small. However, it becomes a serious issue when utilizing

tion between two orthogonal polarization modes. This

photon pairs created by parametric downconversion.

effect is negligible in ¬bers, but can be signi¬cant in

For instance, sending photons of 70-nm bandwidth (as

components like phase modulators. In particular, some

used in our long-distance tests of Bell™s inequality; Tittel

integrated optics waveguides actually guide only one

et al., 1998) down 10 km of optical ¬bers leads to a tem-

mode and thus behave almost like polarizers (e.g., pro-

poral spread of around 500 ps (assuming photons cen-

ton exchange waveguides in LiNbO3 ). Polarization-

tered at 0 and a typical dispersion slope of

dependent losses are usually stable, but if connected to a

0.086 ps nm 2 km 1 ). However, this can be compen-

¬ber with some birefringence, the relation between the

sated for when using energy-time-entangled photons

polarization state and the loss may ¬‚uctuate, producing

(Franson, 1992; Steinberg et al., 1992a, 1992b, Larchuk

random outcomes (Elamari et al., 1998). Polarization-

et al., 1995). In contrast to polarization coding, in which

dependent loss cannot be described by a unitary opera-

frequency and the physical property used to implement

tor acting in the polarization state space (but it is of

the qubit are not conjugate variables, frequency and

course unitary in a larger space (Huttner, Gautier, et al.,

time (thus position) constitute a Fourier pair. The strict

1996). Thus it does not preserve the scalar product. In

energy anticorrelation of signal and idler photons en-

particular, it can turn nonorthogonal states into orthogo-

ables one to achieve a dispersion for one photon that is

nal ones, which can then be distinguished unambigu-

equal in magnitude but opposite in sign to that of the

ously (at the cost of some loss; Huttner, Gautier, et al.,

sister photon, thus corresponding to the same delay24

1996; Clarke et al., 2000). Note that this attenuation

(see Fig. 7). The effect of broadening of the two wave

could be used by Eve, especially to eavesdrop on the

packets then cancels out, and two simultaneously emit-

two-state protocol (Sec. II.D.1).

ted photons stay coincident. However, note that the ar-

Let us conclude this section on polarization effects in

rival time of the pair varies with respect to its emission

¬bers by mentioning that they can be passively compen-

time. The frequency anticorrelation also provides the

sated for, provided one uses a go-and-return con¬gura-

basis for avoiding a decrease in visibility due to different

tion, with Faraday mirrors, as described in Sec. IV.C.2.

wave packet broadening in the two arms of an interfer-

ometer. Since the choromatic dispersion properties of

optical ¬bers do not change with time”in contrast to

3. Chromatic dispersion effects in single-mode ¬bers

birefringence”no active tracking and compensation are

In addition to polarization effects, chromatic disper-

required. It thus turns out that phase and phase-time

sion can also cause problems for quantum cryptography.

coding are particularly suited to transmission over long

For instance, as explained in Secs. IV.C and V.B,

distances in optical ¬bers: nonlinear effects decohering

schemes implementing phase or phase-and-time coding

the qubit ˜˜energy™™ are completely negligible, and chro-

rely on photons arriving at well-de¬ned times, that is, on

matic dispersion effects acting on the localization can be

photons well localized in space. However, in dispersive

avoided or compensated for in many cases.

media like optical ¬bers, different group velocities act as

a noisy environment on the localization of the photon as

well as on the phase acquired in an interferometer.

Hence the broadening of photons featuring nonzero

bandwidth, or, in other words, the coupling between fre- 4. Free-space links

quency and position, must be circumvented or con-

Although today™s telecommunications based on opti-

trolled. This implies working with photons of small

cal ¬bers are very advanced, such channels may not al-

bandwidth, or, as long as the bandwidth is not too large,

ways be available. Hence there is also some effort in

operating close to the wavelength 0 at which chromatic

developing free-space line-of-sight communication sys-

dispersion is zero, i.e., for standard ¬bers around 1310

nm. Fortunately, ¬ber losses are relatively small at this

wavelength and amount to 0.35 dB/km. This region is

23

called the second telecommunications window.22 There Chromatic dispersion in ¬bers is mainly due to the material,

essentially silicon, but also to the refractive index pro¬le. In-

are also special ¬bers, called dispersion-shifted ¬bers,

deed, longer wavelengths feel regions farther away from the

with a refractive index pro¬le such that the chromatic

core where the refractive index is lower. Dispersion-shifted ¬-

bers have, however, been abandoned by today™s industry, be-

cause it has turned out to be simpler to compensate for the

22

The ¬rst one, around 800 nm, is almost no longer used. It global chromatic dispersion by adding an extra ¬ber with high

was motivated by the early existence of sources and detectors negative dispersion. The additional loss is then compensated

at this wavelength. The third window is around 1550 nm, for by an erbium-doped ¬ber ampli¬er.

24

where the attenuation reaches an absolute minimum (Thomas Here we assume a predominantly linear dependence of

et al., 2000) and where erbium-doped ¬bers provide conve- chromatic dispersion as a function of the optical frequency, a

nient ampli¬ers (Desurvire, 1994). realistic assumption.

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

161

Gisin et al.: Quantum cryptography

FIG. 7. Illustration of cancellation of chromatic dispersion ef-

FIG. 8. Transmission losses in free space as calculated using

fects in the ¬bers connecting an entangled-particle source and

the LOWTRAN code for earth-to-space transmission at the el-

two detectors. The ¬gure shows differential group delay curves

evation and location of Los Alamos, USA. Note that there is a

for two slightly different ¬bers approximately 10 km long. Us-

low-loss window at around 770 nm”a wavelength at which

ing frequency-correlated photons with central frequency

high-ef¬ciency silicon APD™s can be used for single-photon de-

0 ”determined by the properties of the ¬bers”the difference

tection (see also Fig. 9 and compare to Fig. 6). Figure courtesy

in propagation times t 2 t 1 between the signal (at s 1, s 2)

of Richard Hughes.

and idler (at i 1, i 2) photon is the same for all s , i . Note

that this cancellation scheme is not restricted to signal and

window of typically a few nanoseconds. Finally, it is clear

idler photons at nearly equal wavelengths. It also applies to

that the performance of free-space systems depends dra-

asymmetrical setups in which the signal photon (generating the

matically on atmospheric conditions and is possible only

trigger to indicate the presence of the idler photon) is at a

in clear weather.

short wavelength of around 800 nm and travels only a short

Finally, let us brie¬‚y comment on the different sources

distance. Using a ¬ber with appropriate zero dispersion wave-

leading to coupling losses. A ¬rst concern is the trans-

length 0 , it is still possible to achieve equal differential group

mission of the signals through a turbulent medium, lead-

delay with respect to the energy-correlated idler photon sent

ing to arrival-time jitter and beam wander (hence prob-

through a long ¬ber at a telecommunications wavelength.

lems with beam pointing). However, as the time scales

for atmospheric turbulences involved are rather small”

tems, not only for classical data transmission but also for around 0.1“0.01 s”the time jitter due to a variation of

quantum cryptography (see Hughes, Buttler, et al., 2000 the effective refractive index can be compensated for by

and Gorman et al., 2000). sending a reference pulse at a different wavelength a

Transmission over free space features some advan- short time (around 100 ns) before each signal pulse.

tages compared to the use of optical ¬bers. The atmo- Since this reference pulse experiences the same atmo-

sphere has a high transmission window at a wavelength spheric conditions as the subsequent one, the signal will

of around 770 nm (see Fig. 8), where photons can easily arrive essentially without jitter in the time window de-

¬ned by the arrival of the reference pulse. In addition,

be detected using commercial, high-ef¬ciency photon-

the reference pulse can be re¬‚ected back to the trans-

counting modules (see Sec. III.C.1). Furthermore, the

mitter and used to correct the direction of the laser

atmosphere is only weakly dispersive and essentially

nonbirefringent25 at these wavelengths. It will thus not beam by means of adaptive optics, hence compensating

for beam wander and ensuring good beam pointing.

alter the polarization state of a photon.

Another issue is beam divergence, hence increase of

However, there are some drawbacks concerning free-

spot size at the receiver end caused by diffraction at the

space links as well. In contrast to the signal transmitted

transmitter aperture. Using, for example, 20-cm-

in a guiding medium where the energy is ˜˜protected™™

diameter optics, one obtains a diffraction-limited spot

and remains localized in a small region of space, the

size after 300 km of 1 m. This effect can in principle be

energy transmitted via a free-space link spreads out,

kept small by taking advantage of larger optics. How-

leading to higher and varying transmission losses. In ad-

ever, it can also be advantageous to have a spot size that

dition to loss of energy, ambient daylight, or even moon-

is large compared to the receiver™s aperture in order to

light at night, can couple into the receiver, leading to a

ensure constant coupling in case of remaining beam

higher error rate. However, such errors can be kept to a wander. In their 2000 paper, Gilbert and Hamrick pro-

reasonable level by using a combination of spectral ¬l- vide a comprehensive discussion of free-space channels

tering (interference ¬lters 1 nm), spatial ¬ltering at the in the context of QC.

receiver, and timing discrimination using a coincidence

C. Single-photon detection

25 With the availability of pseudo-single-photon and

In contrast to an optical ¬ber, air is not subject to stress and

photon-pair sources, the success of quantum cryptogra-

is hence isotropic.

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

162 Gisin et al.: Quantum cryptography

on faint laser pulses, for which the arrival times of the

phy essentially depends on the ability to detect single

photons are well known. However, it only applies if

photons. In principle, this can be achieved using a vari-

prior timing information is available. For two-photon

ety of techniques, for instance, photomultipliers, ava-

schemes, it is most often combined with a passive-

lanche photodiodes, multichannel plates, and supercon-

quenched detector, generating the trigger signal for the

ducting Josephson junctions. The ideal detector should

gated detector.

ful¬ll the following requirements:

In addition to Geiger mode, Brown and Daniels

• the quantum detection ef¬ciency should be high

(1989) have investigated the performance of silicon

over a large spectral range,

APD™s operated in sub-Geiger mode. In this mode, the

• the probability of generating noise, that is, a signal

without an arriving photon, should be small, bias voltage is kept slightly smaller than the breakdown

• the time between detection of a photon and genera- voltage such that the multiplication factor”around

tion of an electrical signal should be as constant as pos- 100”is suf¬cient to detect an avalanche, yet, is still

sible, i.e., the time jitter should be small, to ensure good small enough to prevent real breakdowns. Unfortu-

timing resolution, nately, the single-photon counting performance in this

• the recovery time (i.e., the dead time) should be mode is rather poor, and thus efforts have not been con-

short to allow high data rates. tinued, the major problem being the need for extremely

low-noise ampli¬ers.

In addition, it is important to keep the detectors prac-

tical. For instance, a detector that needs liquid helium or An avalanche engendered by carriers created in the

even nitrogen cooling would certainly render commer- conduction band of the diode can be set off not only by

cial development dif¬cult. an impinging photon, but also by unwanted causes.

Unfortunately, it turns out that it is impossible to ful- These might be thermal or band-to-band tunneling pro-

¬ll all the above criteria at the same time. Today, the cesses, or emissions from trapping levels populated

best choice is avalanche photodiodes (APD™s). Three while a current transits through the diode. The ¬rst two

different semiconductor materials are used: either sili- produce avalanches not due to photons and are referred

con, germanium, or indium gallium arsenide, depending to as dark counts. The third process depends on previous

on the wavelengths. avalanches and its effects are called afterpulses. Since

APDs are usually operated in the so-called Geiger the number of trapped charges decreases exponentially

mode. In this mode, the applied voltage exceeds the

with time, these afterpulses can be limited by applying

breakdown voltage, leading an absorbed photon to trig-

large dead times. Thus there is a tradeoff between high

ger an electron avalanche consisting of thousands of car-

count rates and low afterpulses. The time constant of the

riers. To reset the diode, this macroscopic current must

exponential decrease of afterpulses shortens for higher

be quenched”the emission of charges must be stopped

temperatures of the diode. Unfortunately, operating

and the diode recharged (Cova et al., 1996). Three main

APD™s at higher temperatures leads to a higher fraction

possibilities exist:

of thermal noise, that is, higher dark counts. Thus there

• In passive-quenching circuits, a large (50“500 k ) is again a tradeoff to be optimized. Finally, increasing

resistor is connected in series with the APD (see, for the bias voltage leads to a higher quantum ef¬ciency and

example, Brown et al., 1986). This causes a decrease in a smaller time jitter, at the cost of an increase in noise.

the voltage across the APD as soon as an avalanche We thus see that the optimal operating parameters”

starts. When it drops below breakdown voltage, the ava- voltage, temperature, and dead time (i.e., maximum

lanche stops and the diode recharges. The recovery time count rate)”depend on the speci¬c application. More-

of the diode is given by its capacitance and by the value over, since the relative magnitudes of ef¬ciency, thermal

of the quench resistor. The maximum count rate varies noise, and afterpulses vary with the type of semiconduc-

from a few hundred kilohertz to a few megahertz. tor material used, no general solution exists. In the next

• In active-quenching circuits, the bias voltage is ac- two sections we brie¬‚y discuss the different types of

tively lowered below the breakdown voltage as soon as APD™s. The ¬rst section focuses on silicon APD™s for the

the leading edge of the avalanche current is detected detection of photons at wavelengths below 1 m; the

(see, for example, Brown et al., 1987). This mode makes second comments on germanium and on indium gallium

possible higher count rates than those in passive quench- arsenide APD™s for photon counting at telecommunica-

ing (up to tens of megahertz), since the dead time can be tions wavelengths. The different behavior of the three

as short as tens of nanoseconds. However, the fast elec- types is shown in Fig. 9. Although the best ¬gure of

tronic feedback system makes active-quenching circuits merit for quantum cryptography is the ratio of dark-

much more complicated than passive ones. count rate R to detection ef¬ciency , we show here the

• Finally, in gated-mode operation, the bias voltage is better-known noise equivalent power (NEP), which

kept below the breakdown voltage and is raised above it shows similar behavior. The noise equivalent power is

only for a short time, typically a few nanosecods when a de¬ned as the optical power required to measure a unity

photon is expected to arrive. Maximum count rates simi- signal-to-noise ratio and is given by

lar to those in active-quenching circuits can be obtained

h

using less complicated electronics. Gated-mode opera-

NEP 2R. (25)

tion is commonly used in quantum cryptography based

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

163

Gisin et al.: Quantum cryptography

ster (1993a) implemented a single-photon interference

scheme for quantum cryptography over a distance of 10

km, and in 1994, Tapster, Rarity, and Owens demon-

strated a violation of Bell™s inequalities over 4 km. These

experiments were the ¬rst to take advantage of Ge

APD™s operated in passively quenched Geiger mode. At

a temperature of 77 K, which can be achieved using ei-

ther liquid nitrogen or Stirling engine cooling, typical

quantum ef¬ciencies of about 15% at dark-count rates

of 25 kHz can be achieved (Owens et al., 1994), and time

jitter down to 100 ps has been observed (Lacaita et al.,

1994) a normal value being 200“300 ps.

Traditionally, germanium APD™s have been imple-

FIG. 9. Noise equivalent power as a function of wavelength for

mented in the domain of long-distance quantum com-

silicon, germanium, and InGaAs/InP APD™s.

munication. However, this type of diode is currently be-

ing replaced by InGaAs APD™s, and it has become more

Here, h is Planck™s constant and is the frequency of the and more dif¬cult to ¬nd germanium APD™s on the mar-

impinging photons. ket. Motivated by pioneering research reported in 1985

(Levine et al., 1985), the latest research focuses on

1. Photon counting at wavelengths below 1.1 m InGaAs APD™s, which allow single-photon detection in

both telecommunications windows. Starting with work

Since the beginning of the 1980s much work has been

by Zappa et al. (1994), InGaAs APD™s as single-photon

done to characterize silicon APD™s for single-photon

counters have meanwhile been thoroughly characterized

counting (Ingerson 1983; Brown et al., 1986, 1987;

(Lacaita et al., 1996; Ribordy et al., 1998; Karlsson et al.,

Brown and Daniels, 1989; Spinelli, 1996), and the perfor-

1999; Hiskett et al., 2000; Rarity et al., 2000; Stucki et al.,

mance of Si APD™s has continuously been improved.

2001), and the ¬rst implementations for quantum cryp-

Since the ¬rst test of Bell™s inequality using Si APD™s by

tography have been reported (Ribordy, 1998; Bouren-

Shih and Alley in 1988, they have completely replaced

nane et al., 1999; Bethune and Risk, 2000; Hughes, Mor-

the photomultipliers used until then in the domain of

gan, and Peterson, 2000; Ribordy et al., 2000). However,

fundamental quantum optics, now known as quantum

if operating Ge APD™s is already more inconvenient

communication. Today, quantum ef¬ciencies of up to

than using silicon APD™s, the practicality of InGaAs

76% (Kwiat et al., 1993) and time jitter as low as 28 ps

APD™s is even worse, the problem being an extremely

(Cova et al., 1989) have been reported. Commercial

high afterpulse fraction. Therefore operation in passive-

single-photon counting modules are available (for ex-

quenching mode is impossible for applications in which

ample, EG&G SPCM-AQ-151), featuring quantum ef¬-

low noise is crucial. In gated mode, InGaAs APD™s are

ciencies of 70% at a wavelength of 700 nm, a time jitter

better for single-photon counting at 1.3 m than Ge

of around 300 ps, and maximum count rates higher than

APD™s. For instance, at a temperature of 77 K and a

5 MHz. Temperatures of 20 °C”suf¬cient to keep

dark-count probability of 10 5 per 2.6-ns gate, quantum

thermally generated dark counts as low as 50 Hz”can

ef¬ciencies of around 30% and 17% have been reported

easily be achieved using Peltier cooling. Single-photon

for InGaAs and Ge APD™s, respectively (Ribordy et al.,

counters based on silicon APD™s thus offer an almost

1998), while the time jitter of both devices is compa-

perfect solution for all applications in which photons of

rable. If working at a wavelength of 1.55 m, the tem-

wavelengths below 1 m can be used. Apart from fun-

perature has to be increased for single-photon detection.

damental quantum optics, these applications include

At 173 K and a dark-count rate of 10 4 , a quantum

quantum cryptography in free space and in optical ¬-

ef¬ciency of 6% can still be observed using InGaAs/InP

bers; however, due to high losses, the latter works only

devices, while the same ¬gure for germanium APD™s is

over short distances.

close to zero.

To date, no industrial effort has been made to opti-

2. Photon counting at telecommunications wavelengths

mize APD™s operating at telecommunications wave-

lengths for photon counting, and their performance still

When working in the second telecommunications win-

lags far behind that one of silicon APD™s.26 However,

dow (1.3 m), one can take advantage of APD™s made

there is no fundamental reason why photon counting at

from germanium or InGaAs/InP semiconductor materi-

wavelengths above 1 m should be more dif¬cult than at

als. In the third window (1.55 m), the only option is

wavelengths below 1 m except that the high-

InGaAs/InP.

Photon counting with germanium APD™s, although

known for 30 years (Haecker et al., 1971), began to be

used in quantum communication as the need arose to 26

The ¬rst commercial photon counter at telecommunications

transmit single photons over long distances using optical wavelengths came out only this year (the Hamamatsu photo-

¬bers, which necessitated working at telecommunica- multiplier R5509-72). However, its ef¬ciency is not yet suf¬-

tions wavelengths. In 1993, Townsend, Rarity, and Tap- cient for use in quantum cryptography.

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

164 Gisin et al.: Quantum cryptography

An elegant con¬guration integrating the random-

wavelength photons are less energetic. The real reasons

number generator into the QC system consists in using a

for the lack of commercial products are, ¬rst, that sili-

passive choice of bases, as discussed in Sec. V (Muller

con, the most common semiconductor material, is not

et al., 1993). However, the problem of detector-induced

sensitive enough (the band gap is too large), and second

correlation remains.

that the market for photon counting is not yet mature.

But, without great risk, one can predict that good com-

mercial photon counters will become available in the

near future and that they will have a major impact on E. Quantum repeaters

quantum cryptography.

Today™s ¬ber-based QC systems are limited to opera-

tion over tens of kilometers due to the combination of

¬ber losses and detector noise. The losses by themselves

D. Quantum random-number generators

only reduce the bit rate (exponentially with distance).

With perfect detectors the distance would not be limited.

The key used in the one-time pad must be secret and

However, because of the dark counts, each time a pho-

used only once. Consequently it must be as long as the

ton is lost there is a chance that a dark count produces

message, and it must be perfectly random. The latter

an error. Hence, when the probability of a dark count

point proves to be a delicate and interesting one. Com-

becomes comparable to the probability that a photon is

puters are deterministic systems that cannot create truly

correctly detected, the signal-to-noise ratio tends to 0

random numbers. However, all secure cryptosystems,

[more precisely, the mutual information I( , ) tends to

both classical and quantum ones, require truly random

a lower bound29]. In this section we brie¬‚y explain how

numbers.27 Hence the random numbers must be created

the use of entangled photons and of entanglement swap-

by a random physical process. Moreover, to make sure ™

ping (Zukowski et al., 1993) could offer ways to extend

that the process does not merely appear random while

the achievable distances in the foreseeable future (some

having some hidden deterministic pattern, the process

prior knowledge of entanglement swapping is assumed).

needs to be completely understood. It is thus of interest

Let t link denote the transmission coef¬cient (i.e., the

to implement a simple process in order to gain con¬-

probability that a photon sent by Alice gets to one of

dence in the randomness of its proper operation.

Bob™s detectors), the detector ef¬ciency, and p dark the

A natural solution is to rely on the random choice of a

dark-count probability per time bin. With a perfect

single photon at a beamsplitter28 (Rarity et al., 1994). In

single-photon source, the probability P raw of a correct

this case the randomness is in principle guaranteed by

qubit detection is P raw t link , while the probability

the laws of quantum mechanics, though one still has to

P det of an error is P det (1 t link )p dark . Accordingly,

be very careful not to introduce any experimental arti-

the QBER P det /(P raw P det ), and the normalized net

fact that could correlate adjacent bits. Different experi-

rate is net (P raw P det )•fct(QBER), where the func-

mental realizations have been demonstrated (Jenne-

tion fct denotes the fraction of bits remaining after error

wein, Achleitner, et al., 2000; Stefanov et al., 2000;

correction and privacy ampli¬cation. For the sake of il-

Hildebrand, 2001), and prototypes are commercially

lustration, we simply assume a linear dependence drop-

available (www.gap-optique.unige.ch). One particular

ping to zero for QBER 15% (this simpli¬cation does

problem is the dead time of the detectors, which may

not affect the qualitative results of this section; for a

introduce a strong anticorrelation between neighboring

¨

more precise calculation, see Lutkenhaus 2000):

bits. Similarly, afterpulses may provoke a correlation.

fct(QBER) 1 QBER/15%. The corresponding net

These detector-related effects increase with higher pulse

rate net is displayed in Fig. 10. Note that it drops to zero

rates, limiting the bit rate of a quantum number genera-

near 90 km.

tor to a few megahertz.

Let us now assume that instead of a perfect single-

In the BB84 protocol Alice has to choose randomly

photon source, Alice and Bob use a perfect two-photon

among four different states and Bob between two bases.

source set in the middle of their quantum channel. Each

The limited random-number generation rate may force

photon then has a probability t link of reaching a detec-

Alice to produce her numbers in advance and store

tor. The probability of a correct joined detection is thus

them, creating a security risk. On Bob™s side the random-

P raw t link 2 , while an error occurs with probability

bit creation rate can be lower, since, in principle, the

2

t link ) 2 p dark 2 t link (1

P det (1 t link )p dark

basis need be changed only after a photon has been de-

(both photons lost and two dark counts, or one photon

tected, which normally happens at rates below 1 MHz.

lost and one dark count). This can be conveniently re-

However, one must make sure that this does not give a

1/n

written as P raw t link n and P det t link (1

spy an opportunity for a Trojan horse attack (see Sec.

1/n n n

t link )p dark t link , valid for any division of the

VI.K).

29

27

The absolute lower bound is 0, but depending on the as-

The PIN number that the bank assigns to your ATM card

sumed eavesdropping strategy, Eve could take advantage of

must be random. If not, someone else knows it.

28

the losses. In the latter case, the lower bound is given by her

Strictly speaking, the choice is made only once the photons

are detected at one of the outports. mutual information I( , ).

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

165

Gisin et al.: Quantum cryptography

ronment, also called decoherence, can be controlled and

moderated. In addition, researchers can bene¬t from all

the tools developed in the past two decades for optical

telecommunications. It is unlikely that other carriers will

be employed in the foreseeable future.

Comparing different QC setups is a dif¬cult task,

since several criteria must be taken into account. What

matters in the end, of course, is the rate of corrected

secret bits (the distilled bit rate R dist ) that can be trans-

mitted and the transmission distance. One can already

note that with present and near-future technology it will

probably not be possible to achieve rates of the order of

gigahertz, which are now common with conventional op-

FIG. 10. Normalized net key creation rate net as a function of

tical communication systems (in their comprehensive

distance in optical ¬bers. For n 1, Alice uses a perfect single-

paper published in 2000, Gilbert and Hamrick discuss

photon source. For n 1, the link is divided into n equal-length

practical methods for achieving high-bit-rate QC). This

sections, and n/2 two-photon sources are distributed between

implies that encryption with a key exchanged through

Alice and Bob. Parameters: detection ef¬ciency 10%,

QC will be limited to highly con¬dential information.

dark-count probability p dark 10 4 , and ¬ber attenuation

While the determination of the transmission distance

0.25 dB/km.

and rate of detection (the raw bit rate R raw ) is straight-

forward, estimating the net rate is rather dif¬cult. Al-

link into n equal-length sections and n detectors. Note though, in principle, errors in the bit sequence follow

that the measurements performed at the nodes between only from tampering by a malevolent eavesdropper, the

Alice and Bob transmit (swap) the entanglement to the situation is rather different in reality. Discrepancies be-

twin photons without revealing any information about tween the keys of Alice and Bob also happen because of

the qubit (these measurements are called Bell measure- experimental imperfections. The error rate QBER can

ments and are at the core of entanglement swapping and be easily determined. Similarly, the error correction pro-

of quantum teleportation). The corresponding net rates cedure is rather simple. Error correction leads to a re-

are displayed in Fig. 10. Clearly, the rates for short dis- duction of the key rate that depends strongly on the

tances are smaller when several detectors are used, be- QBER. The real problem is to estimate the information

cause of their limited ef¬ciencies (here we assume obtained by Eve, a quantity necessary for privacy ampli-

10%), but the distance before the net rate drops to ¬cation. This depends not only on the QBER, but also

zero is extended to longer distances! Intuitively, this can on other factors, such as the photon number statistics of

be understood as follows. Let us assume that a logical the source or the way the choice of the measurement

qubit propagates from Alice to Bob (although some basis is made. Moreover in a pragmatic approach, one

photons propagate in the opposite direction). Then, might also accept restrictions on Eve™s technology, limit-

each two-photon source and each Bell measurement acts ing her strategies and therefore also the information she

on this logical qubit as a kind of quantum nondemolition can obtain per error she introduces. Since the ef¬ciency

measurement, testing whether the logical qubit is still of privacy ampli¬cation rapidly decreases when the

there. In this way, Bob activates his detectors only when QBER increases, the distilled bit rate depends dramati-

1/n

there is a large chance t link that the photon gets to his cally on Eve™s information and hence on the assumptions

detectors. made. One can de¬ne as the maximum transmission dis-

Note that if in addition to detector noise there is noise tance the distance at which the distilled rate reaches

due to decoherence, then the above idea can be ex- zero. This distance can give one an idea of the dif¬culty

tended, using entanglement puri¬cation. This is essen- of evaluating a QC system from a physical point of view.

tially the idea behind quantum repeaters (Briegel et al., Technological aspects must also be taken into account.

1998; Dur et al., 1999). In this article we do not focus on all the published per-

formances (in particular not on the key rates), which

strongly depend on current technology and the ¬nancial

IV. EXPERIMENTAL QUANTUM CRYPTOGRAPHY WITH

resources of the research teams who carried out the ex-

FAINT LASER PULSES

periments. Rather, we try to weigh the intrinsic techno-

Experimental quantum key distribution was demon- logical dif¬culties associated with each setup and to an-

strated for the ¬rst time in 1989 (the results were pub- ticipate certain technological advances. Last but not

lished only in 1992 by Bennett, Bessette, et al.). Since least, the cost of realizing a prototype should also be

then, tremendous progress has been made. Today, sev- considered.

eral groups have shown that quantum key distribution is In this section, we ¬rst deduce a general formula for

possible, even outside the laboratory. In principle, any the QBER and consider its impact on the distilled rate.

two-level quantum system could be used to implement We then review faint-pulse implementations. We class

QC. In practice, all implementations have relied on pho- them according to the property used to encode the qu-

tons. The reason is that their interaction with the envi- bits value and follow a rough chronological order. Fi-

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

166 Gisin et al.: Quantum cryptography

1

nally, we assess the possibility of adopting the various of detectors. The two factors of 2 are related to the fact

setups for the realization of an industrial prototype. Sys- that a dark count has a 50% chance of happening when

tems based on entangled photon pairs are presented in Alice and Bob have chosen incompatible bases (and is

the next section. thus eliminated during sifting) and a 50% chance of oc-

curring in the correct detector.

Finally, error counts can arise from uncorrelated pho-

A. Quantum bit error rate

tons due to imperfect photon sources:

The QBER is de¬ned as the ratio of wrong bits to the 11

total number of bits received30 and is normally on the R acc p f t n. (30)

2 2 acc rep link

order of a few percent. We can express it as a function of

This factor appears only in systems based on entangled

rates,

photons, where the photons belonging to different pairs

N wrong R error R error but arriving in the same time window are not necessarily

QBER . (26)

N right N wrong R sift R error R sift in the same state. The quantity p acc is the probability of

¬nding a second pair within the time window, knowing

Here the sifted key corresponds to the cases in which

that a ¬rst one was created.32

Alice and Bob made compatible choices of bases, hence

The QBER can now be expressed as follows:

its rate is half that of the raw key.

The raw rate is essentially the product of the pulse R opt R det R acc

QBER (31)

rate f rep , the mean number of photons per pulse , the R sift

probability t link of a photons arriving at the analyzer,

p dark n p acc

and the probability of the photon™s being detected:

p opt (32)

t link 2q 2q

1 1

R sift R raw qf t . (27)

2 rep link

2 QBERopt QBERdet QBERacc . (33)

1

The factor q (q 1, typically 1 or 2 ) must be introduced We now analyze these three contributions. The ¬rst one,

for some phase-coding setups in order to correct for QBERopt , is independent of the transmission distance

noninterfering path combinations (see, for example, (it is independent of t link ). It can be considered as a

Secs. IV.C and V.B). measure of the optical quality of the setup, depending

One can identify three different contributions to only on the polarization or interference fringe contrast.

R error . The ¬rst arises from photons that end up in the The technical effort needed to obtain and, more impor-

wrong detector due to imperfect interference or polar- tantly, to maintain a given QBERopt is an important cri-

ization contrast. The rate R opt is given by the product of terion for evaluating different QC setups. In

the sifted-key rate and the probability p opt of a photon™s polarization-based systems, it is rather simple to achieve

going to the wrong detector: a polarization contrast of 100:1, corresponding to a

QBERopt of 1%. In ¬ber-based QC, the problem is to

1

maintain this value in spite of polarization ¬‚uctuations

R opt R sift p opt qf tp . (28)

2 rep link opt and depolarization in the ¬ber link. For phase-coding

setups, QBERopt and the interference visibility are re-

For a given setup, this contribution can be considered as

lated by

an intrinsic error rate indicating its suitability for use in

QC. We shall discuss it below in the case of each par- 1V

ticular system. QBERopt . (34)

2

The second contribution, R det , arises from the detec-

tor dark counts (or from remaining environmental stray A visibility of 98% thus translates into an optical error

light in free-space setups). This rate is independent of rate of 1%. Such a value implies the use of well-aligned

the bit rate.31 Of course, only dark counts falling within and stable interferometers. In bulk optics, perfect mode

the short time window when a photon is expected give overlap is dif¬cult to achieve, but the polarization is

rise to errors, stable. In single-mode ¬ber interferometers, on in con-

trast, perfect mode overlap is automatically achieved,

11

but the polarization must be controlled, and chromatic

R det fp n, (29)

2 2 rep dark dispersion can constitute a problem.

The second contribution, QBERdet , increases with

where p dark is the probability of registering a dark count

distance, since the dark-count rate remains constant

per time window and per detector, and n is the number

while the bit rate goes down like t link . It depends en-

30

In the following section we consider systems implementing

32

Note that a passive choice of measurement basis implies

the BB84 protocol. For other protocols, some of the formulas

that four detectors (or two detectors during two time windows)

have to be slightly adapted.

31

are activated for every pulse, thus leading to a doubling of R det

This is true provided that afterpulses (see Sec. III.C) do not

contribute to the dark counts. and R acc .

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

167

Gisin et al.: Quantum cryptography

FIG. 12. Typical system for quantum cryptography using po-

larization coding: LD, laser diode; BS, beamsplitter; F, neutral

density ¬lter; PBS, polarizing beamsplitter; /2, half wave-

FIG. 11. Bit rate, after error correction and privacy ampli¬ca- plate; APD, avalanche photodiode.

tion, vs ¬ber length. The chosen parameters are as follows:

pulse rates of 10 MHz for faint laser pulses ( 0.1) and 1

most evident when comparing the curves 1550 and 1550

MHz for the case of ideal single photons (1550-nm ˜˜single™™);

nm ˜˜single,™™ since the latter features a QBER that is 10

losses of 2, 0.35, and 0.25 dB/km; detector ef¬ciencies of 50, 20,

times lower. One can see that the maximum range is

and 10; dark-count probabilities of 10 7 , and 10 5 , and 10 5

about 100 km. In practice it is closer to 50 km, due to

for 800, 1300, and 1550 nm, respectively. Losses at Bob™s end

nonideal error correction and privacy ampli¬cation,

and QBERopt are neglected.

multiphoton pulses, and other optical losses not consid-

ered here. Finally, let us mention that typical key cre-

tirely on the ratio of the dark-count rate to the quantum

ation rates on the order of a thousand bits per second

ef¬ciency. At present, good single-photon detectors are

over distances of a few tens of kilometers have been

not commercially available for telecommunications

demonstrated experimentally (see, for example,

wavelengths. The span of QC is not limited by decoher-

Townsend, 1998b or Ribordy et al., 2000).

ence. As QBERopt is essentially independent of the ¬ber

length, it is detector noise that limits the transmission

distance. B. Polarization coding

Finally, the QBERacc contribution is present only in

Encoding the qubits in the polarization of photons is a

some two-photon schemes in which multiphoton pulses

natural solution. The ¬rst demonstration of QC by Ben-

are processed in such a way that they do not necessarily

nett and co-workers (Bennett, Bessette, et al., 1992)

encode the same bit value (see, for example, Secs. V.B.1

made use of this choice. They realized a system in which

and V.B.2). Although all systems have some probability

Alice and Bob exchanged faint light pulses produced by

of multiphoton pulses, in most these contribute only to

a light-emitting diode and containing less than one pho-

the information available to Eve (see Sec. VI.H) and not

ton on average over a distance of 30 cm in air. In spite of

to the QBER. However, for implementations featuring

the small scale of this experiment, it had an important

passive choice by each photon, the multiphoton pulses

impact on the community, as it showed that it was not

do not contribute to Eve™s information but only to the

unreasonable to use single photons instead of classical

error rate (see Sec. VI.J).

pulses for encoding bits.

Now, let us calculate the useful bit rate as a function

A typical QC system with the BB84 four-state proto-

of the distance. R sift and QBER are given as a function

col using the polarization of photons is shown in Fig. 12.

of t link in Eqs. (27) and (32), respectively. The ¬ber link

Alice™s system consists of four laser diodes. They emit

transmission decreases exponentially with length. The

short classical photon pulses ( 1 ns) polarized at 45°,

fraction of bits lost due to error correction and privacy

0°, 45°, and 90°. For a given qubit, a single diode is

ampli¬cation is a function of QBER and depends on

triggered. The pulses are then attenuated by a set of

Eve™s strategy. The number of remaining bits R net is

¬lters to reduce the average number of photons to well

given by the sifted-key rate multiplied by the difference

below 1, and sent along the quantum channel to Alice.

between the Alice-Bob mutual Shannon information

It is essential that the pulses remain polarized for Bob

I( , ) and Eve™s maximal Shannon information

I max( , ): to be able to extract the information encoded by Alice.

As discussed in Sec. III.B.2, polarization mode disper-

I max

R net R sift I , , . (35)

sion may depolarize the photons, provided the delay it

The difference between I( , ) and I max( , ) is calcu- introduces between polarization modes is longer than

the coherence time. This sets a constraint on the type of

lated here according to Eqs. (63) and (65) (Sec. VI.E),

lasers used by Alice.

considering only individual attacks and no multiphoton

Upon reaching Bob, the pulses are extracted from the

pulses. We obtain R net (the useful bit rate after error

¬ber. They travel through a set of waveplates used to

correction and privacy ampli¬cation) for different wave-

recover the initial polarization states by compensating

lengths as shown in Fig. 11. There is ¬rst an exponential

for the transformation induced by the optical ¬ber (Sec.

decrease, then, due to error correction and privacy am-

III.B.2). The pulses then reach a symmetric beamsplit-

pli¬cation, the bit rates fall rapidly down to zero. This is

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

168 Gisin et al.: Quantum cryptography

ter, implementing the basis choice. Transmitted photons

are analyzed in the vertical-horizontal basis with a po-

larizing beamsplitter and two photon-counting detec-

tors. The polarization state of the re¬‚ected photons is

¬rst rotated with a waveplate by 45° ( 45°’0°). The

photons are then analyzed with a second set of polariz-

ing beamsplitters and photon-counting detectors. This

implements the diagonal basis. For illustration, let us

follow a photon polarized at 45°. We see that its state

of polarization is arbitrarily transformed in the optical

¬ber. At Bob™s end, the polarization controller must be

set to bring it back to 45°. If it chooses the output of

the beamsplitter corresponding to the vertical-horizontal

basis, it will experience an equal probability of re¬‚ection

or transmission at the polarizing beamsplittter, yielding a

FIG. 13. Geneva and Lake Geneva. The Swisscom optical ¬-

random outcome. On the other hand, if it chooses the

ber cable used for quantum cryptography experiments runs

diagonal basis, its state will be rotated to 90°. The po-

under the lake between the town of Nyon, about 23 km north

larizing beamsplitter will then re¬‚ect it with unit prob-

of Geneva, and the center of the city.

ability, yielding a deterministic outcome.

Instead of having Alice use four lasers and Bob two

polarizing beamsplitters, one can also implement this dard ¬bers with polarization-maintaining ¬bers does not

system with active polarization modulators such as solve the problem. The reason is that, in spite of their

Pockels cells. For emission, the modulator is randomly name, these ¬bers do not maintain polarization, as ex-

activated for each pulse to rotate the state of polariza- plained in Sec. III.B.2.

tion to one of the four states, while, at the receiver, it Recently, Townsend has also investigated such

randomly rotates half of the incoming pulses by 45°. It is polarization-encoding systems for QC on short-span

also possible to realize the whole system with ¬ber op- links up to 10 kilometers (1998a, 1998b) with photons at

tics components. 800 nm. It is interesting to note that, although he used

Antoine Muller and co-workers at the University of standard telecommunications ¬bers which could support

Geneva have used such a system to perform QC experi- more than one spatial mode at this wavelength, he was

´

ments over optical ¬bers (1993; see also Breguet et al., able to ensure single-mode propagation by carefully

1994). They created a key over a distance of 1100 meters controlling the launching conditions. Because of the

with photons at 800 nm. In order to increase the trans- problem discussed above, polarization coding does not

mission distance, they repeated the experiment with seem to be the best choice for QC in optical ¬bers. Nev-

photons at 1300 nm (Muller et al., 1995, 1996) and cre- ertheless, this problem is drastically reduced when con-

ated a key over a distance of 23 km. An interesting fea- sidering free-space key exchange, as air has essentially

ture of this experiment is that the quantum channel con- no birefringence at all (see Sec. IV.E).

necting Alice and Bob consisted of an optical ¬ber part

of an installed cable used by the telecommunications

company Swisscom for carrying phone conversations. It

runs between the Swiss cities of Geneva and Nyon, un- C. Phase coding

der Lake Geneva (Fig. 13). This was the ¬rst time QC

was performed outside of a physics laboratory. These The idea of encoding the value of qubits in the phase

experiments had a strong impact on the interest of the of photons was ¬rst mentioned by Bennett in the paper

wider public in the new ¬eld of quantum communica- in which he introduced the two-state protocol (1992). It

tion. is indeed a very natural choice for optics specialists.

These two experiments highlighted the fact that the State preparation and analysis are then performed with

polarization transformation induced by a long optical ¬- interferometers, which can be realized with single-mode

ber was unstable over time. Indeed, when monitoring optical ¬ber components.

the QBER of their system, Muller noticed that, although Figure 14 presents an optical ¬ber version of a Mach-

it remained stable and low for some time (on the order Zehnder interferometer. It is made out of two symmetric

of several minutes), it would suddenly increase after a couplers”the equivalent of beamsplitters”connected

while, indicating a modi¬cation of the polarization trans- to each other, with one phase modulator in each arm.

formation in the ¬ber. This implies that a real ¬ber- One can inject light into the setup, using a continuous

based QC system would require active alignment to and classical source, and monitor the intensity at the

compensate for this evolution. Although not impossible, output ports. Provided that the coherence length of the

such a procedure is certainly dif¬cult. James Franson did light used is larger than the path mismatch in the inter-

indeed implement an active-feedback alignment system ferometers, interference fringes can be recorded. Taking

(Franson and Jacobs, 1995), but did not pursue this line into account the /2 phase shift experienced upon re-

of research. It is interesting to note that replacing stan- ¬‚ection at a beamsplitter, the effect of the phase modu-

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

169

Gisin et al.: Quantum cryptography

TABLE I. Implementation of the BB84 four-state protocol

with phase encoding.

Alice Bob

Bit value Bit value

A B A B

0 0 0 0 0

0 0 /2 3 /2 ?

1 0 1

1 /2 /2 ?

0 /2 0 /2 ?

FIG. 14. Conceptual interferometric setup for quantum cryp- 0 /2 /2 0 0

tography using an optical ¬ber Mach-Zehnder interferometer: 1 3 /2 0 3 /2 ?

LD, laser diode; PM, phase modulator; APD, avalanche pho- 1 3 /2 /2 1

todiode.

lators ( A and B ), and the path-length difference

Alice selected. When the phase difference equals /2 or

( L), the intensity in the output port labeled ˜˜0™™ is

3 /2, the bases are incompatible and the photon ran-

given by

domly chooses which port it takes at Bob™s coupler. This

kL scheme is summarized in Table I. We must stress that it

A B

I 0 ¯ • cos2

I , (36) is essential with this scheme to keep the path difference

2

stable during a key exchange session. It should not

where k is the wave number and ¯ the intensity of the

I change by more than a fraction of a wavelength of the

source. If the phase term is equal to /2 n , where n is photons. A drift of the length of one arm would indeed

an integer, destructive interference is obtained. There- change the phase relation between Alice and Bob and

fore the intensity registered in port 0 reaches a mini- induce errors in their bit sequence.

mum, and all the light exits from port 1. When the phase It is interesting to note that encoding qubits with two-

term is equal to n , the situation is reversed: construc- path interferometers is formally isomorphic to polariza-

tive interference is obtained in port 0, while the intensity tion encoding. The two arms correspond to a natural

in port 1 goes to a minimum. With intermediate phase basis, and the weights c j of each qubit state

settings, light can be recorded in both ports. This device (c 1 e i /2,c 2 e i /2) are determined by the coupling ratio

acts like an optical switch. It is essential to keep the path of the ¬rst beamsplitter, while the relative phase is

difference stable in order to record stationary interfer- ´

introduced in the interferometer. The Poincare sphere

ences. representation, which applies to all two-level quantum

Although we have discussed the behavior of this inter- systems, can also be used to represent phase-coding

ferometer for classical light, it works exactly the same states. In this case, the azimuth angle represents the

when a single photon is injected. The probability of de- relative phase between the light that has propagated

tecting the photon in one output port can be varied by along the two arms. The elevation corresponds to the

changing the phase. It is the ¬ber optic version of coupling ratio of the ¬rst beamsplitter. States produced

Young™s double-slit experiment, in which the arms of the by a switch are on the poles, while those resulting from

interferometer replace the apertures. the use of a 50/50 beamsplitter lie on the equator. Figure

This interferometer combined with a single-photon 15 illustrates this analogy. Consequently, all polarization

source and photon-counting detectors can be used for schemes can also be implemented using phase coding.

QC. Alice™s setup consists of the source, the ¬rst coupler,

and the ¬rst phase modulator, while Bob takes the sec-

ond modulator and coupler, as well as the detectors. Let

us consider the implementation of the four-state BB84

protocol. On the one hand, Alice can apply one of four

phase shifts (0, /2, ,3 /2) to encode a bit value. She

associates 0 and /2 with bit 0, and and 3 /2 with bit

1. On the other hand, Bob performs a basis choice by

randomly applying a phase shift of either 0 or /2. He

associates the detector connected to the output port 0

with a bit value of 0, and the detector connected to port

1 with bit 1. When the difference of their phase is equal

to 0 or , Alice and Bob are using compatible bases and ´

FIG. 15. Poincare sphere representation of two-level quantum

they obtain deterministic results. In such cases, Alice states generated by two-path interferometers. The poles corre-

can infer from the phase shift she applied the output spond to the states generated by an interferometer in which

port chosen by the photon at Bob™s end and hence the the ¬rst coupler is replaced by a switch. The states generated

bit value he registered. Bob, on his side, deduces from with a symmetrical beamsplitter are on the equator. The azi-

the output port chosen by the photon the phase that muth indicates the phase between the two paths.

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

170 Gisin et al.: Quantum cryptography

tally sensitive part of the system, provided that the

variations in the ¬ber are slower than their temporal

separations, determined by the interferometer™s imbal-

ance ( 5 ns). This condition is much less dif¬cult to

ful¬ll. In order to obtain good fringe visibility, and hence

a low error rate, the imbalances of the interferometers

must be equal to within a fraction of the coherence time

of the photons. This implies that the path differences

FIG. 16. Double Mach-Zehnder implementation of an inter- must be matched to within a few millimeters, which does

ferometric system for quantum cryptography: LD, laser diode; not constitute a problem. The imbalance must be chosen

PM, phase modulator; APD, avalanche photodiode. The inset so that it is possible to distinguish the three temporal

represents the temporal count distribution recorded as a func-

peaks clearly and thus discriminate interfering from

tion of the time passed since the emission of the pulse by Al-

noninterfering events. It must typically be larger than

ice. Interference is observed in the central peak.

the pulse length and the timing jitter of the photon-

counting detectors. In practice, the second condition is

Similarly, every coding using two-path interferometers the more stringent one. Assuming a time jitter of the

can be realized using polarization. However, in practice order of 500 ps, an imbalance of at least 1.5 ns keeps

one choice is often more convenient than the other, de- the overlap between the peaks low.

pending on circumstances like the nature of the quan- The main dif¬culty associated with this QC scheme is

tum channel.33 that the imbalances of Alice™s and Bob™s interferometers

must be kept stable to within a fraction of the wave-

length of the photons during a key exchange to maintain

1. The double Mach-Zehnder implementation

correct phase relations. This implies that the interferom-

Although the scheme presented in the previous sec- eters must lie in containers whose temperature is stabi-

tion works perfectly well on an optical table, it is impos- lized. In addition, for long key exchanges an active sys-

sible to keep the path difference stable when Alice and tem is necessary to compensate for drift.34 Finally, in

Bob are separated by more than a few meters. As men- order to ensure the indistinguishability of both interfer-

tioned above, the relative length of the arms should not ing processes, one must make sure that in each interfer-

change by more than a fraction of a wavelength. If Alice ometer the polarization transformation induced by the

and Bob are separated by 1 kilometer, for example, it is short path is the same as that induced by the long path.

clearly impossible to prevent path difference changes Both Alice and Bob must then use a polarization con-

smaller than 1 m caused by environmental variations. troller to ful¬ll this condition. However, the polarization

In his 1992 letter, Bennett also showed how to circum- transformation is rather stable in short optical ¬bers

vent this problem. He suggested using two unbalanced whose temperature is kept stable and which do not ex-

Mach-Zehnder interferometers, one for Alice and one perience strains. Thus this adjustment does not need to

for Bob, connected in series by a single optical ¬ber (see be repeated frequently.

Fig. 16). When monitoring counts as a function of the Paul Tapster and John Rarity of DERA, the Defence

time since the emission of the photons, Bob obtains Evalution and Research Agency (Malvern, England),

three peaks (see the inset in Fig. 16). The ¬rst one cor- working with Paul Townsend, were the ¬rst to test this

responds to the photons that chose the short path in system over a ¬ber optic spool of 10 km (Townsend

both Alice™s and Bob™s interferometers, while the last et al., 1993a, 1993b). Townsend later improved the inter-

one corresponds to photons that chose both the long ferometer by replacing Bob™s input coupler with a polar-

paths. Finally, the central peak corresponds to photons ization splitter to suppress the lateral noninterfering

that chose the short path in Alice™s interferometer and peaks (1994). In this case, it is again unfortunately nec-

the long one in Bob™s, and vice versa. If these two pro- essary to align the polarization state of the photons at

cesses are indistinguishable, they produce interference. Bob™s end, in addition to stabilizing the imbalance in the

A timing window can be used to discriminate between interferometers. He later thoroughly investigated key

interfering and noninterfering events. If the latter are exchange with phase coding and improved the transmis-

disregarded, it is then possible for Alice and Bob to ex- sion distance (Marand and Townsend, 1995; Townsend,

change a key. 1998b). He also tested the possibility of multiplexing a

The advantage of this setup is that both ˜˜halves™™ of

the photon travel in the same optical ¬ber. They thus

experience the same optical length in the environmen- 34

Polarization coding requires the optimization of three pa-

rameters (three parameters are necessary for unitary polariza-

tion control). In comparison, phase coding requires optimiza-

33

Note, in addition, that using many-path interferometers tion of only one parameter. This is possible because the

opens up the possibility of coding quantum systems of dimen- coupling ratios of the beamsplitters are ¬xed. Both solutions

sions larger than 2, like qutrits, ququarts, etc. (Bechmann- would be equivalent if one could limit the polarization evolu-

Pasquinucci and Peres, 2000; Bechmann-Pasquinucci and Tit- tion to rotations of the elliptic states without changes in the

tel, 2000; Bourennane, Karlsson, and Bjorn, 2001). ellipticity.

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

171

Gisin et al.: Quantum cryptography

quantum channel using two different wavelengths with

conventional data transmission over a single optical ¬ber

(Townsend, 1997a). Richard Hughes and co-workers

from Los Alamos National Laboratory have also exten-

sively tested such an interferometer (1996; Hughes, Mor-

gan, and Peterson, 2000) up to distances of 48 km of

installed optical ¬ber.35

2. ˜˜Plug-and-play™™ systems

As discussed in the two previous sections, both polar-

ization and phase coding require active compensation of

FIG. 17. Evolution of the polarization state of a light pulse

optical path ¬‚uctuations. A simple approach would be to

´

represented on the Poincare sphere over a round-trip propa-

alternate between adjustment periods”when pulses

gation along an optical ¬ber terminated by a Faraday mirror.

containing large numbers of photons are exchanged be-

tween Alice and Bob to adjust the compensating system

correcting for slow drifts in phase or polarization”and symmetry through the equatorial plane: the north and

qubits transmission periods, when the number of pho- m ’(m 1 ,m 2 ,

south hemispheres are exchanged

tons is reduced to a quantum level. m 3 ) , or in terms of the qubit state vector,

An approach invented in 1989 by Martinelli, then at

*

CISE Tecnologie Innovative in Milano, allows one to 1 2

’

T:

*. (37)

automatically and passively compensate for all polariza- 2 1

tion ¬‚uctuations in an optical ¬ber (see also Martinelli,

This is a simple representation, but some attention has

1992). Let us ¬rst consider what happens to the polar-

to be paid. This transformation is not unitary. Indeed,

ization state of a light pulse traveling through an optical

the above description switches from a right-handed ref-

¬ber, before being re¬‚ected by a Faraday mirror”a mir-

˜

ror with a /4 Faraday rotator36 in front. We must ¬rst erence frame XYZ to a left-handed one XYZ , where

˜

de¬ne a convenient description of the change in polar- Z Z. There is nothing wrong in doing this, and this

explains the nonunitary polarization transformation.37

ization of light re¬‚ected by a mirror at normal incidence.

Let the mirror be in the x-y plane and z be the optical Note that other descriptions are possible, but they re-

axis. Clearly, all linear polarization states are unchanged quire arti¬cially breaking the XY symmetry. The main

by a re¬‚ection. However, right-handed circular polariza- reason for choosing this particular transformation is that

tion is changed into left-handed and vice versa. Actually, the description of the polarization evolution in the opti-

after a re¬‚ection the rotation continues in the same cal ¬ber before and after the re¬‚ection is then straight-

sense, but since the propagation direction is reversed, forward. Indeed, let U e i B l /2 describe this evolu-

right-handed and left-handed polarizations are swapped.

tion under the effect of some modal birefringence B in a

The same holds for elliptic polarization states: the axes

¬ber section of length l (where is the vector whose

of the ellipse are unchanged, but right and left are ex-

components are the Pauli matrices). Then the evolution

´

changed. Accordingly, on a Poincare sphere the polar-

after re¬‚ection is simply described by the inverse opera-

ization transformation upon re¬‚ection is described by a

tor U 1 e i B l /2. Now that we have a description of

the mirror, let us add the Faraday rotator. It produces a

´

/2 rotation of the Poincare sphere around the north-

35

Note that in this experiment, Hughes and co-workers used i z /4 (see Fig. 17). Because the Fara-

south axis: F e

an unusually high mean number of photons per pulse. They

day effect is nonreciprocal (remember that it is due to a

used a mean photon number of approximately 0.6 in the cen-

magnetic ¬eld, which can be thought of as produced by a

tral interference peak, corresponding to a 1.2 in the pulses

spiraling electric current), the direction of rotation

leaving Alice. The latter value is the relevant one for eaves-

around the north-south axis is independent of the light

dropping analysis, since Eve could use an interferometer”

propagation direction. Accordingly, after re¬‚ection on

conceivable with present technology”in which the ¬rst cou-

pler was replaced by an optical switch and that allowed her to the mirror, the second passage through the Faraday ro-

exploit all the photons sent by Alice. In light of this high and tator rotates the polarization in the same direction (see

optical losses (22.8 dB), one may argue that this implementa- again Fig. 17) and is described by the same operator F.

tion was not secure, even when taking into account only so- Consequently, the total effect of a Faraday mirror is to

called realistic eavesdropping strategies (see Sec. VI.I). Finally,

it is possible to estimate the results that other groups would

have obtained if they had used a similar value of . One then

37

¬nds that key distribution distances of the same order could Note that this transformation is positive, but not completely

have been achieved. This illustrates that the distance is a some- positive. It is thus closely connected to the partial transposition

what arbitrary ¬gure of merit for a QC system. map (Peres, 1996). If several photons are entangled, then it is

36

These commercially available components are extremely crucial to describe all of them in frames with the same chirality.

compact and convenient when using telecommunications Actually that this is necessary is the content of the Peres-

wavelengths, which is not true for other wavelengths. Horodecki entanglement witness (Horodecki et al., 1996).

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

172 Gisin et al.: Quantum cryptography

change any incoming polarization state into its orthogo-

nal state: m ’ m . This is best seen in Fig. 17 but can

also be expressed mathematically:

*

1 2

’

FTF:

*. (38)

2 1

FIG. 18. Self-aligned plug-and-play system: LD, laser diode;

Finally, the whole optical ¬ber can be modeled as con-

APD, avalanche photodiode; Ci , ¬ber coupler; PMj , phase

sisting of a discrete number of birefringent elements. If

modulator; PBS, polarizing beamsplitter; DL, optical delay

there are N such elements in front of the Faraday mir-

line; FM, Faraday mirror; DA , classical detector.

ror, the change in polarization during a round trip can be

expressed (recall that the operator FTF only changes

realization of this scheme in greater detail: A short and

the sign of the corresponding Bloch vector m )

bright laser pulse is injected into the system through a

as

circulator. It splits at a coupler. One of the half pulses,

U 1 1 ¯ U N 1 FTFU N ¯ U 1 FTF. (39)

labeled P 1 , propagates through the short arm of Bob™s

setup directly to a polarizing beamsplitter. The polariza-

The output polarization state is thus orthogonal to the

tion transformation in this arm is set so that it is fully

input one, regardless of any birefringence in the ¬bers.

transmitted. P 1 is then sent through the ¬ber optic link.

This approach can thus correct for time-varying birefrin-

The second half pulse, labeled P 2 , takes the long arm to

gence changes, provided that they are slow compared to

the polarizing beamsplitter. The polarization evolution is

the time required for the light to make a round trip (a

such that P 2 is re¬‚ected. A phase modulator present in

few hundred microseconds).

this long arm is left inactive so that it imparts no phase

By combining this approach with time multiplexing in

shift to the outgoing pulse. P 2 is also sent through the

a long-path interferometer, it is possible to implement a

link, with a delay on the order of 200 ns. Both half

quantum cryptography system based on phase coding in

pulses travel to Alice. P 1 goes through a coupler. The

which all optical and mechanical ¬‚uctuations are auto-

diverted light is detected with a classical detector to pro-

matically and passively compensated for (Muller et al.,

vide a timing signal. This detector is also important in

1997). We performed the ¬rst experiment on such a sys-

preventing so-called Trojan horse attacks, which are dis-

tem in early 1997 (Zbinden et al., 1997), and a key was

cussed in Sec. VI.K. The nondiverted light then propa-

exchanged over a 23-km installed optical ¬ber cable (the

gates through an attenuator and an optical delay line”

same one as was used in the polarization coding experi-

consisting simply of an optical ¬ber spool”whose role

ments mentioned above). This setup featured a high in-

will be explained later. Finally, it passes a phase modu-

terference contrast (fringe visibility of 99.8%) and excel-

lator before being re¬‚ected by the Faraday mirror. P 2

lent long-term stability and clearly established the value

follows the same path. Alice brie¬‚y activates her modu-

of the approach for QC. The fact that no optical adjust-

lator to apply a phase shift on P 1 only, in order to en-

ments were necessary earned it the nickname of ˜˜plug-

code a bit value exactly as in the traditional phase-

and-play™™ setup. It is interesting to note that the idea of

coding scheme. The attenuator is set so that when the

combining time multiplexing with Faraday mirrors was

pulses leave Alice, they contain no more than a fraction

¬rst used to implement an ˜˜optical microphone™™

(Breguet and Gisin, 1995).38

´ of a photon. When they reach the polarizing beamsplit-

ter after their return trip through the link, the polariza-

However, our ¬rst realization still suffered from cer-

tion state of the pulses is exactly orthogonal to what it

tain optical inef¬ciencies, and it has been improved since

was when they left, thanks to the effect of the Faraday

then. Like the setup tested in 1997, the new system is

mirror. P 1 is then re¬‚ected instead of being transmitted.

based on time multiplexing, in which the interfering

It takes the long arm to the coupler. When it passes, Bob

pulses travel along the same optical path, but now, in

activates his modulator to apply a phase shift used to

different time ordering. A schematic is shown in Fig. 18.

implement his basis choice. Similarly, P 2 is transmitted

Brie¬‚y, the general idea is that pulses emitted at Bob™s

and takes the short arm. Both pulses reach the coupler

end can travel along one of two paths: they can go via

at the same time and they interfere. Single-photon de-

the short arm, be re¬‚ected at the Faraday mirror (FM)

tectors are then used to record the output port chosen

at Alice™s end, and ¬nally, back at Bob™s, setup travel via

by the photon.

the long arm. Or, they travel ¬rst via the long arm at

We implemented the four full-state BB84 protocol

Bob™s end, get re¬‚ected at Alice™s end, and return via the

with this setup. The system was tested once again on the

short arm of Bob™s setup. These two possibilities then

same installed optical ¬ber cable linking Geneva and

superpose on beamsplitter C 1 . We shall now explain the

Nyon (23 km; see Fig. 13) at 1300 nm, and we observed

a very low QBERopt 1.4% (Ribordy et al., 1998, 2000).

Proprietary electronics and software were developed to

38

Note that since then, we have used this interferometer for

allow for fully automated and user-friendly operation of

various other applications: a nonlinear index-of-refraction

the system. Because of the intrinsically bidirectional na-

measurement in ¬bers (Vinegoni, Wegmuller, and Gisin, 2000)

ture of this system, great attention had to be paid to

and an optical switch (Vinegoni, Wegmuller, Huttner, and Gi-

Rayleigh backscattering. Light traveling in an optical ¬-

sin, 2000).

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

173

Gisin et al.: Quantum cryptography

ber undergoes scattering by inhomogeneities. A small

fraction ( 1%) of this light is recaptured by the ¬ber in

the backward direction. When the repetition rate is high

enough, pulses traveling to and from Alice must inter-

sect at some point along the line. Their intensity, how-

ever, is strongly different. The pulses are more than a

thousand times brighter before than after re¬‚ection

from Alice. Backscattered photons can accompany a FIG. 19. Implementation of sideband modulation: LD, laser

quantum pulse propagating back to Bob and induce diode; A, attenuator; PMi , optical phase modulator; j , elec-

false counts. We avoided this problem by making sure tronic phase controller; RFOk , radio frequency oscillator; FP,

that pulses traveling to and from Bob are not present in Fabry-Perot ¬lter; APD, avalanche photodiode.

the line simultaneously. They are emitted by Bob in the

form of trains. Alice stores these trains in her optical of optical waves (approximately 200 THz at 1550 nm),

delay line, which consists of an optical ¬ber spool. Bob this condition is dif¬cult to ful¬ll. One solution is to use

waits until all the pulses of a train have reached him self-aligned systems like the plug-and-play setups dis-

before sending the next one. Although it completely cussed in the previous section. Goedgebuer and his team

solves the problem of Rayleigh backscattering-induced from the University of Besancon, in France, introduced

¸

errors, this con¬guration has the disadvantage of reduc- an alternative solution (Sun et al., 1995; Mazurenko

ing the effective repetition frequency. A storage line half ´

et al., 1997; Merolla et al., 1999; see also Molotkov,

as long as the transmission line amounts to a reduction 1998). Note that the title of this section is not completely

of the bit rate by a factor of approximately 3. accurate, since the value of the qubits is coded not in the

Researchers at IBM simultaneously and indepen- frequency of the light, but in the relative phase between

dently developed a similar system at 1300 nm (Bethune sidebands of a central optical frequency.

and Risk, 2000). However, they avoided the problems Their system is depicted in Fig. 19. A source emits

associated with Rayleigh backscattering by reducing the short pulses of classical monochromatic light with angu-

intensity of the pulses emitted by Bob. Since these could lar frequency S . A ¬rst phase modulator PMA modu-

not be used for synchronization purposes any longer, lates the phase of this beam with a frequency S and

they added a wavelength-multiplexed classical channel a small modulation depth. Two sidebands are thus gen-

(1550 nm) in the line to allow Bob and Alice to synchro- erated at frequencies S . The phase modulator is

nize their systems. They tested their setup on a 10-km driven by a radio-frequency oscillator RFOA whose

optical ¬ber spool. Both of these systems are equivalent phase A can be varied. Finally, the beam is attenuated

and exhibit similar performances. In addition, the group so that the sidebands contain much less than one photon

of Anders Karlsson at the Royal Institute of Technology per pulse, while the central peak remains classical. After

in Stockholm veri¬ed in 1999 that this technique also the transmission link, the beam experiences a second

works at a wavelength of 1550 nm (Bourennane et al., phase modulation applied by PMB . This phase modula-

1999, 2000). These experiments demonstrate the poten- tor is driven by a second radio-frequency oscillator

tial of plug-and-play-like systems for real-world quan- RFOB with the same frequency and phase B . These

tum key distribution. They certainly constitute a good oscillators must be synchronized. After passing through

candidate for the realization of prototypes. this device, the beam contains the original central fre-

Their main disadvantage with respect to the other sys- quency S , the sidebands created by Alice, and the

tems discussed in this section is that they are more sen- sidebands created by Bob. The sidebands at frequencies

sitive to Trojan horse strategies (see Sec. VI.K). Indeed, are mutually coherent and thus yield interfer-

S

Eve could send a probe beam and recover it through the ence. Bob can then record the interference pattern in

strong re¬‚ection by the mirror at the end of Alice™s sys- these sidebands after removal of the central frequency

tem. To prevent such an attack, Alice adds an attenuator and the higher-order sidebands with a spectral ¬lter.

to reduce the amount of light propagating through her To implement the B92 protocol (see Sec. II.D.1), Al-

system. In addition, she must monitor the incoming in- ice randomly chooses the value of the phase A for

tensity using a classical linear detector. Systems based on each pulse. She associates a bit value of 0 with phase 0

this approach cannot be operated with a true single- and a bit value of 1 with phase . Bob also randomly

photon source and thus will not bene¬t from the chooses whether to apply a phase B of 0 or . One can

progress in this ¬eld.39 see that if A 0, the interference is constructive

B

and Bob™s single-photon detector has a nonzero prob-

D. Frequency coding ability of recording a count. This probability depends on

the number of photons initially present in the sideband,

Phase-based systems for QC require phase synchroni- as well as on the losses induced by the channel. On the

zation and stabilization. Because of the high frequency other hand, if A , interference is destructive,

B

and no count will ever be recorded. Consequently, Bob

can infer, every time he records a count, that he applied

39 the same phase as Alice. When a given pulse does not

The fact that the pulses make a round trip implies that

yield a detection, the reason can be that the phases ap-

losses are doubled, yielding a reduced counting rate.

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

174 Gisin et al.: Quantum cryptography

plied were different and destructive interference took and-play systems. In addition, if this system is to be truly

independent of polarization, it is essential to ensure that

place. It can also mean that the phases were actually

the phase modulators have very low polarization depen-

equal, but the pulse was empty or the photon got lost.

dency. In addition, the stability of the frequency ¬lter

Bob cannot decide between these two possibilities.

may constitute a practical dif¬culty.

From a conceptual point of view, Alice sends one of two

nonorthogonal states. There is then no way for Bob to

distinguish between them deterministically. However, he

can perform a generalized measurement, also known as E. Free-space line-of-sight applications

a positive operator value measurement, which will some-

Since optical ¬ber channels may not always be avail-

times fail to give an answer, but at all other times gives

able, several groups are trying to develop free-space

the correct one.

line-of-sight QC systems capable, for example, of dis-

Eve could perform the same measurement as Bob.

tributing a key between building rooftops in an urban

When she obtains an inconclusive result, she could just

setting.

block both the sideband and the central frequency so

Of course it may sound dif¬cult to detect single pho-

that she does not have to guess a value and does not risk

tons amidst background light, but the ¬rst experiments

introducing an error. To prevent her from doing that,

have already demonstrated the feasibility of free-space

Bob veri¬es the presence of this central frequency. Now

QC. Sending photons through the atmosphere also has

if Eve tries to conceal her presence by blocking only the

advantages, since this medium is essentially nonbirefrin-

sideband, the reference central frequency will still have

gent (see Sec. III.B.4). It is then possible to use plain

a certain probability of introducing an error. It is thus

polarization coding. In addition, one can ensure very

possible to catch Eve in both cases. The monitoring of

high channel transmission over long distances by care-

the reference beam is essential in all two-state protocols

fully choosing the wavelength of the photons (see again

to reveal eavesdropping. In addition, it was shown that

Sec. III.B.4). The atmosphere has, for example, a high

this reference-beam monitoring can be extended to the

transmission ˜˜window™™ in the vicinity of 770 nm (trans-

four-state protocol (Huttner et al., 1995).

mission as high as 80% can occur between a ground

The advantage of this setup is that the interference is

station and a satellite), which happens to be compatible

controlled by the phase of the radio-frequency oscilla-

with commercial silicon APD photon-counting modules

tors. Their frequency is six orders of magnitude smaller

(detection ef¬ciency can be as high as 65% with low

than the optical frequency and thus considerably easier

noise).

to stabilize and synchronize. It is indeed a relatively

The systems developed for free-space applications are

simple task, which can be achieved by electronic means.

actually very similar to that shown in Fig. 12. The main

The Besancon group performed key distribution with

¸

difference is that the emitter and receiver are connected

such a system. The source they used was a distributed

by telescopes pointing at each other, instead of by an

Bragg re¬‚ector (DBR) laser diode at a wavelength of

optical ¬ber. The contribution of background light to

1540 nm and a bandwidth of 1 MHz. It was externally

errors can be maintained at a reasonable level by using a

modulated to obtain 50-ns pulses, thus increasing the

combination of timing discrimination (coincidence win-

bandwidth to about 20 MHz. They used two identical

dows of typically a few nanoseconds), spectral ¬ltering

LiNbO3 phase modulators operating at a frequency

(interference ¬lters 1 nm), and spatial ¬ltering (cou-

/2 300 MHz. Their spectral ¬lter was a Fabry-Perot

pling into an optical ¬ber). This can be illustrated by the

cavity with a ¬nesse of 55. Its resolution was 36 MHz.

following simple calculation. Let us suppose that

They performed key distribution over a 20-km single-

the isotropic spectral background radiance is

mode optical ¬ber spool, recording a QBERopt contri-

10 2 W m 2 nm 1 sr 1 at 800 nm. This corresponds to

bution of approximately 4%. They estimated that 2%

the spectral radiance of a clear zenith sky with a sun

could be attributed to the transmission of the central

elevation of 77° (Zissis and Larocca, 1978). The diver-

frequency by the Fabry-Perot cavity. Note also that the

gence of a Gaussian beam with radius w 0 is given by

detector noise was relatively high due to the long pulse

/w 0 . The product of beam (telescope) cross sec-

durations. Both these errors could be lowered by in-

tion and solid angle, which is a constant, is therefore

creasing the separation between the central peak and

w2 2 2

. By multiplying the radiance by 2 , one

the sidebands, allowing reduced pulse widths and hence 0

shorter detection times and lower dark counts. Never- obtains the spectral power density. With an interference

theless, a compromise must be found since, in addition ¬lter of 1-nm width, the power incident on the detector

is 6 10 15 W, corresponding to 2 104 photons per sec-

to the technical drawbacks of high-speed modulation,

ond or 2 10 5 photons per nanosecond. This quantity

the polarization transformation in an optical ¬ber de-

pends on the wavelength. The remaining 2% of the is approximately two orders of magnitude larger than

QBERopt is due to polarization effects in the setup. the dark-count probability of Si APD™s, but still compat-

This system is another possible candidate. Its main ible with the requirements of QC. The performance of

advantage is that it could be used with a true single- free-space QC systems depends dramatically on atmo-

photon source if it existed. On the other hand, the con- spheric conditions and air quality. This is problematic for

tribution of imperfect interference visibility to the error urban applications where pollution and aerosols degrade

rate is signi¬cantly higher than that measured with plug- the transparency of air.

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

175

Gisin et al.: Quantum cryptography

The ¬rst free-space QC experiment over a distance

of more than a few centimeters40 was performed by Ja-

cobs and Franson in 1996. They exchanged a key over a

distance of 150 m in a hallway illuminated with standard

¬‚uorescent lighting and over 75 m outdoors in bright

daylight without excessive QBER. Hughes and his team

were the ¬rst to exchange a key over more than one

FIG. 20. Multi-user implementation of quantum cryptography

kilometer under outdoor nighttime conditions (Buttler

with one Alice connected to three Bobs by optical ¬bers. The

et al., 1998; Hughes, Buttler, et al., 2000). More recently,

photons sent by Alice randomly choose to go to one or the

they even improved their system to reach a distance of

other Bob at a coupler.

1.6 km under daylight conditions (Buttler et al., 2000).

Finally, Rarity and co-workers performed a similar ex-

periment, in which they exchanged a key over a distance (Townsend et al., 1994; Phoenix et al., 1995; Townsend,

of 1.9 km under nighttime conditions (Gorman et al., 1997b). They used a passive optical ¬ber network archi-

2001). tecture in which one Alice, the network manager, is con-

Until quantum repeaters become available and allow nected to multiple network users (i.e., many Bobs; see

us to overcome the distance limitation of ¬ber-based Fig. 20). The goal is for Alice to establish a veri¬ably

QC, free-space systems seem to offer the only possibility secure and unique key with each Bob. In the classical

for QC over distances of more than a few dozen kilome- limit, the information transmitted by Alice is gathered

ters. A QC link could be established between ground- by all Bobs. However, because of their quantum behav-

based stations and a low-orbit (300“1200 km) satellite. ior, the photons are effectively routed at the beamsplit-

The idea is for Alice and Bob to each exchange a key ter to one, and only one, of the users. Using the double

(k A and k B , respectively) with the same satellite, using

Mach-Zehnder con¬guration discussed above, they

QC. Then the satellite publicly announces the value K

tested such an arrangement with three Bobs. Neverthe-

k A k B , where represents the XOR operator or,

less, because of the fact that QC requires a direct and

equivalently, the binary addition modulo 2 without carry.

low-attenuation optical channel between Alice and Bob,

Bob subtracts his key from this value to recover Alice™s

the ability to implement it over large and complex net-

key (k A Kk B ). 41 The fact that the key is known to

works appears limited.

the satellite operator may at ¬rst be seen as a disadvan-

tage. But this point might actually be conducive to the

development of QC, since governments always like to V. EXPERIMENTAL QUANTUM CRYPTOGRAPHY WITH

control communications. Although it has not yet been PHOTON PAIRS

demonstrated, Hughes as well as Rarity have

estimated”in view of their free-space experiments” The possibility of using entangled photon pairs for

that the dif¬culty can be overcome. The main dif¬culty quantum cryptography was ¬rst proposed by Ekert in

would come from beam pointing”do not forget that the 1991. In a subsequent paper, he investigated, with other

satellites will move with respect to the ground”and researchers, the feasibility of a practical system (Ekert

wandering induced by turbulence. In order to minimize et al., 1992). Although all tests of Bell™s inequalities (for

the latter problem, the photons would in practice prob- a review see, for example, Zeilinger, 1999) can be seen

ably be sent down from the satellite. Atmospheric tur-

as experiments in quantum cryptography, systems spe-

bulence is concentrated almost entirely in the ¬rst kilo-

ci¬cally designed to meet the special requirements of

meter above the earth™s surface. Another possibile way

QC, like quick changes of basis, have been implemented

to compensate for beam wander is to use adaptative op-

only recently.42 In 1999, three groups demonstrated

tics. Free-space QC experiments over distances of about

quantum cryptography based on the properties of en-

2 km constitute a major step towards key exchange

tangled photons. Their results were reported in the same

with a satellite. According to Buttler et al. (2000), the

issue of Phys. Rev. Lett. (Jennewein, Simon, et al., 2000;

optical depth is indeed similar to the effective atmo-

Naik et al., 2000; Tittel et al., 2000), illustrating the rapid

spheric thickness that would be encountered in a

progress in the still new ¬eld of quantum communica-

surface-to-satellite application.

tion.

One advantage of using photon pairs for QC is the

F. Multi-user implementations

fact that one can remove empty pulses, since the detec-

Paul Townsend and colleagues have investigated the

application of QC over multi-user optical ¬ber networks

42

This de¬nition of quantum cryptography applies to the fa-

mous experiment by Aspect and co-workers testing Bell™s in-

40

equalities with time-varying analyzers (Aspect et al., 1982). QC

Remember that Bennett and co-workers performed the

had, however, not yet been invented. It also applies to the

¬rst demonstration of QC over 30 cm in air (Bennett, Bessette,

more recent experiments closing locality loopholes, like the

et al., 1992).

41

one performed in Innsbruck using fast polarization modulators

This scheme could also be used with optical ¬ber implemen-

(Weihs et al., 1998) or the one performed in Geneva using two

tation provided that secure nodes existed. In the case of a

analyzers on each side (Tittel et al., 1999; Gisin and Zbinden,

satellite, one tacitly assumes that it constitutes such a secure

1999).

node.

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

176 Gisin et al.: Quantum cryptography

tion of one photon of a pair reveals the presence of a

companion. In principle, it is thus possible to have a

probability of emitting a nonempty pulse equal to one.43

It is bene¬cial only because currently available single-

photon detectors feature a high dark-count probability.

The dif¬culty of always collecting both photons of a pair