. 23
( 27)


G±β ∝ 1 ’ · cos (2± ’ 2β) , (19.64)
for some value of the ¬tting parameter ·. Given appropriate assumptions about the
curve-¬tting technique, one can show that

·=V. (19.65)

The physical meaning of a high, but imperfect (V < 1), visibility is that decoherence
of some sort has occurred between the two photons γA and γB during their propagation
from the source to Alice and Bob. Thus the entangled pure state emitted by the source
changes, for either fundamental or technical reasons, into a slightly mixed state before
arriving at the detectors.
Next, let us consider experiments with four counters, such as the one sketched in
Fig. 19.3. Again, using data analysis that assumes a ¬nite-visibility ¬tting parameter
·, the joint probabilities (19.58) and (19.59) have the following modi¬ed forms:
’ · cos(2± ’ 2β) ,
pee (±, β) = poo (±, β) = (19.66)
+ · cos(2± ’ 2β) ,
peo (±, β) = poe (±, β) = (19.67)
so that Bell™s joint expectation value becomes

E(±, β) = ’· cos(2± ’ 2β) . (19.68)

For the special settings in eqn (19.61), one ¬nds

S = ’ √ · = ’2 2· . (19.69)
This implies that the maximum amount of visibility Vmax permitted by Bell™s inequal-
ity |S| 2 is
Vmax = ·max = √ = 70.7% . (19.70)
Comparisons with experiments

19.6.2 Data from the tandem-crystal experiment violates the Bell
inequality |S| 2
For comparison with experiment, we show once again the data from the tandem two-
crystal experiment discussed in Section 13.3.5, but this time we superpose a ¬nite-
visibility, sinusoidal interference-fringe pattern, of the form (19.64), with the maximum
visibility Vmax = 70.7% permitted by Bell™s theorem. This is shown as a light, dotted
curve in Fig. 19.7.
One can see by inspection that the data violate the Bell inequality (19.38) by many
standard deviations. Indeed, detailed statistical analysis shows that these data violate
the constraint |S| 2 by 242 standard deviations. However, this data exhibits a high
signal-to-noise ratio, so that systematic errors will dominate random errors in the data

19.6.3 Possible experimental loopholes
A The detection loophole
Since the quantum e¬ciencies of photon counters are never unity, there is a possible
experimental loophole, called the detection loophole, in most quantum optical tests
of Bell™s theorem. If the quantum e¬ciency is less than 100%, then some of the photons
will not be counted. This could be important, if the ensemble of photons generated by
the source is not homogeneous. For example, it is conceivable”although far-fetched”
that the photons that were not counted just happen to have di¬erent correlations than
the ones that were counted. For example, the second-order interference fringes for the
undetected photons might have a visibility that is less than the maximum allowable
amount Vmax = 70.7%. Averaging the visibility of the undetected photons with the
visibility of the detected photons, which do have a measured visibility greater than
70.7%, might produce a total distribution which just barely manages to satisfy the
inequality (19.38).

Singles (10 s)
Coincidences (10 s)




0 0
’45 45 135 225
0 90 180 270 315
θ2 (θ1 = ’45 )

Fig. 19.7 Data from the tandem-crystals experiment (discussed in Section 13.3.5) compared
to maximum-visibility sinusoidal interference fringes with Vmax = 70.7% (light, dotted curve),
which is the maximum visibility permitted by Bell™s theorem. (Adapted from Kwiat et al.
Bell™s theorem and its optical tests

This scenario is ruled out if one adopts the entirely reasonable, fair-sampling as-
sumption that the detected photons represent a fair sample of the undetected photons.
In this case, the undetected photons would not have substantially distorted the ob-
served interference fringes if they had been included in the data analysis. Nevertheless,
the fair-sampling assumption is di¬cult to prove or disprove by experiment.
One way out of this di¬culty is to repeat the quantum optical tests of Bell™s
theorem with extremely high quantum e¬ciency photon counters, such as solid-state
photomultipliers (Kwiat et al., 1994). This would minimize the chance of missing any
appreciable fraction of the photons in the total ensemble of photon pairs from the
source. To close the detection loophole, a quantum e¬ciency of greater than 83% is
required for maximally entangled photons, but this requirement can be reduced to
67% by the use of nonmaximally entangled photons (Eberhard, 1993).
Replacing photons by ions allows much higher quantum e¬ciencies of detection,
since ions can be detected much more e¬ciently than photons. In practice, nearly
all ions can be counted, so that almost none will be missed. An experiment using
entangled ions has been performed (Rowe et al., 2001). With the detection loophole
closed, the experimenters observed an 8 standard deviation violation of the Clauser“
Horne“Shimony“Holt inequality (Clauser et al., 1969)

|E (±1 , β1 ) + E (±2 , β1 )| + |E (±1 , β2 ) ’ E (±2 , β2 )| 2. (19.71)

This is one of several experimentally useful Bell inequalities that are equivalent in
physical content to the condition |S| 2 discussed above.

B The locality loophole
Another possible loophole”which is conceptually much more important than the ques-
tion of detector e¬ciency”is the locality loophole. Closing this loophole is especially
vital in light of the incorporation of the extremely important Einsteinian principle of
locality into Bell™s theorem.
Since photons travel at the speed of light, they are much better suited than atoms or
ions for closing the locality loophole. Using photons, it is easy to ensure that Alice™s and
Bob™s decisions for the settings of their parameters ± and β are space-like separated,
and therefore truly independent.
For example, Alice and Bob could randomly and quickly reset ± and β during the
time interval after emission from the source and before arrival of the photons at their
respective calcite prisms. There would then be no way for any secret machinery at
the source to know beforehand what values of ± and β Alice or Bob would eventu-
ally decide upon for their measurements. Therefore, properties of the photons that
were predetermined at the source could not possibly in¬‚uence the outcomes of the
measurements that Alice and Bob were about to perform.
The ¬rst attempt to close the locality loophole was an experiment with a separation
of 12 m between Alice and Bob. Rapidly varying the settings of ± and β, by means of
two acousto-optical switches (Aspect et al., 1982), produced a violation of the Clauser“
Horne“Shimony“Holt inequality (19.71) by 6 standard deviations.
However, the time variation of the two polarizing elements in this experiment was
periodic and deterministic, so that the settings of ± and β at the time of arrival of the
Comparisons with experiments

photons could, in principle, be predicted. This would still allow the properties of the
photons that led to the observed outcomes of measurements to be predetermined at
the source.
A more satisfactory experiment vis-`-vis closing the locality loophole was per-
formed with a separation of 400 m between the two polarizers. Two separate, ultrafast
electro-optic modulators, driven by two local, independent random number genera-
tors, rapidly varied the settings of ± and β in a completely random fashion. The result
was a violation of the Clauser“Horne“Shimony“Holt inequality (19.71) by 30 standard
The two random number generators operated at the very high toggle frequency
of 500 MHz. After accounting for various extraneous time delays, the experimenters
concluded that no given setting of ± or β could have been in¬‚uenced by any event that
occurred more than 0.1 µs earlier, which is much shorter than the 1.3 µs light transit
time across 400 meters.
Hence the locality loophole was ¬rmly closed. However, the detection loophole was
far from being closed in this experiment, since only 5% of all the photon pairs were
detected. Thus a heavy reliance on the fair-sampling assumption was required in the
data analysis.

19.6.4 Relativistic issues
An experiment with a very large separation, of 10.9 km, between Alice and Bob has
been performed using optical ¬ber technology, in conjunction with a spontaneous
down-conversion light source (Tittel et al., 1998). A violation of Bell™s inequalities
by 16 standard deviations was observed in this experiment.
Relativistic issues, such as putting limits on the so-called speed of collapse of the
two-photon wave function, could then be examined experimentally using this type of
apparatus. Depending on assumptions about the detection process and about which
inertial frame is used, the speed of collapse was shown to be at least 104 c to 107 c
(Zbinden et al., 2001). Further experiments with rapidly rotating absorbers ruled out
an alternative theory of nonlocal collapse (Suarez and Scarani, 1997).

19.6.5 Greenberger“Horne“Zeilinger states
The previous discussion of experiments testing Bell™s theorem was based on constraints
on the total amount of correlation between random events observable in two-particle
coincidence experiments. These constraints are fundamentally statistical in nature.
Greenberger, Horne, and Zeilinger (GHZ) (Kafatos, 1989, pp. 69“72) showed that
using three particles, as opposed to two, in a maximally entangled state such as

|ψGHZ ∝ |a, b, c ’ |a , b , c , (19.72)

allows a test of the combined principles of locality and realism by observing, or failing
to observe, a single triple-coincidence click. Thus, in principle, the use of statistical
correlations is unnecessary for testing local realistic theories. However, in practice,
the detectors with quantum e¬ciencies less than 100% used in real experiments again
required the use of inequalities. Violations of these inequalities have been observed
in experiments involving nonmaximally entangled states generated by spontaneous
¼¼ Bell™s theorem and its optical tests

down-conversion (Torgerson et al., 1995; White et al., 1999). Once again, the results
contradict all local realistic theories.
For a review of these and other quantum optical tests of the foundations of physics,
see Steinberg et al. (2005).

19.7 Exercises
19.1 The original EPR argument
(1) Show that the EPR wave function, given by eqn (19.1), is an eigenfunction of
the total momentum pA + pB , with eigenvalue 0, and also an eigenfunction of the
operator xA ’ xB , with eigenvalue L.
(2) Calculate the commutator [pA + pB , xA ’ xB ] and use the result to explain why
(1) does not violate the uncertainty principle.
(3) If pA is measured, show that pB has a de¬nite value. Alternatively, if xA is mea-
sured, show that xB has a de¬nite value.
(4) Argue from the previous results that both xB and pB are elements of physical
reality, and explain why this leads to the EPR paradox.

19.2 Parameter independence for quantum theory
(1) Use eqns (19.43)“(19.45) to derive eqn (19.47).
(2) Verify parameter independence when |χ is replaced by any of the four Bell states
{|Ψ± , |¦± } de¬ned by eqns (13.59)“(13.62).

19.3 Violation of outcome independence
(1) Use eqn (19.50) to expand |hA , vB and |vA , hB in terms of |hA , βB and vA , β B .
(2) Evaluate the reduced states |Ψ’ yes and |Ψ’ no .
(3) Calculate the conditional probabilities p(Ayes |», ±, β, Byes ) and p(Ayes |», ±, β,
Bno ).
(4) Calculate the joint probability p (Ayes , Byes |Ψ’ , ±, β ).
(5) If |Ψ’ is replaced by |φ = |hA , vB , is outcome independence still violated?

19.4 Violation of Bell™s inequality
(1) Carry out the calculations needed to derive eqns (19.58) and (19.59).
(2) If |Ψ’ is replaced by |φ = |hA , vB , is the Bell inequality still violated?
Quantum information

Quantum optics began in the early years of the twentieth century, but its applications
to communications, cryptography, and computation are of much more recent vintage.
The progress of communications technology has made quantum e¬ects a matter of
practical interest, as evidenced in the discussion of noise control in optical transmission
lines in Section 20.1. The issue of inescapable quantum noise is also related to the
di¬culty”discussed in Section 20.2”of copying or cloning quantum states.
Other experimental and technological advances are opening up new directions for
development in which the quantum properties of light are a resource, rather than a
problem. Streams of single photons with randomly chosen polarizations have already
been demonstrated as a means for the secure transmission of cryptographic keys, as
discussed in Section 20.3. Multiphoton states o¬er additional options that depend on
quantum entanglement, as shown by the descriptions of quantum dense coding and
quantum teleportation in Section 20.4. This set of ideas plays a central role in the
closely related ¬eld of quantum computing, which is brie¬‚y reviewed in Section 20.5.

20.1 Telecommunications
Optical methods of communication”e.g. signal ¬res, heliographs, Aldis lamps, etc.”
have been in use for a very long time, but high-speed optical telecommunications
are a relatively recent development. The appearance of low-loss optical ¬bers and
semiconductor lasers in the 1960s and 1970s provided the technologies that made new
forms of optical communication a practical possibility.
The subsequent increases in bandwidth to 104 GHz and transmission rates to the
multiterabit range have led”under the lash of Moore™s law”to substantial decreases
in the energy per bit and the size of the physical components involved in switching
and ampli¬cation of signals. An inevitable consequence of this technologically driven
development is that phenomena at the quantum level are rapidly becoming important
for real-world applications.
Long-haul optical transmission lines require repeater stations that amplify the
signal in order to compensate for attenuation. This process typically adds noise to the
signal; for example, erbium doped ¬ber ampli¬ers (EDFA) degrade the signal-to-noise
ratio by about 4 dB. Only 1 dB arises from technical losses in the components; the
remaining 3 dB loss is due to intrinsic quantum noise.
Thus quantum noise is dominant, even for apparently classical signals containing
a very large number of photons. Similar e¬ects arise when the signal is divided by a
passive device such as an optical coupler. Future technological developments can be
¼¾ Quantum information

expected to increase the importance of quantum noise; therefore, we devote Sections
20.1.2 and 20.1.3 to the problem of quantum noise management.

Optical transmission lines—
Let us consider an optical transmission line in which the repeater stations employ
phase-insensitive ampli¬ers. For phase-insensitive input noise, the input and output
signal-to-noise ratios are de¬ned by
bγ (ω)
[SNR]γ = (γ = in, out) , (20.1)
Nγ (ω)
where Nin and Nout are the noise in the input and output respectively. The relation
between the input and output signal-to-noise ratios is obtained by combining eqns
(16.36) and (16.150) to get
2 2
bout (ω) bin (ω) [SNR]in
[SNR]out = = = . (20.2)
Nout (ω) Nin (ω) + A (ω) 1 + A (ω) /Nin (ω)
The most favorable situation occurs when the input noise strength has the standard
quantum limit value 1/2. In this case one ¬nds
[SNR]out 1 1 1
= (20.3)
2 “ 1/G (ω)
[SNR]in 1 + 2A (ω) 2

The inequality follows from eqn (16.151) and the ¬nal result represents the high-gain
limit. The decibel di¬erence between the signal-to-noise ratios is therefore bounded by
’10 log 2 ≈ ’3 .
d = 10 log (20.4)
In other words, the quantum noise added by a high-gain, phase-insensitive ampli¬er
degrades the signal-to-noise ratio by at least three decibels. This result holds even for
strong input ¬elds containing many photons. For example, if the input is described by
the multi-mode coherent state de¬ned by eqns (16.98)“(16.100), then the input noise
strength is Nin (ω) = 1/2. In this case the inequality (20.4) is valid for any value of
the e¬ective classical intensity |βin (t)| , no matter how large.
This result demonstrates that high-gain, phase-insensitive ampli¬ers are intrinsi-
cally noisy. This noise is generated by fundamental quantum processes that are at
work even in the absence of the technical noise”e.g. insertion-loss noise and Johnson
noise in the associated electronic circuits”always encountered in real devices.

Reduction of ampli¬er noise—
In the discussion of squeezing in Section 15.1 we have seen that quantum noise can be
unequally shared between di¬erent ¬eld quadratures by using nonlinear optical e¬ects.
This approach”which can yield essentially noise-free ampli¬cation for one quadrature
by dumping the unwanted noise in the conjugate quadrature”is presented in the
present section.

There is an alternative scheme, based on the special features of cavity quantum
electrodynamics, in which the signal propagates through a photonic bandgap. This
is a three-dimensional structure in which periodic variations of the refractive index
produce a dispersion relation that does not allow propagating solutions in one or more
frequency bands”the bandgaps”so that vacuum ¬‚uctuations and the associated noise
are forbidden at those frequencies (Abram and Grangier, 2003).
In the discussion of linear optical ampli¬ers in Chapter 16, we derived the in-
equality (16.147) which shows that the ampli¬er noise for a phase-conjugating am-
pli¬er is always larger than the vacuum noise, i.e. Namp > 1/2. On the other hand,
the noise added by a phase-transmitting ampli¬er can be made as small as desired
by allowing G (ω) to approach unity. Thus noise reduction can be achieved with a
phase-transmitting ampli¬er, provided that we are willing to give up any signi¬cant
Achieving noise reduction by giving up ampli¬cation scarcely recommends itself
as a useful strategy for long-haul communications, so we turn next to phase-sensitive
ampli¬ers. In this case, the lower bound (16.147) on ampli¬er noise is replaced by the
ampli¬er uncertainty principle (16.169). The resemblance between eqn (16.169) and
the standard uncertainty principle for canonically conjugate variables is promising,
since the latter is known to allow squeezing.
Furthermore, the ampli¬er uncertainty principle has the additional advantage that
the lower bound is itself adjustable; indeed, it can be set to zero. Even when this is
not possible, the noise in one quadrature can be reduced at the expense of increasing
the noise in the conjugate quadrature. We ¬rst demonstrate two examples in which
the ampli¬er noise actually vanishes, and then discuss what can be achieved in less
favorable situations.
The phase-sensitive, traveling-wave ampli¬er described in Section 16.3.2 is intrinsi-
cally noiseless, so the lower bound of the ampli¬er uncertainty principle automatically
vanishes. For applications requiring the generally larger gains possible for regenerative
ampli¬ers, the phase-sensitive OPA presented in Section 16.2.2 can be modi¬ed to
provide noise-free ampli¬cation.
For the phase-sensitive OPA, the ampli¬er noise comes from vacuum ¬‚uctuations
entering the cavity through the mirror M2, as shown in Fig. 16.2. Thus the ampli¬er
noise would be eliminated by preventing the vacuum ¬‚uctuations from entering the
cavity. In an ideal world, this can be accomplished by making M2 a perfect re¬‚ector,
i.e. setting κ2 = 0 in eqns (16.47)“(16.49). Under these circumstances, eqn (16.49)
reduces to · (ω) = 0, so that the ampli¬er is noiseless.
In these examples, the noise vanishes for both of the principal quadratures, i.e.
A1 (ω) = A2 (ω) = 0. According to eqn (16.167), this means that the signal-to-noise
ratio is preserved by ampli¬cation. This is only possible if the lower bound in eqn
(16.170) vanishes, and this in turn requires G1 (ω) G2 (ω) = 1. Consequently, the price
for noise-free ampli¬cation is that one quadrature is attenuated while the other is
In the real world”where traveling-wave ampli¬ers may not provide su¬cient gain
and there are no perfect mirrors”other options must be considered. The general idea is
to achieve high gain and low noise for the same quadrature. For this purpose, the signal
¼ Quantum information

should be carried by modulation of either the amplitude or the phase of the chosen
c c
quadrature, e.g. Xin (ω); and the input noise should be small, i.e. ∆Xin (ω) 1/2.
In the high-gain limit, the lower bound in eqn (16.169) is proportional to
G1 (ω) G2 (ω); consequently, the ampli¬er noise in the conjugate quadrature is nec-
essarily large. This is not a problem as long as the noisy quadrature is strongly rejected
by the detectors in use. The degree to which these objectives can be attained depends
on the details of the overall design.

20.1.3 Reduction of branching noise
The information encoded in an optical signal is often intended for more than one
recipient, so that it is necessary to split the signal into two or more identical parts,
usually by means of a directional coupler. These junction points”which are often
called optical taps”may also be used to split o¬ a small part of the signal for
measurement purposes.
Whatever the motive for the tap, it is in e¬ect a measurement of the radiation
¬eld. A measurement of any quantum system perturbs it in an uncontrollable fashion;
consequently, the optical tap must add noise to the signal. A succession of taps will
therefore degrade the signal, even if there is no associated ampli¬er noise.
In fact, we have already met with this e¬ect, in the guise of the partition noise
at a beam splitter. The explanation that partition noise arises from vacuum ¬‚uctu-
ations entering through the unused port of the beam splitter suggests that injecting
a squeezed vacuum state into the unused port might help with the noise problem.
This idea was initially proposed in 1980 (Shapiro, 1980) and experimentally realized
in 1997 (Bruckmeier et al., 1997). We discuss below a simple model that illustrates
this approach.
The idea is to add two elements, shown in Fig. 20.1, to the simple beam splitter
described in Section 8.4: (1) a squeezed-light generator (SQLG); and (2) a pair of
variable retarder plates (see Exercise 20.1). The SQLG, which is the essential part
of the modi¬ed beam splitter, injects squeezed light into the previously unused input
port 2. The function of the variable retarder plates, which are placed at the input port
2 and the output port 2 , is to simplify the overall scattering matrix.
The phase transformations, a2 ’ eiθ a2 and a2 ’ eiθ a2 , imposed by the retarder
plates are more usefully described as rotations of the input and output quadratures
through the angles θ and θ . Combining the phase transformations with eqn (8.63)”as
outlined in Exercise 20.2”yields the scattering matrix
√ √
i Reiθ
S = √ iθ √ i(θ+θ ) . (20.5)
i Re Te

The phases of the beam splitter coe¬cients have been chosen so that t = T is real and

r = i R is pure imaginary, where T and R are respectively the intensity transmission
and re¬‚ection coe¬cients.
The SQLG is designed to emit a squeezed state for the quadrature
1 ’iβ
e a2 + eiβ a† ,
X2 = (20.6)

Fig. 20.1 Modi¬ed beam splitter for noiseless
branching. The OPA injects squeezed light into
port 2 and the phase plates are used to obtain
a convenient form for the scattering matrix.

so an application of eqn (15.39) produces the variances
e’2r e2r
V (X2 ) = , V (Y2 ) = , (20.7)
4 4
where Y2 is the conjugate quadrature and r is the magnitude of the squeezing para-
meter. For the special values θ = ’π/2 and θ = π/2 the input“output relations for
the amplitude quadratures are
√ √
X1 T √R X1

= , (20.8)
X2 X2
where the quadratures for the input channel 1, and the output channels 1 and 2 are
de¬ned by the angle β used in eqn (20.6).
Let us now specialize to a balanced beam splitter, and assume that the signal is
carried by X1 . The squeezed state satis¬es X2 = 0; consequently, the two output
signals have the same average:
X1 = X2 = √ X1 . (20.9)
Since the input signal X1 and the SQLG output are uncorrelated, the variances of the
output signals X1 and X2 are also identical:
¼ Quantum information

V (X1 ) = V (X2 ) = V (X1 ) + . (20.10)
2 8
The 50% reduction of the output variances compared to the input variance does
not mean that the output signals are quieter; it merely re¬‚ects the reduction of the

amplitudes by the factor 1/ 2. This can be seen by de¬ning the signal-to-noise ratios,
2 2
| Xm | | Xm |
SNR (Xm ) = , SNR (Xm ) = (m = 1, 2) , (20.11)
V (Xm ) V (Xm )

and using the previous results to ¬nd

SNR (X1 )
SNR (X1 ) = SNR (X2 ) = . (20.12)
1 + e’r / [4V (X1 )]

In the limit of strong squeezing, this coupler almost exactly preserves the signal-
to-noise ratio of the input signal. Consequently, the output signals are faithful copies
of the input signal down to the level of the quantum ¬‚uctuations. The injection of the
squeezed light into port 2 has e¬ectively diverted almost all of the partition noise into
the unobserved output quadratures Y1 and Y2 .
This scheme succeeds in splitting the signal without adding any noise, but at the
cost of reducing the intensity of the output signals by 50%. This drawback can be
overcome by inserting a noiseless ampli¬er, e.g. the traveling-wave OPA described in
Section 16.3.2, prior to port 1 of the beam splitter. The gain of the ampli¬er can
be adjusted so that each of the split signals has the same strength and the same
signal-to-noise ratio as the original signal.

20.2 Quantum cloning
At ¬rst glance, it may seem that the noiseless beam splitter of Section 20.1.3 produces
a perfect copy or clone of the input signal. This impression is misleading, since only the
expectation values and variances of the particular input quadrature X1 are faithfully
copied; indeed, the variance of the output conjugate quadrature Y1 is much larger than
the variance of Y1 .
This observation suggests a general question: To what extent does quantum theory
allow cloning? In the following section, we will review the famous no-cloning theorem
(Dieks, 1982; Wootters and Zurek, 1982), which outlaws perfect cloning of an unknown
quantum state.
We should note that this work was not done to answer the question we have
just raised. It was a response to a proposal by Herbert (1982) for a superluminal
communications scheme employing EPR correlations. The connection between no-
cloning and no-superluminal-signaling is a recurring theme in later work (Ghirardi
and Weber, 1983; Bussey, 1987).
The no-cloning theorem quickly became an important physical principle which
was, for example, used to argue for the security of quantum cryptography (Bennett
and Brassard, 1984). The ¬nal step in the initial development was the extension of the
result from pure to mixed states (Barnum et al., 1996).
Quantum cloning

This was immediately followed by the work of Buˇek and Hillery (1996) who began
the investigation of imperfect cloning. We will study the degree of cloning allowed by
quantum theory in Section 20.2.2.
In the study of quantum information, the systems of interest are usually described
by states in a ¬nite-dimensional Hilbert space Hsys . For the special case of two-state
systems”e.g. a two-level atom, a spin-1/2 particle, or the two polarizations of a
photon”Hsys is two-dimensional, and a vector |γ in Hsys is called a qubit. The
generic description of qubits employs the so-called computational basis {|0 , |1 }
de¬ned by
σz |0 = |0 , σz |1 = ’ |1 . (20.13)
In this notation a general qubit is represented by |γ = γ0 |0 + γ1 |1 .
In the more general case, dim (Hsys ) = d > 2, the state is called a qudit. We will
follow the usual convention by referring to the systems under study as qubits, but
it should be kept in mind that many of the results also hold in the general ¬nite-
dimensional case. In the interests of simplicity, we will only treat closed systems un-
dergoing unitary time evolution.
For the applications considered below, it is often necessary to consider one or more
ancillary (helper) systems in addition to the system of interest. The reservoirs used
in the treatment of dissipation in Chapter 14 are an example of ancillary systems or
ancillas. In that case the unitary evolution of the closed sample“reservoir system was
used to derive the dissipative equations by tracing over the ancilla degrees of freedom.
Another common theme in this ¬eld is the assumption that the total system consists
of a family of distinguishable qubits. The Hilbert space H for the system is H =
HQ — Hanc , where Hanc and HQ are respectively the state spaces for the ancillas and
the family of qubits. This abstract approach has the great advantage that the results
do not depend on the speci¬c details of particular physical realizations, but there are,
nevertheless, some implicit physical assumptions involved.
If the qubits are particles, then”as we learnt in Section 6.5.1”the Hilbert space
HQ for two qubits is

(Hsys — Hsys )sym for bosons ,
HQ = (20.14)
(Hsys — Hsys )asym for fermions .

For massive particles”e.g. atoms, molecules, quantum dots, etc.”a way around this
complication is to choose an experimental arrangement in which each particle™s center-
of-mass position can be treated classically. In these circumstances, as we saw in Section
6.5.2, the symmetrization or antisymmetrization normally required for identical par-
ticles can be ignored. In this model, a qubit located at ra is described by a copy of
Hsys , called Ha . The vectors |γ a in Ha represent the internal states of the qubit.
For a family of two qubits, located at ra and rb , the space HQ is the unsymmetrized
tensor product: HQ = Ha — Hb . The Bell states, ¬rst de¬ned in Section 13.3.5 for
photons, are represented by
¼ Quantum information

Ψ± = √ {|1, 0 ± |0, 1 ab } ,
= √ {|0, 0 ± |1, 1 ab } ,
¦ ab
≡ |u |v b .
|u, v (20.16)
ab a

More features of the Bell states can be found in Exercise 20.3.
In the general case of qubits located at r1 , . . . , rN the qubit space is
HQ = Ha , (20.17)

and a generic state is denoted by |u1 , . . . , uN 12···N . When no confusion will result, the
notation is simpli¬ed by omitting the subscripts on the kets, e.g. |u, v ab ’ |u, v . The
application of these ideas to photons requires a bit more care, as we will see below.

20.2.1 The no-cloning theorem
For closed systems, we can assume that every physically permitted operation is de-
scribed by a unitary transformation U acting on the Hilbert space H describing the
qubits and the ancillas. To set the scene for the cloning discussion, we assume that
there is a set of qubits, |B b , all in the same (internal) blank state |B , and a cloning
device which is initially in the ready state |R anc ∈ Hanc .
If we only want to make one copy”this is called 1 ’ 2 cloning”the total initial
state is
|γ, B, R ≡ |γ a — |B b — |R anc = |γ a |B b |R anc . (20.18)
The cloning assumption is that there is a unitary operator U such that

U |γ, B, R = |γ, γ, Rγ = |γ |γ |Rγ , (20.19)
a b anc

where |Rγ anc is the state of the cloner after it has cloned the state |γ a . In this
approach, cloning is not the creation of a new particle, but instead the imposition of
a speci¬ed internal state on an existing particle.
After this preparation, the no-cloning theorem can be stated as follows (Scarani
et al., 2005).
Theorem 20.1 There is no quantum operation that can perfectly duplicate an un-
known quantum state.

We will use a proof given by Peres (1995, Sec. 9-4) that exhibits a contradiction
following from the assumption that a cloning operation does exist, i.e. that there is a
unitary operator satisfying eqn (20.19).
Quantum cloning

Since the cloning device is supposed to work in the absence of any knowledge of
the initial state, it must be possible to use U to clone a di¬erent state |ζ , so that
U |ζ, B, R = |ζ, ζ, Rζ . (20.20)
A direct use of the unitarity of U yields
γ, γ, Rγ | ζ, ζ, Rζ = γ, B, R| ζ, B, R = γ |ζ , (20.21)
where we have imposed the convention that the initial states |R anc , |γ a , |B b , and
|ζ a are all normalized and that the inner product between internal states does not
depend on the location of the qubit.
Using the explicit tensor products in eqns (20.19) and (20.20) produces the alter-
native form
γ, γ, Rγ | ζ, ζ, Rζ = Rγ |Rζ γ |ζ . (20.22)
For non-orthogonal qubits, |γ and |ζ , equating the two results leads to
Rγ |Rζ γ |ζ = 1 . (20.23)
The inner product Rγ |Rζ automatically satis¬es | Rγ |Rζ | 1, and we can
always choose |γ and |ζ so that | γ |ζ | < 1; therefore, there are states |γ and |ζ
for which eqn (20.23) cannot be satis¬ed. This contradiction proves the theorem.
This elegant proof shows that the impossibility of perfect cloning of unknown, and
hence arbitrary, states is a fundamental feature of quantum theory; indeed, the only
requirement is that quantum operations are represented by unitary transformations.
In this respect it is similar to the Heisenberg uncertainty principle, for which the sole
requirement is the canonical commutation relation [q, p] = i .
We should emphasize, however, that this argument only excludes universal clon-
ing machines, i.e. those that can clone any given state. This leaves open the possibility
that speci¬c states could be cloned. In fact the argument does not prohibit the cloning
of each member of a known set of mutually orthogonal states.
The application of this theorem in the context of quantum optics raises some
problems. The proof rests on the assumption that the qubits are distinguishable and
localizable, but photons are indistinguishable, massless bosons that cannot be precisely
localized and are easily created and destroyed. Thus it is not immediately obvious that
the proof of the no-cloning theorem given above applies to photons.
A second problem arises from the observation that stimulated emission”which
produces new photons with the same wavenumber and polarization as the incident
photons”would seem to provide a ready-made copying mechanism. Why is it that
stimulated emission is not a counterexample to the no-cloning theorem? In the follow-
ing paragraphs we will address these questions in turn.
Since photons are indistinguishable bosons, we cannot add any identifying subscript
to a photonic qubit |γ , and the two-qubit space is the two-photon Fock space, H(2) .
The simplest way to de¬ne a photonic qubit is to choose a speci¬c wavevector k, and
set |γ = “† |0 , where
γks a† .
Ҡ = (20.24)
Since s takes on two values, the state |γ quali¬es as a qubit.
½¼ Quantum information

Cloning this qubit can only mean that a second photon is added in the same mode;
therefore, the cloning transformation (20.19) for this case would be

U “† |0 |R = √ “†2 |0 |Rγ . (20.25)
anc anc

By contrast to the distinguishable qubit model, the polarization state is not imposed
on an existing photon in a blank state; instead, a new photon is created with the same
polarization as the original. Despite this signi¬cant physical di¬erence, a similar proof
of the no-cloning theorem can be constructed by following the hints in Exercise 20.4.
The proof of the no-cloning theorem”either the standard version starting with
eqn (20.19) or the photonic version treated in Exercise 20.4”does not suggest any
speci¬c mechanism that prevents cloning. Finding a mechanism of this sort for photons
turns out to be related to the second problem noted above. Could stimulated emission
provide a cloning method?
The discussion of stimulated emission starts with a photon incident on an atom in
an excited state. In this case, the nonzero ratio A/B = k 3 /π 2 = 0 of the Einstein
A and B coe¬cients provides the essential clue: stimulated emission is unavoidably
accompanied by spontaneous emission. Since the spontaneously emitted photons have
random directions and polarizations, they will violate the cloning assumptions (20.25).
This argument eliminates cloning machines based on excited atoms, but what about
parametric ampli¬ers, such as the traveling-wave OPA in Section 16.3.2, in which
there are no population inversions and, consequently, no excited atoms? This possible
loophole was closed by the work of Milonni and Hardies (1982), in which it is shown
that stimulated emission is necessarily accompanied by spontaneous emission, even in
the absence of inverted atoms.
In the context of quantum optics, the impossibility of perfect, universal cloning
can therefore be understood as a consequence of the unavoidable pairing of stimulated
and spontaneous emission.
The no-cloning theorem does not exclude devices that can clone each member of a
known set of orthogonal states. For example, two orthogonal polarization states can be
cloned by exploiting stimulated emission. For this purpose, suppose that the sum over
polarizations in eqn (20.24) refers to the linear polarization vectors eh (horizontal)
and ev (vertical ).
The cloning device consists of a trap containing a single excited atom, followed by
a polarizing beam splitter. The PBS is oriented so that h- and v-polarized photons
are sent through ports 1 and 2 respectively. For an initial state |1kh , the ¬rst-order
perturbation calculation suggested in Exercise 20.5 shows that the combination of
stimulated and spontaneous emission produces an output state proportional to

2 |2kh + |1kh , 1kv . (20.26)

Since the PBS sends the unwanted v-polarized photon through port 2, the only two-
photon state emitted through port 1 is the desired cloned state |2kh . The argument
is symmetrical under the simultaneous exchange of h with v and port 1 with port 2;
therefore, the device is equally good at cloning v-polarized photons.
Quantum cloning

This design produces perfect clones of each state in the basis, but only if the
basis is known in advance, so that the PBS can be properly oriented. As usual, the
experimental realization is a di¬erent matter. This idea depends on having detectors
that can reliably distinguish between one and two photons in a given mode, but such
detectors are”to say the least”very hard to ¬nd.
Since classical theory is an approximation to quantum theory, we are left with a
¬nal puzzle: How is it that the no-cloning theorem does not prohibit the everyday
practice of amplifying and copying classical signals? To understand this, we observe
that for an incident state with ni photons, the total emission probability for the
ampli¬er is proportional to ni +1, where ni and 1 respectively correspond to stimulated
and spontaneous emission.
If ni = 1, the two processes are equally probable, but if ni 1, then stimulated
emission dominates the output signal. Thus the classical copying process can achieve
its aim, despite the fact that it cannot create a perfect clone of the input.

Quantum cloning machines—
The ideal cloning operation in eqn (20.19) would”if only it were possible”produce
an exact copy of a qubit without damaging the original. In their seminal paper on
imperfect cloning, Hillery and Buˇek posed two questions: (1) How close can one come
to perfect cloning? (2) What happens to the original qubit in the process?
Attempts to answer these questions have generated a large and rapidly developing
¬eld of research. In the remainder of this section, we will give a very brief outline of the
basic notions, and discuss one optical implementation. For those interested in a more
detailed account, the best strategy is to consult a recent review article, e.g. Scarani
et al. (2005) or Fan (2006).

A Cloning distinguishable qubits—
The unattainable ideal of perfect cloning is replaced by the idea of a quantum cloning
machine (QCM), which consists of a chosen ancillary state |R anc in Hanc and a
unitary transformation U acting on H = HQ — Hanc . We will only discuss the simplest
case of 1 ’ 2 cloning, for which the action of U on the initial state |γ, B, R de¬nes
the cloned state
|γ; γ ≡ U |γ, B, R . (20.27)
In general, the vector |γ; γ represents an entangled state of the ancilla and the two
qubits, so the state of the qubits alone is described by the reduced density operator

ρab = Tranc |γ; γ γ; γ| , (20.28)

where the trace is de¬ned by summing over a basis for the ancillary space Hanc . The
states of the individual qubits are in turn represented by the reduced density operators

ρa = Trb ρab and ρb = Tra ρab . (20.29)

The task is to choose |R anc and U to achieve the best possible result, as opposed
to imposing the form of |γ; γ a priori. This e¬ort clearly depends on de¬ning what is
meant by ˜best possible™.
½¾ Quantum information

Of the many available measures of success, the most commonly used is the ¬delity:

Fa (γ) = a γ |ρa | γ , Fb (γ) = b γ |ρb | γ , (20.30)
a b

which measures the overlap between the mixed state produced by the cloning operation
and the original pure state. A QCM is said to be a universal QCM if the ¬delities
are independent of |γ , i.e. the machine does equally well at cloning every state.
A nonuniversal QCM is called a state-dependent QCM. The QCM is a sym-
metric QCM if the ¬delities of the output states are equal, i.e. Fa (γ) = Fb (γ), and
it is an optimal QCM if the ¬delities are as large as quantum theory allows.
The unitary operator U for a QCM is linear, so its action on the general input
state |γ, B, R is completely determined by its action on the special states |0, B, R
and |1, B, R , where 0 and 1 label the computational basis vectors de¬ned by eqn
(20.13). For the Buˇek“Hillery QCM, the ancilla consists of a single qubit, |R anc =
R0 |0 anc + R1 |1 anc , and the transformation U is de¬ned by

2 1+
|0 a |0 b |1 anc ’
U |0, B, R = Ψ ab |0 anc , (20.31)
3 3
2 1+
|1 a |1 b |1 anc +
U |1, B, R = ’ Ψ ab |1 anc . (20.32)
3 6

The Bell state |Ψ+ ab is de¬ned in eqn (20.15). In Exercise 20.6, these explicit
expressions are used to evaluate the reduced density operators ρa and ρb which yield
the ¬delities Fa (γ) = Fb (γ) = 5/6. Thus the Buˇek“Hillery QCM is universal and
symmetric. It has also been shown”see the references given in Scarani et al. (2005)”
that it is optimal.

Cloning photons—
In order to carry out an actual experiment, the abstractions of the preceding discus-
sion must be replaced by real hardware. Furthermore, the application of these ideas
in quantum optics also requires a more careful use of the theory. Both of these con-
siderations are illustrated by an experimental demonstration of a cloning machine for
photons (Lamas-Linares et al., 2002).
The basic idea, as shown in Fig. 20.2, is to use stimulated emission in a type
II down-conversion crystal, which is adjusted so that the down-converted photons
propagating along certain directions are entangled in polarization (Kwiat et al., 1995b).

Fig. 20.2 Schematic for a photon cloning ma-
chine. The type II down-converter produces
nondegenerate signal and idler modes with
wavevectors k1 (mode 1) and k2 (mode 2). The
photons are entangled in polarization.
Quantum cloning

The pump beam and the single photon to be injected into the crystal are both derived
from a Ti“sapphire laser producing 120 fs pulses. The pump is created by frequency-
doubling the laser beam, and the single-photon state is generated by splitting o¬ a
small part of the beam, which is then attenuated below the single-photon level.
With this method, there is still a small probability that two photons could be
injected. If no down-conversion occurs, the transmitted two-photon state will appear as
a false count for cloning. These false counts can be avoided by triggering the detectors
for the k1 -photons with the detection of the conjugate k2 -photon, which is a signature
of down-conversion.
To model this situation, we ¬rst pick a pair of orthogonal linear polarizations, eh
and ev , for each of the wavevectors. The production of polarization-entangled signal
and idler modes is then described by the interaction Hamiltonian

HSS = „¦P a† 1 v a† 2 h ’ a† 1 h a† 2 v + HC . (20.33)
k k k k

By following the hints in Exercise 20.7, one can show that this Hamiltonian is invariant
under joint and identical rotations of the two polarization bases around their respective
The cloning e¬ect is consequently independent of the polarization of the input
photon; that is, this should be a universal QCM. It is therefore su¬cient to con-
sider a particular input state, say |1k1 v = a† 1 v |0 , which evolves into |• (t) =
exp (’iHSS t/ ) |1k1 v . The relevant time t is limited by the pulse duration of the
pump, which satis¬es „¦P tP 1; therefore, the action of the evolution operator can
be approximated by a Taylor series expansion of the exponential in powers of „¦P t:

|• (t) ≈ {1 ’ iHSS t/ + · · · } |1k1 v

= |1k1 v ’ i„¦P t 2 |2k1 v , 1k2 h ’ |1k1 v , 1k1 h , 1k2 v + · · · . (20.34)

This result for |• (t) displays the probabilistic character of this QCM; the most
likely outcome is that the injected photon passes through the crystal without producing
a clone. The cloning e¬ect occurs with a probability determined by the ¬rst-order

term in the expansion. The factor 2 in the ¬rst part of this expression represents the
enhancement due to stimulated emission.
According to von Neumann™s projection rule, the detection of a trigger photon with
wavevector k2 and either polarization leaves the system in the state
P2 |• (t)
|• (t) = , (20.35)
• (t) |P2 | • (t)
P2 = |1k2 v 1k2 v | + |1k2 h 1k2 h | (20.36)
is the projection operator describing the reduction of the state associated with this
measurement. Combining eqns (20.34) and (20.36) yields

2 1
|• (t) = ’i |2k1 v , 1k2 h ’ |1k1 v , 1k1 h , 1k2 v . (20.37)
3 3
½ Quantum information

The probability of detecting two photons in the mode k1 v is 2/3 and the probability
of detecting one photon in each of the modes k1 v and k1 h is 1/3. The factor of two
between the probabilities is also a consequence of stimulated emission.
The indistinguishability of the photons guarantees that the QCM is symmetric, but
it also prevents the de¬nition of reduced density operators like those in eqn (20.29).
In this situation, the cloning ¬delity can be de¬ned as the probability that an output
photon with wavevector k1 has the same polarization as the input photon. This hap-
pens with unit probability for the ¬rst term in |• (t) red and with probability 1/2 in
the second term; therefore, the ¬delity is

2 1 1 5
— (1) + —
F= = . (20.38)
3 3 2 6

The theoretical model for this QCM therefore predicts that it is universal, symmetric,
and optimal.
In the experiment, the incident photon ¬rst passes through an adjustable optical
delay line, which is used to control the time lapse ∆T between its arrival and that of
the laser pulse that generates the down-converted photons. Stimulated emission should
only occur when the photon wave packet and the pump pulse overlap. The results of
the experiment, which are shown in Fig. 20.3, support this prediction.
The number of counts, N (2, 0), with two photons in the mode k1 v and no photon in
the mode k1 h is shown in Fig. 20.3 as a function of the distance c∆T , for three di¬erent
polarization states”curves (a)“(c)”of the injected photon. As expected, there is a
pronounced peak at zero distance. The corresponding plots (d)“(f) of N (1, 1)”the
number of counts with one photon in each polarization mode”show no such e¬ect.
The experimental ¬delity can be derived from the ratio

Npeak (2, 0)
R= (20.39)
Nbase (2, 0)

between the peak value and the base value of the N (2, 0) curve. At maximum overlap
between the incident single-photon wave packet and the pump pulse (c∆T = 0), the
probability of the (2, 0)-con¬guration is

Npeak (2, 0)
P (2, 0) = , (20.40)
Npeak (2, 0) + Npeak (1, 1)

which becomes
P (2, 0) = (20.41)
R + Npeak (1, 1) /Nbase (2, 0)

when expressed in terms of R.
The base values Nbase (1, 1) and Nbase (2, 0) represent the situation in which there
is no overlap between the single-photon wave packet and the pump pulse. In this case,
the detection of the original photon and a down-converted photon in the spatial mode
k1 are independent events. Down-conversion produces k1 v and k1 h photons with equal
Quantum cloning

Linear 0o
(a) (d)
Counts (100s)
N(2,0) N(1,1)
100 200
0 0
’100 ’50 ’100 ’50
0 50 100 0 50 100

Linear 45o
(b) (e)
Counts (100s)

N(2,0) N(1,1)
0 0
’100 ’50 0 50 100 ’100 ’50 0 50 100
Left circular
(c) (f)
Counts (100s)

N(2,0) N(1,1)
’100 ’50 ’100 ’50
0 50 100 0 50 100
Position (µm) Position (µm)

Fig. 20.3 Plots (a)“(c) show N (2, 0) as a function of c∆T for linear at 0—¦ (vertical), linear
at 45—¦ , and left circular polarizations respectively. Plots (d)“(f) show N (1, 1) for the same
polarizations. (Reproduced from Lamas-Linares et al. (2002).)

probability; therefore, the probability that the polarizations of the two k1 -photons are
the same is 1/2. This implies that

Nbase (1, 1) = Nbase (2, 0) . (20.42)

The apparent disagreement between eqn (20.42) and the data in the plot pairs (a) and
(d), (b) and (e), and (c) and (f) is an artefact of the detection method used to count
the (2, 0)-con¬gurations; see Exercise 20.7.
The data show that Npeak (1, 1) = Nbase (1, 1); therefore

P (2, 0) = , (20.43)
½ Quantum information

P (1, 1) = . (20.44)
Applying the argument used to derive eqn (20.38) leads to
1 1 R + 1/2
—1+ — = . (20.45)
R+1 R+1 2 R+1
The data yield essentially the same ¬delity, F = 0.81 ± 0.01, for all polarizations. This
is close to the optimal value F = 5/6 0.833; consequently, this QCM is very nearly
universal and optimal.

20.3 Quantum cryptography
The history of cryptography”the art of secure communication through the use of
secret writing or codes”can be traced back at least two thousand years (Singh, 1999),
and the importance of this subject continues to increase. In current practice, the
message is expressed as a string of binary digits M , and then combined with a second
string, known as the key, by an algorithm or cipher. The critical issue is the possibility
that the encrypted message could be read by an unauthorized person.
For most applications, it is su¬cient to make this task so di¬cult that the message
remains con¬dential for as long as the information has value. The commonly employed
method of public key cryptography enforces this condition by requiring the solution
of a computationally di¬cult problem, e.g. factoring a very large integer. This kind of
encryption is not provably secure, since it is subject to attack by cryptanalysis, e.g.
through the use of better factorization algorithms or faster computers.
In classical cryptography, the only provably secure method is the one-time pad,
i.e. the key is only used once (Gisin et al., 2002). In one version of this scheme, the
key shared by Alice and Bob is a randomly generated number K which must have a
binary representation at least as long as the message. Since the binary digits of K are
random, the key itself contains no information. Alice encrypts her message as the signal
S = M • K, where • indicates bit-wise addition without carry, i.e. addition modulo
2. This means that corresponding bits are added according to the rules 0 + 0 = 0,
0 + 1 = 1, and 1 + 1 = 0.
The bits of S are as random as those of K, so the signal carries no information
for Eve, the lurking eavesdropper. On the other hand, Bob can decipher the message
by bit-wise subtraction of K from S to recover M . The security of the messages is
weakened by repeated use of the key. For example, if two messages M 1 and M 2 are
sent, then the identity K • K = 0 implies

S1 • S2 = M 1 • K • M 2 • K
= M1 • M2 • K • K
= M1 • M2 . (20.46)

The bits in M 1 and M 2 are not random; therefore, Eve gains some information about
the messages themselves. With enough messages, the encryption system could be bro-
Quantum cryptography

The use of a one-time pad solves the problem of secure communication, only to raise
a new problem. How is the key itself to be safely transmitted through a potentially
insecure channel? If Alice and Bob have to meet for this purpose, she might as well
deliver the message itself.
One of the most intriguing discoveries in recent years (Wiesner, 1983; Bennett and
Brassard, 1984, 1985) is that the peculiar features of quantum theory o¬er a solution
to the problem of secure transmission of cryptographic keys. Once this is done, the
message itself can be sent as a string of classical bits. Thus quantum cryptography
really reduces to the secure transmission of keys, i.e. quantum key distribution.
A quantum method for distributing a key evidently involves encoding the key in the
quantum states of some microscopic system. Since the electromagnetic ¬eld provides
the most useful classical communication channel, it is natural to use a property of
photons, e.g. polarization, to carry the information in a quantum channel.
As a concrete illustration, consider orthogonal linear polarizations eh (k) and ev (k)
that de¬ne the basis of single-photon states:

B = |h = a† |0 , |v = a† |0 . (20.47)
kh kv

One can then encode 0 as |h and 1 as |v . We will see below that a scheme based on
B alone is too simple to foil Eve, so we add a second basis

h = a† |0 , |v = a† |0
B= , (20.48)

where the new polarization basis
eh (k) = √ [eh (k) + ev (k)] ,
ev (k) = √ [ev (k) ’ eh (k)]
is the ¬rst polarization basis rotated through 45—¦ . The creation operators and the
single-photon basis states transform just like the polarization vectors. The correspond-
ing encoding for B is: 0 ” h and 1 ” |v .
The two basis sets have the essential property that no member of one basis is
orthogonal to either member of the other. The bases are also as di¬erent as possible,
in the sense that | s |s | = 1/2 for s = h, v and s = h, v. Pairs of bases related in this
way are said to be mutually unbiased, and they are a feature of many quantum key
distribution schemes.

20.3.1 The BB84 protocol
We now consider the BB84 protocol, named after Bennett and Brassard and the year
they proposed the scheme (Bennett and Brassard, 1984). In the initial step, Alice sends
a string of photons to Bob. For each photon, she uses a random number generator to
choose a polarization from the four possibilities in B and B. At this stage, the only
restriction is that Bob and Alice must be able to establish a one“one correspondence
between the transmitted and received photons.
½ Quantum information

Bob, who is equipped with an independent random number generator, chooses one
of the basis sets, B or B, in which to measure each incoming photon. If Alice sends |h
or |v and Bob happens to choose B, his measurement will pick out the correct state,
and his bit assignment will exactly match the one Alice sent. If, on the other hand,
Bob chooses B, then a measurement on |h will yield h or |v with equal probability.
Thus if Alice sent 0, Bob will assign 1 half the time. Since Bob will make the wrong
choice of basis about half the time, his average error rate will be 25%. The bit string
resulting from this procedure is called the raw key.
An error rate of 25% would overwhelm any standard error correction scheme, but
the BB84 protocol provides another option. For each bit, Bob announces”through
the insecure public channel”his choice of measurement basis, but not the result of
his measurement. Alice replies by stating whether or not the encoding basis and the
measurement basis agree for that bit. If their bases agree, the bit is kept; otherwise,
it is discarded. The remaining bit string, which is about half the length of the raw
string, is called the sifted key.
The ¬rst experimental demonstration of this scheme was a table top experiment
in which the signals from Alice to Bob were carried by faint pulses of light containing
less than one photon on average (Bennett et al., 1992). The distance between sender
and receiver in this experiment was only 30 cm, but within a few years quantum key
distribution was demonstrated (Muller et al., 1995, 1996) over a distance of 23 km with
signals carried by a commercial optical ¬ber network.
In order to understand the quantum basis for the security of the BB84 protocol,
let us ¬rst imagine an alternative in which the bits are encoded in classical pulses of
polarized light. If Eve intercepts a particular pulse, so that it does not arrive at Bob™s
detector, then Alice and Bob can agree to discard that bit from the string. This lowers
the bit rate for transmitting the key, but Eve gains no information.
Thus it is not enough for Eve to detect the pulse; she must also make a copy
for herself and send the original on to Bob. This tactic would provide information
about the key without alerting Alice and Bob. In the classical case, this procedure
is”at least in principle”always possible. For example, Eve could split o¬ a small
part of each pulse by means of a strongly unbalanced beam splitter, and record the
polarization. The remaining pulse could then be ampli¬ed to match the original, and
sent on to Bob.
Eve faces the same problem for the quantum BB84 protocol. She must make a
copy of each single-photon state sent by Alice, and then send the original on to Bob.
Furthermore, she must be able to do this for photons described by either of the bases
B or B. Since the basis vectors in B are not orthogonal to the basis vectors in B, this
is precisely what the no-cloning theorem says cannot be done.
Furthermore, when Eve intercepts a signal and sends a new signal on to Bob,
she is bound”again according to the no-cloning theorem”to make a certain number
of errors on average. If she carries out this strategy too often, Alice and Bob will
become aware of her activity. According to this ideal description, the BB84 protocol
is invulnerable to attack.
In practice”as one might expect”things are more complicated. Transmission of
the key will be degraded by technical imperfections as well as Eve™s machinations. It
Entanglement as a quantum resource

is also possible for Eve to gain some knowledge of the key by means of the imperfect
cloning methods discussed in Section 20.2.2, without necessarily revealing her presence
to Alice and Bob. The techniques for countering such attacks are primarily classical
in nature (Gisin et al., 2002), so we will not pursue them further.
Thus the no-cloning theorem”which was originally introduced as a purely negative
statement about quantum theory”is the conceptual basis for the security of quantum
key distribution protocols. In this connection, it is important to realize that the classi-
cal proof of the absolute security of the one-time pad depends on the assumption that
the bits of K are truly random. For this reason, the choices made by Alice and Bob
must be equally random.
This turns out to be a rather delicate issue. The standard random number gen-
erators for computers are deterministic programs of ¬nite length; consequently, their
output cannot be truly random. The ultimate security of BB84, or any other quantum
key distribution protocol, therefore depends on generating a truly random sequence
of numbers by some physical means. The behavior of a single photon at a beam split-
ter provides a natural way to satisfy this need. A single photon incident on an ideal
balanced beam splitter with 100% detectors at each output port will”according to
quantum theory”generate a perfectly random sequence of ¬rings in the detectors.
Associating 0 with one detector and 1 with the other de¬nes a perfect coin ¬‚ip.
As always, reality is more complicated; for example, the dead time of real detectors
can impose a strong anti-correlation between successive bits. This e¬ect limits the bit
rate of quantum random number generation to a few megahertz (Gisin et al., 2002).
Leaving these practical issues aside, we see that the security of quantum key distribu-
tion is guaranteed by the perfectly random nature of individual quantum events. This
is a historically unique situation; the security of quantum cryptography ultimately
depends on the validity of quantum theory itself.

20.4 Entanglement as a quantum resource
The quantum e¬ects on communications studied in the previous sections are primarily
a source of di¬culties. The use of phase-sensitive ampli¬ers to eliminate the quantum
noise added by ampli¬cation, and the injection of squeezed light to minimize branching
noise at an optical coupler are responses to these di¬culties.
The role of the no-cloning theorem in providing a basis for the secure transmission
of a cryptographic key is usually presented in a positive light, but this is a partisan
view. For the frustrated Eve, the no-cloning theorem is still a negative result.
In these applications, quantum theory may provide new options, but it does not
provide any new resources. For example, the qubits used by Alice and Bob in the key
distribution protocol each carry only one classical bit, sometimes called a cbit.
It is the fundamental quantum property of entanglement that provides a novel
communications resource. In the present section, we will consider two examples, quan-
tum dense coding and quantum teleportation, which employ this resource. In both
cases the ancilla is an entangled qubit pair provided by an external source, and Alice
and Bob are each provided with one qubit of the pair. Local operations carried out
by Alice and Bob on their respective qubits change the entangled state in a nonlocal
way, and detection of these changes can be used to transfer information.
¾¼ Quantum information

Before considering the speci¬c applications, we must discuss some special features
arising from the use of photons to carry the qubits. The abstract language used above
implicitly assumes that the qubits are distinguishable quantum systems with de¬nite
locations. Since photons are indistinguishable bosons that cannot be precisely local-
ized, there appears to be a conceptual problem.
The ¬rst point to note is that the indistinguishability of photons renders state-
ments like ˜Bob carries out a local operation on his photon™ meaningless. The correct
statement is ˜Bob carries out a local operation on a photon.™ This brings us to the
second point: the word ˜local™ in ˜local operation™ applies to the hardware that realizes
the theoretical manipulation, not to the photon.
We made this remark for detectors in Section 6.6.2, but it applies equally to retarder
plates, beam splitters, etc. These classical devices”unlike photons”are both distin-
guishable and localizable. On the other hand, the physical operations they perform are
represented by unitary operators that apply to the entire state of the electromagnetic
¬eld. By virtue of the peculiar properties of entangled states, this means that local
operations can have nonlocal e¬ects.
In the experiments we will discuss, the photons in the pair are ideally described
by plane waves, with wavevectors kA (directed toward Alice) and kB (directed to-
ward Bob), and equal frequencies, ωA = ωB . An example is shown in Fig. 20.4. The
polarization-entangled, two-photon state emitted by the source is therefore a super-
position of the states |1kA s , 1kB s , where s, s = h, v.
We will only consider situations with ¬xed directions for the wavevectors, so the
shorthand notation

2 bits 2 bits

1 photon
(Bell BOB
state (encoder)

Fig. 20.4 Quantum dense coding: a source
1 photon k) 1 photon k*
of polarization-entangled photons provides a
communications resource. Bob™s local opera-
Source of
tions on a photon alter the nonlocal entangled polarization-
state, so that a single photon sent from Bob to entangled
Alice allows her to receive two bits of informa-
Entanglement as a quantum resource

≡ a† γ s a † γ |0 for (γ, s) = (γ , s ) ,
s γ , sγ k k s
|sγ , sγ ≡ √ a†2 s |0 ,

with γ, γ ∈ {A, B}, s, s ∈ {h, v}, is adequate.
A third point related to local operations is that these plane waves are idealizations
of Gaussian wave packets with ¬nite transverse widths. This means that the realistic
kA -mode is e¬ectively zero at Bob™s location, and the kB -mode is e¬ectively zero at
Alice™s location. The mathematical consequence is that Bob™s local manipulations are
represented by unitary operators that only act on the kB -mode, i.e. on the second
argument of the two-photon state |sA , sB . By the same token, Alice™s operations
only act on the ¬rst argument. This is formally similar to performing operations on
distinguishable qubits, but we emphasize that it is the modes that are distinguishable,
not the photons.

20.4.1 Quantum dense coding
The common currency for classical digital communication and computation is the bit,
i.e. the binary digits 0 and 1, which are physically represented by classical two-state
systems. For storage, e.g. in a magnetic storage device, 0 and 1 can be respectively
represented by a spin-down state (a downwards-pointing net magnetization), and a
spin-up state of a magnetic resolution element. For transmission, 0 and 1 are typically
represented by two resolvable voltages V0 and V1 .
In either case, the two states of a macroscopic system encode the binary choice
between 0 and 1; that is, one bit of information is carried by a classical two-state
system. Conversely, the one-to-one relation between the two states of the classical
system and the two logical states 0 and 1 assures us that a classical, two-state system
can carry at most one bit of information.
For a two-state quantum system the outcome is quite di¬erent. A surprising result
of quantum theory is that two bits of information can be transmitted by sending
a single qubit. This apparent doubling of the transmission rate is called quantum
dense coding.

A A generic model for quantum dense coding
A thought experiment (Bennett and Wiesner, 1992) to implement quantum dense
coding is sketched in Fig. 20.4. In this scenario, Bob has received two bits of classical
information through his input port IN, and he wants to communicate this news to
Alice. Since there are four possible two-bit messages, an encoding scheme with four al-
ternatives is needed. The resource Bob will use is the pair of entangled qubits provided
by the source.
Bob can carry out local operations to change the original two-qubit state into any
one of the four Bell states, chosen according to a prearranged mapping of the four
possible messages onto the four Bell states. Once this is done, Bob sends the qubit in
his apparatus to Alice, so that she has the entire entangled state at her disposal. Alice
then performs a Bell state measurement, i.e. an observation that determines which
¾¾ Quantum information

of the four Bell states describes the two-qubit state. By means of this measurement
Alice acquires the two bits of information sent by Bob.
The fact that Alice obtains the message after receiving the qubit sent by Bob
suggests that the two classical bits were somehow packed into this single qubit. This
is an essentially classical point of view that does not really ¬t the present case. Alice
receives two qubits, one from the original source of the entangled state and one sent
by Bob. The qubit from the original source may well have been sent long before Bob™s
actions, so it seems eminently reasonable to assume that it carries no information.
On the other hand, Bob™s qubit by itself also carries no information. For example,
if the ever resourceful Eve manages to intercept Bob™s qubit, she will learn absolutely
nothing. Furthermore, if Alice™s qubit from the source does not arrive, then she also
will learn nothing from receiving Bob™s qubit. This should make it clear that the
information is carried, nonlocally, by the entangled state itself.
The real advantage of this scheme is that Bob can send two bits with a single
operation. This is twice the rate possible for a classical channel; consequently, quantum
dense coding might better be called quantum rapid coding.

B Quantum dense coding with photons
In an experimental demonstration of quantum dense coding (Mattle et al., 1996), a
polarization-entangled, two-photon state is generated by means of down-conversion in
a type II crystal, as shown for example in Fig. 13.5. The two down-converted photons
have the same frequency, but di¬erent propagation directions, selected by means of
irises. The source is adjusted so that it emits the state
i 1
|˜ = √ |hA , vB + √ |vA , hB . (20.51)
2 2
Bob allows the input photon in the kB -mode to pass successively through a half-
wave and a quarter-wave retarder. These devices are reviewed in Exercise 20.8. The
experimentally adjustable parameter for each retarder is the angle ‘ between the
fast axis and the horizontal polarization vector eh . The unitary operations needed to
generate the four Bell states,
1 1
¦± ≡ √ |hA , hB ± √ |vA , vB , (20.52)
2 2
1 1
Ψ± ≡ √ |hA , vB ± √ |vA , hB , (20.53)
2 2
correspond to di¬erent settings of the retarder angles, ‘»/2 and ‘»/4 .
The source of entangled pairs has been arranged so that the emitted state |˜
scatters into the Bell state |Ψ+ , for the settings ‘»/2 = ‘»/4 = 0. Using the operations
discussed in Exercise 20.9, Bob encodes his two bits by choosing the two angles ‘»/2
and ‘»/4 , and then sends the photon to Alice. Bob™s local operations have changed the
entangled state, but Alice can only detect these changes by a Bell state measurement
that requires both photons.
This means that Alice cannot begin to decode the message before she receives the
photon sent by Bob, as well as the photon from the source. In common with all other
Entanglement as a quantum resource

communication schemes, the time required for transmission of information by quantum
dense coding is restricted by the speed of light.
The next step is for Alice to decode the message, which turns out to be quite
a bit more di¬cult than encoding it. Linear optical techniques are constrained by a
no-go theorem, which states that the four Bell states cannot be distinguished with a
probability greater than 50% (Calsamiglia and Lutkenhaus, 2001). Indeed, the Bell
state analysis used in the particular experiment discussed above could not distinguish
between the states |¦+ and |¦’ .
However, for entangled photon pairs produced by down-conversion, there is a way
around this prohibition. The proof of the no-go theorem involves the assumption that
the Bell states are not entangled in any degrees of freedom other than the polarization;
consequently, the no-go theorem can be circumvented by the use of hyperentangled
states (Kwiat and Weinfurter, 1998). The example discussed in Section 13.3.5”in
which the photons are entangled in both polarization and momentum”is one candi-
An alternative, and experimentally easier, scheme exploits the fact that down-
conversion automatically produces photon pairs that are entangled in both energy
and polarization. As we have seen in Section 13.3.2-B, energy entanglement implies
that the two photons are produced at essentially the same time.
This feature is the basis for a complete Bell state analysis. In addition to its intrinsic
interest, this scheme illustrates the application of various theoretical and experimental
techniques; therefore, we will discuss it in some detail. A schematic diagram illustrating
the idea for this measurement is shown in Fig. 20.5.
As one can see from Exercise 20.10, the Bell state |Ψ’ has the curious property
that it is unchanged by scattering from a balanced beam splitter, i.e. |Ψ’ = |Ψ’ .
This implies that the photons exhibit anti-pairing, i.e. one photon exits through each
of the two output ports. The other Bell states display the opposite behavior; whenever
|Ψ+ or |¦± are incident, the photons are paired, as discussed in Section 10.2.1. In
other words, both scattered photons are emitted through one or the other of the two
output ports.
This di¬erence allows |Ψ’ to be distinguished from the remaining Bell states:
when |Ψ’ is incident, detectors in the A and B arms of the apparatus will both ¬re
so that a coincidence count is registered. For the other Bell states, only the detectors
in one arm will ¬re, so there will be no coincidence counts between the two arms. This
e¬ect only depends on the behavior at the beam splitter, so it would work even if the
photons were not hyperentangled.

Fig. 20.5 Schematic of an experiment for a
) *4.- * complete Bell state analysis using hyperentan-
gled photons. (1) The beam splitter (BS) iden-
2*5 ¬ «
ti¬es ¬Ψ’ . (2)¬ The birefringent elements (BR-
*5 «
FEs) identify ¬Ψ+ . (3) The¬ polarizing ¬ beam
* *4.- ) « «

from ¬¦+ .
splitters (PBSs) distinguish ¬¦
(Adapted from Kwiat and Weinfurter (1998).)
¾ Quantum information

Next we turn to the task of distinguishing |Ψ+ from |¦± . This is accomplished
by means of the two birefringent elements, which have optic axes aligned along the h-
and v-polarizations. The two down-converted photons are emitted simultaneously in
matched wave packets with widths of the order of 15 fs, but the h- and v-components
experience di¬erent group velocities due to the di¬erence between the indices of re-
fraction for the two polarizations.
The resulting separation between the two wave packets means that the detections
of the two photons will also be separated in time. In principle, it is only necessary
to separate the two packets by an amount greater than their widths, but in practice
the delay must be larger than the resolution time”of the order of 1 ns”of the detec-
tors. The detection events for |¦± are expected to be simultaneous, since |¦± is a
superposition of states with pairs of photons having the same polarization.
The ¬nal task of separating |¦+ and |¦’ begins with the action of the beam
¦± ’ ¦± = √ {|hA , hA ± |vA , vA } + (A ” B) . (20.54)
Applying eqn (8.2) to each polarization produces the scattering matrix for a birefrin-
gent element of length L:
Sks,k s = eiφs δkk δss , (20.55)
where φs = ns (ω) L/c is the phase shift for the s-polarization. Propagation through
the birefringent elements therefore produces

ie2iφ0 iδ
¦± e |hA , hA ± e’iδ |vA , vA
√ + (A ” B) ,
= (20.56)
where φ0 = (φh + φv ) /2, and δ = φh ’ φv .
For both |¦+ and |¦’ two photons will strike a single detector, so the two
states are still not distinguished. The last trick is to send the light into a polarizing
beam splitter oriented along the 45—¦ -rotated basis B de¬ned in eqn (20.48). In Exercise
20.11, it is shown that expressing |¦± in the new basis yields

i 2iφ0
hA , hA + |v A , v A ’ + (A ” B) ,
¦+ = e cos δ 2i sin δ hA , v A

i 2iφ0
¦’ hA , hA + |v A , v A ’ + (A ” B) .
= e i sin δ 2 cos δ hA , v A

Coincidence counts between the detectors at the output ports of the PBS will arise
from hA , v A , but not from hA , hA and |v A , v A . Since the coe¬cients depend on
the phase di¬erence δ, the two outcomes”coincidence counts or counts in one detector
only”can be separated by choosing δ to achieve destructive interference for one of the
terms. For example, adjusting L so that

(nh ’ nv ) ω
δ= L = nπ (20.59)
Entanglement as a quantum resource

leads to the greatly simpli¬ed states

i 2iφ0 n
hA , hA + |v A , v A + (A ” B)
¦+ = e (’) (20.60)
¦’ = √ e2iφ0 (’)n+1 hA , v A + (A ” B) . (20.61)

In this case |¦’ produces coincidence counts between the h- and v-counters, while
|¦+ leads to two-photon counts in one or the other of the detectors.
The procedure outlined above constitutes a complete Bell measurement, but the
two photons must be hyperentangled. This Bell state analysis also makes substantial
demands on the photon counters. A demonstration experiment based on this scheme
has recently been carried out (Schuck et al., 2006). The result was that the four Bell
states could be identi¬ed with a probability in the range of 81%“89%. This is already
substantially greater than the 50% bound imposed by the no-go theorem for linear
optics, and further improvements of the experimental technique are to be expected.

20.4.2 Quantum teleportation
In quantum dense coding, the apparently arcane and counterintuitive property of
entanglement is precisely what allows Bob to transmit two classical bits of information
by means of local operations carried out on a single qubit. We next consider an even
more remarkable demonstration of the power of entanglement. In this scenario, Alice
has received a qubit in an unknown state |γ T ∈ HT ”where HT is the internal state
space of the qubit”and she wants to transmit this quantum information to Bob by
sending him two classical bits. This is the inverse of the quantum dense coding problem,
and the method used to accomplish this magic feat is called quantum teleportation
(Bennett et al., 1993).
If Alice were sent an unknown classical signal, she could simply make a copy and
send it to Bob, but the no-cloning theorem prohibits this action for an unknown
quantum signal. What, then, is Alice to do in the quantum case? Let us ¬rst consider
what can be done without the aid of any ancilla. In this situation, the only available
option is to measure the value of some observable OT = n · σT , where n is a unit


. 23
( 27)