. 2
( 4)


Polarization-dependent loss is a differential attenua-
small. However, it becomes a serious issue when utilizing
tion between two orthogonal polarization modes. This
photon pairs created by parametric downconversion.
effect is negligible in ¬bers, but can be signi¬cant in
For instance, sending photons of 70-nm bandwidth (as
components like phase modulators. In particular, some
used in our long-distance tests of Bell™s inequality; Tittel
integrated optics waveguides actually guide only one
et al., 1998) down 10 km of optical ¬bers leads to a tem-
mode and thus behave almost like polarizers (e.g., pro-
poral spread of around 500 ps (assuming photons cen-
ton exchange waveguides in LiNbO3 ). Polarization-
tered at 0 and a typical dispersion slope of
dependent losses are usually stable, but if connected to a
0.086 ps nm 2 km 1 ). However, this can be compen-
¬ber with some birefringence, the relation between the
sated for when using energy-time-entangled photons
polarization state and the loss may ¬‚uctuate, producing
(Franson, 1992; Steinberg et al., 1992a, 1992b, Larchuk
random outcomes (Elamari et al., 1998). Polarization-
et al., 1995). In contrast to polarization coding, in which
dependent loss cannot be described by a unitary opera-
frequency and the physical property used to implement
tor acting in the polarization state space (but it is of
the qubit are not conjugate variables, frequency and
course unitary in a larger space (Huttner, Gautier, et al.,
time (thus position) constitute a Fourier pair. The strict
1996). Thus it does not preserve the scalar product. In
energy anticorrelation of signal and idler photons en-
particular, it can turn nonorthogonal states into orthogo-
ables one to achieve a dispersion for one photon that is
nal ones, which can then be distinguished unambigu-
equal in magnitude but opposite in sign to that of the
ously (at the cost of some loss; Huttner, Gautier, et al.,
sister photon, thus corresponding to the same delay24
1996; Clarke et al., 2000). Note that this attenuation
(see Fig. 7). The effect of broadening of the two wave
could be used by Eve, especially to eavesdrop on the
packets then cancels out, and two simultaneously emit-
two-state protocol (Sec. II.D.1).
ted photons stay coincident. However, note that the ar-
Let us conclude this section on polarization effects in
rival time of the pair varies with respect to its emission
¬bers by mentioning that they can be passively compen-
time. The frequency anticorrelation also provides the
sated for, provided one uses a go-and-return con¬gura-
basis for avoiding a decrease in visibility due to different
tion, with Faraday mirrors, as described in Sec. IV.C.2.
wave packet broadening in the two arms of an interfer-
ometer. Since the choromatic dispersion properties of
optical ¬bers do not change with time”in contrast to
3. Chromatic dispersion effects in single-mode ¬bers
birefringence”no active tracking and compensation are
In addition to polarization effects, chromatic disper-
required. It thus turns out that phase and phase-time
sion can also cause problems for quantum cryptography.
coding are particularly suited to transmission over long
For instance, as explained in Secs. IV.C and V.B,
distances in optical ¬bers: nonlinear effects decohering
schemes implementing phase or phase-and-time coding
the qubit ˜˜energy™™ are completely negligible, and chro-
rely on photons arriving at well-de¬ned times, that is, on
matic dispersion effects acting on the localization can be
photons well localized in space. However, in dispersive
avoided or compensated for in many cases.
media like optical ¬bers, different group velocities act as
a noisy environment on the localization of the photon as
well as on the phase acquired in an interferometer.
Hence the broadening of photons featuring nonzero
bandwidth, or, in other words, the coupling between fre- 4. Free-space links
quency and position, must be circumvented or con-
Although today™s telecommunications based on opti-
trolled. This implies working with photons of small
cal ¬bers are very advanced, such channels may not al-
bandwidth, or, as long as the bandwidth is not too large,
ways be available. Hence there is also some effort in
operating close to the wavelength 0 at which chromatic
developing free-space line-of-sight communication sys-
dispersion is zero, i.e., for standard ¬bers around 1310
nm. Fortunately, ¬ber losses are relatively small at this
wavelength and amount to 0.35 dB/km. This region is
called the second telecommunications window.22 There Chromatic dispersion in ¬bers is mainly due to the material,
essentially silicon, but also to the refractive index pro¬le. In-
are also special ¬bers, called dispersion-shifted ¬bers,
deed, longer wavelengths feel regions farther away from the
with a refractive index pro¬le such that the chromatic
core where the refractive index is lower. Dispersion-shifted ¬-
bers have, however, been abandoned by today™s industry, be-
cause it has turned out to be simpler to compensate for the
The ¬rst one, around 800 nm, is almost no longer used. It global chromatic dispersion by adding an extra ¬ber with high
was motivated by the early existence of sources and detectors negative dispersion. The additional loss is then compensated
at this wavelength. The third window is around 1550 nm, for by an erbium-doped ¬ber ampli¬er.
where the attenuation reaches an absolute minimum (Thomas Here we assume a predominantly linear dependence of
et al., 2000) and where erbium-doped ¬bers provide conve- chromatic dispersion as a function of the optical frequency, a
nient ampli¬ers (Desurvire, 1994). realistic assumption.

Rev. Mod. Phys., Vol. 74, No. 1, January 2002
Gisin et al.: Quantum cryptography

FIG. 7. Illustration of cancellation of chromatic dispersion ef-
FIG. 8. Transmission losses in free space as calculated using
fects in the ¬bers connecting an entangled-particle source and
the LOWTRAN code for earth-to-space transmission at the el-
two detectors. The ¬gure shows differential group delay curves
evation and location of Los Alamos, USA. Note that there is a
for two slightly different ¬bers approximately 10 km long. Us-
low-loss window at around 770 nm”a wavelength at which
ing frequency-correlated photons with central frequency
high-ef¬ciency silicon APD™s can be used for single-photon de-
0 ”determined by the properties of the ¬bers”the difference
tection (see also Fig. 9 and compare to Fig. 6). Figure courtesy
in propagation times t 2 t 1 between the signal (at s 1, s 2)
of Richard Hughes.
and idler (at i 1, i 2) photon is the same for all s , i . Note
that this cancellation scheme is not restricted to signal and
window of typically a few nanoseconds. Finally, it is clear
idler photons at nearly equal wavelengths. It also applies to
that the performance of free-space systems depends dra-
asymmetrical setups in which the signal photon (generating the
matically on atmospheric conditions and is possible only
trigger to indicate the presence of the idler photon) is at a
in clear weather.
short wavelength of around 800 nm and travels only a short
Finally, let us brie¬‚y comment on the different sources
distance. Using a ¬ber with appropriate zero dispersion wave-
leading to coupling losses. A ¬rst concern is the trans-
length 0 , it is still possible to achieve equal differential group
mission of the signals through a turbulent medium, lead-
delay with respect to the energy-correlated idler photon sent
ing to arrival-time jitter and beam wander (hence prob-
through a long ¬ber at a telecommunications wavelength.
lems with beam pointing). However, as the time scales
for atmospheric turbulences involved are rather small”
tems, not only for classical data transmission but also for around 0.1“0.01 s”the time jitter due to a variation of
quantum cryptography (see Hughes, Buttler, et al., 2000 the effective refractive index can be compensated for by
and Gorman et al., 2000). sending a reference pulse at a different wavelength a
Transmission over free space features some advan- short time (around 100 ns) before each signal pulse.
tages compared to the use of optical ¬bers. The atmo- Since this reference pulse experiences the same atmo-
sphere has a high transmission window at a wavelength spheric conditions as the subsequent one, the signal will
of around 770 nm (see Fig. 8), where photons can easily arrive essentially without jitter in the time window de-
¬ned by the arrival of the reference pulse. In addition,
be detected using commercial, high-ef¬ciency photon-
the reference pulse can be re¬‚ected back to the trans-
counting modules (see Sec. III.C.1). Furthermore, the
mitter and used to correct the direction of the laser
atmosphere is only weakly dispersive and essentially
nonbirefringent25 at these wavelengths. It will thus not beam by means of adaptive optics, hence compensating
for beam wander and ensuring good beam pointing.
alter the polarization state of a photon.
Another issue is beam divergence, hence increase of
However, there are some drawbacks concerning free-
spot size at the receiver end caused by diffraction at the
space links as well. In contrast to the signal transmitted
transmitter aperture. Using, for example, 20-cm-
in a guiding medium where the energy is ˜˜protected™™
diameter optics, one obtains a diffraction-limited spot
and remains localized in a small region of space, the
size after 300 km of 1 m. This effect can in principle be
energy transmitted via a free-space link spreads out,
kept small by taking advantage of larger optics. How-
leading to higher and varying transmission losses. In ad-
ever, it can also be advantageous to have a spot size that
dition to loss of energy, ambient daylight, or even moon-
is large compared to the receiver™s aperture in order to
light at night, can couple into the receiver, leading to a
ensure constant coupling in case of remaining beam
higher error rate. However, such errors can be kept to a wander. In their 2000 paper, Gilbert and Hamrick pro-
reasonable level by using a combination of spectral ¬l- vide a comprehensive discussion of free-space channels
tering (interference ¬lters 1 nm), spatial ¬ltering at the in the context of QC.
receiver, and timing discrimination using a coincidence
C. Single-photon detection

25 With the availability of pseudo-single-photon and
In contrast to an optical ¬ber, air is not subject to stress and
photon-pair sources, the success of quantum cryptogra-
is hence isotropic.

Rev. Mod. Phys., Vol. 74, No. 1, January 2002
162 Gisin et al.: Quantum cryptography

on faint laser pulses, for which the arrival times of the
phy essentially depends on the ability to detect single
photons are well known. However, it only applies if
photons. In principle, this can be achieved using a vari-
prior timing information is available. For two-photon
ety of techniques, for instance, photomultipliers, ava-
schemes, it is most often combined with a passive-
lanche photodiodes, multichannel plates, and supercon-
quenched detector, generating the trigger signal for the
ducting Josephson junctions. The ideal detector should
gated detector.
ful¬ll the following requirements:
In addition to Geiger mode, Brown and Daniels
• the quantum detection ef¬ciency should be high
(1989) have investigated the performance of silicon
over a large spectral range,
APD™s operated in sub-Geiger mode. In this mode, the
• the probability of generating noise, that is, a signal
without an arriving photon, should be small, bias voltage is kept slightly smaller than the breakdown
• the time between detection of a photon and genera- voltage such that the multiplication factor”around
tion of an electrical signal should be as constant as pos- 100”is suf¬cient to detect an avalanche, yet, is still
sible, i.e., the time jitter should be small, to ensure good small enough to prevent real breakdowns. Unfortu-
timing resolution, nately, the single-photon counting performance in this
• the recovery time (i.e., the dead time) should be mode is rather poor, and thus efforts have not been con-
short to allow high data rates. tinued, the major problem being the need for extremely
low-noise ampli¬ers.
In addition, it is important to keep the detectors prac-
tical. For instance, a detector that needs liquid helium or An avalanche engendered by carriers created in the
even nitrogen cooling would certainly render commer- conduction band of the diode can be set off not only by
cial development dif¬cult. an impinging photon, but also by unwanted causes.
Unfortunately, it turns out that it is impossible to ful- These might be thermal or band-to-band tunneling pro-
¬ll all the above criteria at the same time. Today, the cesses, or emissions from trapping levels populated
best choice is avalanche photodiodes (APD™s). Three while a current transits through the diode. The ¬rst two
different semiconductor materials are used: either sili- produce avalanches not due to photons and are referred
con, germanium, or indium gallium arsenide, depending to as dark counts. The third process depends on previous
on the wavelengths. avalanches and its effects are called afterpulses. Since
APDs are usually operated in the so-called Geiger the number of trapped charges decreases exponentially
mode. In this mode, the applied voltage exceeds the
with time, these afterpulses can be limited by applying
breakdown voltage, leading an absorbed photon to trig-
large dead times. Thus there is a tradeoff between high
ger an electron avalanche consisting of thousands of car-
count rates and low afterpulses. The time constant of the
riers. To reset the diode, this macroscopic current must
exponential decrease of afterpulses shortens for higher
be quenched”the emission of charges must be stopped
temperatures of the diode. Unfortunately, operating
and the diode recharged (Cova et al., 1996). Three main
APD™s at higher temperatures leads to a higher fraction
possibilities exist:
of thermal noise, that is, higher dark counts. Thus there
• In passive-quenching circuits, a large (50“500 k ) is again a tradeoff to be optimized. Finally, increasing
resistor is connected in series with the APD (see, for the bias voltage leads to a higher quantum ef¬ciency and
example, Brown et al., 1986). This causes a decrease in a smaller time jitter, at the cost of an increase in noise.
the voltage across the APD as soon as an avalanche We thus see that the optimal operating parameters”
starts. When it drops below breakdown voltage, the ava- voltage, temperature, and dead time (i.e., maximum
lanche stops and the diode recharges. The recovery time count rate)”depend on the speci¬c application. More-
of the diode is given by its capacitance and by the value over, since the relative magnitudes of ef¬ciency, thermal
of the quench resistor. The maximum count rate varies noise, and afterpulses vary with the type of semiconduc-
from a few hundred kilohertz to a few megahertz. tor material used, no general solution exists. In the next
• In active-quenching circuits, the bias voltage is ac- two sections we brie¬‚y discuss the different types of
tively lowered below the breakdown voltage as soon as APD™s. The ¬rst section focuses on silicon APD™s for the
the leading edge of the avalanche current is detected detection of photons at wavelengths below 1 m; the
(see, for example, Brown et al., 1987). This mode makes second comments on germanium and on indium gallium
possible higher count rates than those in passive quench- arsenide APD™s for photon counting at telecommunica-
ing (up to tens of megahertz), since the dead time can be tions wavelengths. The different behavior of the three
as short as tens of nanoseconds. However, the fast elec- types is shown in Fig. 9. Although the best ¬gure of
tronic feedback system makes active-quenching circuits merit for quantum cryptography is the ratio of dark-
much more complicated than passive ones. count rate R to detection ef¬ciency , we show here the
• Finally, in gated-mode operation, the bias voltage is better-known noise equivalent power (NEP), which
kept below the breakdown voltage and is raised above it shows similar behavior. The noise equivalent power is
only for a short time, typically a few nanosecods when a de¬ned as the optical power required to measure a unity
photon is expected to arrive. Maximum count rates simi- signal-to-noise ratio and is given by
lar to those in active-quenching circuits can be obtained
using less complicated electronics. Gated-mode opera-
NEP 2R. (25)
tion is commonly used in quantum cryptography based

Rev. Mod. Phys., Vol. 74, No. 1, January 2002
Gisin et al.: Quantum cryptography

ster (1993a) implemented a single-photon interference
scheme for quantum cryptography over a distance of 10
km, and in 1994, Tapster, Rarity, and Owens demon-
strated a violation of Bell™s inequalities over 4 km. These
experiments were the ¬rst to take advantage of Ge
APD™s operated in passively quenched Geiger mode. At
a temperature of 77 K, which can be achieved using ei-
ther liquid nitrogen or Stirling engine cooling, typical
quantum ef¬ciencies of about 15% at dark-count rates
of 25 kHz can be achieved (Owens et al., 1994), and time
jitter down to 100 ps has been observed (Lacaita et al.,
1994) a normal value being 200“300 ps.
Traditionally, germanium APD™s have been imple-
FIG. 9. Noise equivalent power as a function of wavelength for
mented in the domain of long-distance quantum com-
silicon, germanium, and InGaAs/InP APD™s.
munication. However, this type of diode is currently be-
ing replaced by InGaAs APD™s, and it has become more
Here, h is Planck™s constant and is the frequency of the and more dif¬cult to ¬nd germanium APD™s on the mar-
impinging photons. ket. Motivated by pioneering research reported in 1985
(Levine et al., 1985), the latest research focuses on
1. Photon counting at wavelengths below 1.1 m InGaAs APD™s, which allow single-photon detection in
both telecommunications windows. Starting with work
Since the beginning of the 1980s much work has been
by Zappa et al. (1994), InGaAs APD™s as single-photon
done to characterize silicon APD™s for single-photon
counters have meanwhile been thoroughly characterized
counting (Ingerson 1983; Brown et al., 1986, 1987;
(Lacaita et al., 1996; Ribordy et al., 1998; Karlsson et al.,
Brown and Daniels, 1989; Spinelli, 1996), and the perfor-
1999; Hiskett et al., 2000; Rarity et al., 2000; Stucki et al.,
mance of Si APD™s has continuously been improved.
2001), and the ¬rst implementations for quantum cryp-
Since the ¬rst test of Bell™s inequality using Si APD™s by
tography have been reported (Ribordy, 1998; Bouren-
Shih and Alley in 1988, they have completely replaced
nane et al., 1999; Bethune and Risk, 2000; Hughes, Mor-
the photomultipliers used until then in the domain of
gan, and Peterson, 2000; Ribordy et al., 2000). However,
fundamental quantum optics, now known as quantum
if operating Ge APD™s is already more inconvenient
communication. Today, quantum ef¬ciencies of up to
than using silicon APD™s, the practicality of InGaAs
76% (Kwiat et al., 1993) and time jitter as low as 28 ps
APD™s is even worse, the problem being an extremely
(Cova et al., 1989) have been reported. Commercial
high afterpulse fraction. Therefore operation in passive-
single-photon counting modules are available (for ex-
quenching mode is impossible for applications in which
ample, EG&G SPCM-AQ-151), featuring quantum ef¬-
low noise is crucial. In gated mode, InGaAs APD™s are
ciencies of 70% at a wavelength of 700 nm, a time jitter
better for single-photon counting at 1.3 m than Ge
of around 300 ps, and maximum count rates higher than
APD™s. For instance, at a temperature of 77 K and a
5 MHz. Temperatures of 20 °C”suf¬cient to keep
dark-count probability of 10 5 per 2.6-ns gate, quantum
thermally generated dark counts as low as 50 Hz”can
ef¬ciencies of around 30% and 17% have been reported
easily be achieved using Peltier cooling. Single-photon
for InGaAs and Ge APD™s, respectively (Ribordy et al.,
counters based on silicon APD™s thus offer an almost
1998), while the time jitter of both devices is compa-
perfect solution for all applications in which photons of
rable. If working at a wavelength of 1.55 m, the tem-
wavelengths below 1 m can be used. Apart from fun-
perature has to be increased for single-photon detection.
damental quantum optics, these applications include
At 173 K and a dark-count rate of 10 4 , a quantum
quantum cryptography in free space and in optical ¬-
ef¬ciency of 6% can still be observed using InGaAs/InP
bers; however, due to high losses, the latter works only
devices, while the same ¬gure for germanium APD™s is
over short distances.
close to zero.
To date, no industrial effort has been made to opti-
2. Photon counting at telecommunications wavelengths
mize APD™s operating at telecommunications wave-
lengths for photon counting, and their performance still
When working in the second telecommunications win-
lags far behind that one of silicon APD™s.26 However,
dow (1.3 m), one can take advantage of APD™s made
there is no fundamental reason why photon counting at
from germanium or InGaAs/InP semiconductor materi-
wavelengths above 1 m should be more dif¬cult than at
als. In the third window (1.55 m), the only option is
wavelengths below 1 m except that the high-
Photon counting with germanium APD™s, although
known for 30 years (Haecker et al., 1971), began to be
used in quantum communication as the need arose to 26
The ¬rst commercial photon counter at telecommunications
transmit single photons over long distances using optical wavelengths came out only this year (the Hamamatsu photo-
¬bers, which necessitated working at telecommunica- multiplier R5509-72). However, its ef¬ciency is not yet suf¬-
tions wavelengths. In 1993, Townsend, Rarity, and Tap- cient for use in quantum cryptography.

Rev. Mod. Phys., Vol. 74, No. 1, January 2002
164 Gisin et al.: Quantum cryptography

An elegant con¬guration integrating the random-
wavelength photons are less energetic. The real reasons
number generator into the QC system consists in using a
for the lack of commercial products are, ¬rst, that sili-
passive choice of bases, as discussed in Sec. V (Muller
con, the most common semiconductor material, is not
et al., 1993). However, the problem of detector-induced
sensitive enough (the band gap is too large), and second
correlation remains.
that the market for photon counting is not yet mature.
But, without great risk, one can predict that good com-
mercial photon counters will become available in the
near future and that they will have a major impact on E. Quantum repeaters
quantum cryptography.
Today™s ¬ber-based QC systems are limited to opera-
tion over tens of kilometers due to the combination of
¬ber losses and detector noise. The losses by themselves
D. Quantum random-number generators
only reduce the bit rate (exponentially with distance).
With perfect detectors the distance would not be limited.
The key used in the one-time pad must be secret and
However, because of the dark counts, each time a pho-
used only once. Consequently it must be as long as the
ton is lost there is a chance that a dark count produces
message, and it must be perfectly random. The latter
an error. Hence, when the probability of a dark count
point proves to be a delicate and interesting one. Com-
becomes comparable to the probability that a photon is
puters are deterministic systems that cannot create truly
correctly detected, the signal-to-noise ratio tends to 0
random numbers. However, all secure cryptosystems,
[more precisely, the mutual information I( , ) tends to
both classical and quantum ones, require truly random
a lower bound29]. In this section we brie¬‚y explain how
numbers.27 Hence the random numbers must be created
the use of entangled photons and of entanglement swap-
by a random physical process. Moreover, to make sure ™
ping (Zukowski et al., 1993) could offer ways to extend
that the process does not merely appear random while
the achievable distances in the foreseeable future (some
having some hidden deterministic pattern, the process
prior knowledge of entanglement swapping is assumed).
needs to be completely understood. It is thus of interest
Let t link denote the transmission coef¬cient (i.e., the
to implement a simple process in order to gain con¬-
probability that a photon sent by Alice gets to one of
dence in the randomness of its proper operation.
Bob™s detectors), the detector ef¬ciency, and p dark the
A natural solution is to rely on the random choice of a
dark-count probability per time bin. With a perfect
single photon at a beamsplitter28 (Rarity et al., 1994). In
single-photon source, the probability P raw of a correct
this case the randomness is in principle guaranteed by
qubit detection is P raw t link , while the probability
the laws of quantum mechanics, though one still has to
P det of an error is P det (1 t link )p dark . Accordingly,
be very careful not to introduce any experimental arti-
the QBER P det /(P raw P det ), and the normalized net
fact that could correlate adjacent bits. Different experi-
rate is net (P raw P det )•fct(QBER), where the func-
mental realizations have been demonstrated (Jenne-
tion fct denotes the fraction of bits remaining after error
wein, Achleitner, et al., 2000; Stefanov et al., 2000;
correction and privacy ampli¬cation. For the sake of il-
Hildebrand, 2001), and prototypes are commercially
lustration, we simply assume a linear dependence drop-
available (www.gap-optique.unige.ch). One particular
ping to zero for QBER 15% (this simpli¬cation does
problem is the dead time of the detectors, which may
not affect the qualitative results of this section; for a
introduce a strong anticorrelation between neighboring
more precise calculation, see Lutkenhaus 2000):
bits. Similarly, afterpulses may provoke a correlation.
fct(QBER) 1 QBER/15%. The corresponding net
These detector-related effects increase with higher pulse
rate net is displayed in Fig. 10. Note that it drops to zero
rates, limiting the bit rate of a quantum number genera-
near 90 km.
tor to a few megahertz.
Let us now assume that instead of a perfect single-
In the BB84 protocol Alice has to choose randomly
photon source, Alice and Bob use a perfect two-photon
among four different states and Bob between two bases.
source set in the middle of their quantum channel. Each
The limited random-number generation rate may force
photon then has a probability t link of reaching a detec-
Alice to produce her numbers in advance and store
tor. The probability of a correct joined detection is thus
them, creating a security risk. On Bob™s side the random-
P raw t link 2 , while an error occurs with probability
bit creation rate can be lower, since, in principle, the
t link ) 2 p dark 2 t link (1
P det (1 t link )p dark
basis need be changed only after a photon has been de-
(both photons lost and two dark counts, or one photon
tected, which normally happens at rates below 1 MHz.
lost and one dark count). This can be conveniently re-
However, one must make sure that this does not give a
written as P raw t link n and P det t link (1
spy an opportunity for a Trojan horse attack (see Sec.
1/n n n
t link )p dark t link , valid for any division of the

The absolute lower bound is 0, but depending on the as-
The PIN number that the bank assigns to your ATM card
sumed eavesdropping strategy, Eve could take advantage of
must be random. If not, someone else knows it.
the losses. In the latter case, the lower bound is given by her
Strictly speaking, the choice is made only once the photons
are detected at one of the outports. mutual information I( , ).

Rev. Mod. Phys., Vol. 74, No. 1, January 2002
Gisin et al.: Quantum cryptography

ronment, also called decoherence, can be controlled and
moderated. In addition, researchers can bene¬t from all
the tools developed in the past two decades for optical
telecommunications. It is unlikely that other carriers will
be employed in the foreseeable future.
Comparing different QC setups is a dif¬cult task,
since several criteria must be taken into account. What
matters in the end, of course, is the rate of corrected
secret bits (the distilled bit rate R dist ) that can be trans-
mitted and the transmission distance. One can already
note that with present and near-future technology it will
probably not be possible to achieve rates of the order of
gigahertz, which are now common with conventional op-
FIG. 10. Normalized net key creation rate net as a function of
tical communication systems (in their comprehensive
distance in optical ¬bers. For n 1, Alice uses a perfect single-
paper published in 2000, Gilbert and Hamrick discuss
photon source. For n 1, the link is divided into n equal-length
practical methods for achieving high-bit-rate QC). This
sections, and n/2 two-photon sources are distributed between
implies that encryption with a key exchanged through
Alice and Bob. Parameters: detection ef¬ciency 10%,
QC will be limited to highly con¬dential information.
dark-count probability p dark 10 4 , and ¬ber attenuation
While the determination of the transmission distance
0.25 dB/km.
and rate of detection (the raw bit rate R raw ) is straight-
forward, estimating the net rate is rather dif¬cult. Al-
link into n equal-length sections and n detectors. Note though, in principle, errors in the bit sequence follow
that the measurements performed at the nodes between only from tampering by a malevolent eavesdropper, the
Alice and Bob transmit (swap) the entanglement to the situation is rather different in reality. Discrepancies be-
twin photons without revealing any information about tween the keys of Alice and Bob also happen because of
the qubit (these measurements are called Bell measure- experimental imperfections. The error rate QBER can
ments and are at the core of entanglement swapping and be easily determined. Similarly, the error correction pro-
of quantum teleportation). The corresponding net rates cedure is rather simple. Error correction leads to a re-
are displayed in Fig. 10. Clearly, the rates for short dis- duction of the key rate that depends strongly on the
tances are smaller when several detectors are used, be- QBER. The real problem is to estimate the information
cause of their limited ef¬ciencies (here we assume obtained by Eve, a quantity necessary for privacy ampli-
10%), but the distance before the net rate drops to ¬cation. This depends not only on the QBER, but also
zero is extended to longer distances! Intuitively, this can on other factors, such as the photon number statistics of
be understood as follows. Let us assume that a logical the source or the way the choice of the measurement
qubit propagates from Alice to Bob (although some basis is made. Moreover in a pragmatic approach, one
photons propagate in the opposite direction). Then, might also accept restrictions on Eve™s technology, limit-
each two-photon source and each Bell measurement acts ing her strategies and therefore also the information she
on this logical qubit as a kind of quantum nondemolition can obtain per error she introduces. Since the ef¬ciency
measurement, testing whether the logical qubit is still of privacy ampli¬cation rapidly decreases when the
there. In this way, Bob activates his detectors only when QBER increases, the distilled bit rate depends dramati-
there is a large chance t link that the photon gets to his cally on Eve™s information and hence on the assumptions
detectors. made. One can de¬ne as the maximum transmission dis-
Note that if in addition to detector noise there is noise tance the distance at which the distilled rate reaches
due to decoherence, then the above idea can be ex- zero. This distance can give one an idea of the dif¬culty
tended, using entanglement puri¬cation. This is essen- of evaluating a QC system from a physical point of view.
tially the idea behind quantum repeaters (Briegel et al., Technological aspects must also be taken into account.
1998; Dur et al., 1999). In this article we do not focus on all the published per-
formances (in particular not on the key rates), which
strongly depend on current technology and the ¬nancial
resources of the research teams who carried out the ex-
periments. Rather, we try to weigh the intrinsic techno-
Experimental quantum key distribution was demon- logical dif¬culties associated with each setup and to an-
strated for the ¬rst time in 1989 (the results were pub- ticipate certain technological advances. Last but not
lished only in 1992 by Bennett, Bessette, et al.). Since least, the cost of realizing a prototype should also be
then, tremendous progress has been made. Today, sev- considered.
eral groups have shown that quantum key distribution is In this section, we ¬rst deduce a general formula for
possible, even outside the laboratory. In principle, any the QBER and consider its impact on the distilled rate.
two-level quantum system could be used to implement We then review faint-pulse implementations. We class
QC. In practice, all implementations have relied on pho- them according to the property used to encode the qu-
tons. The reason is that their interaction with the envi- bits value and follow a rough chronological order. Fi-

Rev. Mod. Phys., Vol. 74, No. 1, January 2002
166 Gisin et al.: Quantum cryptography

nally, we assess the possibility of adopting the various of detectors. The two factors of 2 are related to the fact
setups for the realization of an industrial prototype. Sys- that a dark count has a 50% chance of happening when
tems based on entangled photon pairs are presented in Alice and Bob have chosen incompatible bases (and is
the next section. thus eliminated during sifting) and a 50% chance of oc-
curring in the correct detector.
Finally, error counts can arise from uncorrelated pho-
A. Quantum bit error rate
tons due to imperfect photon sources:
The QBER is de¬ned as the ratio of wrong bits to the 11
total number of bits received30 and is normally on the R acc p f t n. (30)
2 2 acc rep link
order of a few percent. We can express it as a function of
This factor appears only in systems based on entangled
photons, where the photons belonging to different pairs
N wrong R error R error but arriving in the same time window are not necessarily
QBER . (26)
N right N wrong R sift R error R sift in the same state. The quantity p acc is the probability of
¬nding a second pair within the time window, knowing
Here the sifted key corresponds to the cases in which
that a ¬rst one was created.32
Alice and Bob made compatible choices of bases, hence
The QBER can now be expressed as follows:
its rate is half that of the raw key.
The raw rate is essentially the product of the pulse R opt R det R acc
QBER (31)
rate f rep , the mean number of photons per pulse , the R sift
probability t link of a photons arriving at the analyzer,
p dark n p acc
and the probability of the photon™s being detected:
p opt (32)
t link 2q 2q
1 1
R sift R raw qf t . (27)
2 rep link
2 QBERopt QBERdet QBERacc . (33)
The factor q (q 1, typically 1 or 2 ) must be introduced We now analyze these three contributions. The ¬rst one,
for some phase-coding setups in order to correct for QBERopt , is independent of the transmission distance
noninterfering path combinations (see, for example, (it is independent of t link ). It can be considered as a
Secs. IV.C and V.B). measure of the optical quality of the setup, depending
One can identify three different contributions to only on the polarization or interference fringe contrast.
R error . The ¬rst arises from photons that end up in the The technical effort needed to obtain and, more impor-
wrong detector due to imperfect interference or polar- tantly, to maintain a given QBERopt is an important cri-
ization contrast. The rate R opt is given by the product of terion for evaluating different QC setups. In
the sifted-key rate and the probability p opt of a photon™s polarization-based systems, it is rather simple to achieve
going to the wrong detector: a polarization contrast of 100:1, corresponding to a
QBERopt of 1%. In ¬ber-based QC, the problem is to
maintain this value in spite of polarization ¬‚uctuations
R opt R sift p opt qf tp . (28)
2 rep link opt and depolarization in the ¬ber link. For phase-coding
setups, QBERopt and the interference visibility are re-
For a given setup, this contribution can be considered as
lated by
an intrinsic error rate indicating its suitability for use in
QC. We shall discuss it below in the case of each par- 1V
ticular system. QBERopt . (34)
The second contribution, R det , arises from the detec-
tor dark counts (or from remaining environmental stray A visibility of 98% thus translates into an optical error
light in free-space setups). This rate is independent of rate of 1%. Such a value implies the use of well-aligned
the bit rate.31 Of course, only dark counts falling within and stable interferometers. In bulk optics, perfect mode
the short time window when a photon is expected give overlap is dif¬cult to achieve, but the polarization is
rise to errors, stable. In single-mode ¬ber interferometers, on in con-
trast, perfect mode overlap is automatically achieved,
but the polarization must be controlled, and chromatic
R det fp n, (29)
2 2 rep dark dispersion can constitute a problem.
The second contribution, QBERdet , increases with
where p dark is the probability of registering a dark count
distance, since the dark-count rate remains constant
per time window and per detector, and n is the number
while the bit rate goes down like t link . It depends en-

In the following section we consider systems implementing
Note that a passive choice of measurement basis implies
the BB84 protocol. For other protocols, some of the formulas
that four detectors (or two detectors during two time windows)
have to be slightly adapted.
are activated for every pulse, thus leading to a doubling of R det
This is true provided that afterpulses (see Sec. III.C) do not
contribute to the dark counts. and R acc .

Rev. Mod. Phys., Vol. 74, No. 1, January 2002
Gisin et al.: Quantum cryptography

FIG. 12. Typical system for quantum cryptography using po-
larization coding: LD, laser diode; BS, beamsplitter; F, neutral
density ¬lter; PBS, polarizing beamsplitter; /2, half wave-
FIG. 11. Bit rate, after error correction and privacy ampli¬ca- plate; APD, avalanche photodiode.
tion, vs ¬ber length. The chosen parameters are as follows:
pulse rates of 10 MHz for faint laser pulses ( 0.1) and 1
most evident when comparing the curves 1550 and 1550
MHz for the case of ideal single photons (1550-nm ˜˜single™™);
nm ˜˜single,™™ since the latter features a QBER that is 10
losses of 2, 0.35, and 0.25 dB/km; detector ef¬ciencies of 50, 20,
times lower. One can see that the maximum range is
and 10; dark-count probabilities of 10 7 , and 10 5 , and 10 5
about 100 km. In practice it is closer to 50 km, due to
for 800, 1300, and 1550 nm, respectively. Losses at Bob™s end
nonideal error correction and privacy ampli¬cation,
and QBERopt are neglected.
multiphoton pulses, and other optical losses not consid-
ered here. Finally, let us mention that typical key cre-
tirely on the ratio of the dark-count rate to the quantum
ation rates on the order of a thousand bits per second
ef¬ciency. At present, good single-photon detectors are
over distances of a few tens of kilometers have been
not commercially available for telecommunications
demonstrated experimentally (see, for example,
wavelengths. The span of QC is not limited by decoher-
Townsend, 1998b or Ribordy et al., 2000).
ence. As QBERopt is essentially independent of the ¬ber
length, it is detector noise that limits the transmission
distance. B. Polarization coding
Finally, the QBERacc contribution is present only in
Encoding the qubits in the polarization of photons is a
some two-photon schemes in which multiphoton pulses
natural solution. The ¬rst demonstration of QC by Ben-
are processed in such a way that they do not necessarily
nett and co-workers (Bennett, Bessette, et al., 1992)
encode the same bit value (see, for example, Secs. V.B.1
made use of this choice. They realized a system in which
and V.B.2). Although all systems have some probability
Alice and Bob exchanged faint light pulses produced by
of multiphoton pulses, in most these contribute only to
a light-emitting diode and containing less than one pho-
the information available to Eve (see Sec. VI.H) and not
ton on average over a distance of 30 cm in air. In spite of
to the QBER. However, for implementations featuring
the small scale of this experiment, it had an important
passive choice by each photon, the multiphoton pulses
impact on the community, as it showed that it was not
do not contribute to Eve™s information but only to the
unreasonable to use single photons instead of classical
error rate (see Sec. VI.J).
pulses for encoding bits.
Now, let us calculate the useful bit rate as a function
A typical QC system with the BB84 four-state proto-
of the distance. R sift and QBER are given as a function
col using the polarization of photons is shown in Fig. 12.
of t link in Eqs. (27) and (32), respectively. The ¬ber link
Alice™s system consists of four laser diodes. They emit
transmission decreases exponentially with length. The
short classical photon pulses ( 1 ns) polarized at 45°,
fraction of bits lost due to error correction and privacy
0°, 45°, and 90°. For a given qubit, a single diode is
ampli¬cation is a function of QBER and depends on
triggered. The pulses are then attenuated by a set of
Eve™s strategy. The number of remaining bits R net is
¬lters to reduce the average number of photons to well
given by the sifted-key rate multiplied by the difference
below 1, and sent along the quantum channel to Alice.
between the Alice-Bob mutual Shannon information
It is essential that the pulses remain polarized for Bob
I( , ) and Eve™s maximal Shannon information
I max( , ): to be able to extract the information encoded by Alice.
As discussed in Sec. III.B.2, polarization mode disper-
I max
R net R sift I , , . (35)
sion may depolarize the photons, provided the delay it
The difference between I( , ) and I max( , ) is calcu- introduces between polarization modes is longer than
the coherence time. This sets a constraint on the type of
lated here according to Eqs. (63) and (65) (Sec. VI.E),
lasers used by Alice.
considering only individual attacks and no multiphoton
Upon reaching Bob, the pulses are extracted from the
pulses. We obtain R net (the useful bit rate after error
¬ber. They travel through a set of waveplates used to
correction and privacy ampli¬cation) for different wave-
recover the initial polarization states by compensating
lengths as shown in Fig. 11. There is ¬rst an exponential
for the transformation induced by the optical ¬ber (Sec.
decrease, then, due to error correction and privacy am-
III.B.2). The pulses then reach a symmetric beamsplit-
pli¬cation, the bit rates fall rapidly down to zero. This is

Rev. Mod. Phys., Vol. 74, No. 1, January 2002
168 Gisin et al.: Quantum cryptography

ter, implementing the basis choice. Transmitted photons
are analyzed in the vertical-horizontal basis with a po-
larizing beamsplitter and two photon-counting detec-
tors. The polarization state of the re¬‚ected photons is
¬rst rotated with a waveplate by 45° ( 45°’0°). The
photons are then analyzed with a second set of polariz-
ing beamsplitters and photon-counting detectors. This
implements the diagonal basis. For illustration, let us
follow a photon polarized at 45°. We see that its state
of polarization is arbitrarily transformed in the optical
¬ber. At Bob™s end, the polarization controller must be
set to bring it back to 45°. If it chooses the output of
the beamsplitter corresponding to the vertical-horizontal
basis, it will experience an equal probability of re¬‚ection
or transmission at the polarizing beamsplittter, yielding a
FIG. 13. Geneva and Lake Geneva. The Swisscom optical ¬-
random outcome. On the other hand, if it chooses the
ber cable used for quantum cryptography experiments runs
diagonal basis, its state will be rotated to 90°. The po-
under the lake between the town of Nyon, about 23 km north
larizing beamsplitter will then re¬‚ect it with unit prob-
of Geneva, and the center of the city.
ability, yielding a deterministic outcome.
Instead of having Alice use four lasers and Bob two
polarizing beamsplitters, one can also implement this dard ¬bers with polarization-maintaining ¬bers does not
system with active polarization modulators such as solve the problem. The reason is that, in spite of their
Pockels cells. For emission, the modulator is randomly name, these ¬bers do not maintain polarization, as ex-
activated for each pulse to rotate the state of polariza- plained in Sec. III.B.2.
tion to one of the four states, while, at the receiver, it Recently, Townsend has also investigated such
randomly rotates half of the incoming pulses by 45°. It is polarization-encoding systems for QC on short-span
also possible to realize the whole system with ¬ber op- links up to 10 kilometers (1998a, 1998b) with photons at
tics components. 800 nm. It is interesting to note that, although he used
Antoine Muller and co-workers at the University of standard telecommunications ¬bers which could support
Geneva have used such a system to perform QC experi- more than one spatial mode at this wavelength, he was
ments over optical ¬bers (1993; see also Breguet et al., able to ensure single-mode propagation by carefully
1994). They created a key over a distance of 1100 meters controlling the launching conditions. Because of the
with photons at 800 nm. In order to increase the trans- problem discussed above, polarization coding does not
mission distance, they repeated the experiment with seem to be the best choice for QC in optical ¬bers. Nev-
photons at 1300 nm (Muller et al., 1995, 1996) and cre- ertheless, this problem is drastically reduced when con-
ated a key over a distance of 23 km. An interesting fea- sidering free-space key exchange, as air has essentially
ture of this experiment is that the quantum channel con- no birefringence at all (see Sec. IV.E).
necting Alice and Bob consisted of an optical ¬ber part
of an installed cable used by the telecommunications
company Swisscom for carrying phone conversations. It
runs between the Swiss cities of Geneva and Nyon, un- C. Phase coding
der Lake Geneva (Fig. 13). This was the ¬rst time QC
was performed outside of a physics laboratory. These The idea of encoding the value of qubits in the phase
experiments had a strong impact on the interest of the of photons was ¬rst mentioned by Bennett in the paper
wider public in the new ¬eld of quantum communica- in which he introduced the two-state protocol (1992). It
tion. is indeed a very natural choice for optics specialists.
These two experiments highlighted the fact that the State preparation and analysis are then performed with
polarization transformation induced by a long optical ¬- interferometers, which can be realized with single-mode
ber was unstable over time. Indeed, when monitoring optical ¬ber components.
the QBER of their system, Muller noticed that, although Figure 14 presents an optical ¬ber version of a Mach-
it remained stable and low for some time (on the order Zehnder interferometer. It is made out of two symmetric
of several minutes), it would suddenly increase after a couplers”the equivalent of beamsplitters”connected
while, indicating a modi¬cation of the polarization trans- to each other, with one phase modulator in each arm.
formation in the ¬ber. This implies that a real ¬ber- One can inject light into the setup, using a continuous
based QC system would require active alignment to and classical source, and monitor the intensity at the
compensate for this evolution. Although not impossible, output ports. Provided that the coherence length of the
such a procedure is certainly dif¬cult. James Franson did light used is larger than the path mismatch in the inter-
indeed implement an active-feedback alignment system ferometers, interference fringes can be recorded. Taking
(Franson and Jacobs, 1995), but did not pursue this line into account the /2 phase shift experienced upon re-
of research. It is interesting to note that replacing stan- ¬‚ection at a beamsplitter, the effect of the phase modu-

Rev. Mod. Phys., Vol. 74, No. 1, January 2002
Gisin et al.: Quantum cryptography

TABLE I. Implementation of the BB84 four-state protocol
with phase encoding.

Alice Bob
Bit value Bit value

0 0 0 0 0
0 0 /2 3 /2 ?
1 0 1
1 /2 /2 ?
0 /2 0 /2 ?
FIG. 14. Conceptual interferometric setup for quantum cryp- 0 /2 /2 0 0
tography using an optical ¬ber Mach-Zehnder interferometer: 1 3 /2 0 3 /2 ?
LD, laser diode; PM, phase modulator; APD, avalanche pho- 1 3 /2 /2 1

lators ( A and B ), and the path-length difference
Alice selected. When the phase difference equals /2 or
( L), the intensity in the output port labeled ˜˜0™™ is
3 /2, the bases are incompatible and the photon ran-
given by
domly chooses which port it takes at Bob™s coupler. This
kL scheme is summarized in Table I. We must stress that it
I 0 ¯ • cos2
I , (36) is essential with this scheme to keep the path difference
stable during a key exchange session. It should not
where k is the wave number and ¯ the intensity of the
I change by more than a fraction of a wavelength of the
source. If the phase term is equal to /2 n , where n is photons. A drift of the length of one arm would indeed
an integer, destructive interference is obtained. There- change the phase relation between Alice and Bob and
fore the intensity registered in port 0 reaches a mini- induce errors in their bit sequence.
mum, and all the light exits from port 1. When the phase It is interesting to note that encoding qubits with two-
term is equal to n , the situation is reversed: construc- path interferometers is formally isomorphic to polariza-
tive interference is obtained in port 0, while the intensity tion encoding. The two arms correspond to a natural
in port 1 goes to a minimum. With intermediate phase basis, and the weights c j of each qubit state
settings, light can be recorded in both ports. This device (c 1 e i /2,c 2 e i /2) are determined by the coupling ratio
acts like an optical switch. It is essential to keep the path of the ¬rst beamsplitter, while the relative phase is
difference stable in order to record stationary interfer- ´
introduced in the interferometer. The Poincare sphere
ences. representation, which applies to all two-level quantum
Although we have discussed the behavior of this inter- systems, can also be used to represent phase-coding
ferometer for classical light, it works exactly the same states. In this case, the azimuth angle represents the
when a single photon is injected. The probability of de- relative phase between the light that has propagated
tecting the photon in one output port can be varied by along the two arms. The elevation corresponds to the
changing the phase. It is the ¬ber optic version of coupling ratio of the ¬rst beamsplitter. States produced
Young™s double-slit experiment, in which the arms of the by a switch are on the poles, while those resulting from
interferometer replace the apertures. the use of a 50/50 beamsplitter lie on the equator. Figure
This interferometer combined with a single-photon 15 illustrates this analogy. Consequently, all polarization
source and photon-counting detectors can be used for schemes can also be implemented using phase coding.
QC. Alice™s setup consists of the source, the ¬rst coupler,
and the ¬rst phase modulator, while Bob takes the sec-
ond modulator and coupler, as well as the detectors. Let
us consider the implementation of the four-state BB84
protocol. On the one hand, Alice can apply one of four
phase shifts (0, /2, ,3 /2) to encode a bit value. She
associates 0 and /2 with bit 0, and and 3 /2 with bit
1. On the other hand, Bob performs a basis choice by
randomly applying a phase shift of either 0 or /2. He
associates the detector connected to the output port 0
with a bit value of 0, and the detector connected to port
1 with bit 1. When the difference of their phase is equal
to 0 or , Alice and Bob are using compatible bases and ´
FIG. 15. Poincare sphere representation of two-level quantum
they obtain deterministic results. In such cases, Alice states generated by two-path interferometers. The poles corre-
can infer from the phase shift she applied the output spond to the states generated by an interferometer in which
port chosen by the photon at Bob™s end and hence the the ¬rst coupler is replaced by a switch. The states generated
bit value he registered. Bob, on his side, deduces from with a symmetrical beamsplitter are on the equator. The azi-
the output port chosen by the photon the phase that muth indicates the phase between the two paths.

Rev. Mod. Phys., Vol. 74, No. 1, January 2002
170 Gisin et al.: Quantum cryptography

tally sensitive part of the system, provided that the
variations in the ¬ber are slower than their temporal
separations, determined by the interferometer™s imbal-
ance ( 5 ns). This condition is much less dif¬cult to
ful¬ll. In order to obtain good fringe visibility, and hence
a low error rate, the imbalances of the interferometers
must be equal to within a fraction of the coherence time
of the photons. This implies that the path differences
FIG. 16. Double Mach-Zehnder implementation of an inter- must be matched to within a few millimeters, which does
ferometric system for quantum cryptography: LD, laser diode; not constitute a problem. The imbalance must be chosen
PM, phase modulator; APD, avalanche photodiode. The inset so that it is possible to distinguish the three temporal
represents the temporal count distribution recorded as a func-
peaks clearly and thus discriminate interfering from
tion of the time passed since the emission of the pulse by Al-
noninterfering events. It must typically be larger than
ice. Interference is observed in the central peak.
the pulse length and the timing jitter of the photon-
counting detectors. In practice, the second condition is
Similarly, every coding using two-path interferometers the more stringent one. Assuming a time jitter of the
can be realized using polarization. However, in practice order of 500 ps, an imbalance of at least 1.5 ns keeps
one choice is often more convenient than the other, de- the overlap between the peaks low.
pending on circumstances like the nature of the quan- The main dif¬culty associated with this QC scheme is
tum channel.33 that the imbalances of Alice™s and Bob™s interferometers
must be kept stable to within a fraction of the wave-
length of the photons during a key exchange to maintain
1. The double Mach-Zehnder implementation
correct phase relations. This implies that the interferom-
Although the scheme presented in the previous sec- eters must lie in containers whose temperature is stabi-
tion works perfectly well on an optical table, it is impos- lized. In addition, for long key exchanges an active sys-
sible to keep the path difference stable when Alice and tem is necessary to compensate for drift.34 Finally, in
Bob are separated by more than a few meters. As men- order to ensure the indistinguishability of both interfer-
tioned above, the relative length of the arms should not ing processes, one must make sure that in each interfer-
change by more than a fraction of a wavelength. If Alice ometer the polarization transformation induced by the
and Bob are separated by 1 kilometer, for example, it is short path is the same as that induced by the long path.
clearly impossible to prevent path difference changes Both Alice and Bob must then use a polarization con-
smaller than 1 m caused by environmental variations. troller to ful¬ll this condition. However, the polarization
In his 1992 letter, Bennett also showed how to circum- transformation is rather stable in short optical ¬bers
vent this problem. He suggested using two unbalanced whose temperature is kept stable and which do not ex-
Mach-Zehnder interferometers, one for Alice and one perience strains. Thus this adjustment does not need to
for Bob, connected in series by a single optical ¬ber (see be repeated frequently.
Fig. 16). When monitoring counts as a function of the Paul Tapster and John Rarity of DERA, the Defence
time since the emission of the photons, Bob obtains Evalution and Research Agency (Malvern, England),
three peaks (see the inset in Fig. 16). The ¬rst one cor- working with Paul Townsend, were the ¬rst to test this
responds to the photons that chose the short path in system over a ¬ber optic spool of 10 km (Townsend
both Alice™s and Bob™s interferometers, while the last et al., 1993a, 1993b). Townsend later improved the inter-
one corresponds to photons that chose both the long ferometer by replacing Bob™s input coupler with a polar-
paths. Finally, the central peak corresponds to photons ization splitter to suppress the lateral noninterfering
that chose the short path in Alice™s interferometer and peaks (1994). In this case, it is again unfortunately nec-
the long one in Bob™s, and vice versa. If these two pro- essary to align the polarization state of the photons at
cesses are indistinguishable, they produce interference. Bob™s end, in addition to stabilizing the imbalance in the
A timing window can be used to discriminate between interferometers. He later thoroughly investigated key
interfering and noninterfering events. If the latter are exchange with phase coding and improved the transmis-
disregarded, it is then possible for Alice and Bob to ex- sion distance (Marand and Townsend, 1995; Townsend,
change a key. 1998b). He also tested the possibility of multiplexing a
The advantage of this setup is that both ˜˜halves™™ of
the photon travel in the same optical ¬ber. They thus
experience the same optical length in the environmen- 34
Polarization coding requires the optimization of three pa-
rameters (three parameters are necessary for unitary polariza-
tion control). In comparison, phase coding requires optimiza-
Note, in addition, that using many-path interferometers tion of only one parameter. This is possible because the
opens up the possibility of coding quantum systems of dimen- coupling ratios of the beamsplitters are ¬xed. Both solutions
sions larger than 2, like qutrits, ququarts, etc. (Bechmann- would be equivalent if one could limit the polarization evolu-
Pasquinucci and Peres, 2000; Bechmann-Pasquinucci and Tit- tion to rotations of the elliptic states without changes in the
tel, 2000; Bourennane, Karlsson, and Bjorn, 2001). ellipticity.

Rev. Mod. Phys., Vol. 74, No. 1, January 2002
Gisin et al.: Quantum cryptography

quantum channel using two different wavelengths with
conventional data transmission over a single optical ¬ber
(Townsend, 1997a). Richard Hughes and co-workers
from Los Alamos National Laboratory have also exten-
sively tested such an interferometer (1996; Hughes, Mor-
gan, and Peterson, 2000) up to distances of 48 km of
installed optical ¬ber.35

2. ˜˜Plug-and-play™™ systems

As discussed in the two previous sections, both polar-
ization and phase coding require active compensation of
FIG. 17. Evolution of the polarization state of a light pulse
optical path ¬‚uctuations. A simple approach would be to
represented on the Poincare sphere over a round-trip propa-
alternate between adjustment periods”when pulses
gation along an optical ¬ber terminated by a Faraday mirror.
containing large numbers of photons are exchanged be-
tween Alice and Bob to adjust the compensating system
correcting for slow drifts in phase or polarization”and symmetry through the equatorial plane: the north and
qubits transmission periods, when the number of pho- m ’(m 1 ,m 2 ,
south hemispheres are exchanged
tons is reduced to a quantum level. m 3 ) , or in terms of the qubit state vector,
An approach invented in 1989 by Martinelli, then at
CISE Tecnologie Innovative in Milano, allows one to 1 2

*. (37)
automatically and passively compensate for all polariza- 2 1
tion ¬‚uctuations in an optical ¬ber (see also Martinelli,
This is a simple representation, but some attention has
1992). Let us ¬rst consider what happens to the polar-
to be paid. This transformation is not unitary. Indeed,
ization state of a light pulse traveling through an optical
the above description switches from a right-handed ref-
¬ber, before being re¬‚ected by a Faraday mirror”a mir-
ror with a /4 Faraday rotator36 in front. We must ¬rst erence frame XYZ to a left-handed one XYZ , where
de¬ne a convenient description of the change in polar- Z Z. There is nothing wrong in doing this, and this
explains the nonunitary polarization transformation.37
ization of light re¬‚ected by a mirror at normal incidence.
Let the mirror be in the x-y plane and z be the optical Note that other descriptions are possible, but they re-
axis. Clearly, all linear polarization states are unchanged quire arti¬cially breaking the XY symmetry. The main
by a re¬‚ection. However, right-handed circular polariza- reason for choosing this particular transformation is that
tion is changed into left-handed and vice versa. Actually, the description of the polarization evolution in the opti-
after a re¬‚ection the rotation continues in the same cal ¬ber before and after the re¬‚ection is then straight-
sense, but since the propagation direction is reversed, forward. Indeed, let U e i B l /2 describe this evolu-
right-handed and left-handed polarizations are swapped.
tion under the effect of some modal birefringence B in a
The same holds for elliptic polarization states: the axes
¬ber section of length l (where is the vector whose
of the ellipse are unchanged, but right and left are ex-
components are the Pauli matrices). Then the evolution
changed. Accordingly, on a Poincare sphere the polar-
after re¬‚ection is simply described by the inverse opera-
ization transformation upon re¬‚ection is described by a
tor U 1 e i B l /2. Now that we have a description of
the mirror, let us add the Faraday rotator. It produces a
/2 rotation of the Poincare sphere around the north-
Note that in this experiment, Hughes and co-workers used i z /4 (see Fig. 17). Because the Fara-
south axis: F e
an unusually high mean number of photons per pulse. They
day effect is nonreciprocal (remember that it is due to a
used a mean photon number of approximately 0.6 in the cen-
magnetic ¬eld, which can be thought of as produced by a
tral interference peak, corresponding to a 1.2 in the pulses
spiraling electric current), the direction of rotation
leaving Alice. The latter value is the relevant one for eaves-
around the north-south axis is independent of the light
dropping analysis, since Eve could use an interferometer”
propagation direction. Accordingly, after re¬‚ection on
conceivable with present technology”in which the ¬rst cou-
pler was replaced by an optical switch and that allowed her to the mirror, the second passage through the Faraday ro-
exploit all the photons sent by Alice. In light of this high and tator rotates the polarization in the same direction (see
optical losses (22.8 dB), one may argue that this implementa- again Fig. 17) and is described by the same operator F.
tion was not secure, even when taking into account only so- Consequently, the total effect of a Faraday mirror is to
called realistic eavesdropping strategies (see Sec. VI.I). Finally,
it is possible to estimate the results that other groups would
have obtained if they had used a similar value of . One then
¬nds that key distribution distances of the same order could Note that this transformation is positive, but not completely
have been achieved. This illustrates that the distance is a some- positive. It is thus closely connected to the partial transposition
what arbitrary ¬gure of merit for a QC system. map (Peres, 1996). If several photons are entangled, then it is
These commercially available components are extremely crucial to describe all of them in frames with the same chirality.
compact and convenient when using telecommunications Actually that this is necessary is the content of the Peres-
wavelengths, which is not true for other wavelengths. Horodecki entanglement witness (Horodecki et al., 1996).

Rev. Mod. Phys., Vol. 74, No. 1, January 2002
172 Gisin et al.: Quantum cryptography

change any incoming polarization state into its orthogo-
nal state: m ’ m . This is best seen in Fig. 17 but can
also be expressed mathematically:
1 2

*. (38)
2 1
FIG. 18. Self-aligned plug-and-play system: LD, laser diode;
Finally, the whole optical ¬ber can be modeled as con-
APD, avalanche photodiode; Ci , ¬ber coupler; PMj , phase
sisting of a discrete number of birefringent elements. If
modulator; PBS, polarizing beamsplitter; DL, optical delay
there are N such elements in front of the Faraday mir-
line; FM, Faraday mirror; DA , classical detector.
ror, the change in polarization during a round trip can be
expressed (recall that the operator FTF only changes
realization of this scheme in greater detail: A short and
the sign of the corresponding Bloch vector m )
bright laser pulse is injected into the system through a
circulator. It splits at a coupler. One of the half pulses,
U 1 1 ¯ U N 1 FTFU N ¯ U 1 FTF. (39)
labeled P 1 , propagates through the short arm of Bob™s
setup directly to a polarizing beamsplitter. The polariza-
The output polarization state is thus orthogonal to the
tion transformation in this arm is set so that it is fully
input one, regardless of any birefringence in the ¬bers.
transmitted. P 1 is then sent through the ¬ber optic link.
This approach can thus correct for time-varying birefrin-
The second half pulse, labeled P 2 , takes the long arm to
gence changes, provided that they are slow compared to
the polarizing beamsplitter. The polarization evolution is
the time required for the light to make a round trip (a
such that P 2 is re¬‚ected. A phase modulator present in
few hundred microseconds).
this long arm is left inactive so that it imparts no phase
By combining this approach with time multiplexing in
shift to the outgoing pulse. P 2 is also sent through the
a long-path interferometer, it is possible to implement a
link, with a delay on the order of 200 ns. Both half
quantum cryptography system based on phase coding in
pulses travel to Alice. P 1 goes through a coupler. The
which all optical and mechanical ¬‚uctuations are auto-
diverted light is detected with a classical detector to pro-
matically and passively compensated for (Muller et al.,
vide a timing signal. This detector is also important in
1997). We performed the ¬rst experiment on such a sys-
preventing so-called Trojan horse attacks, which are dis-
tem in early 1997 (Zbinden et al., 1997), and a key was
cussed in Sec. VI.K. The nondiverted light then propa-
exchanged over a 23-km installed optical ¬ber cable (the
gates through an attenuator and an optical delay line”
same one as was used in the polarization coding experi-
consisting simply of an optical ¬ber spool”whose role
ments mentioned above). This setup featured a high in-
will be explained later. Finally, it passes a phase modu-
terference contrast (fringe visibility of 99.8%) and excel-
lator before being re¬‚ected by the Faraday mirror. P 2
lent long-term stability and clearly established the value
follows the same path. Alice brie¬‚y activates her modu-
of the approach for QC. The fact that no optical adjust-
lator to apply a phase shift on P 1 only, in order to en-
ments were necessary earned it the nickname of ˜˜plug-
code a bit value exactly as in the traditional phase-
and-play™™ setup. It is interesting to note that the idea of
coding scheme. The attenuator is set so that when the
combining time multiplexing with Faraday mirrors was
pulses leave Alice, they contain no more than a fraction
¬rst used to implement an ˜˜optical microphone™™
(Breguet and Gisin, 1995).38
´ of a photon. When they reach the polarizing beamsplit-
ter after their return trip through the link, the polariza-
However, our ¬rst realization still suffered from cer-
tion state of the pulses is exactly orthogonal to what it
tain optical inef¬ciencies, and it has been improved since
was when they left, thanks to the effect of the Faraday
then. Like the setup tested in 1997, the new system is
mirror. P 1 is then re¬‚ected instead of being transmitted.
based on time multiplexing, in which the interfering
It takes the long arm to the coupler. When it passes, Bob
pulses travel along the same optical path, but now, in
activates his modulator to apply a phase shift used to
different time ordering. A schematic is shown in Fig. 18.
implement his basis choice. Similarly, P 2 is transmitted
Brie¬‚y, the general idea is that pulses emitted at Bob™s
and takes the short arm. Both pulses reach the coupler
end can travel along one of two paths: they can go via
at the same time and they interfere. Single-photon de-
the short arm, be re¬‚ected at the Faraday mirror (FM)
tectors are then used to record the output port chosen
at Alice™s end, and ¬nally, back at Bob™s, setup travel via
by the photon.
the long arm. Or, they travel ¬rst via the long arm at
We implemented the four full-state BB84 protocol
Bob™s end, get re¬‚ected at Alice™s end, and return via the
with this setup. The system was tested once again on the
short arm of Bob™s setup. These two possibilities then
same installed optical ¬ber cable linking Geneva and
superpose on beamsplitter C 1 . We shall now explain the
Nyon (23 km; see Fig. 13) at 1300 nm, and we observed
a very low QBERopt 1.4% (Ribordy et al., 1998, 2000).
Proprietary electronics and software were developed to
Note that since then, we have used this interferometer for
allow for fully automated and user-friendly operation of
various other applications: a nonlinear index-of-refraction
the system. Because of the intrinsically bidirectional na-
measurement in ¬bers (Vinegoni, Wegmuller, and Gisin, 2000)
ture of this system, great attention had to be paid to
and an optical switch (Vinegoni, Wegmuller, Huttner, and Gi-
Rayleigh backscattering. Light traveling in an optical ¬-
sin, 2000).

Rev. Mod. Phys., Vol. 74, No. 1, January 2002
Gisin et al.: Quantum cryptography

ber undergoes scattering by inhomogeneities. A small
fraction ( 1%) of this light is recaptured by the ¬ber in
the backward direction. When the repetition rate is high
enough, pulses traveling to and from Alice must inter-
sect at some point along the line. Their intensity, how-
ever, is strongly different. The pulses are more than a
thousand times brighter before than after re¬‚ection
from Alice. Backscattered photons can accompany a FIG. 19. Implementation of sideband modulation: LD, laser
quantum pulse propagating back to Bob and induce diode; A, attenuator; PMi , optical phase modulator; j , elec-
false counts. We avoided this problem by making sure tronic phase controller; RFOk , radio frequency oscillator; FP,
that pulses traveling to and from Bob are not present in Fabry-Perot ¬lter; APD, avalanche photodiode.
the line simultaneously. They are emitted by Bob in the
form of trains. Alice stores these trains in her optical of optical waves (approximately 200 THz at 1550 nm),
delay line, which consists of an optical ¬ber spool. Bob this condition is dif¬cult to ful¬ll. One solution is to use
waits until all the pulses of a train have reached him self-aligned systems like the plug-and-play setups dis-
before sending the next one. Although it completely cussed in the previous section. Goedgebuer and his team
solves the problem of Rayleigh backscattering-induced from the University of Besancon, in France, introduced
errors, this con¬guration has the disadvantage of reduc- an alternative solution (Sun et al., 1995; Mazurenko
ing the effective repetition frequency. A storage line half ´
et al., 1997; Merolla et al., 1999; see also Molotkov,
as long as the transmission line amounts to a reduction 1998). Note that the title of this section is not completely
of the bit rate by a factor of approximately 3. accurate, since the value of the qubits is coded not in the
Researchers at IBM simultaneously and indepen- frequency of the light, but in the relative phase between
dently developed a similar system at 1300 nm (Bethune sidebands of a central optical frequency.
and Risk, 2000). However, they avoided the problems Their system is depicted in Fig. 19. A source emits
associated with Rayleigh backscattering by reducing the short pulses of classical monochromatic light with angu-
intensity of the pulses emitted by Bob. Since these could lar frequency S . A ¬rst phase modulator PMA modu-
not be used for synchronization purposes any longer, lates the phase of this beam with a frequency S and
they added a wavelength-multiplexed classical channel a small modulation depth. Two sidebands are thus gen-
(1550 nm) in the line to allow Bob and Alice to synchro- erated at frequencies S . The phase modulator is
nize their systems. They tested their setup on a 10-km driven by a radio-frequency oscillator RFOA whose
optical ¬ber spool. Both of these systems are equivalent phase A can be varied. Finally, the beam is attenuated
and exhibit similar performances. In addition, the group so that the sidebands contain much less than one photon
of Anders Karlsson at the Royal Institute of Technology per pulse, while the central peak remains classical. After
in Stockholm veri¬ed in 1999 that this technique also the transmission link, the beam experiences a second
works at a wavelength of 1550 nm (Bourennane et al., phase modulation applied by PMB . This phase modula-
1999, 2000). These experiments demonstrate the poten- tor is driven by a second radio-frequency oscillator
tial of plug-and-play-like systems for real-world quan- RFOB with the same frequency and phase B . These
tum key distribution. They certainly constitute a good oscillators must be synchronized. After passing through
candidate for the realization of prototypes. this device, the beam contains the original central fre-
Their main disadvantage with respect to the other sys- quency S , the sidebands created by Alice, and the
tems discussed in this section is that they are more sen- sidebands created by Bob. The sidebands at frequencies
sitive to Trojan horse strategies (see Sec. VI.K). Indeed, are mutually coherent and thus yield interfer-
Eve could send a probe beam and recover it through the ence. Bob can then record the interference pattern in
strong re¬‚ection by the mirror at the end of Alice™s sys- these sidebands after removal of the central frequency
tem. To prevent such an attack, Alice adds an attenuator and the higher-order sidebands with a spectral ¬lter.
to reduce the amount of light propagating through her To implement the B92 protocol (see Sec. II.D.1), Al-
system. In addition, she must monitor the incoming in- ice randomly chooses the value of the phase A for
tensity using a classical linear detector. Systems based on each pulse. She associates a bit value of 0 with phase 0
this approach cannot be operated with a true single- and a bit value of 1 with phase . Bob also randomly
photon source and thus will not bene¬t from the chooses whether to apply a phase B of 0 or . One can
progress in this ¬eld.39 see that if A 0, the interference is constructive
and Bob™s single-photon detector has a nonzero prob-
D. Frequency coding ability of recording a count. This probability depends on
the number of photons initially present in the sideband,
Phase-based systems for QC require phase synchroni- as well as on the losses induced by the channel. On the
zation and stabilization. Because of the high frequency other hand, if A , interference is destructive,
and no count will ever be recorded. Consequently, Bob
can infer, every time he records a count, that he applied
39 the same phase as Alice. When a given pulse does not
The fact that the pulses make a round trip implies that
yield a detection, the reason can be that the phases ap-
losses are doubled, yielding a reduced counting rate.

Rev. Mod. Phys., Vol. 74, No. 1, January 2002
174 Gisin et al.: Quantum cryptography

plied were different and destructive interference took and-play systems. In addition, if this system is to be truly
independent of polarization, it is essential to ensure that
place. It can also mean that the phases were actually
the phase modulators have very low polarization depen-
equal, but the pulse was empty or the photon got lost.
dency. In addition, the stability of the frequency ¬lter
Bob cannot decide between these two possibilities.
may constitute a practical dif¬culty.
From a conceptual point of view, Alice sends one of two
nonorthogonal states. There is then no way for Bob to
distinguish between them deterministically. However, he
can perform a generalized measurement, also known as E. Free-space line-of-sight applications
a positive operator value measurement, which will some-
Since optical ¬ber channels may not always be avail-
times fail to give an answer, but at all other times gives
able, several groups are trying to develop free-space
the correct one.
line-of-sight QC systems capable, for example, of dis-
Eve could perform the same measurement as Bob.
tributing a key between building rooftops in an urban
When she obtains an inconclusive result, she could just
block both the sideband and the central frequency so
Of course it may sound dif¬cult to detect single pho-
that she does not have to guess a value and does not risk
tons amidst background light, but the ¬rst experiments
introducing an error. To prevent her from doing that,
have already demonstrated the feasibility of free-space
Bob veri¬es the presence of this central frequency. Now
QC. Sending photons through the atmosphere also has
if Eve tries to conceal her presence by blocking only the
advantages, since this medium is essentially nonbirefrin-
sideband, the reference central frequency will still have
gent (see Sec. III.B.4). It is then possible to use plain
a certain probability of introducing an error. It is thus
polarization coding. In addition, one can ensure very
possible to catch Eve in both cases. The monitoring of
high channel transmission over long distances by care-
the reference beam is essential in all two-state protocols
fully choosing the wavelength of the photons (see again
to reveal eavesdropping. In addition, it was shown that
Sec. III.B.4). The atmosphere has, for example, a high
this reference-beam monitoring can be extended to the
transmission ˜˜window™™ in the vicinity of 770 nm (trans-
four-state protocol (Huttner et al., 1995).
mission as high as 80% can occur between a ground
The advantage of this setup is that the interference is
station and a satellite), which happens to be compatible
controlled by the phase of the radio-frequency oscilla-
with commercial silicon APD photon-counting modules
tors. Their frequency is six orders of magnitude smaller
(detection ef¬ciency can be as high as 65% with low
than the optical frequency and thus considerably easier
to stabilize and synchronize. It is indeed a relatively
The systems developed for free-space applications are
simple task, which can be achieved by electronic means.
actually very similar to that shown in Fig. 12. The main
The Besancon group performed key distribution with
difference is that the emitter and receiver are connected
such a system. The source they used was a distributed
by telescopes pointing at each other, instead of by an
Bragg re¬‚ector (DBR) laser diode at a wavelength of
optical ¬ber. The contribution of background light to
1540 nm and a bandwidth of 1 MHz. It was externally
errors can be maintained at a reasonable level by using a
modulated to obtain 50-ns pulses, thus increasing the
combination of timing discrimination (coincidence win-
bandwidth to about 20 MHz. They used two identical
dows of typically a few nanoseconds), spectral ¬ltering
LiNbO3 phase modulators operating at a frequency
(interference ¬lters 1 nm), and spatial ¬ltering (cou-
/2 300 MHz. Their spectral ¬lter was a Fabry-Perot
pling into an optical ¬ber). This can be illustrated by the
cavity with a ¬nesse of 55. Its resolution was 36 MHz.
following simple calculation. Let us suppose that
They performed key distribution over a 20-km single-
the isotropic spectral background radiance is
mode optical ¬ber spool, recording a QBERopt contri-
10 2 W m 2 nm 1 sr 1 at 800 nm. This corresponds to
bution of approximately 4%. They estimated that 2%
the spectral radiance of a clear zenith sky with a sun
could be attributed to the transmission of the central
elevation of 77° (Zissis and Larocca, 1978). The diver-
frequency by the Fabry-Perot cavity. Note also that the
gence of a Gaussian beam with radius w 0 is given by
detector noise was relatively high due to the long pulse
/w 0 . The product of beam (telescope) cross sec-
durations. Both these errors could be lowered by in-
tion and solid angle, which is a constant, is therefore
creasing the separation between the central peak and
w2 2 2
. By multiplying the radiance by 2 , one
the sidebands, allowing reduced pulse widths and hence 0
shorter detection times and lower dark counts. Never- obtains the spectral power density. With an interference
theless, a compromise must be found since, in addition ¬lter of 1-nm width, the power incident on the detector
is 6 10 15 W, corresponding to 2 104 photons per sec-
to the technical drawbacks of high-speed modulation,
ond or 2 10 5 photons per nanosecond. This quantity
the polarization transformation in an optical ¬ber de-
pends on the wavelength. The remaining 2% of the is approximately two orders of magnitude larger than
QBERopt is due to polarization effects in the setup. the dark-count probability of Si APD™s, but still compat-
This system is another possible candidate. Its main ible with the requirements of QC. The performance of
advantage is that it could be used with a true single- free-space QC systems depends dramatically on atmo-
photon source if it existed. On the other hand, the con- spheric conditions and air quality. This is problematic for
tribution of imperfect interference visibility to the error urban applications where pollution and aerosols degrade
rate is signi¬cantly higher than that measured with plug- the transparency of air.

Rev. Mod. Phys., Vol. 74, No. 1, January 2002
Gisin et al.: Quantum cryptography

The ¬rst free-space QC experiment over a distance
of more than a few centimeters40 was performed by Ja-
cobs and Franson in 1996. They exchanged a key over a
distance of 150 m in a hallway illuminated with standard
¬‚uorescent lighting and over 75 m outdoors in bright
daylight without excessive QBER. Hughes and his team
were the ¬rst to exchange a key over more than one
FIG. 20. Multi-user implementation of quantum cryptography
kilometer under outdoor nighttime conditions (Buttler
with one Alice connected to three Bobs by optical ¬bers. The
et al., 1998; Hughes, Buttler, et al., 2000). More recently,
photons sent by Alice randomly choose to go to one or the
they even improved their system to reach a distance of
other Bob at a coupler.
1.6 km under daylight conditions (Buttler et al., 2000).
Finally, Rarity and co-workers performed a similar ex-
periment, in which they exchanged a key over a distance (Townsend et al., 1994; Phoenix et al., 1995; Townsend,
of 1.9 km under nighttime conditions (Gorman et al., 1997b). They used a passive optical ¬ber network archi-
2001). tecture in which one Alice, the network manager, is con-
Until quantum repeaters become available and allow nected to multiple network users (i.e., many Bobs; see
us to overcome the distance limitation of ¬ber-based Fig. 20). The goal is for Alice to establish a veri¬ably
QC, free-space systems seem to offer the only possibility secure and unique key with each Bob. In the classical
for QC over distances of more than a few dozen kilome- limit, the information transmitted by Alice is gathered
ters. A QC link could be established between ground- by all Bobs. However, because of their quantum behav-
based stations and a low-orbit (300“1200 km) satellite. ior, the photons are effectively routed at the beamsplit-
The idea is for Alice and Bob to each exchange a key ter to one, and only one, of the users. Using the double
(k A and k B , respectively) with the same satellite, using
Mach-Zehnder con¬guration discussed above, they
QC. Then the satellite publicly announces the value K
tested such an arrangement with three Bobs. Neverthe-
k A  k B , where  represents the XOR operator or,
less, because of the fact that QC requires a direct and
equivalently, the binary addition modulo 2 without carry.
low-attenuation optical channel between Alice and Bob,
Bob subtracts his key from this value to recover Alice™s
the ability to implement it over large and complex net-
key (k A Kk B ). 41 The fact that the key is known to
works appears limited.
the satellite operator may at ¬rst be seen as a disadvan-
tage. But this point might actually be conducive to the
development of QC, since governments always like to V. EXPERIMENTAL QUANTUM CRYPTOGRAPHY WITH
control communications. Although it has not yet been PHOTON PAIRS
demonstrated, Hughes as well as Rarity have
estimated”in view of their free-space experiments” The possibility of using entangled photon pairs for
that the dif¬culty can be overcome. The main dif¬culty quantum cryptography was ¬rst proposed by Ekert in
would come from beam pointing”do not forget that the 1991. In a subsequent paper, he investigated, with other
satellites will move with respect to the ground”and researchers, the feasibility of a practical system (Ekert
wandering induced by turbulence. In order to minimize et al., 1992). Although all tests of Bell™s inequalities (for
the latter problem, the photons would in practice prob- a review see, for example, Zeilinger, 1999) can be seen
ably be sent down from the satellite. Atmospheric tur-
as experiments in quantum cryptography, systems spe-
bulence is concentrated almost entirely in the ¬rst kilo-
ci¬cally designed to meet the special requirements of
meter above the earth™s surface. Another possibile way
QC, like quick changes of basis, have been implemented
to compensate for beam wander is to use adaptative op-
only recently.42 In 1999, three groups demonstrated
tics. Free-space QC experiments over distances of about
quantum cryptography based on the properties of en-
2 km constitute a major step towards key exchange
tangled photons. Their results were reported in the same
with a satellite. According to Buttler et al. (2000), the
issue of Phys. Rev. Lett. (Jennewein, Simon, et al., 2000;
optical depth is indeed similar to the effective atmo-
Naik et al., 2000; Tittel et al., 2000), illustrating the rapid
spheric thickness that would be encountered in a
progress in the still new ¬eld of quantum communica-
surface-to-satellite application.
One advantage of using photon pairs for QC is the
F. Multi-user implementations
fact that one can remove empty pulses, since the detec-
Paul Townsend and colleagues have investigated the
application of QC over multi-user optical ¬ber networks
This de¬nition of quantum cryptography applies to the fa-
mous experiment by Aspect and co-workers testing Bell™s in-
equalities with time-varying analyzers (Aspect et al., 1982). QC
Remember that Bennett and co-workers performed the
had, however, not yet been invented. It also applies to the
¬rst demonstration of QC over 30 cm in air (Bennett, Bessette,
more recent experiments closing locality loopholes, like the
et al., 1992).
one performed in Innsbruck using fast polarization modulators
This scheme could also be used with optical ¬ber implemen-
(Weihs et al., 1998) or the one performed in Geneva using two
tation provided that secure nodes existed. In the case of a
analyzers on each side (Tittel et al., 1999; Gisin and Zbinden,
satellite, one tacitly assumes that it constitutes such a secure

Rev. Mod. Phys., Vol. 74, No. 1, January 2002
176 Gisin et al.: Quantum cryptography

tion of one photon of a pair reveals the presence of a
companion. In principle, it is thus possible to have a
probability of emitting a nonempty pulse equal to one.43
It is bene¬cial only because currently available single-
photon detectors feature a high dark-count probability.
The dif¬culty of always collecting both photons of a pair


. 2
( 4)