties now identify which of them were transmitted and measured in the same basis.
% Both parties establish a classical channel using IR transmitter and receivers (Figure~\ref{figure:classical_setup}).
% Messages are encoded in a binary string sequence and translated into IR pulsed-sequences with a microcontroller.
% Alice sends her basis choices $X$ to Bob, who compares it with his basis choices $Y$. 
% He then transmits the mask $X\oplusY$ back to Alice. 
% Both parties use the mask to select qubits in strings $A$ and $B$ so that they obtain a common key.
% They establish a classical communication channel with IR pulses 

% They use a classical communication channel established with infrared (IR) pulse sequences to encode binary strings, generated using IR transmitters and receivers (Figure~\ref{figure:classical_setup}).

% Figure~\ref{figure:classical_setup} shows the classical channel used by both parties to 
% After transmitting the qubit sequence, 
% Alice communicates her basis choices X using a classical channel
% (Figure~\ref{figure:classical_setup}) using infrared transmitters and receivers.


% The classical channel (Figure~\ref{figure:classical_setup}) is used to communicate basis choices and send encrypted messages. 
% To operate the classical channel, students first construct the infrared transmitters and receivers as described in Figure~\ref{figure:classical_setup}. 
% They start by sending a sequence of 0 and 1 binaries which are encoded with light pulses. 

%% KIV %%
% Afterwards, they learn how to encode text into binary strings. 
% Finally, they run the programs which automate the whole encoding and sending procedure, to send complete paragraphs. 
% As a final task, they build two way communication channel and chat with each other.

% Classical information was encoded in the classical channel with infrared pulses which represent a binary number. 

% We apply the NEC protocol~\cite{necprotocol}, 
% which allows us to send the ASCII representation (8 bits per letter) of a text message in 32-bit long packets. 
% Hexademical representation was used to abbreviate long lists of binary numbers.  
% The overall classical data transfer rate ($\sim$100~bits/second) is limited by a long chain of information transfer from Alice's to Bob's computer via Arduino and IR transceiver. 

% The setup was constructed with easily available components and interfaces with Arduino. 
\subsection{Building and applying the encryption key}
The length of $K$ is not fixed since the number of events where $X=Y$ is random. For a transmission sequence 16 qubits long, the average length of $K$ is 8-bits.
% As $P(X=Y) = 0.5$, the average length of $K$ is 8-bits.

The key generation procedure can be repeated until the desired length is obtained.
For our implementation, we repeated the procedure about four times to obtain a key 32-bit long.
This process takes about 2.5\,minutes.
The key can be used as a one-time pad to encode a message 32-bit long.
% Alice and Bob can now secure the classical communication channel by transmitting messages encrypted with their shared secret key $K$.
To encrypt a message $M$, Alice (or Bob) applies the XOR operation $M \oplus K =: C$, 
obtaining the encrypted ``cipher'' $C$ of the original message that is to be transmitted through the classical channel.
To decode $C$ and recover $M$, the operation $C \oplus K$ is applied by the remote party.

Messages longer than 32 bit can still be encoded with a 32 bit key.
In our workshop, we used a protocol based on the XOR operation above (see Appendix A).
Although this results in insecure encryption,
it has the advantage of allowing students to encode longer messages without having to understand the workings of more sophisticated encryption techniques, which might detract from the main point of the workshop. 

% TO APPENDIX? < ADRIAN
% Messages longer than 32 bit can still be encoded with a 32 bit key. However, this has to be done carefully as it might present some security flaws (see Appendix). In our workshop, we inadvertently implement a stream cipher protocol, based on a pseudo-random number generator and a XOR protocol, which has a major security flaw. This has two advantages -- first, the students can get an idea on how to ``expand'' the key to encrypt longer messages. Second, the students can appreciate why the classical encryption can be secure.


% we do not use the one-time pad technique which requires generating an equally long key; 
% our experimental implementation of the protocol takes an unreasonable amount of time.
% Instead, we can use a widely-used technique -- the block cipher -- for encoding messages longer than the key.  
% WE MENTION USING A STREAM-CIPHER <-ADRIAN TO GEN A LONGER PSEUDORN KEY DUE TO TIME CONTRAINSTS AND THAT IT IS NOT CRYP SECURE...

%%COMMONLY USED IS STREAM CIPHER, 
% To generate a key that is very much longer than 32-bits,
% our implementation of the protocol takes an unreasonable amount of time.
% We instead use a technique commonly used in classical cryptography~\cite{streamcipher}: we implement a stream cipher by seeding a pseudo-random number generator 
%we seed a pseudo-random number generator~\footnote{We used the PRNG library in Python.} with the secret key to generate a longer key.
% As this is a proof-of-principle demonstration, 

% TO construct a longer key without repeating the 
% For our implementation, we used a XOR Cipher
% To encrypt messages longer than 32-bit using an XOR operation,
% a longer key can be generated without repeating the protocol by using $K$ to seed a pseudo random number generator~\footnote{We used the PRNG library in Python.}. 


% \subsection{Using the secret key}
% After establishing both the classical and quantum channels, students the program which automates the key generation procedure. 
% They then use generated key to encode secret message with the key, and transmit the encoded message via the classical channel. The mission is completed after a secret paragraph has been “securely” transmitted from Alice to Bob.
% Alice and Bob can now secure the classical communication channel by transmitting messages encrypted with their shared secret key $K$.
% To encrypt a message $M$, Alice (or Bob) applies the operation $M \oplus K =: C$, 
% obtaining the encrypted ``cypher'' $C$ of the original message.
% To decode $C$ and recover $M$, the operation $C \oplus K$ is applied by the remote party.


% As a final task, Alice and Bob would need to compare the basis X and Y using by passing a paper (which acts as a public channel) back and forth, and construct the secret key by performing the sifting procedure (Section blah). To pass this stage, they need to verify that they obtain the same secret key. 
% @ADRIAN: Do we need the following?:\\
% Due to the relatively low key generation rate, we limit our key length to be 32 bit. Most of the time, one needs to send 4 or 5 sequences of 16 qubits (2-3 minutes), as BB84 drops approximately half of the qubits to create the sifted key. To encode a long message, we derive an ``expanded'' key by seeding a pseudo random numbe generator (PRNG) with the generated BB84 key. A bit-wise XOR operation between the longer key and the secret message generates the ciphertext. The vulnerability of this operation is also discussed with the students.

% To keep the workshop effective, we guide the students through a journey where they build electrical circuits, calibrate polarization devices, and run programs to automate some parts of the protocol. Students gain insights to the inner-workings of the system by performing some of the essential steps manually before using the programs to automate those steps. The relevant programs and technical documents are freely available on Github~\cite{github}. As this is not a coding or optics lab bootcamp, students were not required to write any of the programs nor align any of the optical components. 

% We  program  a  microchip  (Arduino)  to  operate  the  different  electro-optic  components.
% % operate the IR transceivers, lasers, photodiodes, and motors which orientate the polarizers.
% The programs automated several tasks, including:
% % We used Arduino to perform various tasks: 
% % sending or receiving infrared signals, 
% % controlling the movement of the polarizers, 
% % creating the laser pulse sequence, 
% % measuring the light intensity, etc. 
% % To assist the students, 
% % we automated the following tasks:
% \begin{enumerate}
% \item encoding and decoding information using the NEC (Nippon Electric Company) Infrared protocol \footnote{https://www.sbprojects.net/knowledge/ir/nec.php}, 
% \item\label{item:alignment} establishing a common reference angle between Alice and Bob so that polarization states can be meaningfully interpreted,
% % \item initiating pulse sequences with a signal %synchronizing laser pulse sequences, % hello pls listen now!
% \item correlating detected light intensities with polarization states, %calibrating and measuring light intensities, % calibrate to know wtf is H and V...
% \item generating the secret key by combining the data obtained from the classical and "quantum" channels, %combining information measured from both the classical and "quantum" channels to generate the secret key, 
% \item applying the secret key during symmetric encryption, and %encrypting or decrypting information using the secret key.,
% \item recording and analysing intercepted signals%(for Eve) listen to any incoming IR signals, and
% %\item %(for Eve) analyse the light measurement on the side channel.
% \end{enumerate}

% \subsection{Operating the setup}\label{sec:operating}
% The setup, shown in Fig.~\ref{figure:setup}, consists of a public classical and a quantum channel belonging to Alice and Bob. 


% Is this necessary here? Should we put it inside the hacking setup section?
% Eve-quantum samples the quantum channel with a beam-splitter and Eve-classical monitors the public channel with an IR receiver.

% Classical hardware software
% Quantum hardware software
% Key sifting worksheet
% Hacking
%

% Alongside the classical channel, students build up them channel.  
% The circuits are shown in Fig. ??.
% For the classical channel, students are tasked to build an electrical circuit to send and receive classical information with infrared transmitters and receivers.

%Circuits interface with a micro controller (Arduino)
% The circuit interfaces with a microcontroller (Arduino), and computer programs (in Python) are written to facilitate the text-to-light encoding process. 
% Students start from running a program to send a single bit of information, and upon completion perform more complex tasks until they successfully send a complete paragraph.

% During the workshop, students were informed on some of the technical considerations underlying its design, which includes: 
% they built up their understanding from the basic workings up to the full implementation of the protocol. 
% As the session unfolds, they were also made aware of some technical matters to enhance their technical understanding of the setup and protocol. 
% For our discussion below, we highlight the following 3 important technical topics we shared with the students:
% \begin{enumerate}
%     \item Data representation. Classical information was encoded in the classical channel with infrared pulses which represent a binary number. We used the NEC protocol~\cite{necprotocol}, which allows us to send the ASCII representation (8 bits per letter) of a text message in 32-bit long packets. Hexademical representation was used to abbreviate long lists of binary numbers.  
%     \item Data transfer and key generation rates. The overall classical data transfer rate ($\sim$100~bits/second) is limited by a long chain of information transfer from Alice's to Bob's computer via Arduino and IR transceiver. The key generation rate over the `quantum' channel ($\sim$0.3~bits/second), is limited by (i) the rotation speed of the stepper motor ($\sim12$~rpm), (ii) the stability of Arduino crystal oscillators ($\sim10^{-4}$) which limits the measurement window before re-synchronization needs to be performed, and (iii) the key sifting process in BB84 which drops approximately half of the key.
%     \item Data encryption. Due to the relatively low key generation rate, we derive a longer key by seeding a pseudo random numbe generator (PRNG) with the generated BB84 key. A bit-wise XOR operation between the longer key and the secret message generates the ciphertext. The vulnerability of this operation is also discussed with the students.
% \end{enumerate}

% The students were guided through the programs and handouts; 
% they built up their understanding from the basic workings up to the full implementation of the protocol. 
% As the session unfolds, they were also made aware of some technical matters to enhance their technical understanding of the setup and protocol. 
% For our discussion below, we highlight the following 3 important technical topics we shared with the students: 
% information encoding and encryption, 
% speed of information transfer, 
% and measurement noises. 

% \subsubsection*{Data representation and encryption}

% In the classical channel, we encode information using a series of infrared pulses: there are two types of pulses, each representing either 0 or 1 (binary numbers). To send a text, we use ASCII representation to encode each letter with 8 bits of binary numbers. We use programming libraries to encode/decode string of binary numbers with infrared pulses. If the string is too long~\footnote{The infrared protocol that we used, NEC, has a 32-bit limit (4 characters).}, we break it into packets and send them one after another. Since displaying a long string of binary numbers is quite cumbersome, we teach the students to use a hexadecimal representation. 
% Due to limited key generation rates,
% we derive a longer, more usable key using the key established from SBB84 and a pseudo-random seed.
% A bitwise XOR operation between the generated key and a secret message generates the ciphertext.
% The vulnerability of this operation is also discussed with the students.
% The key generation rate with our SBB84 protocol is pretty low. Thus, we seed a pseudo random number generator (PRNG) with the secure key to generate a much longer key, which is then bitwise XOR-ed with the secret message to generate the ciphertext. Unfortunately, this method is also prone to cryptanalysis attack, another security issue which is also discussed with the students.

% \subsubsection*{Data transfer rates}
% The overall data transfer rate (100~bits/second) in the classical channel is limited by the protocols transfering information to and from the computer, the NEC, and the detector response. 
% For the classical channel, the information transfer rate is limited by the specification of the infrared protocol and the time to propagate the information to and from the computer. We achieve a speed of about 100 bits per second, but in principle it can be increased much further and in principle is only limited by the detector response rate.

% The key rate over the quantum channel ($0.33$~bits/second), instead is limited by (i) the rotation speed of our polarizers ($\approx0.6-1.2$~s per basis choice) (ii) the accuracy ($10^{-4}$) of the crystal oscillators~\cite{ardclock} which limit each measurement sequence to $\approx200$~ms and (iii) the SS84 protocol which drops approximately half data during basis-matching.


% For the `quantum' channel, we are mainly limited by the rotation speed of our polarizers (about $0.6$ to $1.2$ s between basis choices). To maintain  synchronization between Alice and Bob for a few minutes, we perform the laser pulsing and measurement sequence within a time window of $\simeq 200$ ms, as the crystal oscillator on the board is only accurate~\cite{ardclock} up to around $10^{-4}$. In addition, the protocol drops about half of the random bits. This translates to the `quantum' key rate of about $0.33$ bits per second.

\subsection{Hacking the key distribution protocol}\label{sec:hack}
To eavesdrop on the quantum channel,
a third party (Eve) exploits the fact that macroscopic light pulses were used to represent qubits, and directs part of the transmission in the channel into her own polarization analyzing setup (Figure~\ref{figure:setup}) using a beam splitter.
% To highlight that the security of BB84 relies on the single particle nature of photons, a third party, called Eve, exploits the security issue we purposely introduced in our implementation of the protocol, namely the use of macroscopic light fields in the quantum channel.
% Eve performs the side-channel attack by introducing a beam splitter into the polarization state transmission channel and directs a part of the beam into her own polarization analyzing setup. 

% To demonstrate that the key distribution can be eavesdropped due the to the macroscopic light field, 
% team Eve-classical operates an eavesdropping IR receiver while Eve-quantum splits up a portion of the photon and analyze the photons (see Section~\ref{sec:hack}). 
% The full schematic is shown in Figure~\ref{figure:setup}.
% Two additional groups (Eve-classical and Eve-quantum) are tasked to hack the established classical and quantum channel. To Alice and Bob, they “might be” just other teams of Alice and Bob doing similar operation in parallel. This is true for the initial phases of the workshop, as the Eves are starting to learn the basics of the setup. Afterwards, both Eves learn to hack the setup and cooperate to decode the secret message.
Various factors influence the effectiveness of the eavesdropping attempt. 
First, the laser intensity fluctuates ($\sim 20\%$) with the position of the polarizer sheet, which is sensitive to mechanical disturbances (e.g. wind, students' movements). Moreover, the current to the laser diode was also not stabilized. %UTAMA: distance affects which part?

Second, as Eve did not take part in the polarization calibration of Alice's quantum channel, her polarizers are not optimally aligned to distinguish between the various polarization states transmitted in the quantum channel (e.g. Photodiode 1 histogram in Figure~\ref{figure:kmeans}).
To circumvent this issue, Eve projects each state in two measurement basis, 
each separated by about 45$^{\circ}$ from each other, and subsequently measure the corresponding intensity. 
% However, eavesdropping on the quantum channel has some challenges. The noise in the laser power measurement over distance $>$3 meters is pretty significant ($\sim 20\%$). 
% This is due to slight movement of the polarizer sheet as the stepper motor rotates or whenever the wind blows, vibration of the optical components due people movement near the setup, current fluctuation on the laser diode, etc. 
% To reduce experimental complexity and cost, we chose not to stabilize the power of our laser diodes and use cost effective sheet polarizers. 
% Also, since Eve did not perform the alignment procedure of her polarizer with Alice and Bob, it may prove difficult for her to distinguish the four polarization state.

%To improve distinguishability between the four polarization states%
% To solve this issue, we project each state in two measurement basis, each separated by about 45$^{\circ}$ from each other, and measure the corresponding intensity. 
In this way, each polarization state is associated with two intensity values (see Figure~\ref{figure:kmeans}). 
In this 2-dimensional space, we use a K-means clustering algorithm to identify four distinct groups that correspond to the polarization states used. 
Polarization states were arbitrarily assigned to each group and used to generate possible permutations of the key.
% UTAMA 
To proceed, Eve intercepts part of the light emitted from Alice's IR transmitter over the classical channel; the spatial mode of Alice's LED has a relatively large solid angle (see Figure~\ref{figure:classical_pict}).
For her first intercept, she obtains the bit positions corresponding to the sifted key (step 3 in Section~\ref{sec:bb84}) from the classical channel -- she uses this information to sift the permuted keys. 
Next, she intercepts cipher texts over the classical channel.
She uses them to identify the correct key permutation that results in a legible decoded message.

% Through trail and error, a particular assignment is verified to be the key when it can be used to decode meaningful messages from intercepted ciphers.

\begin{figure}[htb]
\includegraphics[width=8.6cm]{img/cluster.pdf}
\caption{\label{figure:kmeans}
    Four identified clusters of signal voltages measured by Eve's dual photodiodes.
    Each cluster represents a polarization state intercepted in the quantum channel and are arbitrarily assigned A, B, C, D. 
    Each polarization state represents H, V, D or A sent from Alice to Bob. 
    By assigning the correct polarization state through trial and error, Eve is able to derive the transmitted key. 
    This is done via obtaining intelligible messages by decoding the ciphers transmitted through the classical channel.
} 
\end{figure}
% USE THE DIAGRAM TO DESCRIBE WHY WE USE 2 BASIS FOR EVE: unfortuitous choice of bases; use marginals of 2d graph to explain noise issues in parallel.

% It is pretty straightforward to eavesdrop on the classical channel: 
% The IR receiver is then set to the ever-listening mode, 
% and records Alice's and Bob's communication. 
% As a ``side mission'', the students are tasked to understand the basic workings of an IR remote control, and try to construct a device capable to switch on/off the projector in the room.\textbf{}



\section{The learning experience}
We aspire to create a learning experience where students are exposed to the inner-workings of current technologies with activities resembling hands-on lab experiences. This extension to a typical lab visit utilizes ideas and components already familiar to the students -- a platform to introduce the complex systems found in the typical research laboratories. 

We trialed this idea at a week-long outreach camp for pre-university students 
(aged 15-19) in Singapore,
% e.g. junior college and polytechnic students, 
where they learn about quantum technologies in a series of lectures and lab visits (QCamp).~\cite{qcamp} 
In the first iteration of the workshop, we tasked the students to custom-build an IR remote controller using the same know-how required for the classical channel (Section \ref{sec:classical}). As we were encouraged by positive responses from the students and organisers, we decided to extend the workshop into a full BB84 experiment. 

% We first introduced this workshop at Qcamp, a week-long quantum technology outreach activity for junior college students~\cite{qcamp}. Qcamp originally consists of mainly theoretical lectures and lab visits. We planned to extend the lab visits into something resembling a short hands-on lab experience, where students are exposed into the inner-workings of current technologies. 

\subsection{Planning considerations}

%The following considerations influenced how we designed the workshop.
%First, the experimental realization must be as simple as possible. 
We designed the implementation of the workshop to be simple and cost-effective.
%To facilitate implementation, we considered the simplicity and cost-effectiveness of the setup. 
This is addressed primarily by the use of macroscopic light intensities in the quantum channel with centimeter-sized, commercially available, Si-PIN photodiodes. 
This removes the requirement to focus light to millimeter-sized single-photon detectors (eg. avalanche photodiodes) usually required for BB84. 
To further reduce cost, we use standard off-the-shelf optical and mechanical components (Appendix B). 
Whereas the vulnerability created from using macroscopic light is undesirable in a security context, we found that the failure to realize a qubit as a single quanta provides a powerful learning opportunity for students who successfully hack the system (Section \ref{sec:hack}) despite following the key distribution procedure faithfully (Section \ref{sec:feedback}).

Another powerful motivation for simplifying the setup is to allow students the opportunity to build a working QKD system from the ground up, given the time-constraints that could be expected for an extra-curricular activity.

% Rephrase from here on
Experimental realization of QKD makes abstract concepts concrete such as the use of polarization encoding in the quantum channel, and basis matching via the classical channel. Furthermore, the hands-on aspect of this approach allows students to demonstrate competence, which is an essential intrinsic motivating factor in any learning task.~\cite{ryan}

% To keep the workshop within a reasonable time (time?), the programs (utama: context to programs - keep it short) were written and tested prior to the workshop, while the students were only required to compile and run the programs, and in a few cases, modify some of the parameters. The codes are freely available on Github~\cite{github}. 
%For the `quantum' channel setup, we placed the optical components on breadboards, and aligned the components before the workshop starts. For future runs with longer workshop duration, we might be able to relax this and allow the students to write some parts of the program or align some parts of the setup.
% Move up to the implementation part

% Our implementation complements a similar BB84 demonstration realized by Camargo et.al., also performed with an intense laser~\cite{brazildemo}. In our work, we demonstrate that without the no-cloning theorem, a purely quantum physical concept, a successful hack using a side-channel attack can be implemented. However, in the demonstration by Camargo et.al., an intercept-resend attack was detectable in the classical regime, as it would be in the quantum regime. %(Consider pushing to intro)

% I think we also need to talk about other works as well
Our approach complements previous quantum cryptography demonstrations realized by Lemelle et.al.~\cite{momentum} and Camargo et.al.~\cite{brazildemo}, 
who also used macroscopic light pulses as a proxy for single photons to encode qubits. 
However, by incorporating Eve's hacking attempt, our approach provides students with the opportunity to investigate the consequences of using classical resources instead of quantum resources for key distribution.
% However, our work allows students to explore further by looking into the consequence of using classical resources instead of quantum resources through the demonstration of a security loophole that occurs despite following the remaining details of the protocol.


% In Lemelle et.al., photons are encoded in either the position of momentum basis (complementary observables) by selecting different lens systems to use. 
% Meanwhile, Camargo et.al. demonstrates the B884 protocol with polarized photons, by manually encoding each photon pulses. 
% Their demonstration provides insights and guides non-experts in understanding quantum ideas. However, 

% However, in our work, we instead show that such tools come with a cautionary tale -- quantum ideas can only work if done properly in the correct regime.

% In the workshop, students have the opportunity to build a cryptography infrastructure from the ground up, within a reasonable amount of time. Experimental realization of QKD makes concrete abstract concepts such as the use of polarization encoding in the quantum channel, and basis matching via the classical channel. By leveraging on this experience to realize a fully functioning system, we provide an opportunity for students to demonstrate competence, which is an essential intrinsic motivating factor in any learning task.~\cite{ryan}

% Second, this removes the additional training required for generating and detecting light at single-photon level, as the students already have the pre-requisite experience working with light at macroscopic levels in high-school. Third, and most importantly, using macroscopic levels of light to encode information subjects the QKD protocol to a security vulnerability. The cost estimate is provided in Appendix B.

% Planning the learning experience for students
% Building and operat the simplified BB84 QKD system (Section~\ref{sec:implementation}) requires 
% We organized a workshop providing for JC students with the necessary know-how to  . ...

% Jianwei, we might also need to talk about the theoretical stuffs at Qcamp...
% We talk later/tmr
% The workshop was first introduced at QCamp, a week-long quantum technology outreach activity for junior colleague students~\cite{qcamp}. The workshop originally consisted of mainly theoretical lectures and lab visits. We planned to extend the lab visits into something resembling a short hands-on lab experience, where students are exposed into the inner-workings of current technologies. 

% Previous iteration of the workshop focuses 

% can understand and work with some lab setups, and hopefully extend it to be used .

% where students learn something meaningful that might be beneficial to their daily lives. 

% In the previous iteration of the workshop, 
% In the first year, we organized an activity where students peered into the signal of the IR remote, studied it, and used it to control the projector in the room or to communicate to one another. We set it up in a game-competition form, where a team would need to hack the projector to prevent the other team from communicating.

% The activity garnered good responses, and we decided to step up the activity to include a real application of quantum technologies. However, developing a hands-on activity with real single photons or single atoms requires a sufficiently deep understanding of them and might be too impractical and costly. 

% Thus, an idea spurred: what if we used classical optics component to do quantum physics, we ``misled'' them to believe that quantum physics is happening, and then we show that classical optics just can't do quantum? 

% BB84 and QKD has to be there somewhere
% To simplify experimental realization, we do not generate quantum states at the single-photon level, thus removing the requirement to focus light to millimeter-sized single-photon detectors (eg. avalanche-photodiodes). Instead, we use a bright laser source and detect light with centimeter-sized, commercially available, Si-PIN photodiodes. This approach has several advantages. 

% First, as there is no need to generate or detect light at the single photon level, the setup is implemented in a cost-effective manner using standard off-the-shelf optical and mechanical components. Second, this removes the additional training required for generating and detecting light at single-photon level, as the students already have the pre-requisite experience working with light at macroscopic levels in high-school. Third, and most importantly, using macroscopic levels of light to encode information subjects the QKD protocol to a security vulnerability. The cost estimate is provided in Appendix B.

\subsection{Learning objectives}

%% Probably this?%%
Before the workshop, the students underwent a series of QCamp lectures covering a spectrum of basic quantum physics and technology discourses. A few lectures serve as the prerequisites to our workshop: photon polarisation, old school cryptography, and quantum key distribution (particularly BB84). The total time for these lectures are about 3 hours.
%%
%To prepare pre-university students to build the BB84 QKD system proposed in Section~\ref{sec:implementation}, we conduct a series of lectures covering topics (list).

Although the workshop might appear to require a relatively advanced syllabus, we were able to keep the students focused on the main tasks to build up the cryptographic system. We leave it for the students to explore the more technical side of the protocol implementation on their own~\cite{github}.  
%%
%Although this presents a relatively advanced syllabus for our audience, we were encouraged by the reception to a previous workshop, where students were tasked to custom-build an IR remote controller using the same know-how required for the classical channel (ref Section classical channel). 

We limited the learning objectives for the students in order to keep the workshop to a time limit of 3 hours:
\begin{enumerate}
    \item Students should be able to assemble and operate experimental apparatus to distribute encrypted messages with keys obtained from BB84 -- refer to Section~\ref{sec:sturole} for task list. %-- students assemble electronic circuits...(list actual subset of tasks). % Jianwei, we did not focus on the encryption.. See below
    By providing a hands-on experience in both creating the secret key and using it to encrypt messages, students will benefit from a more concrete understanding of the cryptography protocol~\cite{handson}.
    %%%
    \item Students should be able to understand the central operating principle of QKD after the hacking attempt -- the no-cloning theorem. The apparent failure of the QKD system creates a cognitive conflict which has been shown to result in greater learning gains~\cite{cogconflict, cogconflict2}. 
\end{enumerate}

% The workshop ends when Eve successfully decodes the secret message, after which a debriefing session (UTAMA: INCLUDE A KEY QUESTION USED TO ELICIT THE CORRECT RESPONSE, ELSE THE SENTENCE IS NOT PROVIDING A LOT OF INFO) was conducted to highlight the importance of the no-cloning theorem and the necessary assumptions in the BB84 protocol. 

The workshop ends when Eve successfully decodes the secret message. The debriefing session usually starts with Eve reading out loud the secret message that Alice sends to Bob. This unexpected revelation sparks the discussion of how the setup differs from an ideal BB84 setup -- our setup does not use light at the single photon level. We further review the assumptions necessary for BB84, the importance of the no-cloning theorem in quantum cryptography, and discuss how device-independent QKD protocols can alleviate some of the assumptions.~\cite{diqkd, diqkd2}

\begin{figure}[ht!]
\includegraphics[width=8.6cm]{img/debrief.png}
\caption{\label{figure:debrief}
 Eve is revealed -- students are discussing in the debriefing session.
} 
\end{figure}

% Afterwards, students visit neighboring teams to learn from each other.
% This security breach allows the students the opportunity to identify the physical principle underlying the security loophole: the 'no-cloning' theorem, its role in quantum cryptography, and to discuss about the importance of device-independent QKD protocols.~\cite{diqkd, diqkd2}

% 1. Experience how it is like to realize a working system -- give a glimpse of how an experimental physicist works.
% 2. Abstract to concrete bridging by a hands on activity.
% To expose students to the inner workings of the protocol, we design a workshop where students are guided to construct 
% We designed a workshop for the students with the following learning objectives.
% The workshop was designed in order to expose students to 
% Students were required to assemble critical components implementing the BB84 key distribution protocol.
% Learning Objectives

\subsection{Student's roles}\label{sec:sturole}
% Utama: Specify Number of Students for which team, who does what. Briefly but specifically mention what are the facilitator's roles. Don't use "run" as it requires definition.

The students are divided into four teams corresponding to Alice, Bob and Eve (two teams). 
More students were assigned to Eve as the duration of our workshop limited the tasks 
% that could be understood and performed by each team 
that could be accomplished by each team -- 
Eve had to acquire the same knowledge as Alice and Bob, in addition to hacking the protocol.
% -- tasks which include the hacking procedure not required for teams Alice and Bob.
% As Eve are tasked to hack Alice and Bob setup, they need to first understand the operating principle of Alice and Bob's setup. 
Eve comprised of two teams Eve-classical and Eve-quantum, each focusing on their respective channels. Each team consists of 3-5 members. 
We assigned a facilitator to each group to help and guide the students throughout the tasks. 

% In the span of three hours, Alice and Bob build and operate the cryptographic setup, while Eve performs the 
% establish the classical channel, quantum channel, generate the encryption key, and communicate the secret message. Teams Eve first follow Alice and Bob's tasks (but only in the respective channel), and switches to the hacking mode afterwards. Below we give a brief description on what the students need to accomplish for each sections:
The tasks assigned to each team are described below. Teams Alice and Bob were assigned tasks 1-4, team Eve-classical were assigned tasks 1, 5 and 7, and team Eve-quantum were assigned tasks 2, 6, and 7.   %UTAMA.
Students were given three hours to accomplish them.

\begin{enumerate}
    \item Classical channel. The students build the IR transceiver on the electrical breadboard, and run pre-written programs which allows them to exchange messages back and forth. 
    \item Quantum channel. The students align the polariser to establish a common polarisation basis, and perform a basic 16-bit BB84 protocol by exchanging a paper (simulating a public channel) back and forth. We have assembled and aligned the optical components prior to the workshop.
    \item Encryption key generation. The students run an automated BB84 protocol which utilises both the classical and quantum channel to generate a 32-bit key. 
    \item Secret message communication. The students use the 32-bit key to encrypt/decrypt the secret messages with the XOR operation (for 32-bit messages or shorter). Alternatively, they run a program which 
    encrypt/decrypt long messages with a key expansion procedure (see Appendix A). Alice sends the encrypted message through the classical channel.
    \item Classical channel hacking. The students position the IR transceiver at a convenient location to eavesdrop on Alice's messages -- in particular the matched basis and the encrypted secret messages. 
    \item Quantum channel hacking. The students record the light pulses split off from Alice's beam using the polarization analyzer, and cluster the polarizations accordingly. A beam-splitter has been placed on Alice's beam path prior to the workshop.
    \item Cracking the secret message. The students work together -- Eve-classical gives the matched basis to Eve-quantum to generate all the possible key combinations. They use the key combinations on the intercepted cipher text to decode a legible message. 
\end{enumerate}

At the end of the workshop, we allocate time for the students to exchange learning experiences with each other, in particular the set of tasks performed by the other teams. The workshop facilitators also explained to the students various optical components and guided them through the whole setup -- most importantly, they reveal the location of the beam-splitter and the polarisation analyzer, which was not clandestinely placed yet often overlooked (Figure~\ref{figure:student_setup}).

% In order to expose each team to the tasks perform by adjacent teams, we allocated time at the end of the workshop for the students to exchange learning experiences with each other. The workshop facilitators also guided the students through the various optical components.

% As the student has 
% As the optical setup was pre-aligned prior to the workshop, we also allow the students to tinker with them after the workshop.

% We found that these set of tasks fit the 3 hour schedule, with around 30 minutes of extra time of to spare. We reserve this extra time in case we need to debug some circuits or programs or to realign the setup, if necessary. If everything runs smoothly, we use the extra time to let the students visit one another or tinker with the optical setup. For longer workshop duration, one can consider to guide the students to write parts of the codes or to build and align the optical setup themselves.  

%Each group was assigned a facilitator who helped and guided them throughout the tasks. 
%Each run takes approximately three hours.

\subsection{Students feedback}\label{sec:feedback}
% Rewrite + 
We conducted the workshops four times during the participants' school holiday period (Jun 2018 and 2019).
After each workshop, we surveyed the students. Table~\ref{tab:response} shows the aggregated results. 
% Table~\ref{tab:response} shows the survey results we obtained from students who attended the workshops conducted on June 2018 and 2019 (4 sessions).
% The workshop was conducted in June 2018 and 2019 (4 sessions in total), 
% and received positive feedback (Table~\ref{tab:response}). 
% The students generally liked the workshop and did not find the concepts too difficult to follow and apply.

Overall, students liked the workshop, 
and were able to follow and apply the concepts thought.
% and the level of difficulty is right in the middle. 
% We also asked the students to give an open-ended response to which are the most favourite and least liked aspects of the QKD lab. 
% We also asked students to comment on the favourite aspect of the workshop.
% As their response varied by a lot, we did a rough clustering of their responses. 
Students also highlighted aspects of the workshop that they liked: 
the successful eavesdropping attempt (31\%), 
the hands-on experience to operate and assemble a functioning QKD system involving lasers and microcontrollers (29\%), 
and the opportunity to apply what they have learnt in lectures on quantum mechanics prior to the workshop (19\%). 
Students also enjoyed the novelty of the instructional method, and appreciated the worksheets designed to facilitate their understanding of concepts such as key-sifting and K-means clustering (8\%). 
% A small fraction of the students liked the novelty in the instructional method and the worksheets (8\%) or gave no comments or other comments (13\%). 

% On the questions about the least liked aspect, 
Around half of the students (54\%) highlighted areas for improvement:
% the highest portion of the students did not give any response, or giving a neutral or positive response instead (46\%). 
the absence of time allocated to experience the tasks of adjacent teams (12\%),
the waiting time for facilitators to troubleshoot the experimental apparatus and debug computer programs (10\%),
% that they have to wait if the setup fails, which happens in a few occasions (10\%), 
% and that the coding and parts of the worksheet are pretty demanding (10\%). 
and the level of difficulty of the worksheets and the steep learning curve required to run the programs (10\%).
A few students thought that the clarity of the instruction could be improved, 
while some obviously did not enjoy the experience of being hacked.
% The rest of the comments (22\%) revolve around that the given instructions are sometimes confusing, and that they are tricked and then hacked. 

% We offered the workshop in Qcamp 2018~\cite{qcamp}. 
% As the workshop was received positively by the students, we decided to offer it again in Qcamp 2019.
% We garnered some feedback from the students, and obtained 35 responses for Qcamp 2018 and 24 responses for Qcamp 2019. 
% The responses were aggregrated and summarized in Table~\ref{tab:response}.
\begin{table}[htb!]
    \small
% UTAMA: Normalise first two qns from 0 to 1. Remaining qns to percentages
    \centering
    \begin{tabular}{|p{6.5cm}| p{2cm}|}
        \hline
         Questions  & Average \\
        \hline
        How did you like the workshop?  &  $2.67\pm0.57$\\
        \hspace*{0.1cm} 0 (Didn't like it) to 3 (It is great!) &  \\
        \hline
        How difficult did you find it?  &  $0.04\pm0.33$\\
        \hspace*{0.1cm} -1 (Too easy!) to 1 (Too hard!) &  \\
        \hline
        Favourite aspects? & Percentage\\
        \hline
        \hspace*{0.3cm}1. The system being hacked & 31\% \\
        \hspace*{0.3cm}2. Hands-on experience  & 29\% \\
        \hspace*{0.3cm}3. Learning to apply new concepts & 19\%\\
        \hspace*{0.3cm}4. Instructions and worksheets & 8\%\\
        \hspace*{0.3cm}5. Other comments& 13\%\\
        \hline
        Areas for improvement? & Percentage\\
        \hline
        \hspace*{0.3cm}1. Not experiencing other tasks & 12\% \\
        \hspace*{0.3cm}2. Waiting time when things fail & 10\% \\
        \hspace*{0.3cm}3. Worksheets and programs & 10\%\\
        \hspace*{0.3cm}4. Other comments & 22\%\\
        \hspace*{0.3cm}5. No comment & 46\% \\
        \hline
    \end{tabular}
    % \caption{Summary of students' responses from Qcamp 2018 and 2019.}
    \caption{Feedback from 59 students.}
    \label{tab:response}
\end{table}


% \begin{enumerate}
%     \item How did you like today's QKD lab overall? \newline
%     Outcome: ``It's great!'' (23 responses), ``I like it!'' (10 responses), ``Not good nor bad'' (2 responses), and ``I didn't like it" (0 response).
%     \item How difficult did you find today's QKD lab? \newline
%     Outcome: ``Goldilocks: not too easy, not too difficult'' (31 responses), ``It's too hard'' (3 responses), and ``It's too easy'' (1 response).
%     \item What was your favourite aspect of the QKD lab? \newline
%     Summary: Most students like the hands-on experience in setting up the system (11 responses), that the system was actually being hacked (9 responses), and other responses (15), to attempt the ``optional'' worksheet (5 responses), learning new stuffs and applying what is learned (5 responses), clarity in the explanation (2 responses), and others (3 responses). 
%     \item What did you like the least about the QKD lab?
%     Summary: Most students did not answer the question (17 responses). Other responses were that one couldn't experience other team missions (4 responses), that the ``optional'' worksheet is a little draining (4 responses), waiting time when things went wrong (3 responses), confusing instructions (3 responses), that they need to deal with coding (2 responses), and others (2 responses).
%     \item Other feedback on the QKD lab.
%     Summary: Only 17 students gave additional feedback. 6 students gave encouraging comments about the workshop, 6 students provided some suggestions on how to improve the workshop in the future, and 5 students demanded that the workshop has more time and activities.
% \end{enumerate}


\section{Conclusion}
We have presented a modified BB84 QKD setup aimed at pre-university students.
The setup was intentionally modified for ease of implementation while simultaneously providing a deeper insight into how the protocol critically relies 
on the underlying quantum physics - the no-cloning theorem.

% This project provides students the experience of building a fully functioning cryptographic system, and 
% the opportunity of hacking it when certain conditions provided by quantum physics is not met,
% providing a deeper insight of how a protocol depends on quantum physics and should lead to a deeper understanding of how cryptography protocol with information-theoretic security works.
% highlights how quantum physics leads to an unconditionally-secure cryptographic protocol.
%NOTE: MATHIAS IS TIRED AND MENTION THE INSIGHTS FROM THE SIDE-CHANNEL ATTACK COGNITIVE DISSONANCE OMG!

The experiment is implemented with off-the-shelf, commercially available apparatus and can be operated with  minimal training in optics, computing and electronics. 
With the codes and documentations made available online, we believe that this simplified implementation of BB84 is an easily deployable and engaging QKD demonstration that can be realized by a wide range of educational institutions.

\section*{A. Encryption of Long Messages}

In the main text, we encrypted 32 bit messages with an XOR operation using the key generated from BB84 with the same length. 
However, for longer messages, we do not repeat the key generation procedure, but instead expand the 32 bit key to the same length as the message.
Although this procedure allows the students to encode the message with the XOR operation outlined above,~\cite{streamcipher} the resulting ciphertext is vulnerable to at least two different attacks.

% First, we note that our key expansion procedure uses Mersenne Twister (MT) pseudo-random number generator (PRNG)~\cite{prng_mt, prng_python}: the 32 bit key is used as an input (seed) to initialize the PRNG, deterministically producing a longer key. However, it has been shown that, if an adversary managed to know even a tiny fraction of the key generated by this PRNG (also known as ``leaks''), he would be able to guess the rest of the key~\cite{mt_hack}. This is because this PRNG only utilises linear operation, with each numbers related by linear equations. By having sufficient entries to the set of equations, one might be able to reconstruct the initial state with say, Gaussian elimination. The adversary could obtain these leaks as she peers into the structure in the message. 
First, we note that our key expansion procedure uses Mersenne Twister (MT) pseudo-random number generator (PRNG)~\cite{prng_mt, prng_python}: the 32 bit key is used as an input (seed) to initialize the PRNG, deterministically producing a longer key. 
Although it has been shown that an adversary is able to guess the rest of expanded key given partial knowledge of the key ("leaks"), 
we chose to proceed with this PNRG as it provides another learning opportunity pertaining to encryption security 
-- students exploit linear relations between bits to reconstruct the key with high probability~\cite{mt_hack}.
The leaks to the expanded key can, for example, be obtained by examining the structure of the message. For the UTF-8 scheme which is widely used to represent characters in a message, the two leading bits of an English alphabet is 01. 
This could be used to deduce the leading bits of every byte of the expanded key by sampling the ciphertext.
Alternatively, a secure key expansion protocol could be implemented using highly non-linear PRNG protocols.~\cite{cryptmt,othersc}
% if the message is in English (ASCII).
% This illustrates that a security protocol is only as strong as its weakest link.
% Alternatively, one could use other more sophis

%%%
%For example, if the messages are encoded in 8 bit ASCII format, the first bit of each character is always 0, and the second bit of each character is 1 for letters and 0 for numbers, spaces, and punctuation marks.
% Another alternative:
% In our workshop, we encode the message in ASCII, with each character taking up 1 byte (8 bits). As ASCII only requires 7 bit to encode all the 128 characters, the first bit is set to be 0.~\footnote{This is compatible with the most common encoding standard today, UTF-8, where the first bit is used to access special characters or characters in other languages.} Thus, one would expect that the first bit of each byte is  always zero, and obtain 1/8 of the key. If this is not enough, one can also guess that the message will most likely contain English characters (01??????), numbers (0011????), spaces (00100000), etc. To prevent against such attacks, one may consider using other variant of PRNGs which are highly non-linear and thus more cryptographically secure, for example CryptMT v3~\cite{cryptmt} and others~\cite{othersc}.

% is not cryptographically secure

% However, the PRNG is not cryptographically secure -- one can predict the whole pseudo-random number sequence even if one only knows a subset of the sequence. If the message characters are encoded in say, 8 bit ASCII format, one may infer that the first bit of each character will always be 0, and that the message might end with a full stop character. From this subset, one might be able to predict the expanded key, and decode the ciphertext. To prevent against such attacks, one may consider using other variant of PRNGs which are more cryptographically secure, for example CryptMT~\cite{cryptmt} and others~\cite{othersc}.


% We use the secret key to seed a general-purpose pseudo-random number generator (PRNG), Mersenne Twister~\cite{prng_mt, prng_python}, to produce an ``expanded'' key with the same length as the message. An XOR operation is then applied on the expanded key and the message to produce the ciphertext, similar to the one-time pad. 

Second, an adversary can try all possible combinations of the 32 bit key, expand them, and decode the ciphertext with the XOR operation. For any message length $m$, this operation results in only $2^{32}$ possible combinations of decoded messages. If the message is much longer than the key ($ m \gg 32$),
%message length is much longer than 32 bits
it is likely that only a few decoded messages are coherent. 
%Utama: good description below, but use instead message length of M bits w key of M bits - otherwise its confusing how come many coherent msgs are possible with fewer bits of message.
This contrasts with the scenario where the message is as long as the key 
%message length is only 32 bits 
as in the one-time pad scenario ($ m = 32$), as this results in as many coherently decoded messages as possible. 
It is possible for students to perform this brute-force attack with modern computers -- if each combination requires $\sim1\,\mathrm{\mu s}$ to be computed and checked for coherence, it would only take $\sim1.2$ hours to exhaust all possibilities. 
% Utama: clearer to say: if the key is much shorter than the message.
It is important to note that every encryption protocols are prone to this type of attack, if the key is short enough~\cite{cryptobook}. The solution to this attack is to create a key long enough that requires an absurd amount of resources to be brute-forced (128 bits, in our current technology).

Although these vulnerabilities were not the main features of our workshop, we used them to highlight potential weak links that could have been overlooked in a presumably secure cryptographic system. We observed that this was an interesting point for a few students, who attempted the brute-force attack by writing their own codes.

% These vulnerabilities were not the main features of the workshop. However, in the debriefing session, we leveraged on these to highlight to the students that, in a chain of a cryptographic system, the security is only as good as its weakest link. We welcome the students, for those keen enough, to try these attacks after the workshop. 

% Our choice of encryption method and key length mirrors one of the main message of the activity -- we create another ``subtle'' modification to the classical symmetric cryptographic protocol. This allows the students to exploit the security loophole, and obtain the secret message. However, this was not the main point of the workshop, and we reserve this cryptanalysis exercise for the more mathematically or computationally inclined students. Last, it is also customary to highlight to the students that, in a chain of a cryptographic system, the security is only as good as its weakest link. 


% Second, as the encryption procedure relies on 32 bit seed generated by the BB84 protocol, there are only $2^{32}$ possible combinations of the original message that results in the same ciphertext. 
% , there are only $2^{32}$ possible combination of ciphertexts, despite the choice of the encryption protocol. 
% Thus, an adversary can generate all $2^{32}$ possible combinations of the decoded message.
% for any encryption protocol, the ciphertext is vulnerable to brute force attacks where an adversary 
% attempts to decode the ciphertext by generating every possible 32-bit seeds.
% one can try to input $2^{32}$ combinations of the seed values, and look only for output that makes sense -- one would expect that the decoded message is understandable by humans. If each attempts takes $\sim1\,\mathrm{\mu s}$ (a speed achievable with modern computers), the total cracking time is only $\sim1.2$ hours. This is also known as the brute force attack.~\cite{cryptobook}



% Messages longer than 32 bit can still be encoded with a 32 bit key. However, this has to be done carefully as it might present some security flaws (see Appendix). In our workshop, we inadvertently implement a stream cipher protocol, based on a pseudo-random number generator and a XOR protocol, which has a major security flaw. This has two advantages -- first, the students can get an idea on how to ``expand'' the key to encrypt longer messages. Second, the students can appreciate why the classical encryption can be secure.

\section*{B. Cost and components}

The total cost of optomechanical, optical, and electronic components for the workshop was approximately USD 2.5k. However, as we were able to borrow most of the standard components from the optics lab and the electronics workshop, the out-of-pocket expenses were barely USD~450, most of which comes from purchasing Arduinos.
% We saved cost by borrowing standard components from the optics lab and the electronics workshop.
% We tried to save cost by borrowing standardcomponents from the optics and electronics lab. The total additional expenses for this project ($\sim$ USD 450) mostly came from purchasing Arduinos. 
% The cost of the optomechanical components alone was around USD 1.3k -- the optics lab has blessed us with high-precision components, which might  not be necessary for this workshop.
To reduce the cost, one can consider 3D-printing. 

The electrical components for the classical channel consist of a small solderless breadboard (MCBB4000), infrared LED (TSAL6200), infrared receiver (TSOP38238), bipolar NPN transistor (BC547), and various sizes of jumper wires and resistor.

The light source for the quantum channel was built with a reasonably-priced laser diode (Thorlabs L785P5) in a simple transistor switch circuit (see Figure~\ref{figure:quantum_setup}). The light output was collimated with a lens (Thorlabs LT220P-B). Temperature and current stabilization were not necessary. 
The quarter wave plate (Dayoptics WPA215Q) was the most expensive optical component in our list, which cost around USD~100.
The motorized polarizers were built from a stepper motor (28BYJ-48-5V) driven with Darlington transistors (ULN2003) and a polarizer sheet (3DLens P50) glued to the motor shaft. As the stepper motor requires higher peak current than what an Arduino supplies, we require an external power supply. The photodetection circuit used a PIN silicon photodiode (OP906) in a reverse-biased configuration. A variable resistor was used to modify the conversion gain of the photodiode. 
The beam was aligned with high-reflective mirrors on kinematic mirror mounts (KM100).




\begin{acknowledgments}
% use full names!
We would like to thank Prof. Christian Kurtsiefer for his support and  guidance for this project, and for his valuable inputs on the manuscript.
We appreciate the help and support from Jenny Hogan and the steering committee of QCamp 2018 and 2019. 
We would like to extend our gratitude to all the students that took part in this experiment.
Last but not least, we gratefully acknowledge the help, effort, and perseverance from the following facilitators: Chow Chang Hoong, Tan Ting You, Yeo Xi Jie, Chen Jia Pern Neville, Florentin Thierry Adam and Ng Boon Loong.

This research is supported by the National Research Foundation, Prime Minister’s Office, Singapore and the Ministry of Education, Singapore under the Research Centres of Excellence programme.
% NEED TO HAVE THIS. ASK JENNY
%The project is sponsored by the outreach fund of Centre for Quantum Technologies, National University of Singapore.
\end{acknowledgments}


\begin{thebibliography}{99}
% \bibitem{dyson} Freeman J. Dyson, ``Feynman's proof of the Maxwell equations,'' 
% Am. J. Phys. \textbf{58} (3), 209--211. 
\bibitem{qkdreview} N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, ``Quantum cryptography,'' Rev. Mod. Phys. \textbf{74}, 145 (2002).
\bibitem{rsa} R. L. Rivest, A. Shamir, and L. Adleman, ``A method for obtaining digital signatures and public-key cryptosystems,'' Communications of the ACM, \textbf{21}(2), 120-126 (1978).
\bibitem{niel} M. A. Nielsen, and I. Chuang, Quantum computation and quantum information (2002). 
\bibitem{bb84proof} P. W. Shor, and J. Preskill, ``Simple Proof of Security of the BB84 Quantum Key Distribution Protocol,'' Phys. Rev. Lett. \textbf{85}, 441  (2000).
\bibitem{bb84proof2} R. Renner, N. Gisin, and B. Kraus, ``Information-theoretic security proof for quantum-key-distribution protocols,'' Phys. Rev. A \textbf{72}, 012332 (2005).
\bibitem{bb84} C. H. Bennett, and G. Brassard, ``Quantum cryptography: Public key distribution and coin tossing,'' Theor. Comput. Sci. \textbf{560}, 7--11 (2014).
\bibitem{nocloning} W. K. Wootters, and W. H. Zurek. ``A single quantum cannot be cloned,'' Nature \textbf{299} (5886), 802-803 (1982).
\bibitem{ekert} Artur K. Ekert, ``Quantum cryptography based on Bell’s theorem,'' Phys. Rev. Lett. \textbf{67}, 661 (1991).
\bibitem{entg} R. Horodecki, P. Horodecki, M. Horodecki, and K. Horodecki, ``Quantum entanglement,'' Rev. Mod. Phys. \textbf{81}, 865 (2009).
\bibitem{bell} John S. Bell, ``On the einstein podolsky rosen paradox,'' Physics Physique Fizika \textbf{1}(3): 195 (1964).
\bibitem{exp1} T. Schmitt-Manderbach et.al., ``Experimental Demonstration of Free-Space Decoy-State Quantum Key Distribution over 144 km,'' Phys. Rev. Lett. \textbf{98}, 010504 (2007).
\bibitem{exp2} C. Z. Peng et. al., ``Experimental Long-Distance Decoy-State Quantum Key Distribution Based on Polarization Encoding,'' Phys. Rev. Lett. \textbf{98}, 010505 (2007).
\bibitem{exp3} J. Yin et. al., ``Satellite-based entanglement distribution over 1200 kilometers,'' Science \textbf{356}(6343), 1140-1144 (2017).
\bibitem{momentum} D. S. Lemelle, M. P. Almeida, P. H. Souto Ribeiro, and S. P. Walborn, ``A simple optical demonstration of quantum cryptography using transverse position and momentum variables,'' Am. J. Phys. \textbf{74}, 542--546 (2006). 
\bibitem{brazildemo} A. L. P. Camargo, L. O. Pereira, W. F. Balthazar, and J. A. O. Huguenin, ``Simulation of the BB84 protocol of quantum cryptography by using an intense laser beam,'' Revista Brasileira de Ensino de Física \textbf{39}, 2305 (2017).
\bibitem{choco} Karl Svozil, ``Staging quantum cryptography with chocolate balls,'' Am. J. Phys. \textbf{74}, 800--803 (2006). 
\bibitem{entangleme} A. López-Incera, and W. Dür, `` Entangle me! A game to demonstrate the principles of quantum mechanics,'' Am. J. Phys. \textbf{87}(2), 95--101 (2019).
\bibitem{interactivesims} A. Kohnle, and A. Rizzoli, ``Interactive simulations for quantum key distribution,''  Eur. J. Phys. \textbf{38}, 035403 (2017).
\bibitem{interactivetuts} S. DeVore, and S. Chandralekha, ``An Interactive Learning Tutorial on Quantum Key Distribution,'' arXiv:1601.01301 (2016).
\bibitem{github} The codes and technical documentation for this project is available at $\langle$\url{https://github.com/HelpMeFinishPhD/Qcamp2019}$\rangle$
\bibitem{entropy} We generate random numbers using the Entropy library, available at $\langle$\url{https://sites.google.com/site/astudyofentropy}$\rangle$.
\bibitem{irremote} Arduino IR Remote Library, available at
$\langle$\url{https://z3t0.github.io/Arduino-IRremote/}$\rangle$
% \bibitem{necprotocol} SB-Projects NEC protocol, available at % $\langle$\url{https://www.sbprojects.net/knowledge/ir/nec.php}$\rangle$
\bibitem{qcamp} QCamp, hosted by Centre for Quantum Technologies. Visit us at $\langle$\url{https://qcamp.quantumlah.org}$\rangle$
\bibitem{ryan} R. M. Ryan, and E. L. Deci, ``Intrinsic and Extrinsic Motivations: Classic Definitions and New Directions,'' Contemporary Educational Psychology \textbf{25}, 54--67 (2000).
\bibitem{handson} D. L. Haury, and P. Rillero, ``Perspectives of Hands-On Science Teaching,'' (1994).
\bibitem{cogconflict} B. J. Guzzetti, T. E. Snyder, G. V. Glass, and W. S. Gamas, ``Promoting conceptual change in science: A comparative meta-analysis of instructional interventions from reading education and science education,'' Reading Research Quarterly, 117-159 (1993).
\bibitem{cogconflict2} M. Limón, ``On the cognitive conflict as an instructional strategy for conceptual change: A critical appraisal,'' Learning and instruction, \textbf{11}(4-5), 357-380 (2001).
\bibitem{diqkd} A. Acin, N. Gisin, and L. Masanes, ```From Bell’s theorem to secure quantum key distribution,'' Phys. Rev. Lett. \textbf{97}, 120405 (2006).
\bibitem{diqkd2} U. Vazirani, and T. Vidick, ``Fully Device-Independent Quantum Key Distribution,'' Phys. Rev. Lett. \textbf{113}, 140501 (2016).
\bibitem{streamcipher} M. J. Robshaw, ``Stream ciphers,'' RSA Laboratories Technical Report (1995).
\bibitem{prng_mt} M. Matsumoto, and T. Nishimura, ``Mersenne twister: a 623-dimensionally equidistributed uniform pseudo-random number generator,'' ACM Transactions on Modeling and Computer Simulation (TOMACS), 8(1), 3-30 (1998).
\bibitem{prng_python} Python implementation of Mersenne Twister PRNG, available at $\langle$\url{https://docs.python.org/3/library/random.html}$\rangle$
\bibitem{mt_hack} G. Argyros and A. Kiayias, ``I Forgot Your Password: Randomness Attacks Against {PHP} Applications,'' Presented as part of the 21st {USENIX} Security Symposium ({USENIX} Security 12) (2012).
\bibitem{cryptmt} Makoto Matsumoto, et al, ``CryptMT stream cipher version 3.'' eSTREAM, ECRYPT Stream Cipher Project, Report 28 (2007).
\bibitem{othersc} T, Good, and M. Benaissa, ``Hardware results for selected stream cipher candidates,'' State of the art of stream ciphers \textbf{7}, 191-204 (2007).
\bibitem{cryptobook} C. Paar, and J. Pelzl, ``Understanding cryptography: a textbook for students and practitioners,'' Springer Science \& Business Media (2009).


\end{thebibliography}

\end{document}
