. 2
( 3)


We thus see that the optimal operating parameters, from Germanium or InGaAs/InP semiconductor materi-
voltage, temperature and dead time (i.e. maximum count als. In the third window (1.55 µm), the only option is
rate) depend on the very application. Besides, since the InGaAs/InP APDs.
relative magnitude of e¬ciency, thermal noise and af- Photon counting with Germanium APDs, although
ter pulses varies with the type of semiconductor material known for 30 years (Haecker, Groezinger and Pilkuhn
used, no general solution exists. In the two next para- 1971), started to be used in the domain of quantum com-
graphs we brie¬‚y present the di¬erent types of APDs. munication with the need of transmitting single photons
The ¬rst paragraph focuses on Silicon APDs which en- over long distances using optical ¬bers, hence with the
able the detection of photons at wavelengths below 1µm, necessity to work at telecommunications wavelength. In
the second one comments on Germanium and on Indium 1993, Townsend, Rarity and Tapster (Townsend et al.
Gallium Arsenide APDs for photon counting at telecom- 1993a) implemented a single photon interference scheme
munication wavelength. The di¬erent behaviour of the for quantum cryptography over a distance of 10 km, and
three types is shown in Fig. 9. Although the best ¬g- in 1994, Tapster, Rarity and Owens (1994) demonstrated
ure of merit for quantum cryptography is the ratio of a violation of Bell inequalities over 4 km. These experi-
dark count rate R per time unit to detection e¬ciency ·, ments where the ¬rst ones to take advantage of Ge APDs
we depict here the better-known noise equivalent power operated in passively quenched Geiger mode. At a tem-
NEP which shows similar behaviour. The NEP is de- perature of 77K which can be achieved using either liquid
¬ned as the optical power required to measure a unity nitrogen or Stirling engine cooling, typical quantum ef-
signal-to-noise ratio, and is given by ¬ciencies of about 15 % at dark count rates of 25 kHz
can be found (Owens et al. 1994), and time jitter down
hν √
N EP = 2R. (25) to 100 ps have been observed (Lacaita et al. 1994) “ a
normal value being 200-300 ps.
Here, h is Planck™s constant and ν is the frequency of the Traditionally, Germanium APDs have been imple-
impinging photons. mented in the domain of long-distance quantum com-
munication. However, this type of diode is currently get-
ting replaced by InGaAs APDs and it is more and more
1. Photon counting at wavelengths below 1.1 µm di¬cult to ¬nd Germanium APDs on the market. Mo-
tivated by pioneering research reported already in 1985
Since the beginning of the 80™s, a lot of work has (Levine, Bethea and Campbell 1985), latest research fo-
been done to characterize Silicon APDs for single pho- cusses on InGaAs APDs, allowing single photon detection
ton counting (Ingerson 1983, Brown 1986, Brown 1987, in both telecommunication windows. Starting with work
Brown 1989, Spinelli 1996), and the performance of Si- by Zappa et al. (1994), InGaAs APDs as single photon
APDs has continuously been improved. Since the ¬rst counters have meanwhile been characterized thoroughly
test of Bell inequality using Si-APDs by Shih and Al- (Lacaita et al. 1996, Ribordy et al. 1998, Hiskett et al.
ley in 1988, they have completely replaced the photo- 2000, Karlsson et al. 1999, and Rarity et al. 2000, Stucki
multipliers used until then in the domain of fundamental et al. 2001), and ¬rst implementations for quantum cryp-
quantum optics, known now as quantum communication. tography have been reported (Ribordy 1998, Bourennane
Today, quantum e¬ciencies of up to 76% (Kwiat et al. et al. 1999, Bethune and Risk 2000, Hughes et al. 2000b,
1993) and time jitter down to 28 ps (Cova et al. 1989) Ribordy et al. 2000). However, if operating Ge APDs
have been reported. Commercial single photon counting is already inconvenient compared to Silicon APDs, the
modules are available (EG&G SPCM-AQ-151), featuring handiness of InGaAs APDs is even worse, the problem
quantum e¬ciencies of 70 % at a wavelength of 700 nm, a being a extremely high afterpulse fraction. Therefore,
time jitter of around 300 psec and maximum count rates operation in passive quenching mode is impossible for
larger than 5 MHz. Temperatures of -20oC “ su¬cient to applications where noise is crucial. In gated mode, In-
keep thermally generated dark counts as low as 50 Hz “ GaAs APDs feature a better performance for single pho-
can easily be achieved using Peltier cooling. Single pho- ton counting at 1.3 µm compared to Ge APDs. For in-
ton counters based on Silicon APDs thus o¬er an almost stance, at a temperature of 77 K and a dark count prob-
ability of 10’5 per 2.6 ns gate, quantum e¬ciencies of
perfect solution for all applications where photons of a
wavelength below 1 µm can be used. Apart from funda- around 30% and of 17% have been reported for InGaAs
mental quantum optics, this includes quantum cryptog- and Ge APDs, respectively (Ribordy et al. 1998), while
raphy in free space and in optical ¬bers, however, due to the time jitter of both devices is comparable. If working
high losses, the latter one only over short distances. at a wavelength of 1.55 µm, the temperature has to be
increased for single photon detection. At 173 K and a
dark count rate of now 10’4 , a quantum e¬ciency of 6%
2. Photon counting at telecommunication wavelengths can still be observed using InGaAs/InP devices while the
same ¬gure for Germanium APDs is close to zero.
When working in the second telecommunication win- To date, no industrial e¬ort has been done to opti-
dow (1.3µm), one has to take advantage of APDs made mize APDs operating at telecommunication wavelength

for photon counting, and their performance is still far In the BB84 protocol Alice has to choose randomly
behind the one of Silicon APDs26 . However, there is between four di¬erent states and Bob between two bases.
no fundamental reasons why photon counting at wave- The limited random number generation rate may force
lengths above 1 µm should be more delicate than below, Alice to produce her numbers in advance and store them,
except that the photons are less energetic. The real rea- opening a security weakness. On Bob™s side the random
sons for the lack of commercial products are, ¬rst, that bit creation rate can be lower since, in principle, the basis
Silicon, the most common semiconductor, is not sensitive must be changed only after a photon has been detected,
(the band gap is too large), and secondly that the mar- which normally happens at rates below 1 MHz. However,
ket for photon counting is not yet mature. But, without one has to make sure that this doesn™t give the spy an
great risk, one can forecast that good commercial pho- opportunity for a Trojan horse attack (see section VI K)!
ton counters will become available in the near future, and An elegant con¬guration integrating the random num-
that this will have a major impact on quantum cryptog- ber generator into the QC system consists in using a pas-
raphy. sive choice of bases, as discussed in chapter V (Muller et
al. 1993). However, the problem of detector induced
correlation remains.
D. Quantum random number generators

E. Quantum repeaters
The key used in the one-time-pad must be secret and
used only once. Consequently, it must be as long as the
message and must be perfectly random. The later point Todays ¬ber based QC systems are limited to tens of
proves to be a delicate and interesting one. Computers kilometers. This is due to the combination of ¬ber losses
are deterministic systems that cannot create truly ran- and detectors™ noise. The losses by themselves do only
dom numbers. But all secure cryptosystems, both classi- reduce the bit rate (exponentially with the distance), but
cal and quantum ones, require truly random numbers27 ! with perfect detectors the distance would not be limited.
Hence, the random numbers must be created by a ran- However, because of the dark counts, each time a pho-
dom physical process. Moreover, to make sure that the ton is lost there is a chance that a dark count produces
random process is not merely looking random with some an error. Hence, when the probability of a dark count
hidden deterministic pattern, it is necessary that it is becomes comparable to the probability that a photon
completely understood. It is thus of interest to imple- is correctly detected, the signal to noise ratio tends to
ment a simple process in order to gain con¬dence in its 0 (more precisely the mutual information I(±, β) tends
to a lower bound29 ). In this section we brie¬‚y explain
proper operation.
A natural solution is to rely on the random choice of how the use of entangled photons and of entanglement

a single photon at a beamsplitter28 (Rarity et al. 1994). swapping (Zukowski et al. 1993) could open ways to
In this case the randomness is in principle guaranteed by extend the achievable distances in a foreseeable future
the laws of quantum mechanics, though, one still has to (some prior knowledge of entanglement swapping is as-
be very careful not to introduce any experimental arte- sumed). Let us denote tlink the transmission coe¬cient
fact that could correlate adjacent bits. Di¬erent experi- (i.e. tlink =probability that a photon sent by Alice gets
mental realizations have been demonstrated (Hildebrand to one of Bob™s detectors), · the detectors™ e¬ciency and
2001, Stefanov et al. 2000, Jennewein et al. 2000a) pdark the dark count probability per time bin. With a
and prototypes are commercially available (www.gap- perfect single photon source, the probability Praw of a
optique.unige.ch). One particular problem is the dead- correct qubit detection reads: Praw = tlink ·, while the
time of the detectors, that may introduce a strong an- probability Pdet of an error is: Pdet = (1 ’ tlink ·)pdark .
ticorrelation between neighboring bits. Similarly, after- Accordingly, the QBER= Prawdet det and the normalized
pulses may provoke a correlation. These detector-related net rate reads: ρnet = (Praw + Pdet ) · f ct(QBER) where
e¬ects increase with higher pulse rates, limiting the bit the function f ct denotes the fraction of bits remaining
rate of quantum number generator to some MHz. after error correction and privacy ampli¬cation. For the
sake of illustration we simply assume a linear dependence
dropping to zero for QBER≥ 15% (This simpli¬cation
does not a¬ect the qualitative results of this section.
For a more precise calculation, see L¨ tkenhaus 2000.):
The ¬rst commercial photon counter at telecommunication
wavelengths came out only this year (Hamamatsu photomul-
tiplier R5509-72). However, the e¬ciency does not yet allow
an implementation for quantum cryptography.
The pin number that the bank attributes to your credit 29
The absolute lower bound is 0, but dependening on the
card must be random. If not, someone knows it! assumed eavesdropping strategy, Eve could take advantage of
Strictly speaking, the choice is made only once the photons the losses. In the latter case, the lower bound is given by her
are detected at one of the outports. mutual information I(±, «).

f ct(QBER) = 1 ’ QBER . The corresponding net rate IV. EXPERIMENTAL QUANTUM
ρnet is displayed on Fig. 10. Note that it drops to zero CRYPTOGRAPHY WITH FAINT LASER
near 90 km. PULSES
Let us now assume that instead of a perfect single-
photon source, Alice and Bob use a (perfect) 2-photon Experimental quantum key distribution was demon-
source set in the middle of their quantum channel. Each strated for the ¬rst time in 1989 (it was published only

photon has then a probability tlink to get to a detec- in 1992 by Bennett et al. 1992a). Since then, tremen-
tor. The probability of a correct joined detection is thus dous progress has been made. Today, several groups have
Praw = tlink√2 , while an error occurs with probability
· shown that quantum key distribution is possible, even
√ √
P det = (1 ’ tlink ·)2 p2 + 2 tlink ·(1 ’ tlink ·)pdark outside the laboratory. In principle, any two-level quan-
(both photon lost and 2 dark counts, or one photon tum system could be used to implement QC. In practice,
lost and one dark count). This can be conveniently all implementations have relied on photons. The reason
rewritten as: Praw = tlink · n and Pdet = (tlink · + (1 ’ is that their interaction with the environment, also called
decoherence, can be controlled and moderated. In addi-
tlink ·)pdark )n ’ tlink · n valid for any division of the link
tion, researchers can bene¬t from all the tools developed
into n equal-length sections and n detectors. Note that
in the past two decades for optical telecommunications.
the measurements performed at the nodes between Alice
It is unlikely that other carriers will be employed in the
and Bob do transmit (swap) the entanglement to the twin
foreseeable future.
photons, without revealing any information about the
Comparing di¬erent QC-setups is a di¬cult task, since
qubit (these measurements are called Bell-measurements
several criteria must be taken into account. What mat-
and are the core of entanglement swapping and of quan-
ters in the end is of course the rate of corrected secret bits
tum teleportation). The corresponding net rates are dis-
(distilled bit rate, Rdist ) that can be transmitted and the
played in Fig. 10. Clearly, the rates for short distances
transmission distance. One can already note that with
are smaller when several detectors are used, because of
present and near future technology, it will probably not
their limited e¬ciencies (here we assume · = 10%). But
be possible to achieve rates of the order of gigahertz,
the distance before the net rate drops to zero is extended
nowadays common with conventional optical communi-
to longer distances! Intuitively, this can be understood
cation systems (in their comprehensive paper published
as follows. Let™s consider that a logical qubit propagates
in 2000, Gilbert and Hamrick discuss practical methods
from Alice to Bob (although some photons propagate in
to achieve high bit rate QC). This implies that encryp-
the opposite direction). Then, each 2-photon source and
tion with a key exchanged through QC is to be limited
each Bell-measurement acts on this logical qubit as a kind
to highly con¬dential information. While the determina-
of QND measurement: they test whether the logical qubit
tion of the transmission distance and rate of detection
is still there! In this way, Bob activates his detectors only
(the raw bit rate, Rraw ) is straightforward, estimating
when there is a large chance tlink that the photon gets
the net rate is rather di¬cult. Although in principle er-
to his detectors.
rors in the bit sequence follow only from tampering by
Note that if in addition to the detectors™ noise there
a malevolent eavesdropper, the situation is rather dif-
is noise due to decoherence, then the above idea can be
ferent in reality. Discrepancies in the keys of Alice and
extended, using entanglement puri¬cation. This is essen-
Bob also always happen because of experimental imper-
tially the idea of quantum repeaters (Briegel et al. 1998,
fections. The error rate (here called quantum bit error
Dur et al. 1999).
rate, or QBER) can be easily determined. Similarly, the
error correction procedure is rather simple. Error cor-
rection leads to a ¬rst reduction of the key rate that de-
pends strongly on the QBER. The real problem consist
in estimating the information obtained by Eve, a quan-
tity necessary for privacy ampli¬cation. It does not only
depend on the QBER, but also on other factors, like the
photon number statistics of the source, or the way the
choice of the measurement basis is made. Moreover in
a pragmatic approach, one might also accept restrictions
on Eve™s technology, limiting her strategies and there-
fore also the information she can obtain per error she
introduces. Since the e¬ciency of privacy ampli¬cation
rapidly decreases when the QBER increases, the distilled
bit rate depends dramatically on Eve™s information and
hence on the assumptions made. One can de¬ne as the
maximum transmission distance, the distance where the
distilled rate reaches zero. This can give an idea of the

di¬culty to evaluate a QC system from a physical point product of the sifted key rate and the probability popt of
of view. a photon going in the wrong detector:
Technological aspects must also be taken into account.
In this article we do not focus on all the published per- Ropt = Rsif t popt = q frep µ tlink popt · (28)
formances (in particular not on the key rates), which
strongly depend on present technology and the ¬nancial This contribution can be considered, for a given set-up,
possibilities of the research teams having carried out the as an intrinsic error rate indicating the suitability to use
experiments. On the contrary, we try to weight the in- it for QC. We will discuss it below in the case of each
trinsic technological di¬culties associated with each set- particular system.
up and to anticipate certain technological advances. And The second contribution, Rdet , arises from the detector
last but not least the cost of the realization of a prototype dark counts (or from remaining environmental stray light
should also be considered. in free space setups). This rate is independent of the bit
In this chapter, we ¬rst deduce a general formula for rate31 . Of course, only dark counts falling in a short time
the QBER and consider its impact on the distilled rate. window when a photon is expected give rise to errors.
We then review faint pulses implementations. We class
them according to the property used to encode the qubits
Rdet = frep pdark n (29)
value and follow a rough chronological order. Finally, we 22
assess the possibility to adopt the various set-ups for the
where pdark is the probability of registering a dark count
realization of an industrial prototype. Systems based on
per time-window and per detector, and n is the number of
entangled photon pairs are presented in the next chapter.
detectors. The two 1 -factors are related to the fact that
a dark count has a 50% chance to happen with Alice and
Bob having chosen incompatible bases (thus eliminated
A. Quantum Bit Error Rate
during sifting) and a 50% chance to arise in the correct
The QBER is de¬ned as the number of wrong bits to
Finally error counts can arise from uncorrelated pho-
the total number of received bits30 and is normally in
tons, because of imperfect photon sources:
the order of a few percent. In the following we will use
it expressed as a function of rates: 11
Racc = pacc frep tlink n· (30)
Nwrong Rerror Rerror
QBER = = ≈
This factor appears only in systems based on entangled
Nright + Nwrong Rsif t + Rerror Rsif t
photons, where the photons belonging to di¬erent pairs
but arriving in the same time window are not necessarily
in the same state. The quantity pacc is the probability to
where the sifted key corresponds to the cases in which
¬nd a second pair within the time window, knowing that
Alice and Bob made compatible choices of bases, hence
a ¬rst one was created32 .
its rate is half that of the raw key.
The QBER can now be expressed as follows:
The raw rate is essentially the product of the pulse
rate frep , the mean number of photon per pulse µ, the Ropt + Rdet + Racc
QBER = (31)
probability tlink of a photon to arrive at the analyzer and
Rsif t
the probability · of the photon being detected:
pdark · n pacc
= popt + + (32)
tlink · · · 2 · q · µ 2 · q · µ
1 1
Rsif t = Rraw = q frep µ tlink · (27)
= QBERopt + QBERdet + QBERacc (33)
2 2
The factor q (q¤1, typically 1 or 2 ) must be introduced We analyze now these three contributions. The ¬rst
for some phase-coding setups in order to correct for non- one, QBERopt , is independent on the transmission dis-
interfering path combinations (see, e.g., sections IV C tance (it is independent of tlink ). It can be considered as
and V B). a measure of the optical quality of the setup, depending
One can distinguish three di¬erent contributions to only on the polarisation or interference fringe contrast.
Rerror . The ¬rst one arises because of photons ending
up in the wrong detector, due to unperfect interference
or polarization contrast. The rate Ropt is given by the
This is true provided that afterpulses (see section III C)
do not contribute to the dark counts.
Note that a passive choice of measurement basis implies
In the followin we are considering systems implementing that four detectors (or two detectors during two time win-
the BB84 protocol. For other protocols some of the formulas dows) are activated for every pulse, leading thus to a doubling
have to be slightly adapted. of Rdet and Racc .

The technical e¬ort needed to obtain, and more impor- rate after error correction and privacy ampli¬cation) for
tant, to maintain a given QBERopt is an important crite- di¬erent wavelengths as shown in Fig. 11. There is ¬rst
rion for evaluating di¬erent QC-setups. In polarization an exponential decrease, then, due to error correction
based systems, it™s rather simple to achieve a polarisa- and privacy ampli¬cation, the bit rates fall rapidly down
tion contrast of 100:1, corresponding to a QBERopt of to zero. This is most evident comparing the curves 1550
1%. In ¬ber based QC, the problem is to maintain this nm and 1550 nm “single” since the latter features 10
value in spite of polarisation ¬‚uctuations and depolarisa- times less QBER. One can see that the maximum range
tion in the ¬ber link. For phase coding setups, QBERopt is about 100 km. In practice it is closer to 50 km, due
and the interference visibility are related by to non-ideal error correction and privacy ampli¬cation,
multiphoton pulses and other optical losses not consid-
1’V ered here. Finally, let us mention that typical key cre-
QBERopt = (34)
2 ation rates of the order of a thousand bits per second over
distances of a few tens of kilometers have been demon-
A visibility of 98% translates thus into an optical error
strated experimentally (see, for example, Ribordy et al.
rate of 1%. Such a value implies the use of well aligned
2000 or Townsend 1998b).
and stable interferometers. In bulk optics perfect mode
overlap is di¬cult to achieve, but the polarization is sta-
ble. In single-mode ¬ber interferometers, on the contrary,
B. Polarization coding
perfect mode overlap is automatically achieved, but the
polarisation must be controlled and chromatic dispersion
Encoding the qubits in the polarization of photons is
can constitute a problem.
a natural solution. The ¬rst demonstration of QC by
The second contribution, QBERdet , increases with dis-
Charles Bennett and his coworkers (Bennett et al. 1992a)
tance, since the darkcount rate remains constant while
made use of this choice. They realized a system where
the bit rate goes down like tlink . It depends entirely on
Alice and Bob exchanged faint light pulses produced by
the ratio of the dark count rate to the quantum e¬ciency.
a LED and containing less than one photon on average
At present, good single-photon detectors are not commer-
over a distance of 30 cm in air. In spite of the small scale
cially available for telecommunication wavelengths. The
of this experiment, it had an important impact on the
span of QC is not limited by decoherence. As QBERopt
community in the sense that it showed that it was not
is essentially independent of the ¬ber length, it is the
unreasonable to use single photons instead of classical
detector noise that limits the transmission distance.
pulses for encoding bits.
Finally, the QBERacc contribution is present only in
A typical system for QC with the BB84 four states
some 2-photon schemes in which multi-photon pulses are
protocol using the polarization of photons is shown in
processed in such a way that they do not necessarily
Fig. 12. Alice™s system consists of four laser diodes. They
encode the same bit value (see e.g. paragraphs V B 1
emit short classical photon pulses (≈ 1ns) polarized at
and V B 2). Indeed, although in all systems there is a
’45—¦ , 0—¦ , +45—¦ , and 90—¦ . For a given qubit, a single
probability for multi-photon pulses, in most these con-
diode is triggered. The pulses are then attenuated by a
tribute only to the information available to Eve (see sec-
set of ¬lters to reduce the average number of photons well
tion VI H) and not to the QBER. But for implementa-
below 1, and sent along the quantum channel to Alice.
tions featuring passive choice by each photon, the multi-
It is essential that the pulses remain polarized for Bob
photon pulses do not contribute to Eve™s information but
to be able to extract the information encoded by Alice.
to the error rate (see section VI J).
As discussed in paragraph III B 2, polarization mode dis-
Now, let us calculate the useful bit rate as a func-
persion may depolarize the photons, provided the delay
tion of the distance. Rsif t and QBER are given as a
it introduces between both polarization modes is larger
function of tlink in eq. (27) and (32) respectively. The
than the coherence time. This sets a constraint on the
¬ber link transmission decreases exponentially with the
type of lasers used by Alice.
length. The fraction of bits lost due to error correc-
When reaching Bob, the pulses are extracted from the
tion and privacy ampli¬cation is a function of QBER
¬ber. They travel through a set of waveplates used to re-
and depends on Eve™s strategy. The number of remain-
cover the initial polarization states by compensating the
ing bits Rnet is given by the sifted key rate multiplied
transformation induced by the optical ¬ber (paragraph
by the di¬erence of the Alice-Bob mutual Shannon infor-
III B 2). The pulses reach then a symmetric beamsplit-
mation I(±, β) and Eve™s maximal Shannon information
ter, implementing the basis choice. Transmitted photons
I max (±, «):
are analyzed in the vertical-horizontal basis with a po-
larizing beamsplitter and two photon counting detectors.
Rnet = Rsif t I(±, β) ’ I max (±, «) (35)
The polarization state of the re¬‚ected photons is ¬rst ro-
tated with a waveplate by 45—¦ (’45—¦ to 0—¦ ). The photons
The latter are calculated here according to eq. (64) and are then analyzed with a second set of polarizing beam-
(66) (section VI E), considering only individual attacks splitter and photon counting detectors. This implements
and no multiphoton pulses. We obtain Rnet (useful bit

the diagonal basis. For illustration, let us follow a photon with photons at 800nm. It is interesting to note that,
polarized at +45—¦ , we see that its state of polarization is although he used standard telecommunications ¬bers
arbitrarily transformed in the optical ¬ber. At Bob™s end, which can support more than one spatial mode at this
the polarization controller must be set to bring it back wavelength, he was able to ensure single-mode propa-
to +45—¦ . If it chooses the output of the beamsplitter gation by carefully controlling the launching conditions.
corresponding to the vertical-horizontal basis, it will ex- Because of the problem discussed above, polarization
perience equal re¬‚ection and transmission probability at coding does not seem to be the best choice for QC in
the polarizing beamsplittter, yielding a random outcome. optical ¬bers. Nevertheless, this problem is drastically
On the other hand, if it chooses the diagonal basis, its improved when considering free space key exchange, as
state will be rotated to 90—¦ . The polarizing beamsplit- the air has essentially no birefringence at all (see section
ter will then re¬‚ect it with unit probability, yielding a IV E).
deterministic outcome.
Instead of Alice using four lasers and Bob two polar-
izing beamsplitters, it is also possible to implement this C. Phase coding
system with active polarization modulators such as Pock-
els cells. For emission, the modulator is randomly acti- The idea of encoding the value of qubits in the phase
vated for each pulse to rotate the state of polarization of photons was ¬rst mentioned by Bennett in the paper
to one of the four states, while, at the receiver, it ran- where he introduced the two-states protocol (1992). It is
domly rotates half of the incoming pulses by 45—¦ . It is indeed a very natural choice for optics specialists. State
also possible to realize the whole system with ¬ber optics preparation and analysis are then performed with inter-
components. ferometers, that can be realized with single-mode optical
Antoine Muller and his coworkers at the University of ¬bers components.
Geneva used such a system to perform QC experiments Fig. 14 presents an optical ¬ber version of a Mach-
over optical ¬bers (1993, see also Br´guet et al. 1994).
e Zehnder interferometer. It is made out of two symmetric
They created a key over a distance of 1100 meters with couplers “ the equivalent of beamsplitters “ connected
photons at 800 nm. In order to increase the transmission to each other, with one phase modulator in each arm.
distance, they repeated the experiment with photons at One can inject light in the set-up using a continuous and
1300nm (Muller et al.1995 and 1996) and created a key classical source, and monitor the intensity at the output
over a distance of 23 kilometers. An interesting feature ports. Provided that the coherence length of the light
of this experiment is that the quantum channel connect- used is larger than the path mismatch in the interferom-
ing Alice and Bob consisted in an optical ¬ber part of an eters, interference fringes can be recorded. Taking into
installed cable, used by the telecommunication company account the π/2-phase shift experienced upon re¬‚ection
Swisscom for carrying phone conversations. It runs be- at a beamsplitter, the e¬ect of the phase modulators (φA
tween the Swiss cities of Geneva and Nyon, under Lake and φB ) and the path length di¬erence (∆L), the inten-
Geneva (Fig. 13). This was the ¬rst time QC was per- sity in the output port labeled “0” is given by:
formed outside of a physics laboratory. It had a strong
φA ’ φB + k∆L
impact on the interest of the wider public for the new
I0 = I · cos2 (36)
¬eld of quantum communication. 2
These two experiments highlighted the fact that the
polarization transformation induced by a long optical where k is the wave number and I the intensity of the
¬ber was unstable over time. Indeed, when monitoring source. If the phase term is equal to π/2 + nπ where n
the QBER of their system, Muller noticed that, although is an integer, destructive interference is obtained. There-
it remained stable and low for some time (of the order of fore the intensity registered in port “0” reaches a mini-
several minutes), it would suddenly increase after a while, mum and all the light exits in port “1”. When the phase
indicating a modi¬cation of the polarization transforma- term is equal to nπ, the situation is reversed: construc-
tion in the ¬ber. This implies that a real ¬ber based QC tive interference is obtained in port “0”, while the inten-
system requires active alignment to compensate for this sity in port “1” goes to a minimum. With intermediate
evolution. Although not impossible, such a procedure is phase settings, light can be recorded in both ports. This
certainly di¬cult. James Franson did indeed implement device acts like an optical switch. It is essential to keep
an active feedback aligment system ( 1995), but did not the path di¬erence stable in order to record stationary
pursue along this direction. It is interesting to note that interferences.
replacing standard ¬bers with polarization maintaining Although we discussed the behavior of this interferom-
¬bers does not solve the problem. The reason is that, in eter for classical light, it works exactly the same when a
spite of their name, these ¬bers do not maintain polar- single photon is injected. The probability to detect the
ization, as explained in paragraph III B 2. photon in one output port can be varied by changing the
Recently, Paul Townsend of BT Laboratories also in- phase. It is the ¬ber optic version of Young™s slits exper-
vestigated such polarization encoding systems for QC on iment, where the arms of the interferometer replace the
short-span links up to 10 kilometers (1998a and 1998b) apertures.

This interferometer combined with a single photon the ¬rst beamsplitter. States produced by a switch are
source and photon counting detectors can be used for on the poles, while those resulting from the use of a 50/50
QC. Alice™s set-up consists of the source, the ¬rst coupler beamsplitter lie on the equator. Figure 15 illustrates this
and the ¬rst phase modulator, while Bob takes the sec- analogy. Consequently, all polarization schemes can also
ond modulator and coupler, as well as the detectors. Let be implemented using phase coding. Similarly, every cod-
us consider the implementation of the four-states BB84 ing using 2-path interferometers can be realized using po-
protocol. On the one hand, Alice can apply one of four larization. However, in practice one choice is often more
phase shifts (0, π/2, π, 3π/2) to encode a bit value. She convenient than the other, depending on circumstances
like the nature of the quantum channel33 .
associates 0 and π/2 to bit 0, and π and 3π/2 to bit
1. On the other hand, Bob performs a basis choice by
applying randomly a phase shift of either 0 or π/2, and
he associates the detector connected to the output port 1. The double Mach-Zehnder implementation
“0” to a bit value of 0, and the detector connected to
the port “1” to 1. When the di¬erence of their phase is Although the scheme presented in the previous para-
equal to 0 or π, Alice and Bob are using compatible bases graph works perfectly well on an optical table, it is im-
and they obtain deterministic results. In such cases, Al- possible to keep the path di¬erence stable when Alice and
ice can infer from the phase shift she applied, the output Bob are separated by more than a few meters. As men-
port chosen by the photon at Bob™s end and hence the tioned above, the relative length of the arms should not
bit value he registered. Bob, on his side, deduces from change by more than a fraction of a wavelength. Consid-
the output port chosen by the photon, the phase that ering a separation between Alice and Bob of 1 kilometer
Alice selected. When the phase di¬erence equals π/2 or for example, it is clear that it is not possible to prevent
3π/2, the bases are incompatible and the photon chooses path di¬erence changes smaller than 1µm caused by en-
randomly which port it takes at Bob™s coupler. This is vironmental variations. In his 1992 letter, Bennett also
summarized in Table 1. We must stress that it is essen- showed how to get round this problem. He suggested to
tial with this scheme to keep the path di¬erence stable use two unbalanced Mach-Zehnder interferometers con-
during a key exchange session. It should not change by nected in series by a single optical ¬ber (see Fig. 16),
more than a fraction of a wavelength of the photons. A both Alice and Bob being equipped with one. When
drift of the length of one arm would indeed change the monitoring counts as a function of the time since the
phase relation between Alice and Bob, and induce errors emission of the photons, Bob obtains three peaks (see
in their bit sequence. the inset in Fig. 16). The ¬rst one corresponds to the
cases where the photons chose the short path both in
Alice Bob Alice™s and in Bob™s interferometers, while the last one
Bit value φA φB φA ’ φB Bit value corresponds to photons taking twice the long paths. Fi-
nally, the central peak corresponds to photons choosing
0 0 0 0 0
the short path in Alice™s interferometer and the long one
0 0 π/2 3π/2 ?
in Bob™s, and to the opposite. If these two processes are
1 π 0 π 1
indistinguishable, they produce interference. A timing
1 π π/2 π/2 ?
window can be used to discriminate between interfering
0 π/2 0 π/2 ?
and non-interfering events. Disregarding the latter, it is
0 π/2 π/2 0 0
then possible for Alice and Bob to exchange a key.
1 3π/2 0 3π/2 ?
The advantage of this set-up is that both “halves” of
1 3π/2 π/2 π 1
the photon travel in the same optical ¬ber. They experi-
ence thus the same optical length in the environmentally
Table 1: Implementation of the BB84 four-states pro-
sensitive part of the system, provided that the variations
tocol with phase encoding.
in the ¬ber are slower than their temporal separations,
determined by the interferometer™s imbalance (≈ 5ns).
It is interesting to note that encoding qubits with 2-
This condition is much less di¬cult to ful¬ll. In order to
paths interferometers is formally isomorphic to polar-
obtain a good interference visibility, and hence a low er-
ization encoding. The two arms correspond to a nat-
ror rate, the imbalancements of the interferometers must
ural basis, and the weights cj of each qubit state ψ =
c1 e’iφ/2 , c2 eiφ/2 are determined by the coupling ratio
of the ¬rst beam splitter while the relative phase φ is in-
troduced in the interferometer. The Poincar´ sphere rep-
Note, in addition, that using many-path interferometers
resentation, which applies to all two-levels quantum sys-
opens up the possibility to code quantum systems of dimen-
tems, can also be used to represent phase-coding states.
sions larger than 2, like qutrits, ququarts, etc. (Bechmann-
In this case, the azimuth angle represents the relative
Pasquinucci and Tittel 2000, Bechmann-Pasquinucci and
phase between the light having propagated along the two
Peres 2000, Bourennane et al. 2001a).
arms. The elevation corresponds to the coupling ratio of

be equal within a fraction of the coherence time of the ter (1996 and 2000b), up to distances of 48 km of installed
optical ¬ber 35 .
photons. This implies that the path di¬erences must be
matched within a few millimeters, which does not con-
stitute a problem. Besides, the imbalancement must be
chosen so that it is possible to clearly distinguish the 2. The “Plug-&-Play” systems
three temporal peaks and thus discriminate interfering
from non-interfering events. It must then typically be As discussed in the two previous sections, both polar-
larger than the pulse length and than the timing jitter ization and phase coding require active compensation of
of the photon counting detectors. In practice, the second optical path ¬‚uctuations. A simple approach would be
condition is the most stringent one. Assuming a time to alternate between adjustment periods, where pulses
jitter of the order of 500ps, an imbalancement of at least containing large numbers of photons are exchanged be-
1.5ns keeps the overlap between the peaks low. tween Alice and Bob to adjust the compensating system
The main di¬culty associated with this QC scheme is correcting for slow drifts in phase or polarization, and
that the imbalancements of Alice™s and Bob™s interferom- qubits transmission periods, where the number of pho-
eters must be kept stable within a fraction of the wave- tons is reduced to a quantum level.
length of the photons during a key exchange to maintain An approach invented in 1989 by Martinelli, then at
correct phase relations. This implies that the interfer- CISE Tecnologie Innovative in Milano, allows to auto-
ometers must lie in containers whose temperature is sta- matically and passively compensate all polarization ¬‚uc-
bilized. In addition, for long key exchanges an active tuations in an optical ¬ber (see also Martinelli, 1992).
system is necessary to compensate the drifts34 . Finally, Let us consider ¬rst what happens to the state of po-
in order to ensure the indistinguishability of both inter- larization of a pulse of light travelling through an op-
fering processes, one must make sure that in each inter- tical ¬ber, before being re¬‚ected by a Faraday mirror
ferometer the polarization transformation induced by the “ a mirror with a » Faraday rotator36 “ in front, and
short path is the same as the one induced by the long one. coming back. We must ¬rst de¬ne a convenient descrip-
Alice as much as Bob must then use a polarization con- tion of the change in polarization of light re¬‚ected by
troller to ful¬ll this condition. However, the polarization a mirror under perpendicular incidence. Let the mirror
transformation in short optical ¬bers whose temperature be in the x-y plane and z be the optical axis. Clearly,
is kept stable, and which do not experience strains, is all linear polarization states are unchanged by a re¬‚ec-
rather stable. This adjustment does thus not need to be tion. But right-handed circular polarization is changed
repeated frequently. into left-handed and vice-versa. Actually, after a re¬‚ec-
Paul Tapster and John Rarity from DERA working tion the rotation continues in the same sense, but since
with Paul Townsend were the ¬rst ones to test this sys- the propagation direction is reversed, right-handed and
tem over a ¬ber optic spool of 10 kilometers (1993a and left-handed are swapped. The same holds for elliptic po-
1993b). Townsend later improved the interferometer by larization states: the axes of the ellipse are unchanged,
replacing Bob™s input coupler by a polarization splitter
to suppress the lateral non-interfering peaks (1994). In
this case, it is unfortunately again necessary to align the
polarization state of the photons at Bob™s, in addition to 35
Note that in this experiment Hughes and his coworkers
the stabilization of the interferometers imbalancement. used an unusually high mean number of photons per pulse
He later thoroughly investigated key exchange with phase (They used a mean photon number of approximately 0.6 in
coding and improved the transmission distance (Marand the central interference peak, corresponding to a µ ≈ 1.2 in
and Townsend 1995, Townsend 1998b). He also tested the pulses leaving Alice. The latter value is the relevant one
the possibility to multiplex at two di¬erent wavelengths for an eavesdropping analysis, since Eve could use an inter-
a quantum channel with conventional data transmission ferometer “ conceivable with present technology “ where the
over a single optical ¬ber (Townsend 1997a). Richard ¬rst coupler is replaced by an optical switch and which allows
Hughes and his co-workers from Los Alamos National her to exploit all the photons sent by Alice.). In the light of
Laboratory also extensively tested such an interferome- this high µ and of the optical losses (22.8 dB), one may argue
that this implementation was not secure, even when taking
into account only so-called realistic eavesdropping strategies
(see VI I). Finally, it is possible to estimate the results that
other groups would have obtained if they had used a similar
Polarization coding requires the optimization of three pa-
value of µ. One then ¬nds that key distribution distances
rameters (three parameters are necessary for unitary polar-
of the same order could have been achieved. This illustrates
ization control). In comparison, phase coding requires opti-
that the distance is a somewhat arbitrary ¬gure of merit for
mization of only one parameter. This is possible because the
a QC system.
coupling ratios of the beamsplitters are ¬xed. Both solutions 36
These components, commercially available, are extremely
would be equivalent if one could limit the polarization evolu-
compact and convenient when using telecommunications
tion to rotations of the elliptic states, without changes in the
wavelengths, which is not true for other wavelengths.

but right and left are exchanged. Accordingly, on the there are N such elements in front of the Faraday mirror,
Poincar´ sphere the polarization transformation upon re-
e the change in polarization during a round trip can be
¬‚ection is described by a symmetry through the equa- expressed as (recall that the operator FTF only changes
torial plane: the north and south hemispheres are ex- the sign of the corresponding Bloch vector m = ψ|σ|ψ ):
changed: m ’ (m1 , m2 , ’m3 ). Or in terms of the qubit
’1 ’1
U1 ...UN F T F UN ...U1 = F T F (39)
state vector:

ψ1 ψ2 The output polarization state is thus orthogonal to the
T: ’ (37)

ψ2 ψ1 input one, regardless of any birefringence in the ¬bers.
This approach can thus correct for time varying birefrin-
This is a simple representation, but some attention has gence changes, provided that they are slow compared to
to be paid. Indeed this transformation is not a unitary the time required for the light to make a round trip (a
one! Actually, the above description switches from a few hundreds of microseconds).
right-handed reference frame XY Z to a left handed one By combining this approach with time-multiplexing
˜ ˜
XY Z, where Z = ’Z. There is nothing wrong in doing in a long path interferometer, it is possible to imple-
so and this explains the non-unitary polarization trans- ment a quantum cryptography system based on phase
formation37 . Note that other descriptions are possible, coding where all optical and mechanical ¬‚uctuations are
but they require to arti¬cially break the XY symmetry. automatically and passively compensated (Muller et al.
The main reason for choosing this particular transforma- 1997). We performed a ¬rst experiment in early 1997
tion is that the description of the polarization evolution (Zbinden et al., 1997), and a key was exchanged over an
in the optical ¬ber before and after the re¬‚ection is then installed optical ¬ber cable of 23 km (the same one as in
straightforward. Indeed, let U = e’iωBσ„“/2 describe this the case of polarization coding mentioned before). This
setup features a high interference contrast (fringe visi-
evolution under the e¬ect of some modal birefringence
bility of 99.8%) and an excellent long term stability and
B in a ¬ber section of length „“ (σ is the vector whose
clearly established the value of the approach for QC. The
components are the Pauli matrices). Then, the evolution
fact that no optical adjustments are necessary earned it
after re¬‚ection is simply described by the inverse opera-
the nickname of “plug & play” set-up. It is interesting to
tor U ’1 = eiωBσ„“/2 . Now that we have a description for
note that the idea of combining time-multiplexing with
the mirror, let us add the Faraday rotator. It produces
Faraday mirrors was ¬rst used to implement an “optical
a π rotation of the Poincar´ sphere around the north-
microphone” (Br´guet and Gisin, 1995)38 .
’iπσz /4
south axis: F = e (see Fig. 17). Because the
However, our ¬rst realization still su¬ered from certain
Faraday e¬ect is non-reciprocal (remember that it is due
optical ine¬ciencies, and has been improved since then.
to a magnetic ¬eld which can be thought of as produced
Similar to the setup tested in 1997, the new system is
by a spiraling electric current), the direction of rotation
based on time multiplexing as well, where the interfering
around the north-south axis is independent of the light
pulses travel along the same optical path, however, in
propagation direction. Accordingly, after re¬‚ection on
di¬erent time ordering. A schematic is shown in Fig. 18.
the mirror, the second passage through the Faraday ro-
Brie¬‚y, to understand the general idea, pulses emitted
tator rotates the polarization in the same direction (see
at Bobs can travel either via the short arm at Bob™s, be
again Fig. 17) and is described by the same operator F .
re¬‚ected at the Faraday mirror FM at Alice™s and ¬nally,
Consequently, the total e¬ect of a Faraday mirror is to
back at Bobs, travel via the long arm. Or, they travel
change any incoming polarization state into its orthogo-
¬rst via the long arm at Bob™s, get re¬‚ected at Alice™s,
nal state m ’ ’m. This is best seen on Fig. 17, but can
travel via the short arm at Bob™s and then superpose
also be expressed mathematically:
with the ¬rst mentioned possibility on beamsplitter C1 .
We now explain the realization of this scheme more in

ψ1 ψ2
FTF : ’ (38) detail: A short and bright laser pulse is injected in the

ψ2 ’ψ1
system through a circulator. It splits at a coupler. One
of the half pulses, labeled P1 , propagates through the
Finally, the whole optical ¬ber can be modelled as con-
short arm of Bob™s set-up directly to a polarizing beam-
sisting of a discrete number of birefringent elements. If
splitter. The polarization transformation in this arm is
set so that it is fully transmitted. P1 is then sent onto
the ¬ber optic link. The second half pulse, labeled P2 ,
Note that this transformation is positive, but not com-
pletely positive. It is thus closely connected to the partial
transposition map (Peres 1996). If several photons are entan-
Note that since then, we have used this interferometer for
gled, then it is crucial to describe all of them in frames with
various other applications: non-linear index of refraction mea-
the same chirality. Actually that this is necessary is the con-
surement in ¬bers (Vinegoni et al., 2000a), optical switch
tent of the Peres-Horodecki entanglement witness (Horodecki
(Vinegoni et al., 2000b).
et al. 1996).

takes the long arm to the polarizing beamsplitter. The e¬ective repetition frequency. A storage line half long as
polarization evolution is such that it is re¬‚ected. A phase the transmission line amounts to a reduction of the bit
modulator present in this long arm is left inactive so that rate by a factor of approximately three.
it imparts no phase shift to the outgoing pulse. P2 is Researchers at IBM developed a similar system simul-
also sent onto the link, with a delay of the order of 200 taneously and independently (Bethune and Risk, 2000),
ns. Both half pulses travel to Alice. P1 goes through a also working at 1300 nm. However, they avoided the
coupler. The diverted light is detected with a classical problems associated with Rayleigh backscattering, by re-
detector to provide a timing signal. This detector is also ducing the intensity of the pulses emitted by Bob. As
important in preventing so called Trojan Horse attacks these cannot be used for synchronization purposes any
discussed in section VI K. The non-diverted light prop- longer, they added a classical channel wavelength mul-
agates then through an attenuator and a optical delay tiplexed (1550 nm) in the line, to allow Bob and Alice
line “ consisting simply of an optical ¬ber spool “ whose to synchronize their systems. They tested their set-up
role will be explained later. Finally it passes a phase on a 10 km long optical ¬ber spool. Both of these sys-
modulator, before being re¬‚ected by Faraday mirror. P2 tems are equivalent and exhibit similar performances. In
follows the same path. Alice activates brie¬‚y her modula- addition, the group of Anders Karlsson at the Royal In-
tor to apply a phase shift on P1 only, in order to encode stitute of Technology in Stockholm veri¬ed in 1999 that
a bit value exactly like in the traditional phase coding this technique also works at a wavelength of 1550 nm
scheme. The attenuator is set so that when the pulses (Bourennane et al., 1999 and Bourennane et al., 2000).
leave Alice, they do not contain more than a fraction of a These experiments demonstrate the potential of “plug &
photon. When they reach the PBS after their return trip play”-like systems for real world quantum key distribu-
through the link, the polarization state of the pulses is tion. They certainly constitute a good candidate for the
exactly orthogonal to what it was when they left, thanks realization of prototypes.
to the e¬ect of the Faraday mirror. P1 is then re¬‚ected Their main disadvantage with respect to the other sys-
instead of being transmitted. It takes the long arm to tems discussed in this section is that they are more sensi-
the coupler. When it passes, Bob activates his modula- tive to Trojan horse strategies (see section VI K). Indeed,
tor to apply a phase shift used to implement his basis Eve could send a probe beam and recover it through the
choice. Similarly, P2 is transmitted and takes the short strong re¬‚ection by the mirror at the end of Alice™s sys-
arm. Both pulses reach the coupler at the same time and tem. To prevent such an attack, Alice adds an attenu-
they interfere. Single-photon detectors are then use to ator to reduce the amount of light propagating through
record the output port chosen by the photon. her system. In addition, she must monitor the incoming
We implemented with this set-up the full four states intensity using a classical linear detector. Besides, sys-
BB84 protocol. The system was tested once again on tems based on this approach cannot be operated with a
the same installed optical ¬ber cable linking Geneva and true single-photon source, and will thus not bene¬t from
the progress in this ¬eld 39 .
Nyon (23 km, see Fig. 13) at 1300 nm and observed
a very low QBERopt ≈ 1.4% (Ribordy et al. 1998 and
2000). Proprietary electronics and software were devel-
oped to allow fully automated and user-friendly operation D. Frequency coding
of the system. Because of the intrinsically bi-directional
nature of this system, great attention must be paid to Phase based systems for QC require phase synchroniza-
Rayleigh backscattering. The light traveling in an optical tion and stabilization. Because of the high frequency of
¬ber undergoes scattering by inhomogeneities. A small optical waves (approximately 200 THz at 1550 nm), this
fraction (≈1%) of this light is recaptured by the ¬ber condition is di¬cult to ful¬ll. One solution is to use self-
in the backward direction. When the repetition rate is aligned systems like the “plug&play” set-ups discussed
high enough, pulses traveling to Alice and back from her in the previous section. Prof. Goedgebuer and his team
must intersect at some point along the line. Their inten- from the University of Besan¸on, in France, introduced
sity is however strongly di¬erent. The pulses are more an alternative solution (Sun et al. 1995, Mazurenko et al.
than a thousand times brighter before than after re¬‚ec- 1997, M´rolla et al. 1999; see also Molotkov 1998). Note
tion from Alice. Backscattered photons can accompany that the title of this section is not completely correct in
a quantum pulse propagating back to Bob and induce the sense that the value of the qubits is not coded in the
false counts. We avoided this problem by making sure frequency of the light, but in the relative phase between
that pulses traveling from and to Bob are not present in sidebands of a central optical frequency.
the line simultaneously. They are emitted in the form
of trains by Bob. Alice stores these trains in her optical
delay line, which consists of an optical ¬ber spool. Bob
waits until all the pulses of a train have reached him, be- 39
The fact that the pulses travel along a round trip implies
fore sending the next one. Although it completely solves that losses are doubled, yielding a reduced counting rate.
the problem of Rayleigh backscattering induced errors,
this con¬guration has the disadvantage of reducing the

Their system is depicted in Fig. 19. A source emits to reveal eavesdropping. In addition, it was shown that
short pulses of classical monochromatic light with angu- this reference beam monitoring can be extended to the
lar frequency ωS . A ¬rst phase modulator P MA modu- four-states protocol (Huttner et al., 1995).
lates the phase of this beam with a frequency „¦ ≪ ωS The advantage of this set-up is that the interference
and a small modulation depth. Two sidebands are thus is controlled by the phase of the radio-frequency oscilla-
generated at frequencies ωS ± „¦. The phase modulator is tors. Their frequency is 6 orders of magnitude smaller
driven by a radio-frequency oscillator RF OA whose phase than the optical frequency, and thus considerably easier
¦A can be varied. Finally, the beam is attenuated so that to stabilize and synchronize. It is indeed a relatively sim-
the sidebands contain much less than one photon per ple task that can be achieved by electronic means. The
pulse, while the central peak remains classical. After the Besan¸on group performed key distribution with such a
transmission link, the beam experiences a second phase system. The source they used was a DBR laser diode
modulation applied by P MB . This phase modulator is at a wavelength of 1540 nm and a bandwidth of 1 MHz.
driven by a second radio-frequency oscillator RF OB with It was externally modulated to obtain 50 ns pulses, thus
the same frequency „¦ and a phase ¦B . These oscillators increasing the bandwidth to about 20 MHz. They used
must be synchronized. After passing through this device, two identical LiNbO3 phase modulators operating at a
the beam contains the original central frequency ωS , the frequency „¦/2π = 300M Hz. Their spectral ¬lter was
sidebands created by Alice, and the sidebands created by a Fabry-Perot cavity with a ¬nesse of 55. Its resolution
Bob. The sidebands at frequencies ωS ± „¦ are mutually was 36 MHz. They performed key distribution over a
coherent and thus yield interference. Bob can then record 20 km long single-mode optical ¬ber spool, recording a
the interference pattern in these sidebands, after removal QBERopt contribution of approximately 4%. They es-
of the central frequency and the higher order sidebands timated that 2% can be attributed to the transmission
with a spectral ¬lter. of the central frequency by the Fabry-Perot cavity. Note
To implement the B92 protocol (see paragraph II D 1), also that the detector noise is relatively large due to the
Alice randomly chooses the value of the phase ¦A , for large pulse durations. Both these errors could be lowered
each pulse. She associates a bit value of “0” to the phase by increasing the separation between the central peak
0 and the bit “1” to phase π. Bob also chooses randomly and the sidebands, allowing reduced pulse widths, hence
whether to apply a phase ¦B of 0 or π. One can see that shorter detection times and lower darkcounts. Neverthe-
if |¦A ’ ¦B | = 0, the interference is constructive and less, a compromise must be found since, in addition to
Bob™s single-photon detector has a non-zero probability technical drawbacks of high speed modulation, the po-
of recording a count. This probability depends on the larization transformation in an optical ¬ber depends on
number of photons present initially in the sideband, as the wavelength. The remaining 2% of the QBERopt is
well as the losses induced by the channel. On the other due to polarization e¬ects in the set-up.
hand, if |¦A ’ ¦B | = π, interference is destructive and This system is another possible candidate. It™s main
no count will ever be recorded. Consequently, Bob can advantage is the fact that it could be used with a true
infer, everytime he records a count, that he applied the single-photon source, if it existed. On the other hand,
same phase as Alice. When a given pulse does not yield the contribution of imperfect interference visibility to the
a detection, the reason can be that the phases applied error rate is signi¬cantly higher than that measured with
were di¬erent and destructive interference took place. It “plug&play” systems. In addition, if this system is to be
can also mean that the phases were actually equal, but truly independent of polarization, it is essential to ensure
the pulse was empty or the photon got lost. Bob cannot that the phase modulators have very low polarization
decide between these two possibilities. From a concep- dependency. In addition, the stability of the frequency
tual point of view, Alice sends one of two non-orthogonal ¬lter may constitute a practical di¬culty.
states. There is then no way for Bob to distinguish be-
tween them deterministically. However he can perform a
generalized measurement, also known as a positive opera- E. Free space line-of-sight applications
tor value measurement, which will sometimes fail to give
an answer, and at all other times gives the correct one. Since optical ¬ber channels may not always be avail-
Eve could perform the same measurement as Bob. able, several groups are trying to develop free space line-
When she obtains an inconclusive result, she could just of-sight QC systems, capable for example to distribute a
block both the sideband and the central frequency so key between buildings rooftops in an urban setting.
that she does not have to guess a value and does not risk It may of course sound di¬cult to detect single pho-
introducing an error. To prevent her from doing that, tons amidst background light, but the ¬rst experiments
Bob veri¬es the presence of this central frequency. Now demonstrated the possibility of free space QC. Besides,
if Eve tries to conceal her presence by blocking only the sending photons through the atmosphere also has advan-
sideband, the reference central frequency will still have tages, since this medium is essentially not birefringent
a certain probability of introducing an error. It is thus (see paragraph III B 4). It is then possible to use plain
possible to catch Eve in both cases. The monitoring of polarization coding. In addition, one can ensure a very
the reference beam is essential in all two-states protocol

high channel transmission over large distances by choos- Before quantum repeaters become available and allow
ing carefully the wavelength of the photons (see again to overcome the distance limitation of ¬ber based QC,
paragraph III B 4). The atmosphere has for example a free space systems seem to o¬er the only possibility for
high transmission “window” in the vicinity of 770 nm QC over distances of more than a few dozens kilome-
(transmission as high as 80% between a ground station ters. A QC link could be established between ground
and a satellite), which happens to be compatible with based stations and a low orbit (300 to 1200 km) satel-
commercial silicon APD photon counting modules (de- lite. The idea is ¬rst to exchange a key kA between Alice
tection e¬ciency as high as 65% and low noise). and a satellite, using QC, next to establish another key
The systems developed for free space applications are kB between Bob and the same satellite. Then the satel-
actually very similar to the one shown in Fig. 12. The lite publicly announces the value K = kA • kB obtained
main di¬erence is that the emitter and receiver are con- after an XOR of the two keys (• represents here the
nected to telescopes pointing at each other, instead of XOR operator or equivalently the binary addition mod-
an optical ¬ber. The contribution of background light ulo 2 without carry). Bob subtracts then his key from
this value to recover Alice™s key (kA = K – kB ) 41 . The
to errors can be maintained at a reasonable level by us-
ing a combination of timing discrimination (coincidence fact that the key is known to the satellite operator may
windows of typically a few ns), spectral ¬ltering (¤ 1 nm be at ¬rst sight seen as a disadvantage. But this point
interference ¬lters) and spatial ¬ltering (coupling into an might on the contrary be a very positive one for the de-
optical ¬ber). This can be illustrated with the follow- velopment of QC, since governments always like to keep
ing simple calculation. Let us suppose that the isotropic control of communications! Although this has not yet
spectral background radiance is 10’2 W/m2 nm sr at been demonstrated, Hughes as well as Rarity have es-
800 nm. This corresponds to the spectral radiance of a timated - in view of their free space experiments - that
clear zenith sky with a sun elevation of 77—¦ (Zissis and the di¬culty can be mastered. The main di¬culty would
Larocca, 1978). The divergence θ of a Gaussian beam come from beam pointing - don™t forget that the satel-
with radius w0 is given by θ = »/w0 π. The product of lites will move with respect to the ground - and wander-
beam (telescope) cross-section and solid angle, which is a ing induced by turbulences. In order to reduce this latter
constant, is therefore πw0 πθ2 = »2 . By multiplying the
problem the photons would in practice probably be sent
radiance by »2 , one obtains the spectral power density. down from the satellite. Atmospheric turbulences are in-
With an interference ¬lter of 1 nm width, the power on deed almost entirely concentrated on the ¬rst kilometer
the detector is 6 · 10’15 W, corresponding to 2 · 104 pho- above the earth surface. Another possibility to compen-
tons per second or 2 · 10’5 photons per ns time window. sate for beam wander is to use adaptative optics. Free
This quantity is approximately two orders of magnitude space QC experiments over distances of the order of 2
larger than the dark count probability of Si APD™s, but km constitute major steps towards key exchange with a
still compatible with the requirements of QC. Besides the satellite. According to Buttler et al. (2000), the optical
performance of free space QC systems depends dramati- depth is indeed similar to the e¬ective atmospheric thick-
cally on atmospheric conditions and air quality. This is ness that would be encountered in a surface-to-satellite
problematic for urban applications where pollution and application.
aerosols degrade the transparency of air.
The ¬rst free space QC experiment over a distance of
more than a few centimeters 40 was performed by Jacobs F. Multi-users implementations
and Franson in 1996. They exchanged a key over a dis-
tance of 150 m in a hallway illuminated with standard Paul Townsend and colleagues investigated the ap-
¬‚uorescent lighting and 75 m outdoor in bright daylight plication of QC over multi-user optical ¬ber networks
without excessive QBER. Hughes and his team were the (Phoenix et al 1995, Townsend et al. 1994, Townsend
¬rst to exchange a key over more than one kilometer un- 1997b). They used a passive optical ¬ber network ar-
der outdoor nighttime conditions (Buttler et al. 1998, chitecture where one Alice “ the network manager “ is
and Hughes et al. 2000a). More recently, they even im- connected to multiple network users (i.e. many Bobs, see
proved their system to reach a distance of 1.6 km under Fig. 20). The goal is for Alice to establish a veri¬ably
daylight conditions (Buttler et al. 2000). Finally Rarity secure and unique key with each Bob. In the classical
and his coworkers performed a similar experiment where limit, the information transmitted by Alice is gathered by
they exchanged a key over a distance of 1.9 km under all Bobs. However, because of their quantum behavior,
nighttime conditions (Gorman et al. 2000).

This scheme could also be used with optical ¬ber imple-
Remember that Bennett and his coworkers performed the mentation provided that secure nodes exist. In the case of a
¬rst demonstration of QC over 30 cm in air (Bennett et al. satellite, one tacitly assumes that it constitutes such a secure
1992a). node.

the photons are e¬ectively routed at the beamsplitter to V. EXPERIMENTAL QUANTUM
one, and only one, of the users. Using the double Mach- CRYPTOGRAPHY WITH PHOTON PAIRS
Zehnder con¬guration discussed above, they tested such
an arrangement with three Bobs. Nevertheless, because The possibility to use entangled photon pairs for quan-
of the fact that QC requires a direct and low attenuation tum cryptography was ¬rst proposed by Ekert in 1991.
optical channel between Alice and Bob, the possibility to In a subsequent paper, he investigated, with other re-
implement it over large and complex networks appears searchers, the feasibility of a practical system (Ekert et
limited. al., 1992). Although all tests of Bell inequalities (for a
review, see for example, Zeilinger 1999) can be seen as
experiments of quantum cryptography, systems speci¬-
cally designed to meet the special requirements of QC,
like quick change of bases, were ¬rst implemented only
recently 42 . In 1999, three groups demonstrated quan-
tum cryptography based on the properties of entangled
photons. They were reported in the same issue of Phys.
Rev. Lett. (Jennewein et al. 2000b, Naik et al. 2000,
Tittel et al. 2000), illustrating the fast progress in the
still new ¬eld of quantum communication.
When using photon pairs for QC, one advantage lies
in the fact that one can remove empty pulses, since the
detection of one photon of a pair reveals the presence of
a companion. In principle, it is thus possible to have
a probability of emitting a non-empty pulse equal to
one43 . It is bene¬cial only because presently available
single-photon detector feature high dark count probabil-
ity. The di¬culty to always collect both photons of a pair
somewhat reduces this advantage. One frequently hears
that photon-pairs have also the advantage of avoiding
multi-photon pulses, but this is not correct. For a given
mean photon number, the probability that a non-empty
pulse contains more than one photon is essentially the
same for weak pulses and for photon pairs (see paragraph
III A 2). Second, using entangled photons pairs prevents
unintended information leakage in unused degrees of free-
dom (Mayers and Yao 1998). Observing a QBER smaller
than approximately 15%, or equivalently that Bell™s in-
equality is violated, indeed guarantees that the photons
are entangled and so that the di¬erent states are not
fully distinguishable through other degrees of freedom.
A third advantage was indicated recently by new and
elaborate eavesdropping analyses. The fact that passive
state preparation can be implemented prevents multipho-
ton splitting attacks (see section VI J).

This de¬nition of quantum cryptography applies to the fa-
mous experiment by Aspect and his co-workers testing Bell
inequalities with time varying analyzers (Aspect et al., 1982).
QC had however not yet been invented. It also applies to the
more recent experiments closing the locality loopholes, like
the one performed in Innsbruck using fast polarization mod-
ulators (Weihs et al. 1998) or the one performed in Geneva
using two analyzers on each side (Tittel et al. 1999; Gisin and
Zbinden 1999).
Photon pair sources are often, though not always, pumped
continuously. In these cases, the time window determined by
a trigger detector and electronics de¬nes an e¬ective pulse.

The coupling between the optical frequency and the schemes, everything is as if Alice™s photon propagated
property used to encode the qubit, i.e. decoherence, is backwards in time from Alice to the source and then for-
rather easy to master when using faint laser pulses. How- wards from the source to Bob.
ever, this issue is more serious when using photon pairs,
because of the larger spectral width. For example, for a
spectral width of 5 nm FWHM “ a typical value, equiva- A. Polarization entanglement
lent to a coherence time of 1 ps “ and a ¬ber with a typical

PMD of 0.2 ps/ km, transmission over a few kilometers A ¬rst class of experiments takes advantage of
induces signi¬cant depolarization, as discussed in para- polarization-entangled photon pairs. The setup, depicted
graph III B 2. In case of polarization-entangled photons, in Fig. 21, is similar to the scheme used for polarization
this gradually destroys their correlation. Although it is in coding based on faint pulses. A two-photon source emits
principle possible to compensate this e¬ect, the statistical pairs of entangled photons ¬‚ying back to back towards
nature of the PMD makes this impractical44 . Although Alice and Bob. Each photon is analyzed with a polar-
perfectly ¬ne for free-space QC (see section IV E), polar- izing beamsplitter whose orientation with respect to a
ization entanglement is thus not adequate for QC over common reference system can be changed rapidly. Two
long optical ¬bers. A similar e¬ect arises when dealing experiments, have been reported in the spring of 2000
with energy-time entangled photons. Here, the chromatic (Jennewein et al. 2000b, Naik et al. 2000). Both used
dispersion destroys the strong time-correlations between photon pairs at a wavelength of 700 nm, which were de-
the photons forming a pair. However, as discussed in tected with commercial single photon detectors based on
paragraph III B 3, it is possible to passively compensate Silicon APD™s. To create the photon pairs, both groups
for this e¬ect using either additional ¬bers with opposite took advantage of parametric downconversion in one or
dispersion, or exploiting the inherent energy correlation two BBO crystals pumped by an argon-ion laser. The an-
of photon pairs. alyzers consisted of fast modulators, used to rotate the
Generally speaking, entanglement based systems are polarization state of the photons, in front of polarizing
far more complex than faint laser pulses set-ups. They beamsplitters.
will most certainly not be used in the short term for the The group of Anton Zeilinger, then at the University of
realization of industrial prototypes. In addition the cur- Innsbruck, demonstrated such a crypto-system, including
rent experimental key creation rates obtained with these error correction, over a distance of 360 meters (Jennewein
systems are at least two orders of magnitude smaller than et al. 2000b). Inspired by a test of Bell inequalities
those obtained with faint laser pulses set-ups (net rate in performed with the same set-up a year earlier (Weihs et
the order of a few tens of bits per second rather than a few al., 1998), the two-photon source was located near the
thousands bits per second for a 10 km distance). Nev- center between the two analyzers. Special optical ¬bers,
ertheless, they o¬er interesting possibilities in the con- designed for guiding only a single mode at 700 nm, were
text of cryptographic optical networks The photon pairs used to transmit the photons to the two analyzers. The
source can indeed be operated by a key provider and sit- results of the remote measurements were recorded locally
uated somewhere in between potential QC customers. In and the processes of key sifting and of error correction
this case, the operator of the source has no way to get any implemented at a later stage, long after the distribution
information about the key obtained by Alice and Bob. of the qubits. Two di¬erent protocols were implemented:
It is interesting to emphasize the close analogy between one based on Wigner™s inequality (a special form of Bell
1 and 2-photon schemes, which was ¬rst noted by Ben- inequalities), and the other one following BB84.
nett, Brassard and Mermin (1992). Indeed, in a 2-photon The group of Paul Kwiat then at Los Alamos National
scheme, one can always consider that when Alice detects Laboratory, demonstrated the Ekert protocol (Naik et al.
her photon, she e¬ectively prepares Bob™s photon in a 2000). This experiment was a table-top realization with
given state. In the 1-photon analog, Alice™s detectors the source and the analyzers only separated by a few
are replaced by sources, while the photon pair source be- meters. The quantum channel consisted of a short free
tween Alice and Bob is bypassed. The di¬erence between space distance. In addition to performing QC, the re-
these schemes lies only in practical issues, like the spec- searchers simulated di¬erent eavesdropping strategies as
tral widths of the light. Alternatively, one can look at well. As predicted by the theory, they observed a rise of
this analogy from a di¬erent point of view: in 2-photon the QBER with an increase of the information obtained
by the eavesdropper. Moreover, they also recently im-
plemented the six-state protocol described in paragraph
II D 2, and observed the predicted QBER increase to 33%
(Enzer et al. 2001).
In the case of weak pulses we saw that a full round trip to-
The main advantage of polarization entanglement is
gether with the use of Faraday mirrors circumvents the prob-
the fact that analyzers are simple and e¬cient. It is
lem (see paragraph IV C 2). However, since the channel loss
on the way from the source to the Faraday mirror inevitably therefore relatively easy to obtain high contrast. Naik
increases the empty pulses fraction, the main advantage of and co-workers, for example, measured a polarization
photon pairs vanishes in such a con¬guration.

extinction of 97%, mainly limited by electronic imper- in Alice™s and Bob™s interferometer “ non-local quantum
correlation (Franson 1989)45 “ see Fig. 22. The phase
fections of the fast modulators. This amounts to a
QBERopt contribution of only 1.5%. In addition, the in the interferometers at Alice™s and Bob™s can, for ex-
constraint on the coherence length of the pump laser is ample, be adjusted so that both photons always emerge
not very stringent (note that if it is shorter than the from the same output port. It is then possible to ex-
length of the crystal some di¬culties can appear, but we change bits by associating values to the two ports. This
will not mention them here). is, however, not su¬cient. A second measurement basis
In spite of their qualities, it would be di¬cult to repro- must be implemented, to ensure security against eaves-
duce these experiments on distances of more than a few dropping attempts. This can be done for example by
kilometers of optical ¬ber. As mentioned in the intro- adding a second interferometer to the systems (see Fig.
duction to this chapter, polarization is indeed not robust 23). In the latter case, when reaching an analyzer, a
enough to decoherence in optical ¬bers. In addition, the photon chooses randomly to go to one or the other in-
polarization state transformation induced by an installed terferometer. The second set of interferometers can be
¬ber frequently ¬‚uctuates, making an active alignment adjusted to also yield perfect correlations between out-
system absolutely necessary. Nevertheless, these exper- put ports. The relative phase between their arms should
iments are very interesting in the context of free space however be chosen so that when the photons go to inter-
QC. ferometers not associated, the outcomes are completely
Such a system features a passive state preparation by
Alice, yielding security against multiphoton splitting at-
B. Energy-time entanglement
tacks (see section VI J). In addition, it also features a
passive basis choice by Bob, which constitutes an elegant
1. Phase-coding
solution: neither a random number generator, nor an
active modulator are necessary. It is nevertheless clear
The other class of experiments takes advantage of
that QBERdet and QBERacc (de¬ned in eq. (33)) are
energy-time entangled photon pairs. The idea originates
doubled since the number of activated detectors is twice
from an arrangement proposed by Franson in 1989 to
as high. This disadvantage is however not as important
test Bell inequalities. As we will see below, it is com-
as it ¬rst appears since the alternative, a fast modula-
parable to the double Mach-Zehnder con¬guration dis-
tor, introduces losses close to 3dB, also resulting in an
cussed in section IV C 1. A source emits pairs of energy-
increase of these error contributions. The striking simi-
correlated photons with both particles created at exactly
larity between this scheme and the double Mach-Zehnder
the same, however uncertain time (see Fig. 22). This
arrangement discussed in the context of faint laser pulses
can be achieved by pumping a non-linear crystal with
in section IV C 1 is obvious when comparing Fig. 24 and
a pump of large coherence time. The pairs of down-
Fig. 16!
converted photons are then split, and one photon is sent
This scheme has been realized in the ¬rst half of 2000
to each party down quantum channels. Both Alice and
by our group at Geneva University (Ribordy et al., 2001).
Bob possess a widely, but identically unbalanced Mach-
It constitutes the ¬rst experiment in which an asymmet-
Zehnder interferometer, with photon counting detectors
ric setup, optimized for QC was used instead of a system
connected to the outputs. Locally, if Alice or Bob change
designed for tests of Bell inequality and having a source
the phase of their interferometer, no e¬ect on the count
located in the center between Alice and Bob (see Fig.
rates is observed, since the imbalancement prevents any
25). The two-photon source (a KNbO3 crystal pumped
single-photon interference. Looking at the detection-time
by a doubled Nd-YAG laser) provides energy-time entan-
at Bob™s with respect to the arrival time at Alice™s, three
gled photons at non-degenerate wavelengths “ one around
di¬erent values are possible for each combination of de-
810 nm, the other one centered at 1550 nm. This choice
tectors. The di¬erent possibilities in a time spectrum
allows to use high e¬ciency silicon based single photon
are shown in Fig. 22. First, both photons can propagate
counters featuring low noise to detect the photons of the
through the short arms of the interferometers. Next, one
lower wavelength. To avoid the high transmission losses
can take the long arm at Alice™s, while the other one
at this wavelength in optical ¬bers, the distance between
takes the short one at Bob™s. The opposite is also pos-
the source and the corresponding analyzer is very short,
sible. Finally, both photons can propagate through the
long arms. When the path di¬erences of the interferome-
ters are matched within a fraction of the coherence length
of the down-converted photons, the short-short and the
The imbalancement of the interferometers must be large
long-long processes are indistinguishable, provided that
enough so that the middle peak can easily be distinguished
the coherence length of the pump photon is larger than
from the satellite ones. This minimal imbalancement is de-
the path-length di¬erence. Conditioning detection only
termined by the convolution of the detector™s jitter (tens of
on the central time peak, one observes two-photon inter-
ps), the electronic jitter (from tens to hundreds of ps) and the
ferences which depends on the sum of the relative phases
single-photon coherence time (<1ps).

of the order of a few meters. The other photon, at the slots (note that she has two detectors to take into ac-
wavelength where ¬ber losses are minimal, is sent via count). For instance, detection of a photon in the ¬rst
an optical ¬ber to Bob™s interferometer and is then de- slot corresponds to “pump photon having traveled via the
tected by InGaAs APD™s. The decoherence induced by short arm and downconverted photon via the short arm”.
chromatic dispersion is limited by the use of dispersion- To keep it short, we refer to this process as | s P , | s A ,
shifted optical ¬ber (see section III B 3). where P stands for the pump- and A for Alice™s pho-
ton46 . However, the characterization of the complete
Implementing the BB84 protocols in the way discussed
above, with a total of four interferometers, is di¬cult. photon pair is still ambiguous, since, at this point, the
They must indeed be aligned and their relative phase path of the photon having traveled to Bob (short or long
kept accurately stable during the whole key distribution in his interferometer) is unknown to Alice. Figure 26
session. To simplify this problem, we devised birefringent illustrates all processes leading to a detection in the dif-
interferometers with polarization multiplexing of the two ferent time slots both at Alice™s and at Bob™s detector.
bases. Consequently, the constraint on the stability of the Obviously, this reasoning holds for any combination of
interferometers is equivalent to that encountered in the two detectors. In order to build up the secret key, Al-
faint pulses double Mach-Zehnder system. We obtained ice and Bob now publicly agree about the events where
interference visibilities of typically 92%, yielding in turn both detected a photon in one of the satellite peaks “
a QBERopt contribution of about 4%. We demonstrated without revealing in which one “ or both in the central
QC over a transmission distance of 8.5 km in a laboratory peak “ without revealing the detector. This procedure
setting using a ¬ber on a spool and generated several corresponds to key-sifting. For instance, in the example
Mbits of key in hour long sessions. This is the largest discussed above, if Bob tells Alice that he also detected
span realized to date for QC with photon pairs. his photon in a satellite peak, she knows that it must
As already mentioned, it is essential for this scheme to have been the left peak as well. This is due to the fact
have a pump laser whose coherence length is larger than that the pump photon has traveled via the short arm “
the path imbalancement of the interferometers. In addi- hence Bob can detect his photon either in the left satellite
tion, its wavelength must remain stable during a key ex- or in the central peak. The same holds for Bob who now
change session. These requirements imply that the pump knows that Alice™s photon traveled via the short arm in
laser must be somewhat more elaborate than in the case her interferometer. Therefore, in case of joint detection
of polarization entanglement. in a satellite peak, Alice and Bob must have correlated
detection times. Assigning a bit value to each side peak,
Alice and Bob can exchange a sequence of correlated bits.
The cases where both ¬nd the photon in the central
2. Phase-time coding
time slot are used to implement the second basis. They
correspond to the | s P , | l A | l B and | l P , | s A | s B
We have mentioned in section IV C that states gener-
possibilities. If these are indistinguishable, one obtains
ated by two-paths interferometers are two-levels quantum
two-photon interferences, exactly as in the case discussed
systems. They can also be represented on a Poincar´ e
in the previous paragraph on phase coding. Adjusting
sphere. The four-states used for phase coding in the
the phases, and maintaining them stable, perfect corre-
previous section would lie on the equator of the sphere,
lations between output ports chosen by the photons at
equally distributed. The coupling ratio of the beamsplit-
Alice™s and Bob™s interferometers are used to establish
ter is indeed 50%, and they di¬er only by a phase dif-
the key bits in this second basis.
ference introduced between the components propagating
Phase-time coding has recently been implemented in a
through either arm. In principle, the four-state proto-
laboratory experiment by our group (Tittel et al., 2000)
col can be equally well implemented with only two states
and was reported at the same time as the two polariza-
on the equator and the two other ones on the poles. In
tion entanglement-based schemes mentioned above. A
this section, we present a system exploiting such a set
contrast of approximately 93% was obtained, yielding a
of states. Proposed by our group in 1999 (Brendel et
QBERopt contribution of 3.5%, similar to that obtained
al., 1999), the scheme follows in principle the Franson
with the phase coding scheme. This experiment will be
con¬guration described in the context of phase coding.
repeated over long distances, since losses in optical ¬bers
However, it is based on a pulsed source emitting entan-
are low at the downconverted photons™ wavelength (1300
gled photons in so-called energy-time Bell states (Tittel
et al. 2000). The emission time of the photon pair is
An advantage of this set-up is that coding in the time
therefore given by a superposition of only two discrete
basis is particularly stable. In addition, the coherence
terms, instead of a wide and continuous range bounded
length of the pump laser is not critical anymore. It is
only by the large coherence length of the pump laser (see
paragraph V B 1).
Consider Fig. 26. If Alice registers the arrival times
of the photons with respect to the emission time of the
pump pulse t0 , she ¬nds the photons in one of three time Note that it does not constitute a product state.

however necessary to use relatively short pulses (≈ 500 VI. EAVESDROPPING
ps) powerful enough to induce a signi¬cant downconver-
sion probability. A. Problems and Objectives
Phase-time coding, as discussed in this section, can
also be realized with faint laser pulses (Bechmann- After the qubit exchange and bases reconciliation, Al-
Pasquinucci and Tittel, 2000). The 1-photon con¬gu- ice and Bob each have a sifted key. Ideally, these are
ration has though never been realized. It would be sim- identical. But in real life, there are always some errors
ilar to the double Mach-Zehnder discussed in paragraph and Alice and Bob must apply some classical information
IV C 1, but with the ¬rst coupler replaced by an active processing protocols, like error correction and privacy
switch. For the time-basis, Alice would set the switch ampli¬cation, to their data (see paragraph II C 4). The
either to full transmission or to full re¬‚ection, while for ¬rst protocol is necessary to obtain identical keys, the
the energy-basis she would set it at 50%. This illustrates second to obtain a secret key. Essentially, the problem
how considerations initiated on photon pairs can yield of eavesdropping is to ¬nd protocols which, given that
advances on faint pulses systems. Alice and Bob can only measure the QBER, either pro-
vides Alice and Bob with a provenly secure key, or stops
the protocol and informs the users that the key distribu-
3. Quantum secret sharing
tion has failed. This is a delicate question, really at the
intersection between quantum physics and information
In addition to QC using phase-time coding, we used the theory. Actually, there is not one, but several eavesdrop-
setup depicted in Fig. 26 for the ¬rst proof-of-principle ping problems, depending on the precise protocol, on the
demonstration of quantum secret sharing “ the general- degree of idealization one admits, on the technological
ization of quantum key distribution to more than two power one assumes Eve has and on the assumed ¬delity
parties (Tittel et al., 2001). In this new application of of Alice and Bob™s equipment. Let us immediately stress
quantum communication, Alice distributes a secret key to that the complete analysis of eavesdropping on quantum
two other users, Bob and Charlie, in a way that neither channel is by far not yet ¬nished. In this chapter we
Bob nor Charlie alone have any information about the review some of the problems and solutions, without any
key, but that together they have full information. Like claim of mathematical rigor nor complete cover of the
with traditional QC, an eavesdropper trying to get some huge and fast evolving literature.
information about the key creates errors in the transmis- The general objective of eavesdropping analysis is to
sion data and thus reveals her presence. The motivation ¬nd ultimate and practical proofs of security for some
behind quantum secret sharing is to guarantee that Bob quantum cryptosystems. Ultimate means that the se-
and Charlie cooperate “ one of them might be dishonest curity is guaranteed against entire classes of eavesdrop-
“ in order to obtain a given piece of information. In con- ping attacks, even if Eve uses not only the best of to-
trast with previous proposals using three-particle GHZ day™s technology, but any conceivable technology of to-

states (Zukowski et al.,1998, and Hillery et al., 1999), morrow. They take the form of theorems, with clearly
pairs of entangled photons in so-called energy-time Bell stated assumptions expressed in mathematical terms. In
states were used to mimic the necessary quantum cor- contrast, practical proofs deal with some actual pieces of
relation of three entangled qubits, albeit only two pho- hardware and software. There is thus a tension between
tons exist at the same time. This is possible because “ultimate” and “practical” proofs. Indeed the ¬rst ones
of the symmetry between the preparation device acting favor general abstract assumptions, whereas the second
on the pump pulse and the devices analyzing the down- ones concentrate on physical implementations of the gen-
converted photons. Therefore, the emission of a pump eral concepts. Nevertheless, it is worth aiming at ¬nding
pulse can be considered as the detection of a photon with such proofs. In addition to the security issue, they pro-
100% e¬ciency, and the scheme features a much higher vide illuminating lessons for our general understanding
coincidence rate than that expected with the initially pro- of quantum information.
posed “triple-photon” schemes. In the ideal game Eve has perfect technology: she is
only limited by the laws of quantum mechanics, but not
at all by today™s technology 47 . In particular, Eve can-

The question whether QC would survive the discovery of
the currently unknown validity limits of quantum mechanics
is interesting. Let us argue that it is likely that quantum me-
chanics will always adequately describe photons at telecom
and vsible wavelengths, like classical mechanics always ade-
quately describes the fall of apples, whatever the future of

not clone the qubits, as this is incompatible with quan- choose a value at random. Note also that the di¬erent
tum dynamics (see paragraph II C 2), but Eve is free to contributions of dark count to the total QBER depend
use any unitary interaction between one or several qubits on whether Bob™s choice of basis is implemented using an
and an auxiliary system of her choice. Moreover, after active or a passive switch (see section IV A).
the interaction, Eve may keep her auxiliary system un- Next, one usually assumes that Alice and Bob have
perturbed, in particular in complete isolation from the thoroughly checked their equipments and that it is func-
environment, for an arbitrarily long time. Finally, af- tioning according to the speci¬cations. This is not par-
ter listening to all the public discussion between Alice ticular to quantum cryptography, but is quite a delicate
and Bob, she can perform the measurement of her choice question, as Eve could be the actual manufacturer of the
on her system, being again limited only by the laws of equipment! Classical crypto-systems must also be care-
quantum mechanics. Moreover, one assumes that all er- fully tested, like any commercial apparatuses. Testing a
rors are due to Eve. It is tempting to assume that some crypto-system is however delicate, because in cryptogra-
errors are due to Alice™s and Bob™s instruments and this phy the client buys con¬dence and security, two qualities
probably makes sense in practice. But there is the danger di¬cult to quantify. D. Mayers and A. Yao (1998) pro-
that Eve replaces them with higher quality instruments posed to use Bell inequality to test that the equipments
(see next section)! really obey quantum mechanics, but even this is not en-
In the next section we elaborate on the most relevant tirely satisfactory. Indeed and interestingly, one of the
di¬erences between the above ideal game (ideal espe- most subtle loopholes in all present day tests of Bell in-
cially from Eve™s point of view!) and real systems. Next, equality, the detection loophole, can be exploited to pro-
we return to the idealized situation and present several duce a purely classical software mimicking all quantum
eavesdropping strategies, starting from the simplest ones, correlation (Gisin and Gisin 1999). This illustrates once
where explicit formulas can be written down and ending again how close practical issues in QC are to philosophi-
with a general abstract security proof. Finally, we dis- cal debates about the foundations of quantum physics!
cus practical eavesdropping attacks and comment on the Finally, one has to assume that Alice and Bob are per-
complexity of real system™s security. fectly isolated from Eve. Without such an assumption
the entire game would be meaningless: clearly, Eve is
not allowed to look over Alice™s shoulder! But this el-
ementary assumption is again a nontrivial one. What
B. Idealized versus real implementation
if Eve uses the quantum channel connecting Alice to the
outside world? Ideally, the channel should incorporate an
Alice and Bob use technology available today. This
isolator 48 to keep Eve from shining light into Alice™s out-
trivial remark has several implications. First, all real
put port to examine the interior of her laboratory. But
components are imperfect, so that the qubits are pre-
all isolators operate only on a ¬nite bandwidth, hence
pared and detected not exactly in the basis described by
there should also be a ¬lter. But ¬lters have only a ¬nite
the theory. Moreover, a real source always has a ¬nite
e¬ciency. And so on. Except for section VI K where this
probability to produce more than one photon. Depending
assumption is discussed, we henceforth assume that Alice
on the details of the encoding device, all photons carry
and Bob are isolated from Eve.
the same qubit (see section VI J). Hence, in principle,
Eve could measure the photon number, without perturb-
ing the qubit. This is discussed in section VI H. Recall
C. Individual, joint and collective attacks
that ideally, Alice should emit single qubit-photons, i.e.
each logical qubit should be encoded in a single degree
of freedom of a single photon. In order to simplify the problem, several eavesdrop-
On Bob™s side the situation is, ¬rst, that the e¬ciency ping strategies of restricted generalities have been de¬ned
of his detectors is quite limited and, next, that the dark (L¨ tkenhaus 1996, Biham and Mor 1997a and 1997b) and
counts (spontaneous counts not produced by photons) analyzed. Of particular interest is the assumption that
are non negligible. The limited e¬ciency is analogous to Eve attaches independent probes to each qubit and mea-
the losses in the quantum channel. The analysis of the sures her probes one after the other. This class of attacks
dark counts is more delicate and no complete solution is called individual attacks, also known as incoherent at-
is known. Conservatively, L¨ tkenhaus (2000) assumes
u tacks. This important class is analyzed in sections VI D
in his analysis that all dark counts provide information and VI E. Two other classes of eavesdropping strate-
to Eve. He also advises that whenever two detectors gies let Eve process several qubits coherently, hence the
¬re simultaneously (generally due to a real photon and name of coherent attacks. The most general coherent at-
a dark count), Bob should not disregard such events but

Optical isolators, based on the Faraday e¬ect, let light pass
through only in one direction.
physics might be.

tacks are called joint attacks, while an intermediate class has to be averaged over all possible results r that Eve
assumes that Eve attaches one probe per qubit, like in might get:
individual attacks, but can measure several probes coher-
Ha = P (r)H(i|r) (41)
ently, like in coherent attacks. This intermediate class is posteriori
called collective attacks. It is not known whether this r
class is less e¬cient than the most general joint one. It is
also not known whether it is more e¬cient than the sim-
H(i|r) = ’ P (i|r) log(P (i|r)) (42)
pler individual attacks. Actually, it is not even known
whether joint attacks are more e¬cient than individual
ones! where the a posteriori probability of bit i given Eve™s
For joint and collective attacks, the usual assumption result r is given by Bayes™s theorem:
is that Eve measures her probe only after Alice and Bob
have completed all their public discussion about bases P (r|i)P (i)
P (i|r) = (43)
reconciliation, error correction and privacy ampli¬cation. P (r)
But for the more realistic individual attacks, one assumes
with P (r) = i P (r|i)P (i). In the case of intercept-
that Eve waits only until the bases reconciliation phase
of the public discussion49 . The motivation for this is resend, Eve gets one out of 4 possible results: r ∈ {‘, “
, ←, ’}. After the basis has been revealed, Alice™s input
that one hardly sees what Eve could gain waiting for the
assumes one out of 2 values: i ∈ {‘, “} (assuming the ‘“
public discussion on error correction and privacy ampli-
basis was used, the other case is completely analogous).
¬cation before measuring her probes, since she is anyway
One gets P (i =‘ |r =‘) = 1, P (i =‘ |r =’) = 2 and
going to measure them independently.
P (r) = 1 . Hence, I(±, «) = 1’ 2 h(1)’ 2 h( 2 ) = 1’ 2 = 2
1 1 1 1 1
Individual attacks have the nice feature that the prob- 2
lem can be entirely translated into a classical one: Alice, (with h(p) = p log2 (p) + (1 ’ p) log2 (1 ’ p)).
Bob and Eve all have classical information in the form Another strategy for Eve, not more di¬cult to imple-
of random variables ±, β an «, respectively, and the laws ment, consists in measuring the photons in the inter-
of quantum mechanics imposes constraints on the joint mediate basis (see Fig. 27), also known as the Brei-
probability distribution P (±, β, «). Such classical scenar- dbart basis (Bennett et al. 1992a). In this way the
ios have been widely studied by the classical cryptology probability that Eve guesses the correct bit value is

community and many results can thus be directly ap- p = cos(π/8)2 = 1 + 42 ≈ 0.854, corresponding to a
plied. QBER=2p(1 ’ p) = 25% and Shannon information gain
per bit of
D. Simple individual attacks: intercept-resend, I = 1 ’ H(p) ≈ 0.399. (44)
measurement in the intermediate basis
Consequently, this strategy is less advantageous for Eve
than the intercept-resend one. Note however, that with
The simplest attack for Eve consists in intercepting all
this strategy Eve™s probability to guess the correct bit
photons individually, to measure them in a basis cho-
value is 85.%, compared to only 75% in the intercept-
sen randomly among the two bases used by Alice and to
resend case. This is possible because in the latter case
send new photons to Bob prepared according to her re-
Eve™s information is deterministic in half the cases, while
sult. As presented in paragraph II C 3 and assuming that
in the ¬rst one Eve™s information is always probabilistic
the BB84 protocol is used, Eve gets thus 0.5 bit of infor-
(formally this results from the convexity of the entropy
mation per bit in the sifted key, for an induced QBER
of 25%. Let us illustrate the general formalism on this
simple example. Eve™s mean information gain on Alice™s
bit, I(±, «), equals their relative entropy decrease:
E. Symmetric individual attacks
I(±, «) = Ha ’ Ha (40)
priori posteriori
In this section we present in some details how Eve
i.e. I(±, β) is the number of bits one can save writing ± could get a maximum Shannon information for a ¬xed
when knowing β. Since the a priori probability for Alice™s QBER, assuming a perfect single qubit source and re-
bit is uniform, Ha priori = 1. The a posteriori entropy stricting Eve to attacks on one qubit after the other (i.e.
individual attacks). The motivation is that this ideal-
ized situation is rather easy to treat and nicely illustrates
several of the subtleties of the subject. Here we concen-
trate on the BB84 4-state protocol, for related results on
With today™s technology, it might even be fair to assume,
the 2-state and the 6-state protocols see Fuchs and Peres
in individual attacks, that Eve must measure her probe before
(1996) and Bechmann-Pasquinucci and Gisin (1999), re-
the basis reconciliation.

The general idea of eavesdropping on a quantum chan- U | “, 0 = | “ — φ“ + | ‘ — θ“ (48)
nel goes as follows. When a qubit propagates from Al-
where the 4 states φ‘ , φ“ , θ‘ and θ“ belong to Eve™s probe
ice to Bob, Eve can let a system of her choice, called a
Hilbert space HEve and satisfy φ‘ ⊥ θ‘ and φ“ ⊥ θ“ .
probe, interact with the qubit (see Fig. 28). She can
By symmetry |φ‘ |2 = |φ“ |2 ≡ F and |θ‘ |2 = |θ“ |2 ≡ D.
freely choose the probe and its initial state, but it has to
Unitarity imposes F + D = 1 and
be a system satisfying the quantum rules (i.e. described
in some Hilbert space). Eve can also choose the interac-
φ‘ |θ“ + θ‘ |φ“ = 0. (49)
tion, but it should be independent of the qubit state and
she should follow the laws of quantum mechanics, i.e. her
The φ™s correspond to Eve™s state when Bob gets the
interaction is described by a unitary operator. After the
qubit undisturbed, while the θ™s are Eve™s state when
interaction a qubit has to go to Bob (in section VI H we
the qubit is disturbed.
consider lossy channels, so that Bob does not always ex-
Let us emphasize that this is the most general unitary
pect a qubit, a fact that Eve can take advantage of). It
interaction satisfying (46). One ¬nds that the shrinking
makes no di¬erence whether this qubit is the original one
factor is given by: · = F ’ D. Accordingly, if Alice
(possibly in a modi¬ed state) or not. Actually the ques-
sends | ‘ and Bob measures in the compatible basis,
tion does not even make sense since a qubit is nothing
then ‘ |ρBob (m)| ‘ = F is the probability that Bob
but a qubit! But in the formalism it is convenient to use
gets the correct result. Hence F is the ¬delity and D the
the same Hilbert space for the qubit sent by Alice and
that received by Bob (this is no loss of generality, since


. 2
( 3)