ńņš. 2 |

18

We thus see that the optimal operating parameters, from Germanium or InGaAs/InP semiconductor materi-

voltage, temperature and dead time (i.e. maximum count als. In the third window (1.55 Āµm), the only option is

rate) depend on the very application. Besides, since the InGaAs/InP APDs.

relative magnitude of eļ¬ciency, thermal noise and af- Photon counting with Germanium APDs, although

ter pulses varies with the type of semiconductor material known for 30 years (Haecker, Groezinger and Pilkuhn

used, no general solution exists. In the two next para- 1971), started to be used in the domain of quantum com-

graphs we brieļ¬‚y present the diļ¬erent types of APDs. munication with the need of transmitting single photons

The ļ¬rst paragraph focuses on Silicon APDs which en- over long distances using optical ļ¬bers, hence with the

able the detection of photons at wavelengths below 1Āµm, necessity to work at telecommunications wavelength. In

the second one comments on Germanium and on Indium 1993, Townsend, Rarity and Tapster (Townsend et al.

Gallium Arsenide APDs for photon counting at telecom- 1993a) implemented a single photon interference scheme

munication wavelength. The diļ¬erent behaviour of the for quantum cryptography over a distance of 10 km, and

three types is shown in Fig. 9. Although the best ļ¬g- in 1994, Tapster, Rarity and Owens (1994) demonstrated

ure of merit for quantum cryptography is the ratio of a violation of Bell inequalities over 4 km. These experi-

dark count rate R per time unit to detection eļ¬ciency Ī·, ments where the ļ¬rst ones to take advantage of Ge APDs

we depict here the better-known noise equivalent power operated in passively quenched Geiger mode. At a tem-

NEP which shows similar behaviour. The NEP is de- perature of 77K which can be achieved using either liquid

ļ¬ned as the optical power required to measure a unity nitrogen or Stirling engine cooling, typical quantum ef-

signal-to-noise ratio, and is given by ļ¬ciencies of about 15 % at dark count rates of 25 kHz

can be found (Owens et al. 1994), and time jitter down

hĪ½ ā

N EP = 2R. (25) to 100 ps have been observed (Lacaita et al. 1994) ā“ a

Ī·

normal value being 200-300 ps.

Here, h is Planckā™s constant and Ī½ is the frequency of the Traditionally, Germanium APDs have been imple-

impinging photons. mented in the domain of long-distance quantum com-

munication. However, this type of diode is currently get-

ting replaced by InGaAs APDs and it is more and more

1. Photon counting at wavelengths below 1.1 Āµm diļ¬cult to ļ¬nd Germanium APDs on the market. Mo-

tivated by pioneering research reported already in 1985

Since the beginning of the 80ā™s, a lot of work has (Levine, Bethea and Campbell 1985), latest research fo-

been done to characterize Silicon APDs for single pho- cusses on InGaAs APDs, allowing single photon detection

ton counting (Ingerson 1983, Brown 1986, Brown 1987, in both telecommunication windows. Starting with work

Brown 1989, Spinelli 1996), and the performance of Si- by Zappa et al. (1994), InGaAs APDs as single photon

APDs has continuously been improved. Since the ļ¬rst counters have meanwhile been characterized thoroughly

test of Bell inequality using Si-APDs by Shih and Al- (Lacaita et al. 1996, Ribordy et al. 1998, Hiskett et al.

ley in 1988, they have completely replaced the photo- 2000, Karlsson et al. 1999, and Rarity et al. 2000, Stucki

multipliers used until then in the domain of fundamental et al. 2001), and ļ¬rst implementations for quantum cryp-

quantum optics, known now as quantum communication. tography have been reported (Ribordy 1998, Bourennane

Today, quantum eļ¬ciencies of up to 76% (Kwiat et al. et al. 1999, Bethune and Risk 2000, Hughes et al. 2000b,

1993) and time jitter down to 28 ps (Cova et al. 1989) Ribordy et al. 2000). However, if operating Ge APDs

have been reported. Commercial single photon counting is already inconvenient compared to Silicon APDs, the

modules are available (EG&G SPCM-AQ-151), featuring handiness of InGaAs APDs is even worse, the problem

quantum eļ¬ciencies of 70 % at a wavelength of 700 nm, a being a extremely high afterpulse fraction. Therefore,

time jitter of around 300 psec and maximum count rates operation in passive quenching mode is impossible for

larger than 5 MHz. Temperatures of -20oC ā“ suļ¬cient to applications where noise is crucial. In gated mode, In-

keep thermally generated dark counts as low as 50 Hz ā“ GaAs APDs feature a better performance for single pho-

can easily be achieved using Peltier cooling. Single pho- ton counting at 1.3 Āµm compared to Ge APDs. For in-

ton counters based on Silicon APDs thus oļ¬er an almost stance, at a temperature of 77 K and a dark count prob-

ability of 10ā’5 per 2.6 ns gate, quantum eļ¬ciencies of

perfect solution for all applications where photons of a

wavelength below 1 Āµm can be used. Apart from funda- around 30% and of 17% have been reported for InGaAs

mental quantum optics, this includes quantum cryptog- and Ge APDs, respectively (Ribordy et al. 1998), while

raphy in free space and in optical ļ¬bers, however, due to the time jitter of both devices is comparable. If working

high losses, the latter one only over short distances. at a wavelength of 1.55 Āµm, the temperature has to be

increased for single photon detection. At 173 K and a

dark count rate of now 10ā’4 , a quantum eļ¬ciency of 6%

2. Photon counting at telecommunication wavelengths can still be observed using InGaAs/InP devices while the

same ļ¬gure for Germanium APDs is close to zero.

When working in the second telecommunication win- To date, no industrial eļ¬ort has been done to opti-

dow (1.3Āµm), one has to take advantage of APDs made mize APDs operating at telecommunication wavelength

19

for photon counting, and their performance is still far In the BB84 protocol Alice has to choose randomly

behind the one of Silicon APDs26 . However, there is between four diļ¬erent states and Bob between two bases.

no fundamental reasons why photon counting at wave- The limited random number generation rate may force

lengths above 1 Āµm should be more delicate than below, Alice to produce her numbers in advance and store them,

except that the photons are less energetic. The real rea- opening a security weakness. On Bobā™s side the random

sons for the lack of commercial products are, ļ¬rst, that bit creation rate can be lower since, in principle, the basis

Silicon, the most common semiconductor, is not sensitive must be changed only after a photon has been detected,

(the band gap is too large), and secondly that the mar- which normally happens at rates below 1 MHz. However,

ket for photon counting is not yet mature. But, without one has to make sure that this doesnā™t give the spy an

great risk, one can forecast that good commercial pho- opportunity for a Trojan horse attack (see section VI K)!

ton counters will become available in the near future, and An elegant conļ¬guration integrating the random num-

that this will have a major impact on quantum cryptog- ber generator into the QC system consists in using a pas-

raphy. sive choice of bases, as discussed in chapter V (Muller et

al. 1993). However, the problem of detector induced

correlation remains.

D. Quantum random number generators

E. Quantum repeaters

The key used in the one-time-pad must be secret and

used only once. Consequently, it must be as long as the

message and must be perfectly random. The later point Todays ļ¬ber based QC systems are limited to tens of

proves to be a delicate and interesting one. Computers kilometers. This is due to the combination of ļ¬ber losses

are deterministic systems that cannot create truly ran- and detectorsā™ noise. The losses by themselves do only

dom numbers. But all secure cryptosystems, both classi- reduce the bit rate (exponentially with the distance), but

cal and quantum ones, require truly random numbers27 ! with perfect detectors the distance would not be limited.

Hence, the random numbers must be created by a ran- However, because of the dark counts, each time a pho-

dom physical process. Moreover, to make sure that the ton is lost there is a chance that a dark count produces

random process is not merely looking random with some an error. Hence, when the probability of a dark count

hidden deterministic pattern, it is necessary that it is becomes comparable to the probability that a photon

completely understood. It is thus of interest to imple- is correctly detected, the signal to noise ratio tends to

ment a simple process in order to gain conļ¬dence in its 0 (more precisely the mutual information I(Ī±, Ī²) tends

to a lower bound29 ). In this section we brieļ¬‚y explain

proper operation.

A natural solution is to rely on the random choice of how the use of entangled photons and of entanglement

Ė™

a single photon at a beamsplitter28 (Rarity et al. 1994). swapping (Zukowski et al. 1993) could open ways to

In this case the randomness is in principle guaranteed by extend the achievable distances in a foreseeable future

the laws of quantum mechanics, though, one still has to (some prior knowledge of entanglement swapping is as-

be very careful not to introduce any experimental arte- sumed). Let us denote tlink the transmission coeļ¬cient

fact that could correlate adjacent bits. Diļ¬erent experi- (i.e. tlink =probability that a photon sent by Alice gets

mental realizations have been demonstrated (Hildebrand to one of Bobā™s detectors), Ī· the detectorsā™ eļ¬ciency and

2001, Stefanov et al. 2000, Jennewein et al. 2000a) pdark the dark count probability per time bin. With a

and prototypes are commercially available (www.gap- perfect single photon source, the probability Praw of a

optique.unige.ch). One particular problem is the dead- correct qubit detection reads: Praw = tlink Ī·, while the

time of the detectors, that may introduce a strong an- probability Pdet of an error is: Pdet = (1 ā’ tlink Ī·)pdark .

P

ticorrelation between neighboring bits. Similarly, after- Accordingly, the QBER= Prawdet det and the normalized

+P

pulses may provoke a correlation. These detector-related net rate reads: Ļnet = (Praw + Pdet ) Ā· f ct(QBER) where

eļ¬ects increase with higher pulse rates, limiting the bit the function f ct denotes the fraction of bits remaining

rate of quantum number generator to some MHz. after error correction and privacy ampliļ¬cation. For the

sake of illustration we simply assume a linear dependence

dropping to zero for QBERā„ 15% (This simpliļ¬cation

does not aļ¬ect the qualitative results of this section.

26

For a more precise calculation, see LĀØ tkenhaus 2000.):

u

The ļ¬rst commercial photon counter at telecommunication

wavelengths came out only this year (Hamamatsu photomul-

tiplier R5509-72). However, the eļ¬ciency does not yet allow

an implementation for quantum cryptography.

27

The pin number that the bank attributes to your credit 29

The absolute lower bound is 0, but dependening on the

card must be random. If not, someone knows it! assumed eavesdropping strategy, Eve could take advantage of

28

Strictly speaking, the choice is made only once the photons the losses. In the latter case, the lower bound is given by her

are detected at one of the outports. mutual information I(Ī±, Ē«).

20

f ct(QBER) = 1 ā’ QBER . The corresponding net rate IV. EXPERIMENTAL QUANTUM

15%

Ļnet is displayed on Fig. 10. Note that it drops to zero CRYPTOGRAPHY WITH FAINT LASER

near 90 km. PULSES

Let us now assume that instead of a perfect single-

photon source, Alice and Bob use a (perfect) 2-photon Experimental quantum key distribution was demon-

source set in the middle of their quantum channel. Each strated for the ļ¬rst time in 1989 (it was published only

ā

photon has then a probability tlink to get to a detec- in 1992 by Bennett et al. 1992a). Since then, tremen-

tor. The probability of a correct joined detection is thus dous progress has been made. Today, several groups have

Praw = tlinkā2 , while an error occurs with probability

Ī· shown that quantum key distribution is possible, even

ā ā

P det = (1 ā’ tlink Ī·)2 p2 + 2 tlink Ī·(1 ā’ tlink Ī·)pdark outside the laboratory. In principle, any two-level quan-

dark

(both photon lost and 2 dark counts, or one photon tum system could be used to implement QC. In practice,

lost and one dark count). This can be conveniently all implementations have relied on photons. The reason

1/n

rewritten as: Praw = tlink Ī· n and Pdet = (tlink Ī· + (1 ā’ is that their interaction with the environment, also called

decoherence, can be controlled and moderated. In addi-

1/n

tlink Ī·)pdark )n ā’ tlink Ī· n valid for any division of the link

tion, researchers can beneļ¬t from all the tools developed

into n equal-length sections and n detectors. Note that

in the past two decades for optical telecommunications.

the measurements performed at the nodes between Alice

It is unlikely that other carriers will be employed in the

and Bob do transmit (swap) the entanglement to the twin

foreseeable future.

photons, without revealing any information about the

Comparing diļ¬erent QC-setups is a diļ¬cult task, since

qubit (these measurements are called Bell-measurements

several criteria must be taken into account. What mat-

and are the core of entanglement swapping and of quan-

ters in the end is of course the rate of corrected secret bits

tum teleportation). The corresponding net rates are dis-

(distilled bit rate, Rdist ) that can be transmitted and the

played in Fig. 10. Clearly, the rates for short distances

transmission distance. One can already note that with

are smaller when several detectors are used, because of

present and near future technology, it will probably not

their limited eļ¬ciencies (here we assume Ī· = 10%). But

be possible to achieve rates of the order of gigahertz,

the distance before the net rate drops to zero is extended

nowadays common with conventional optical communi-

to longer distances! Intuitively, this can be understood

cation systems (in their comprehensive paper published

as follows. Letā™s consider that a logical qubit propagates

in 2000, Gilbert and Hamrick discuss practical methods

from Alice to Bob (although some photons propagate in

to achieve high bit rate QC). This implies that encryp-

the opposite direction). Then, each 2-photon source and

tion with a key exchanged through QC is to be limited

each Bell-measurement acts on this logical qubit as a kind

to highly conļ¬dential information. While the determina-

of QND measurement: they test whether the logical qubit

tion of the transmission distance and rate of detection

is still there! In this way, Bob activates his detectors only

(the raw bit rate, Rraw ) is straightforward, estimating

1/n

when there is a large chance tlink that the photon gets

the net rate is rather diļ¬cult. Although in principle er-

to his detectors.

rors in the bit sequence follow only from tampering by

Note that if in addition to the detectorsā™ noise there

a malevolent eavesdropper, the situation is rather dif-

is noise due to decoherence, then the above idea can be

ferent in reality. Discrepancies in the keys of Alice and

extended, using entanglement puriļ¬cation. This is essen-

Bob also always happen because of experimental imper-

tially the idea of quantum repeaters (Briegel et al. 1998,

fections. The error rate (here called quantum bit error

Dur et al. 1999).

rate, or QBER) can be easily determined. Similarly, the

error correction procedure is rather simple. Error cor-

rection leads to a ļ¬rst reduction of the key rate that de-

pends strongly on the QBER. The real problem consist

in estimating the information obtained by Eve, a quan-

tity necessary for privacy ampliļ¬cation. It does not only

depend on the QBER, but also on other factors, like the

photon number statistics of the source, or the way the

choice of the measurement basis is made. Moreover in

a pragmatic approach, one might also accept restrictions

on Eveā™s technology, limiting her strategies and there-

fore also the information she can obtain per error she

introduces. Since the eļ¬ciency of privacy ampliļ¬cation

rapidly decreases when the QBER increases, the distilled

bit rate depends dramatically on Eveā™s information and

hence on the assumptions made. One can deļ¬ne as the

maximum transmission distance, the distance where the

distilled rate reaches zero. This can give an idea of the

21

diļ¬culty to evaluate a QC system from a physical point product of the sifted key rate and the probability popt of

of view. a photon going in the wrong detector:

Technological aspects must also be taken into account.

1

In this article we do not focus on all the published per- Ropt = Rsif t popt = q frep Āµ tlink popt Ī· (28)

2

formances (in particular not on the key rates), which

strongly depend on present technology and the ļ¬nancial This contribution can be considered, for a given set-up,

possibilities of the research teams having carried out the as an intrinsic error rate indicating the suitability to use

experiments. On the contrary, we try to weight the in- it for QC. We will discuss it below in the case of each

trinsic technological diļ¬culties associated with each set- particular system.

up and to anticipate certain technological advances. And The second contribution, Rdet , arises from the detector

last but not least the cost of the realization of a prototype dark counts (or from remaining environmental stray light

should also be considered. in free space setups). This rate is independent of the bit

In this chapter, we ļ¬rst deduce a general formula for rate31 . Of course, only dark counts falling in a short time

the QBER and consider its impact on the distilled rate. window when a photon is expected give rise to errors.

We then review faint pulses implementations. We class

11

them according to the property used to encode the qubits

Rdet = frep pdark n (29)

value and follow a rough chronological order. Finally, we 22

assess the possibility to adopt the various set-ups for the

where pdark is the probability of registering a dark count

realization of an industrial prototype. Systems based on

per time-window and per detector, and n is the number of

entangled photon pairs are presented in the next chapter.

detectors. The two 1 -factors are related to the fact that

2

a dark count has a 50% chance to happen with Alice and

Bob having chosen incompatible bases (thus eliminated

A. Quantum Bit Error Rate

during sifting) and a 50% chance to arise in the correct

detector.

The QBER is deļ¬ned as the number of wrong bits to

Finally error counts can arise from uncorrelated pho-

the total number of received bits30 and is normally in

tons, because of imperfect photon sources:

the order of a few percent. In the following we will use

it expressed as a function of rates: 11

Racc = pacc frep tlink nĪ· (30)

22

Nwrong Rerror Rerror

QBER = = ā

This factor appears only in systems based on entangled

Nright + Nwrong Rsif t + Rerror Rsif t

photons, where the photons belonging to diļ¬erent pairs

(26)

but arriving in the same time window are not necessarily

in the same state. The quantity pacc is the probability to

where the sifted key corresponds to the cases in which

ļ¬nd a second pair within the time window, knowing that

Alice and Bob made compatible choices of bases, hence

a ļ¬rst one was created32 .

its rate is half that of the raw key.

The QBER can now be expressed as follows:

The raw rate is essentially the product of the pulse

rate frep , the mean number of photon per pulse Āµ, the Ropt + Rdet + Racc

QBER = (31)

probability tlink of a photon to arrive at the analyzer and

Rsif t

the probability Ī· of the photon being detected:

pdark Ā· n pacc

= popt + + (32)

tlink Ā· Ī· Ā· 2 Ā· q Ā· Āµ 2 Ā· q Ā· Āµ

1 1

Rsif t = Rraw = q frep Āµ tlink Ī· (27)

= QBERopt + QBERdet + QBERacc (33)

2 2

1

The factor q (qā¤1, typically 1 or 2 ) must be introduced We analyze now these three contributions. The ļ¬rst

for some phase-coding setups in order to correct for non- one, QBERopt , is independent on the transmission dis-

interfering path combinations (see, e.g., sections IV C tance (it is independent of tlink ). It can be considered as

and V B). a measure of the optical quality of the setup, depending

One can distinguish three diļ¬erent contributions to only on the polarisation or interference fringe contrast.

Rerror . The ļ¬rst one arises because of photons ending

up in the wrong detector, due to unperfect interference

or polarization contrast. The rate Ropt is given by the

31

This is true provided that afterpulses (see section III C)

do not contribute to the dark counts.

32

Note that a passive choice of measurement basis implies

30

In the followin we are considering systems implementing that four detectors (or two detectors during two time win-

the BB84 protocol. For other protocols some of the formulas dows) are activated for every pulse, leading thus to a doubling

have to be slightly adapted. of Rdet and Racc .

22

The technical eļ¬ort needed to obtain, and more impor- rate after error correction and privacy ampliļ¬cation) for

tant, to maintain a given QBERopt is an important crite- diļ¬erent wavelengths as shown in Fig. 11. There is ļ¬rst

rion for evaluating diļ¬erent QC-setups. In polarization an exponential decrease, then, due to error correction

based systems, itā™s rather simple to achieve a polarisa- and privacy ampliļ¬cation, the bit rates fall rapidly down

tion contrast of 100:1, corresponding to a QBERopt of to zero. This is most evident comparing the curves 1550

1%. In ļ¬ber based QC, the problem is to maintain this nm and 1550 nm āsingleā since the latter features 10

value in spite of polarisation ļ¬‚uctuations and depolarisa- times less QBER. One can see that the maximum range

tion in the ļ¬ber link. For phase coding setups, QBERopt is about 100 km. In practice it is closer to 50 km, due

and the interference visibility are related by to non-ideal error correction and privacy ampliļ¬cation,

multiphoton pulses and other optical losses not consid-

1ā’V ered here. Finally, let us mention that typical key cre-

QBERopt = (34)

2 ation rates of the order of a thousand bits per second over

distances of a few tens of kilometers have been demon-

A visibility of 98% translates thus into an optical error

strated experimentally (see, for example, Ribordy et al.

rate of 1%. Such a value implies the use of well aligned

2000 or Townsend 1998b).

and stable interferometers. In bulk optics perfect mode

overlap is diļ¬cult to achieve, but the polarization is sta-

ble. In single-mode ļ¬ber interferometers, on the contrary,

B. Polarization coding

perfect mode overlap is automatically achieved, but the

polarisation must be controlled and chromatic dispersion

Encoding the qubits in the polarization of photons is

can constitute a problem.

a natural solution. The ļ¬rst demonstration of QC by

The second contribution, QBERdet , increases with dis-

Charles Bennett and his coworkers (Bennett et al. 1992a)

tance, since the darkcount rate remains constant while

made use of this choice. They realized a system where

the bit rate goes down like tlink . It depends entirely on

Alice and Bob exchanged faint light pulses produced by

the ratio of the dark count rate to the quantum eļ¬ciency.

a LED and containing less than one photon on average

At present, good single-photon detectors are not commer-

over a distance of 30 cm in air. In spite of the small scale

cially available for telecommunication wavelengths. The

of this experiment, it had an important impact on the

span of QC is not limited by decoherence. As QBERopt

community in the sense that it showed that it was not

is essentially independent of the ļ¬ber length, it is the

unreasonable to use single photons instead of classical

detector noise that limits the transmission distance.

pulses for encoding bits.

Finally, the QBERacc contribution is present only in

A typical system for QC with the BB84 four states

some 2-photon schemes in which multi-photon pulses are

protocol using the polarization of photons is shown in

processed in such a way that they do not necessarily

Fig. 12. Aliceā™s system consists of four laser diodes. They

encode the same bit value (see e.g. paragraphs V B 1

emit short classical photon pulses (ā 1ns) polarized at

and V B 2). Indeed, although in all systems there is a

ā’45ā—¦ , 0ā—¦ , +45ā—¦ , and 90ā—¦ . For a given qubit, a single

probability for multi-photon pulses, in most these con-

diode is triggered. The pulses are then attenuated by a

tribute only to the information available to Eve (see sec-

set of ļ¬lters to reduce the average number of photons well

tion VI H) and not to the QBER. But for implementa-

below 1, and sent along the quantum channel to Alice.

tions featuring passive choice by each photon, the multi-

It is essential that the pulses remain polarized for Bob

photon pulses do not contribute to Eveā™s information but

to be able to extract the information encoded by Alice.

to the error rate (see section VI J).

As discussed in paragraph III B 2, polarization mode dis-

Now, let us calculate the useful bit rate as a func-

persion may depolarize the photons, provided the delay

tion of the distance. Rsif t and QBER are given as a

it introduces between both polarization modes is larger

function of tlink in eq. (27) and (32) respectively. The

than the coherence time. This sets a constraint on the

ļ¬ber link transmission decreases exponentially with the

type of lasers used by Alice.

length. The fraction of bits lost due to error correc-

When reaching Bob, the pulses are extracted from the

tion and privacy ampliļ¬cation is a function of QBER

ļ¬ber. They travel through a set of waveplates used to re-

and depends on Eveā™s strategy. The number of remain-

cover the initial polarization states by compensating the

ing bits Rnet is given by the sifted key rate multiplied

transformation induced by the optical ļ¬ber (paragraph

by the diļ¬erence of the Alice-Bob mutual Shannon infor-

III B 2). The pulses reach then a symmetric beamsplit-

mation I(Ī±, Ī²) and Eveā™s maximal Shannon information

ter, implementing the basis choice. Transmitted photons

I max (Ī±, Ē«):

are analyzed in the vertical-horizontal basis with a po-

larizing beamsplitter and two photon counting detectors.

Rnet = Rsif t I(Ī±, Ī²) ā’ I max (Ī±, Ē«) (35)

The polarization state of the reļ¬‚ected photons is ļ¬rst ro-

tated with a waveplate by 45ā—¦ (ā’45ā—¦ to 0ā—¦ ). The photons

The latter are calculated here according to eq. (64) and are then analyzed with a second set of polarizing beam-

(66) (section VI E), considering only individual attacks splitter and photon counting detectors. This implements

and no multiphoton pulses. We obtain Rnet (useful bit

23

the diagonal basis. For illustration, let us follow a photon with photons at 800nm. It is interesting to note that,

polarized at +45ā—¦ , we see that its state of polarization is although he used standard telecommunications ļ¬bers

arbitrarily transformed in the optical ļ¬ber. At Bobā™s end, which can support more than one spatial mode at this

the polarization controller must be set to bring it back wavelength, he was able to ensure single-mode propa-

to +45ā—¦ . If it chooses the output of the beamsplitter gation by carefully controlling the launching conditions.

corresponding to the vertical-horizontal basis, it will ex- Because of the problem discussed above, polarization

perience equal reļ¬‚ection and transmission probability at coding does not seem to be the best choice for QC in

the polarizing beamsplittter, yielding a random outcome. optical ļ¬bers. Nevertheless, this problem is drastically

On the other hand, if it chooses the diagonal basis, its improved when considering free space key exchange, as

state will be rotated to 90ā—¦ . The polarizing beamsplit- the air has essentially no birefringence at all (see section

ter will then reļ¬‚ect it with unit probability, yielding a IV E).

deterministic outcome.

Instead of Alice using four lasers and Bob two polar-

izing beamsplitters, it is also possible to implement this C. Phase coding

system with active polarization modulators such as Pock-

els cells. For emission, the modulator is randomly acti- The idea of encoding the value of qubits in the phase

vated for each pulse to rotate the state of polarization of photons was ļ¬rst mentioned by Bennett in the paper

to one of the four states, while, at the receiver, it ran- where he introduced the two-states protocol (1992). It is

domly rotates half of the incoming pulses by 45ā—¦ . It is indeed a very natural choice for optics specialists. State

also possible to realize the whole system with ļ¬ber optics preparation and analysis are then performed with inter-

components. ferometers, that can be realized with single-mode optical

Antoine Muller and his coworkers at the University of ļ¬bers components.

Geneva used such a system to perform QC experiments Fig. 14 presents an optical ļ¬ber version of a Mach-

over optical ļ¬bers (1993, see also BrĀ“guet et al. 1994).

e Zehnder interferometer. It is made out of two symmetric

They created a key over a distance of 1100 meters with couplers ā“ the equivalent of beamsplitters ā“ connected

photons at 800 nm. In order to increase the transmission to each other, with one phase modulator in each arm.

distance, they repeated the experiment with photons at One can inject light in the set-up using a continuous and

1300nm (Muller et al.1995 and 1996) and created a key classical source, and monitor the intensity at the output

over a distance of 23 kilometers. An interesting feature ports. Provided that the coherence length of the light

of this experiment is that the quantum channel connect- used is larger than the path mismatch in the interferom-

ing Alice and Bob consisted in an optical ļ¬ber part of an eters, interference fringes can be recorded. Taking into

installed cable, used by the telecommunication company account the Ļ/2-phase shift experienced upon reļ¬‚ection

Swisscom for carrying phone conversations. It runs be- at a beamsplitter, the eļ¬ect of the phase modulators (ĻA

tween the Swiss cities of Geneva and Nyon, under Lake and ĻB ) and the path length diļ¬erence (āL), the inten-

Geneva (Fig. 13). This was the ļ¬rst time QC was per- sity in the output port labeled ā0ā is given by:

formed outside of a physics laboratory. It had a strong

ĻA ā’ ĻB + kāL

impact on the interest of the wider public for the new

I0 = I Ā· cos2 (36)

ļ¬eld of quantum communication. 2

These two experiments highlighted the fact that the

polarization transformation induced by a long optical where k is the wave number and I the intensity of the

ļ¬ber was unstable over time. Indeed, when monitoring source. If the phase term is equal to Ļ/2 + nĻ where n

the QBER of their system, Muller noticed that, although is an integer, destructive interference is obtained. There-

it remained stable and low for some time (of the order of fore the intensity registered in port ā0ā reaches a mini-

several minutes), it would suddenly increase after a while, mum and all the light exits in port ā1ā. When the phase

indicating a modiļ¬cation of the polarization transforma- term is equal to nĻ, the situation is reversed: construc-

tion in the ļ¬ber. This implies that a real ļ¬ber based QC tive interference is obtained in port ā0ā, while the inten-

system requires active alignment to compensate for this sity in port ā1ā goes to a minimum. With intermediate

evolution. Although not impossible, such a procedure is phase settings, light can be recorded in both ports. This

certainly diļ¬cult. James Franson did indeed implement device acts like an optical switch. It is essential to keep

an active feedback aligment system ( 1995), but did not the path diļ¬erence stable in order to record stationary

pursue along this direction. It is interesting to note that interferences.

replacing standard ļ¬bers with polarization maintaining Although we discussed the behavior of this interferom-

ļ¬bers does not solve the problem. The reason is that, in eter for classical light, it works exactly the same when a

spite of their name, these ļ¬bers do not maintain polar- single photon is injected. The probability to detect the

ization, as explained in paragraph III B 2. photon in one output port can be varied by changing the

Recently, Paul Townsend of BT Laboratories also in- phase. It is the ļ¬ber optic version of Youngā™s slits exper-

vestigated such polarization encoding systems for QC on iment, where the arms of the interferometer replace the

short-span links up to 10 kilometers (1998a and 1998b) apertures.

24

This interferometer combined with a single photon the ļ¬rst beamsplitter. States produced by a switch are

source and photon counting detectors can be used for on the poles, while those resulting from the use of a 50/50

QC. Aliceā™s set-up consists of the source, the ļ¬rst coupler beamsplitter lie on the equator. Figure 15 illustrates this

and the ļ¬rst phase modulator, while Bob takes the sec- analogy. Consequently, all polarization schemes can also

ond modulator and coupler, as well as the detectors. Let be implemented using phase coding. Similarly, every cod-

us consider the implementation of the four-states BB84 ing using 2-path interferometers can be realized using po-

protocol. On the one hand, Alice can apply one of four larization. However, in practice one choice is often more

phase shifts (0, Ļ/2, Ļ, 3Ļ/2) to encode a bit value. She convenient than the other, depending on circumstances

like the nature of the quantum channel33 .

associates 0 and Ļ/2 to bit 0, and Ļ and 3Ļ/2 to bit

1. On the other hand, Bob performs a basis choice by

applying randomly a phase shift of either 0 or Ļ/2, and

he associates the detector connected to the output port 1. The double Mach-Zehnder implementation

ā0ā to a bit value of 0, and the detector connected to

the port ā1ā to 1. When the diļ¬erence of their phase is Although the scheme presented in the previous para-

equal to 0 or Ļ, Alice and Bob are using compatible bases graph works perfectly well on an optical table, it is im-

and they obtain deterministic results. In such cases, Al- possible to keep the path diļ¬erence stable when Alice and

ice can infer from the phase shift she applied, the output Bob are separated by more than a few meters. As men-

port chosen by the photon at Bobā™s end and hence the tioned above, the relative length of the arms should not

bit value he registered. Bob, on his side, deduces from change by more than a fraction of a wavelength. Consid-

the output port chosen by the photon, the phase that ering a separation between Alice and Bob of 1 kilometer

Alice selected. When the phase diļ¬erence equals Ļ/2 or for example, it is clear that it is not possible to prevent

3Ļ/2, the bases are incompatible and the photon chooses path diļ¬erence changes smaller than 1Āµm caused by en-

randomly which port it takes at Bobā™s coupler. This is vironmental variations. In his 1992 letter, Bennett also

summarized in Table 1. We must stress that it is essen- showed how to get round this problem. He suggested to

tial with this scheme to keep the path diļ¬erence stable use two unbalanced Mach-Zehnder interferometers con-

during a key exchange session. It should not change by nected in series by a single optical ļ¬ber (see Fig. 16),

more than a fraction of a wavelength of the photons. A both Alice and Bob being equipped with one. When

drift of the length of one arm would indeed change the monitoring counts as a function of the time since the

phase relation between Alice and Bob, and induce errors emission of the photons, Bob obtains three peaks (see

in their bit sequence. the inset in Fig. 16). The ļ¬rst one corresponds to the

cases where the photons chose the short path both in

Alice Bob Aliceā™s and in Bobā™s interferometers, while the last one

Bit value ĻA ĻB ĻA ā’ ĻB Bit value corresponds to photons taking twice the long paths. Fi-

nally, the central peak corresponds to photons choosing

0 0 0 0 0

the short path in Aliceā™s interferometer and the long one

0 0 Ļ/2 3Ļ/2 ?

in Bobā™s, and to the opposite. If these two processes are

1 Ļ 0 Ļ 1

indistinguishable, they produce interference. A timing

1 Ļ Ļ/2 Ļ/2 ?

window can be used to discriminate between interfering

0 Ļ/2 0 Ļ/2 ?

and non-interfering events. Disregarding the latter, it is

0 Ļ/2 Ļ/2 0 0

then possible for Alice and Bob to exchange a key.

1 3Ļ/2 0 3Ļ/2 ?

The advantage of this set-up is that both āhalvesā of

1 3Ļ/2 Ļ/2 Ļ 1

the photon travel in the same optical ļ¬ber. They experi-

ence thus the same optical length in the environmentally

Table 1: Implementation of the BB84 four-states pro-

sensitive part of the system, provided that the variations

tocol with phase encoding.

in the ļ¬ber are slower than their temporal separations,

determined by the interferometerā™s imbalance (ā 5ns).

It is interesting to note that encoding qubits with 2-

This condition is much less diļ¬cult to fulļ¬ll. In order to

paths interferometers is formally isomorphic to polar-

obtain a good interference visibility, and hence a low er-

ization encoding. The two arms correspond to a nat-

ror rate, the imbalancements of the interferometers must

ural basis, and the weights cj of each qubit state Ļ =

c1 eā’iĻ/2 , c2 eiĻ/2 are determined by the coupling ratio

of the ļ¬rst beam splitter while the relative phase Ļ is in-

troduced in the interferometer. The PoincarĀ“ sphere rep-

e

33

Note, in addition, that using many-path interferometers

resentation, which applies to all two-levels quantum sys-

opens up the possibility to code quantum systems of dimen-

tems, can also be used to represent phase-coding states.

sions larger than 2, like qutrits, ququarts, etc. (Bechmann-

In this case, the azimuth angle represents the relative

Pasquinucci and Tittel 2000, Bechmann-Pasquinucci and

phase between the light having propagated along the two

Peres 2000, Bourennane et al. 2001a).

arms. The elevation corresponds to the coupling ratio of

25

be equal within a fraction of the coherence time of the ter (1996 and 2000b), up to distances of 48 km of installed

optical ļ¬ber 35 .

photons. This implies that the path diļ¬erences must be

matched within a few millimeters, which does not con-

stitute a problem. Besides, the imbalancement must be

chosen so that it is possible to clearly distinguish the 2. The āPlug-&-Playā systems

three temporal peaks and thus discriminate interfering

from non-interfering events. It must then typically be As discussed in the two previous sections, both polar-

larger than the pulse length and than the timing jitter ization and phase coding require active compensation of

of the photon counting detectors. In practice, the second optical path ļ¬‚uctuations. A simple approach would be

condition is the most stringent one. Assuming a time to alternate between adjustment periods, where pulses

jitter of the order of 500ps, an imbalancement of at least containing large numbers of photons are exchanged be-

1.5ns keeps the overlap between the peaks low. tween Alice and Bob to adjust the compensating system

The main diļ¬culty associated with this QC scheme is correcting for slow drifts in phase or polarization, and

that the imbalancements of Aliceā™s and Bobā™s interferom- qubits transmission periods, where the number of pho-

eters must be kept stable within a fraction of the wave- tons is reduced to a quantum level.

length of the photons during a key exchange to maintain An approach invented in 1989 by Martinelli, then at

correct phase relations. This implies that the interfer- CISE Tecnologie Innovative in Milano, allows to auto-

ometers must lie in containers whose temperature is sta- matically and passively compensate all polarization ļ¬‚uc-

bilized. In addition, for long key exchanges an active tuations in an optical ļ¬ber (see also Martinelli, 1992).

system is necessary to compensate the drifts34 . Finally, Let us consider ļ¬rst what happens to the state of po-

in order to ensure the indistinguishability of both inter- larization of a pulse of light travelling through an op-

fering processes, one must make sure that in each inter- tical ļ¬ber, before being reļ¬‚ected by a Faraday mirror

ferometer the polarization transformation induced by the ā“ a mirror with a Ī» Faraday rotator36 ā“ in front, and

4

short path is the same as the one induced by the long one. coming back. We must ļ¬rst deļ¬ne a convenient descrip-

Alice as much as Bob must then use a polarization con- tion of the change in polarization of light reļ¬‚ected by

troller to fulļ¬ll this condition. However, the polarization a mirror under perpendicular incidence. Let the mirror

transformation in short optical ļ¬bers whose temperature be in the x-y plane and z be the optical axis. Clearly,

is kept stable, and which do not experience strains, is all linear polarization states are unchanged by a reļ¬‚ec-

rather stable. This adjustment does thus not need to be tion. But right-handed circular polarization is changed

repeated frequently. into left-handed and vice-versa. Actually, after a reļ¬‚ec-

Paul Tapster and John Rarity from DERA working tion the rotation continues in the same sense, but since

with Paul Townsend were the ļ¬rst ones to test this sys- the propagation direction is reversed, right-handed and

tem over a ļ¬ber optic spool of 10 kilometers (1993a and left-handed are swapped. The same holds for elliptic po-

1993b). Townsend later improved the interferometer by larization states: the axes of the ellipse are unchanged,

replacing Bobā™s input coupler by a polarization splitter

to suppress the lateral non-interfering peaks (1994). In

this case, it is unfortunately again necessary to align the

polarization state of the photons at Bobā™s, in addition to 35

Note that in this experiment Hughes and his coworkers

the stabilization of the interferometers imbalancement. used an unusually high mean number of photons per pulse

He later thoroughly investigated key exchange with phase (They used a mean photon number of approximately 0.6 in

coding and improved the transmission distance (Marand the central interference peak, corresponding to a Āµ ā 1.2 in

and Townsend 1995, Townsend 1998b). He also tested the pulses leaving Alice. The latter value is the relevant one

the possibility to multiplex at two diļ¬erent wavelengths for an eavesdropping analysis, since Eve could use an inter-

a quantum channel with conventional data transmission ferometer ā“ conceivable with present technology ā“ where the

over a single optical ļ¬ber (Townsend 1997a). Richard ļ¬rst coupler is replaced by an optical switch and which allows

Hughes and his co-workers from Los Alamos National her to exploit all the photons sent by Alice.). In the light of

Laboratory also extensively tested such an interferome- this high Āµ and of the optical losses (22.8 dB), one may argue

that this implementation was not secure, even when taking

into account only so-called realistic eavesdropping strategies

(see VI I). Finally, it is possible to estimate the results that

other groups would have obtained if they had used a similar

34

Polarization coding requires the optimization of three pa-

value of Āµ. One then ļ¬nds that key distribution distances

rameters (three parameters are necessary for unitary polar-

of the same order could have been achieved. This illustrates

ization control). In comparison, phase coding requires opti-

that the distance is a somewhat arbitrary ļ¬gure of merit for

mization of only one parameter. This is possible because the

a QC system.

coupling ratios of the beamsplitters are ļ¬xed. Both solutions 36

These components, commercially available, are extremely

would be equivalent if one could limit the polarization evolu-

compact and convenient when using telecommunications

tion to rotations of the elliptic states, without changes in the

wavelengths, which is not true for other wavelengths.

ellipticity.

26

but right and left are exchanged. Accordingly, on the there are N such elements in front of the Faraday mirror,

PoincarĀ“ sphere the polarization transformation upon re-

e the change in polarization during a round trip can be

ļ¬‚ection is described by a symmetry through the equa- expressed as (recall that the operator FTF only changes

torial plane: the north and south hemispheres are ex- the sign of the corresponding Bloch vector m = Ļ|Ļ|Ļ ):

changed: m ā’ (m1 , m2 , ā’m3 ). Or in terms of the qubit

ā’1 ā’1

U1 ...UN F T F UN ...U1 = F T F (39)

state vector:

ā—

Ļ1 Ļ2 The output polarization state is thus orthogonal to the

T: ā’ (37)

ā—

Ļ2 Ļ1 input one, regardless of any birefringence in the ļ¬bers.

This approach can thus correct for time varying birefrin-

This is a simple representation, but some attention has gence changes, provided that they are slow compared to

to be paid. Indeed this transformation is not a unitary the time required for the light to make a round trip (a

one! Actually, the above description switches from a few hundreds of microseconds).

right-handed reference frame XY Z to a left handed one By combining this approach with time-multiplexing

Ė Ė

XY Z, where Z = ā’Z. There is nothing wrong in doing in a long path interferometer, it is possible to imple-

so and this explains the non-unitary polarization trans- ment a quantum cryptography system based on phase

formation37 . Note that other descriptions are possible, coding where all optical and mechanical ļ¬‚uctuations are

but they require to artiļ¬cially break the XY symmetry. automatically and passively compensated (Muller et al.

The main reason for choosing this particular transforma- 1997). We performed a ļ¬rst experiment in early 1997

tion is that the description of the polarization evolution (Zbinden et al., 1997), and a key was exchanged over an

in the optical ļ¬ber before and after the reļ¬‚ection is then installed optical ļ¬ber cable of 23 km (the same one as in

straightforward. Indeed, let U = eā’iĻBĻā„“/2 describe this the case of polarization coding mentioned before). This

setup features a high interference contrast (fringe visi-

evolution under the eļ¬ect of some modal birefringence

bility of 99.8%) and an excellent long term stability and

B in a ļ¬ber section of length ā„“ (Ļ is the vector whose

clearly established the value of the approach for QC. The

components are the Pauli matrices). Then, the evolution

fact that no optical adjustments are necessary earned it

after reļ¬‚ection is simply described by the inverse opera-

the nickname of āplug & playā set-up. It is interesting to

tor U ā’1 = eiĻBĻā„“/2 . Now that we have a description for

note that the idea of combining time-multiplexing with

the mirror, let us add the Faraday rotator. It produces

Faraday mirrors was ļ¬rst used to implement an āoptical

a Ļ rotation of the PoincarĀ“ sphere around the north-

e

2

microphoneā (BrĀ“guet and Gisin, 1995)38 .

e

ā’iĻĻz /4

south axis: F = e (see Fig. 17). Because the

However, our ļ¬rst realization still suļ¬ered from certain

Faraday eļ¬ect is non-reciprocal (remember that it is due

optical ineļ¬ciencies, and has been improved since then.

to a magnetic ļ¬eld which can be thought of as produced

Similar to the setup tested in 1997, the new system is

by a spiraling electric current), the direction of rotation

based on time multiplexing as well, where the interfering

around the north-south axis is independent of the light

pulses travel along the same optical path, however, in

propagation direction. Accordingly, after reļ¬‚ection on

diļ¬erent time ordering. A schematic is shown in Fig. 18.

the mirror, the second passage through the Faraday ro-

Brieļ¬‚y, to understand the general idea, pulses emitted

tator rotates the polarization in the same direction (see

at Bobs can travel either via the short arm at Bobā™s, be

again Fig. 17) and is described by the same operator F .

reļ¬‚ected at the Faraday mirror FM at Aliceā™s and ļ¬nally,

Consequently, the total eļ¬ect of a Faraday mirror is to

back at Bobs, travel via the long arm. Or, they travel

change any incoming polarization state into its orthogo-

ļ¬rst via the long arm at Bobā™s, get reļ¬‚ected at Aliceā™s,

nal state m ā’ ā’m. This is best seen on Fig. 17, but can

travel via the short arm at Bobā™s and then superpose

also be expressed mathematically:

with the ļ¬rst mentioned possibility on beamsplitter C1 .

We now explain the realization of this scheme more in

ā—

Ļ1 Ļ2

FTF : ā’ (38) detail: A short and bright laser pulse is injected in the

ā—

Ļ2 ā’Ļ1

system through a circulator. It splits at a coupler. One

of the half pulses, labeled P1 , propagates through the

Finally, the whole optical ļ¬ber can be modelled as con-

short arm of Bobā™s set-up directly to a polarizing beam-

sisting of a discrete number of birefringent elements. If

splitter. The polarization transformation in this arm is

set so that it is fully transmitted. P1 is then sent onto

the ļ¬ber optic link. The second half pulse, labeled P2 ,

37

Note that this transformation is positive, but not com-

pletely positive. It is thus closely connected to the partial

transposition map (Peres 1996). If several photons are entan-

38

Note that since then, we have used this interferometer for

gled, then it is crucial to describe all of them in frames with

various other applications: non-linear index of refraction mea-

the same chirality. Actually that this is necessary is the con-

surement in ļ¬bers (Vinegoni et al., 2000a), optical switch

tent of the Peres-Horodecki entanglement witness (Horodecki

(Vinegoni et al., 2000b).

et al. 1996).

27

takes the long arm to the polarizing beamsplitter. The eļ¬ective repetition frequency. A storage line half long as

polarization evolution is such that it is reļ¬‚ected. A phase the transmission line amounts to a reduction of the bit

modulator present in this long arm is left inactive so that rate by a factor of approximately three.

it imparts no phase shift to the outgoing pulse. P2 is Researchers at IBM developed a similar system simul-

also sent onto the link, with a delay of the order of 200 taneously and independently (Bethune and Risk, 2000),

ns. Both half pulses travel to Alice. P1 goes through a also working at 1300 nm. However, they avoided the

coupler. The diverted light is detected with a classical problems associated with Rayleigh backscattering, by re-

detector to provide a timing signal. This detector is also ducing the intensity of the pulses emitted by Bob. As

important in preventing so called Trojan Horse attacks these cannot be used for synchronization purposes any

discussed in section VI K. The non-diverted light prop- longer, they added a classical channel wavelength mul-

agates then through an attenuator and a optical delay tiplexed (1550 nm) in the line, to allow Bob and Alice

line ā“ consisting simply of an optical ļ¬ber spool ā“ whose to synchronize their systems. They tested their set-up

role will be explained later. Finally it passes a phase on a 10 km long optical ļ¬ber spool. Both of these sys-

modulator, before being reļ¬‚ected by Faraday mirror. P2 tems are equivalent and exhibit similar performances. In

follows the same path. Alice activates brieļ¬‚y her modula- addition, the group of Anders Karlsson at the Royal In-

tor to apply a phase shift on P1 only, in order to encode stitute of Technology in Stockholm veriļ¬ed in 1999 that

a bit value exactly like in the traditional phase coding this technique also works at a wavelength of 1550 nm

scheme. The attenuator is set so that when the pulses (Bourennane et al., 1999 and Bourennane et al., 2000).

leave Alice, they do not contain more than a fraction of a These experiments demonstrate the potential of āplug &

photon. When they reach the PBS after their return trip playā-like systems for real world quantum key distribu-

through the link, the polarization state of the pulses is tion. They certainly constitute a good candidate for the

exactly orthogonal to what it was when they left, thanks realization of prototypes.

to the eļ¬ect of the Faraday mirror. P1 is then reļ¬‚ected Their main disadvantage with respect to the other sys-

instead of being transmitted. It takes the long arm to tems discussed in this section is that they are more sensi-

the coupler. When it passes, Bob activates his modula- tive to Trojan horse strategies (see section VI K). Indeed,

tor to apply a phase shift used to implement his basis Eve could send a probe beam and recover it through the

choice. Similarly, P2 is transmitted and takes the short strong reļ¬‚ection by the mirror at the end of Aliceā™s sys-

arm. Both pulses reach the coupler at the same time and tem. To prevent such an attack, Alice adds an attenu-

they interfere. Single-photon detectors are then use to ator to reduce the amount of light propagating through

record the output port chosen by the photon. her system. In addition, she must monitor the incoming

We implemented with this set-up the full four states intensity using a classical linear detector. Besides, sys-

BB84 protocol. The system was tested once again on tems based on this approach cannot be operated with a

the same installed optical ļ¬ber cable linking Geneva and true single-photon source, and will thus not beneļ¬t from

the progress in this ļ¬eld 39 .

Nyon (23 km, see Fig. 13) at 1300 nm and observed

a very low QBERopt ā 1.4% (Ribordy et al. 1998 and

2000). Proprietary electronics and software were devel-

oped to allow fully automated and user-friendly operation D. Frequency coding

of the system. Because of the intrinsically bi-directional

nature of this system, great attention must be paid to Phase based systems for QC require phase synchroniza-

Rayleigh backscattering. The light traveling in an optical tion and stabilization. Because of the high frequency of

ļ¬ber undergoes scattering by inhomogeneities. A small optical waves (approximately 200 THz at 1550 nm), this

fraction (ā1%) of this light is recaptured by the ļ¬ber condition is diļ¬cult to fulļ¬ll. One solution is to use self-

in the backward direction. When the repetition rate is aligned systems like the āplug&playā set-ups discussed

high enough, pulses traveling to Alice and back from her in the previous section. Prof. Goedgebuer and his team

must intersect at some point along the line. Their inten- from the University of BesanĀøon, in France, introduced

c

sity is however strongly diļ¬erent. The pulses are more an alternative solution (Sun et al. 1995, Mazurenko et al.

than a thousand times brighter before than after reļ¬‚ec- 1997, MĀ“rolla et al. 1999; see also Molotkov 1998). Note

e

tion from Alice. Backscattered photons can accompany that the title of this section is not completely correct in

a quantum pulse propagating back to Bob and induce the sense that the value of the qubits is not coded in the

false counts. We avoided this problem by making sure frequency of the light, but in the relative phase between

that pulses traveling from and to Bob are not present in sidebands of a central optical frequency.

the line simultaneously. They are emitted in the form

of trains by Bob. Alice stores these trains in her optical

delay line, which consists of an optical ļ¬ber spool. Bob

waits until all the pulses of a train have reached him, be- 39

The fact that the pulses travel along a round trip implies

fore sending the next one. Although it completely solves that losses are doubled, yielding a reduced counting rate.

the problem of Rayleigh backscattering induced errors,

this conļ¬guration has the disadvantage of reducing the

28

Their system is depicted in Fig. 19. A source emits to reveal eavesdropping. In addition, it was shown that

short pulses of classical monochromatic light with angu- this reference beam monitoring can be extended to the

lar frequency ĻS . A ļ¬rst phase modulator P MA modu- four-states protocol (Huttner et al., 1995).

lates the phase of this beam with a frequency ā„¦ āŖ ĻS The advantage of this set-up is that the interference

and a small modulation depth. Two sidebands are thus is controlled by the phase of the radio-frequency oscilla-

generated at frequencies ĻS Ā± ā„¦. The phase modulator is tors. Their frequency is 6 orders of magnitude smaller

driven by a radio-frequency oscillator RF OA whose phase than the optical frequency, and thus considerably easier

Ī¦A can be varied. Finally, the beam is attenuated so that to stabilize and synchronize. It is indeed a relatively sim-

the sidebands contain much less than one photon per ple task that can be achieved by electronic means. The

pulse, while the central peak remains classical. After the BesanĀøon group performed key distribution with such a

c

transmission link, the beam experiences a second phase system. The source they used was a DBR laser diode

modulation applied by P MB . This phase modulator is at a wavelength of 1540 nm and a bandwidth of 1 MHz.

driven by a second radio-frequency oscillator RF OB with It was externally modulated to obtain 50 ns pulses, thus

the same frequency ā„¦ and a phase Ī¦B . These oscillators increasing the bandwidth to about 20 MHz. They used

must be synchronized. After passing through this device, two identical LiNbO3 phase modulators operating at a

the beam contains the original central frequency ĻS , the frequency ā„¦/2Ļ = 300M Hz. Their spectral ļ¬lter was

sidebands created by Alice, and the sidebands created by a Fabry-Perot cavity with a ļ¬nesse of 55. Its resolution

Bob. The sidebands at frequencies ĻS Ā± ā„¦ are mutually was 36 MHz. They performed key distribution over a

coherent and thus yield interference. Bob can then record 20 km long single-mode optical ļ¬ber spool, recording a

the interference pattern in these sidebands, after removal QBERopt contribution of approximately 4%. They es-

of the central frequency and the higher order sidebands timated that 2% can be attributed to the transmission

with a spectral ļ¬lter. of the central frequency by the Fabry-Perot cavity. Note

To implement the B92 protocol (see paragraph II D 1), also that the detector noise is relatively large due to the

Alice randomly chooses the value of the phase Ī¦A , for large pulse durations. Both these errors could be lowered

each pulse. She associates a bit value of ā0ā to the phase by increasing the separation between the central peak

0 and the bit ā1ā to phase Ļ. Bob also chooses randomly and the sidebands, allowing reduced pulse widths, hence

whether to apply a phase Ī¦B of 0 or Ļ. One can see that shorter detection times and lower darkcounts. Neverthe-

if |Ī¦A ā’ Ī¦B | = 0, the interference is constructive and less, a compromise must be found since, in addition to

Bobā™s single-photon detector has a non-zero probability technical drawbacks of high speed modulation, the po-

of recording a count. This probability depends on the larization transformation in an optical ļ¬ber depends on

number of photons present initially in the sideband, as the wavelength. The remaining 2% of the QBERopt is

well as the losses induced by the channel. On the other due to polarization eļ¬ects in the set-up.

hand, if |Ī¦A ā’ Ī¦B | = Ļ, interference is destructive and This system is another possible candidate. Itā™s main

no count will ever be recorded. Consequently, Bob can advantage is the fact that it could be used with a true

infer, everytime he records a count, that he applied the single-photon source, if it existed. On the other hand,

same phase as Alice. When a given pulse does not yield the contribution of imperfect interference visibility to the

a detection, the reason can be that the phases applied error rate is signiļ¬cantly higher than that measured with

were diļ¬erent and destructive interference took place. It āplug&playā systems. In addition, if this system is to be

can also mean that the phases were actually equal, but truly independent of polarization, it is essential to ensure

the pulse was empty or the photon got lost. Bob cannot that the phase modulators have very low polarization

decide between these two possibilities. From a concep- dependency. In addition, the stability of the frequency

tual point of view, Alice sends one of two non-orthogonal ļ¬lter may constitute a practical diļ¬culty.

states. There is then no way for Bob to distinguish be-

tween them deterministically. However he can perform a

generalized measurement, also known as a positive opera- E. Free space line-of-sight applications

tor value measurement, which will sometimes fail to give

an answer, and at all other times gives the correct one. Since optical ļ¬ber channels may not always be avail-

Eve could perform the same measurement as Bob. able, several groups are trying to develop free space line-

When she obtains an inconclusive result, she could just of-sight QC systems, capable for example to distribute a

block both the sideband and the central frequency so key between buildings rooftops in an urban setting.

that she does not have to guess a value and does not risk It may of course sound diļ¬cult to detect single pho-

introducing an error. To prevent her from doing that, tons amidst background light, but the ļ¬rst experiments

Bob veriļ¬es the presence of this central frequency. Now demonstrated the possibility of free space QC. Besides,

if Eve tries to conceal her presence by blocking only the sending photons through the atmosphere also has advan-

sideband, the reference central frequency will still have tages, since this medium is essentially not birefringent

a certain probability of introducing an error. It is thus (see paragraph III B 4). It is then possible to use plain

possible to catch Eve in both cases. The monitoring of polarization coding. In addition, one can ensure a very

the reference beam is essential in all two-states protocol

29

high channel transmission over large distances by choos- Before quantum repeaters become available and allow

ing carefully the wavelength of the photons (see again to overcome the distance limitation of ļ¬ber based QC,

paragraph III B 4). The atmosphere has for example a free space systems seem to oļ¬er the only possibility for

high transmission āwindowā in the vicinity of 770 nm QC over distances of more than a few dozens kilome-

(transmission as high as 80% between a ground station ters. A QC link could be established between ground

and a satellite), which happens to be compatible with based stations and a low orbit (300 to 1200 km) satel-

commercial silicon APD photon counting modules (de- lite. The idea is ļ¬rst to exchange a key kA between Alice

tection eļ¬ciency as high as 65% and low noise). and a satellite, using QC, next to establish another key

The systems developed for free space applications are kB between Bob and the same satellite. Then the satel-

actually very similar to the one shown in Fig. 12. The lite publicly announces the value K = kA ā• kB obtained

main diļ¬erence is that the emitter and receiver are con- after an XOR of the two keys (ā• represents here the

nected to telescopes pointing at each other, instead of XOR operator or equivalently the binary addition mod-

an optical ļ¬ber. The contribution of background light ulo 2 without carry). Bob subtracts then his key from

this value to recover Aliceā™s key (kA = K ā– kB ) 41 . The

to errors can be maintained at a reasonable level by us-

ing a combination of timing discrimination (coincidence fact that the key is known to the satellite operator may

windows of typically a few ns), spectral ļ¬ltering (ā¤ 1 nm be at ļ¬rst sight seen as a disadvantage. But this point

interference ļ¬lters) and spatial ļ¬ltering (coupling into an might on the contrary be a very positive one for the de-

optical ļ¬ber). This can be illustrated with the follow- velopment of QC, since governments always like to keep

ing simple calculation. Let us suppose that the isotropic control of communications! Although this has not yet

spectral background radiance is 10ā’2 W/m2 nm sr at been demonstrated, Hughes as well as Rarity have es-

800 nm. This corresponds to the spectral radiance of a timated - in view of their free space experiments - that

clear zenith sky with a sun elevation of 77ā—¦ (Zissis and the diļ¬culty can be mastered. The main diļ¬culty would

Larocca, 1978). The divergence Īø of a Gaussian beam come from beam pointing - donā™t forget that the satel-

with radius w0 is given by Īø = Ī»/w0 Ļ. The product of lites will move with respect to the ground - and wander-

beam (telescope) cross-section and solid angle, which is a ing induced by turbulences. In order to reduce this latter

constant, is therefore Ļw0 ĻĪø2 = Ī»2 . By multiplying the

2

problem the photons would in practice probably be sent

radiance by Ī»2 , one obtains the spectral power density. down from the satellite. Atmospheric turbulences are in-

With an interference ļ¬lter of 1 nm width, the power on deed almost entirely concentrated on the ļ¬rst kilometer

the detector is 6 Ā· 10ā’15 W, corresponding to 2 Ā· 104 pho- above the earth surface. Another possibility to compen-

tons per second or 2 Ā· 10ā’5 photons per ns time window. sate for beam wander is to use adaptative optics. Free

This quantity is approximately two orders of magnitude space QC experiments over distances of the order of 2

larger than the dark count probability of Si APDā™s, but km constitute major steps towards key exchange with a

still compatible with the requirements of QC. Besides the satellite. According to Buttler et al. (2000), the optical

performance of free space QC systems depends dramati- depth is indeed similar to the eļ¬ective atmospheric thick-

cally on atmospheric conditions and air quality. This is ness that would be encountered in a surface-to-satellite

problematic for urban applications where pollution and application.

aerosols degrade the transparency of air.

The ļ¬rst free space QC experiment over a distance of

more than a few centimeters 40 was performed by Jacobs F. Multi-users implementations

and Franson in 1996. They exchanged a key over a dis-

tance of 150 m in a hallway illuminated with standard Paul Townsend and colleagues investigated the ap-

ļ¬‚uorescent lighting and 75 m outdoor in bright daylight plication of QC over multi-user optical ļ¬ber networks

without excessive QBER. Hughes and his team were the (Phoenix et al 1995, Townsend et al. 1994, Townsend

ļ¬rst to exchange a key over more than one kilometer un- 1997b). They used a passive optical ļ¬ber network ar-

der outdoor nighttime conditions (Buttler et al. 1998, chitecture where one Alice ā“ the network manager ā“ is

and Hughes et al. 2000a). More recently, they even im- connected to multiple network users (i.e. many Bobs, see

proved their system to reach a distance of 1.6 km under Fig. 20). The goal is for Alice to establish a veriļ¬ably

daylight conditions (Buttler et al. 2000). Finally Rarity secure and unique key with each Bob. In the classical

and his coworkers performed a similar experiment where limit, the information transmitted by Alice is gathered by

they exchanged a key over a distance of 1.9 km under all Bobs. However, because of their quantum behavior,

nighttime conditions (Gorman et al. 2000).

41

This scheme could also be used with optical ļ¬ber imple-

40

Remember that Bennett and his coworkers performed the mentation provided that secure nodes exist. In the case of a

ļ¬rst demonstration of QC over 30 cm in air (Bennett et al. satellite, one tacitly assumes that it constitutes such a secure

1992a). node.

30

the photons are eļ¬ectively routed at the beamsplitter to V. EXPERIMENTAL QUANTUM

one, and only one, of the users. Using the double Mach- CRYPTOGRAPHY WITH PHOTON PAIRS

Zehnder conļ¬guration discussed above, they tested such

an arrangement with three Bobs. Nevertheless, because The possibility to use entangled photon pairs for quan-

of the fact that QC requires a direct and low attenuation tum cryptography was ļ¬rst proposed by Ekert in 1991.

optical channel between Alice and Bob, the possibility to In a subsequent paper, he investigated, with other re-

implement it over large and complex networks appears searchers, the feasibility of a practical system (Ekert et

limited. al., 1992). Although all tests of Bell inequalities (for a

review, see for example, Zeilinger 1999) can be seen as

experiments of quantum cryptography, systems speciļ¬-

cally designed to meet the special requirements of QC,

like quick change of bases, were ļ¬rst implemented only

recently 42 . In 1999, three groups demonstrated quan-

tum cryptography based on the properties of entangled

photons. They were reported in the same issue of Phys.

Rev. Lett. (Jennewein et al. 2000b, Naik et al. 2000,

Tittel et al. 2000), illustrating the fast progress in the

still new ļ¬eld of quantum communication.

When using photon pairs for QC, one advantage lies

in the fact that one can remove empty pulses, since the

detection of one photon of a pair reveals the presence of

a companion. In principle, it is thus possible to have

a probability of emitting a non-empty pulse equal to

one43 . It is beneļ¬cial only because presently available

single-photon detector feature high dark count probabil-

ity. The diļ¬culty to always collect both photons of a pair

somewhat reduces this advantage. One frequently hears

that photon-pairs have also the advantage of avoiding

multi-photon pulses, but this is not correct. For a given

mean photon number, the probability that a non-empty

pulse contains more than one photon is essentially the

same for weak pulses and for photon pairs (see paragraph

III A 2). Second, using entangled photons pairs prevents

unintended information leakage in unused degrees of free-

dom (Mayers and Yao 1998). Observing a QBER smaller

than approximately 15%, or equivalently that Bellā™s in-

equality is violated, indeed guarantees that the photons

are entangled and so that the diļ¬erent states are not

fully distinguishable through other degrees of freedom.

A third advantage was indicated recently by new and

elaborate eavesdropping analyses. The fact that passive

state preparation can be implemented prevents multipho-

ton splitting attacks (see section VI J).

42

This deļ¬nition of quantum cryptography applies to the fa-

mous experiment by Aspect and his co-workers testing Bell

inequalities with time varying analyzers (Aspect et al., 1982).

QC had however not yet been invented. It also applies to the

more recent experiments closing the locality loopholes, like

the one performed in Innsbruck using fast polarization mod-

ulators (Weihs et al. 1998) or the one performed in Geneva

using two analyzers on each side (Tittel et al. 1999; Gisin and

Zbinden 1999).

43

Photon pair sources are often, though not always, pumped

continuously. In these cases, the time window determined by

a trigger detector and electronics deļ¬nes an eļ¬ective pulse.

31

The coupling between the optical frequency and the schemes, everything is as if Aliceā™s photon propagated

property used to encode the qubit, i.e. decoherence, is backwards in time from Alice to the source and then for-

rather easy to master when using faint laser pulses. How- wards from the source to Bob.

ever, this issue is more serious when using photon pairs,

because of the larger spectral width. For example, for a

spectral width of 5 nm FWHM ā“ a typical value, equiva- A. Polarization entanglement

lent to a coherence time of 1 ps ā“ and a ļ¬ber with a typical

ā

PMD of 0.2 ps/ km, transmission over a few kilometers A ļ¬rst class of experiments takes advantage of

induces signiļ¬cant depolarization, as discussed in para- polarization-entangled photon pairs. The setup, depicted

graph III B 2. In case of polarization-entangled photons, in Fig. 21, is similar to the scheme used for polarization

this gradually destroys their correlation. Although it is in coding based on faint pulses. A two-photon source emits

principle possible to compensate this eļ¬ect, the statistical pairs of entangled photons ļ¬‚ying back to back towards

nature of the PMD makes this impractical44 . Although Alice and Bob. Each photon is analyzed with a polar-

perfectly ļ¬ne for free-space QC (see section IV E), polar- izing beamsplitter whose orientation with respect to a

ization entanglement is thus not adequate for QC over common reference system can be changed rapidly. Two

long optical ļ¬bers. A similar eļ¬ect arises when dealing experiments, have been reported in the spring of 2000

with energy-time entangled photons. Here, the chromatic (Jennewein et al. 2000b, Naik et al. 2000). Both used

dispersion destroys the strong time-correlations between photon pairs at a wavelength of 700 nm, which were de-

the photons forming a pair. However, as discussed in tected with commercial single photon detectors based on

paragraph III B 3, it is possible to passively compensate Silicon APDā™s. To create the photon pairs, both groups

for this eļ¬ect using either additional ļ¬bers with opposite took advantage of parametric downconversion in one or

dispersion, or exploiting the inherent energy correlation two BBO crystals pumped by an argon-ion laser. The an-

of photon pairs. alyzers consisted of fast modulators, used to rotate the

Generally speaking, entanglement based systems are polarization state of the photons, in front of polarizing

far more complex than faint laser pulses set-ups. They beamsplitters.

will most certainly not be used in the short term for the The group of Anton Zeilinger, then at the University of

realization of industrial prototypes. In addition the cur- Innsbruck, demonstrated such a crypto-system, including

rent experimental key creation rates obtained with these error correction, over a distance of 360 meters (Jennewein

systems are at least two orders of magnitude smaller than et al. 2000b). Inspired by a test of Bell inequalities

those obtained with faint laser pulses set-ups (net rate in performed with the same set-up a year earlier (Weihs et

the order of a few tens of bits per second rather than a few al., 1998), the two-photon source was located near the

thousands bits per second for a 10 km distance). Nev- center between the two analyzers. Special optical ļ¬bers,

ertheless, they oļ¬er interesting possibilities in the con- designed for guiding only a single mode at 700 nm, were

text of cryptographic optical networks The photon pairs used to transmit the photons to the two analyzers. The

source can indeed be operated by a key provider and sit- results of the remote measurements were recorded locally

uated somewhere in between potential QC customers. In and the processes of key sifting and of error correction

this case, the operator of the source has no way to get any implemented at a later stage, long after the distribution

information about the key obtained by Alice and Bob. of the qubits. Two diļ¬erent protocols were implemented:

It is interesting to emphasize the close analogy between one based on Wignerā™s inequality (a special form of Bell

1 and 2-photon schemes, which was ļ¬rst noted by Ben- inequalities), and the other one following BB84.

nett, Brassard and Mermin (1992). Indeed, in a 2-photon The group of Paul Kwiat then at Los Alamos National

scheme, one can always consider that when Alice detects Laboratory, demonstrated the Ekert protocol (Naik et al.

her photon, she eļ¬ectively prepares Bobā™s photon in a 2000). This experiment was a table-top realization with

given state. In the 1-photon analog, Aliceā™s detectors the source and the analyzers only separated by a few

are replaced by sources, while the photon pair source be- meters. The quantum channel consisted of a short free

tween Alice and Bob is bypassed. The diļ¬erence between space distance. In addition to performing QC, the re-

these schemes lies only in practical issues, like the spec- searchers simulated diļ¬erent eavesdropping strategies as

tral widths of the light. Alternatively, one can look at well. As predicted by the theory, they observed a rise of

this analogy from a diļ¬erent point of view: in 2-photon the QBER with an increase of the information obtained

by the eavesdropper. Moreover, they also recently im-

plemented the six-state protocol described in paragraph

II D 2, and observed the predicted QBER increase to 33%

44

(Enzer et al. 2001).

In the case of weak pulses we saw that a full round trip to-

The main advantage of polarization entanglement is

gether with the use of Faraday mirrors circumvents the prob-

the fact that analyzers are simple and eļ¬cient. It is

lem (see paragraph IV C 2). However, since the channel loss

on the way from the source to the Faraday mirror inevitably therefore relatively easy to obtain high contrast. Naik

increases the empty pulses fraction, the main advantage of and co-workers, for example, measured a polarization

photon pairs vanishes in such a conļ¬guration.

32

extinction of 97%, mainly limited by electronic imper- in Aliceā™s and Bobā™s interferometer ā“ non-local quantum

correlation (Franson 1989)45 ā“ see Fig. 22. The phase

fections of the fast modulators. This amounts to a

QBERopt contribution of only 1.5%. In addition, the in the interferometers at Aliceā™s and Bobā™s can, for ex-

constraint on the coherence length of the pump laser is ample, be adjusted so that both photons always emerge

not very stringent (note that if it is shorter than the from the same output port. It is then possible to ex-

length of the crystal some diļ¬culties can appear, but we change bits by associating values to the two ports. This

will not mention them here). is, however, not suļ¬cient. A second measurement basis

In spite of their qualities, it would be diļ¬cult to repro- must be implemented, to ensure security against eaves-

duce these experiments on distances of more than a few dropping attempts. This can be done for example by

kilometers of optical ļ¬ber. As mentioned in the intro- adding a second interferometer to the systems (see Fig.

duction to this chapter, polarization is indeed not robust 23). In the latter case, when reaching an analyzer, a

enough to decoherence in optical ļ¬bers. In addition, the photon chooses randomly to go to one or the other in-

polarization state transformation induced by an installed terferometer. The second set of interferometers can be

ļ¬ber frequently ļ¬‚uctuates, making an active alignment adjusted to also yield perfect correlations between out-

system absolutely necessary. Nevertheless, these exper- put ports. The relative phase between their arms should

iments are very interesting in the context of free space however be chosen so that when the photons go to inter-

QC. ferometers not associated, the outcomes are completely

uncorrelated.

Such a system features a passive state preparation by

Alice, yielding security against multiphoton splitting at-

B. Energy-time entanglement

tacks (see section VI J). In addition, it also features a

passive basis choice by Bob, which constitutes an elegant

1. Phase-coding

solution: neither a random number generator, nor an

active modulator are necessary. It is nevertheless clear

The other class of experiments takes advantage of

that QBERdet and QBERacc (deļ¬ned in eq. (33)) are

energy-time entangled photon pairs. The idea originates

doubled since the number of activated detectors is twice

from an arrangement proposed by Franson in 1989 to

as high. This disadvantage is however not as important

test Bell inequalities. As we will see below, it is com-

as it ļ¬rst appears since the alternative, a fast modula-

parable to the double Mach-Zehnder conļ¬guration dis-

tor, introduces losses close to 3dB, also resulting in an

cussed in section IV C 1. A source emits pairs of energy-

increase of these error contributions. The striking simi-

correlated photons with both particles created at exactly

larity between this scheme and the double Mach-Zehnder

the same, however uncertain time (see Fig. 22). This

arrangement discussed in the context of faint laser pulses

can be achieved by pumping a non-linear crystal with

in section IV C 1 is obvious when comparing Fig. 24 and

a pump of large coherence time. The pairs of down-

Fig. 16!

converted photons are then split, and one photon is sent

This scheme has been realized in the ļ¬rst half of 2000

to each party down quantum channels. Both Alice and

by our group at Geneva University (Ribordy et al., 2001).

Bob possess a widely, but identically unbalanced Mach-

It constitutes the ļ¬rst experiment in which an asymmet-

Zehnder interferometer, with photon counting detectors

ric setup, optimized for QC was used instead of a system

connected to the outputs. Locally, if Alice or Bob change

designed for tests of Bell inequality and having a source

the phase of their interferometer, no eļ¬ect on the count

located in the center between Alice and Bob (see Fig.

rates is observed, since the imbalancement prevents any

25). The two-photon source (a KNbO3 crystal pumped

single-photon interference. Looking at the detection-time

by a doubled Nd-YAG laser) provides energy-time entan-

at Bobā™s with respect to the arrival time at Aliceā™s, three

gled photons at non-degenerate wavelengths ā“ one around

diļ¬erent values are possible for each combination of de-

810 nm, the other one centered at 1550 nm. This choice

tectors. The diļ¬erent possibilities in a time spectrum

allows to use high eļ¬ciency silicon based single photon

are shown in Fig. 22. First, both photons can propagate

counters featuring low noise to detect the photons of the

through the short arms of the interferometers. Next, one

lower wavelength. To avoid the high transmission losses

can take the long arm at Aliceā™s, while the other one

at this wavelength in optical ļ¬bers, the distance between

takes the short one at Bobā™s. The opposite is also pos-

the source and the corresponding analyzer is very short,

sible. Finally, both photons can propagate through the

long arms. When the path diļ¬erences of the interferome-

ters are matched within a fraction of the coherence length

of the down-converted photons, the short-short and the

45

The imbalancement of the interferometers must be large

long-long processes are indistinguishable, provided that

enough so that the middle peak can easily be distinguished

the coherence length of the pump photon is larger than

from the satellite ones. This minimal imbalancement is de-

the path-length diļ¬erence. Conditioning detection only

termined by the convolution of the detectorā™s jitter (tens of

on the central time peak, one observes two-photon inter-

ps), the electronic jitter (from tens to hundreds of ps) and the

ferences which depends on the sum of the relative phases

single-photon coherence time (<1ps).

33

of the order of a few meters. The other photon, at the slots (note that she has two detectors to take into ac-

wavelength where ļ¬ber losses are minimal, is sent via count). For instance, detection of a photon in the ļ¬rst

an optical ļ¬ber to Bobā™s interferometer and is then de- slot corresponds to āpump photon having traveled via the

tected by InGaAs APDā™s. The decoherence induced by short arm and downconverted photon via the short armā.

chromatic dispersion is limited by the use of dispersion- To keep it short, we refer to this process as | s P , | s A ,

shifted optical ļ¬ber (see section III B 3). where P stands for the pump- and A for Aliceā™s pho-

ton46 . However, the characterization of the complete

Implementing the BB84 protocols in the way discussed

above, with a total of four interferometers, is diļ¬cult. photon pair is still ambiguous, since, at this point, the

They must indeed be aligned and their relative phase path of the photon having traveled to Bob (short or long

kept accurately stable during the whole key distribution in his interferometer) is unknown to Alice. Figure 26

session. To simplify this problem, we devised birefringent illustrates all processes leading to a detection in the dif-

interferometers with polarization multiplexing of the two ferent time slots both at Aliceā™s and at Bobā™s detector.

bases. Consequently, the constraint on the stability of the Obviously, this reasoning holds for any combination of

interferometers is equivalent to that encountered in the two detectors. In order to build up the secret key, Al-

faint pulses double Mach-Zehnder system. We obtained ice and Bob now publicly agree about the events where

interference visibilities of typically 92%, yielding in turn both detected a photon in one of the satellite peaks ā“

a QBERopt contribution of about 4%. We demonstrated without revealing in which one ā“ or both in the central

QC over a transmission distance of 8.5 km in a laboratory peak ā“ without revealing the detector. This procedure

setting using a ļ¬ber on a spool and generated several corresponds to key-sifting. For instance, in the example

Mbits of key in hour long sessions. This is the largest discussed above, if Bob tells Alice that he also detected

span realized to date for QC with photon pairs. his photon in a satellite peak, she knows that it must

As already mentioned, it is essential for this scheme to have been the left peak as well. This is due to the fact

have a pump laser whose coherence length is larger than that the pump photon has traveled via the short arm ā“

the path imbalancement of the interferometers. In addi- hence Bob can detect his photon either in the left satellite

tion, its wavelength must remain stable during a key ex- or in the central peak. The same holds for Bob who now

change session. These requirements imply that the pump knows that Aliceā™s photon traveled via the short arm in

laser must be somewhat more elaborate than in the case her interferometer. Therefore, in case of joint detection

of polarization entanglement. in a satellite peak, Alice and Bob must have correlated

detection times. Assigning a bit value to each side peak,

Alice and Bob can exchange a sequence of correlated bits.

The cases where both ļ¬nd the photon in the central

2. Phase-time coding

time slot are used to implement the second basis. They

correspond to the | s P , | l A | l B and | l P , | s A | s B

We have mentioned in section IV C that states gener-

possibilities. If these are indistinguishable, one obtains

ated by two-paths interferometers are two-levels quantum

two-photon interferences, exactly as in the case discussed

systems. They can also be represented on a PoincarĀ“ e

in the previous paragraph on phase coding. Adjusting

sphere. The four-states used for phase coding in the

the phases, and maintaining them stable, perfect corre-

previous section would lie on the equator of the sphere,

lations between output ports chosen by the photons at

equally distributed. The coupling ratio of the beamsplit-

Aliceā™s and Bobā™s interferometers are used to establish

ter is indeed 50%, and they diļ¬er only by a phase dif-

the key bits in this second basis.

ference introduced between the components propagating

Phase-time coding has recently been implemented in a

through either arm. In principle, the four-state proto-

laboratory experiment by our group (Tittel et al., 2000)

col can be equally well implemented with only two states

and was reported at the same time as the two polariza-

on the equator and the two other ones on the poles. In

tion entanglement-based schemes mentioned above. A

this section, we present a system exploiting such a set

contrast of approximately 93% was obtained, yielding a

of states. Proposed by our group in 1999 (Brendel et

QBERopt contribution of 3.5%, similar to that obtained

al., 1999), the scheme follows in principle the Franson

with the phase coding scheme. This experiment will be

conļ¬guration described in the context of phase coding.

repeated over long distances, since losses in optical ļ¬bers

However, it is based on a pulsed source emitting entan-

are low at the downconverted photonsā™ wavelength (1300

gled photons in so-called energy-time Bell states (Tittel

nm).

et al. 2000). The emission time of the photon pair is

An advantage of this set-up is that coding in the time

therefore given by a superposition of only two discrete

basis is particularly stable. In addition, the coherence

terms, instead of a wide and continuous range bounded

length of the pump laser is not critical anymore. It is

only by the large coherence length of the pump laser (see

paragraph V B 1).

Consider Fig. 26. If Alice registers the arrival times

of the photons with respect to the emission time of the

46

pump pulse t0 , she ļ¬nds the photons in one of three time Note that it does not constitute a product state.

34

however necessary to use relatively short pulses (ā 500 VI. EAVESDROPPING

ps) powerful enough to induce a signiļ¬cant downconver-

sion probability. A. Problems and Objectives

Phase-time coding, as discussed in this section, can

also be realized with faint laser pulses (Bechmann- After the qubit exchange and bases reconciliation, Al-

Pasquinucci and Tittel, 2000). The 1-photon conļ¬gu- ice and Bob each have a sifted key. Ideally, these are

ration has though never been realized. It would be sim- identical. But in real life, there are always some errors

ilar to the double Mach-Zehnder discussed in paragraph and Alice and Bob must apply some classical information

IV C 1, but with the ļ¬rst coupler replaced by an active processing protocols, like error correction and privacy

switch. For the time-basis, Alice would set the switch ampliļ¬cation, to their data (see paragraph II C 4). The

either to full transmission or to full reļ¬‚ection, while for ļ¬rst protocol is necessary to obtain identical keys, the

the energy-basis she would set it at 50%. This illustrates second to obtain a secret key. Essentially, the problem

how considerations initiated on photon pairs can yield of eavesdropping is to ļ¬nd protocols which, given that

advances on faint pulses systems. Alice and Bob can only measure the QBER, either pro-

vides Alice and Bob with a provenly secure key, or stops

the protocol and informs the users that the key distribu-

3. Quantum secret sharing

tion has failed. This is a delicate question, really at the

intersection between quantum physics and information

In addition to QC using phase-time coding, we used the theory. Actually, there is not one, but several eavesdrop-

setup depicted in Fig. 26 for the ļ¬rst proof-of-principle ping problems, depending on the precise protocol, on the

demonstration of quantum secret sharing ā“ the general- degree of idealization one admits, on the technological

ization of quantum key distribution to more than two power one assumes Eve has and on the assumed ļ¬delity

parties (Tittel et al., 2001). In this new application of of Alice and Bobā™s equipment. Let us immediately stress

quantum communication, Alice distributes a secret key to that the complete analysis of eavesdropping on quantum

two other users, Bob and Charlie, in a way that neither channel is by far not yet ļ¬nished. In this chapter we

Bob nor Charlie alone have any information about the review some of the problems and solutions, without any

key, but that together they have full information. Like claim of mathematical rigor nor complete cover of the

with traditional QC, an eavesdropper trying to get some huge and fast evolving literature.

information about the key creates errors in the transmis- The general objective of eavesdropping analysis is to

sion data and thus reveals her presence. The motivation ļ¬nd ultimate and practical proofs of security for some

behind quantum secret sharing is to guarantee that Bob quantum cryptosystems. Ultimate means that the se-

and Charlie cooperate ā“ one of them might be dishonest curity is guaranteed against entire classes of eavesdrop-

ā“ in order to obtain a given piece of information. In con- ping attacks, even if Eve uses not only the best of to-

trast with previous proposals using three-particle GHZ dayā™s technology, but any conceivable technology of to-

Ė™

states (Zukowski et al.,1998, and Hillery et al., 1999), morrow. They take the form of theorems, with clearly

pairs of entangled photons in so-called energy-time Bell stated assumptions expressed in mathematical terms. In

states were used to mimic the necessary quantum cor- contrast, practical proofs deal with some actual pieces of

relation of three entangled qubits, albeit only two pho- hardware and software. There is thus a tension between

tons exist at the same time. This is possible because āultimateā and āpracticalā proofs. Indeed the ļ¬rst ones

of the symmetry between the preparation device acting favor general abstract assumptions, whereas the second

on the pump pulse and the devices analyzing the down- ones concentrate on physical implementations of the gen-

converted photons. Therefore, the emission of a pump eral concepts. Nevertheless, it is worth aiming at ļ¬nding

pulse can be considered as the detection of a photon with such proofs. In addition to the security issue, they pro-

100% eļ¬ciency, and the scheme features a much higher vide illuminating lessons for our general understanding

coincidence rate than that expected with the initially pro- of quantum information.

posed ātriple-photonā schemes. In the ideal game Eve has perfect technology: she is

only limited by the laws of quantum mechanics, but not

at all by todayā™s technology 47 . In particular, Eve can-

47

The question whether QC would survive the discovery of

the currently unknown validity limits of quantum mechanics

is interesting. Let us argue that it is likely that quantum me-

chanics will always adequately describe photons at telecom

and vsible wavelengths, like classical mechanics always ade-

quately describes the fall of apples, whatever the future of

35

not clone the qubits, as this is incompatible with quan- choose a value at random. Note also that the diļ¬erent

tum dynamics (see paragraph II C 2), but Eve is free to contributions of dark count to the total QBER depend

use any unitary interaction between one or several qubits on whether Bobā™s choice of basis is implemented using an

and an auxiliary system of her choice. Moreover, after active or a passive switch (see section IV A).

the interaction, Eve may keep her auxiliary system un- Next, one usually assumes that Alice and Bob have

perturbed, in particular in complete isolation from the thoroughly checked their equipments and that it is func-

environment, for an arbitrarily long time. Finally, af- tioning according to the speciļ¬cations. This is not par-

ter listening to all the public discussion between Alice ticular to quantum cryptography, but is quite a delicate

and Bob, she can perform the measurement of her choice question, as Eve could be the actual manufacturer of the

on her system, being again limited only by the laws of equipment! Classical crypto-systems must also be care-

quantum mechanics. Moreover, one assumes that all er- fully tested, like any commercial apparatuses. Testing a

rors are due to Eve. It is tempting to assume that some crypto-system is however delicate, because in cryptogra-

errors are due to Aliceā™s and Bobā™s instruments and this phy the client buys conļ¬dence and security, two qualities

probably makes sense in practice. But there is the danger diļ¬cult to quantify. D. Mayers and A. Yao (1998) pro-

that Eve replaces them with higher quality instruments posed to use Bell inequality to test that the equipments

(see next section)! really obey quantum mechanics, but even this is not en-

In the next section we elaborate on the most relevant tirely satisfactory. Indeed and interestingly, one of the

diļ¬erences between the above ideal game (ideal espe- most subtle loopholes in all present day tests of Bell in-

cially from Eveā™s point of view!) and real systems. Next, equality, the detection loophole, can be exploited to pro-

we return to the idealized situation and present several duce a purely classical software mimicking all quantum

eavesdropping strategies, starting from the simplest ones, correlation (Gisin and Gisin 1999). This illustrates once

where explicit formulas can be written down and ending again how close practical issues in QC are to philosophi-

with a general abstract security proof. Finally, we dis- cal debates about the foundations of quantum physics!

cus practical eavesdropping attacks and comment on the Finally, one has to assume that Alice and Bob are per-

complexity of real systemā™s security. fectly isolated from Eve. Without such an assumption

the entire game would be meaningless: clearly, Eve is

not allowed to look over Aliceā™s shoulder! But this el-

ementary assumption is again a nontrivial one. What

B. Idealized versus real implementation

if Eve uses the quantum channel connecting Alice to the

outside world? Ideally, the channel should incorporate an

Alice and Bob use technology available today. This

isolator 48 to keep Eve from shining light into Aliceā™s out-

trivial remark has several implications. First, all real

put port to examine the interior of her laboratory. But

components are imperfect, so that the qubits are pre-

all isolators operate only on a ļ¬nite bandwidth, hence

pared and detected not exactly in the basis described by

there should also be a ļ¬lter. But ļ¬lters have only a ļ¬nite

the theory. Moreover, a real source always has a ļ¬nite

eļ¬ciency. And so on. Except for section VI K where this

probability to produce more than one photon. Depending

assumption is discussed, we henceforth assume that Alice

on the details of the encoding device, all photons carry

and Bob are isolated from Eve.

the same qubit (see section VI J). Hence, in principle,

Eve could measure the photon number, without perturb-

ing the qubit. This is discussed in section VI H. Recall

C. Individual, joint and collective attacks

that ideally, Alice should emit single qubit-photons, i.e.

each logical qubit should be encoded in a single degree

of freedom of a single photon. In order to simplify the problem, several eavesdrop-

On Bobā™s side the situation is, ļ¬rst, that the eļ¬ciency ping strategies of restricted generalities have been deļ¬ned

of his detectors is quite limited and, next, that the dark (LĀØ tkenhaus 1996, Biham and Mor 1997a and 1997b) and

u

counts (spontaneous counts not produced by photons) analyzed. Of particular interest is the assumption that

are non negligible. The limited eļ¬ciency is analogous to Eve attaches independent probes to each qubit and mea-

the losses in the quantum channel. The analysis of the sures her probes one after the other. This class of attacks

dark counts is more delicate and no complete solution is called individual attacks, also known as incoherent at-

is known. Conservatively, LĀØ tkenhaus (2000) assumes

u tacks. This important class is analyzed in sections VI D

in his analysis that all dark counts provide information and VI E. Two other classes of eavesdropping strate-

to Eve. He also advises that whenever two detectors gies let Eve process several qubits coherently, hence the

ļ¬re simultaneously (generally due to a real photon and name of coherent attacks. The most general coherent at-

a dark count), Bob should not disregard such events but

48

Optical isolators, based on the Faraday eļ¬ect, let light pass

through only in one direction.

physics might be.

36

tacks are called joint attacks, while an intermediate class has to be averaged over all possible results r that Eve

assumes that Eve attaches one probe per qubit, like in might get:

individual attacks, but can measure several probes coher-

Ha = P (r)H(i|r) (41)

ently, like in coherent attacks. This intermediate class is posteriori

called collective attacks. It is not known whether this r

class is less eļ¬cient than the most general joint one. It is

also not known whether it is more eļ¬cient than the sim-

H(i|r) = ā’ P (i|r) log(P (i|r)) (42)

pler individual attacks. Actually, it is not even known

i

whether joint attacks are more eļ¬cient than individual

ones! where the a posteriori probability of bit i given Eveā™s

For joint and collective attacks, the usual assumption result r is given by Bayesā™s theorem:

is that Eve measures her probe only after Alice and Bob

have completed all their public discussion about bases P (r|i)P (i)

P (i|r) = (43)

reconciliation, error correction and privacy ampliļ¬cation. P (r)

But for the more realistic individual attacks, one assumes

with P (r) = i P (r|i)P (i). In the case of intercept-

that Eve waits only until the bases reconciliation phase

of the public discussion49 . The motivation for this is resend, Eve gets one out of 4 possible results: r ā {ā‘, ā“

, ā, ā’}. After the basis has been revealed, Aliceā™s input

that one hardly sees what Eve could gain waiting for the

assumes one out of 2 values: i ā {ā‘, ā“} (assuming the ā‘ā“

public discussion on error correction and privacy ampli-

basis was used, the other case is completely analogous).

ļ¬cation before measuring her probes, since she is anyway

1

One gets P (i =ā‘ |r =ā‘) = 1, P (i =ā‘ |r =ā’) = 2 and

going to measure them independently.

P (r) = 1 . Hence, I(Ī±, Ē«) = 1ā’ 2 h(1)ā’ 2 h( 2 ) = 1ā’ 2 = 2

1 1 1 1 1

Individual attacks have the nice feature that the prob- 2

lem can be entirely translated into a classical one: Alice, (with h(p) = p log2 (p) + (1 ā’ p) log2 (1 ā’ p)).

Bob and Eve all have classical information in the form Another strategy for Eve, not more diļ¬cult to imple-

of random variables Ī±, Ī² an Ē«, respectively, and the laws ment, consists in measuring the photons in the inter-

of quantum mechanics imposes constraints on the joint mediate basis (see Fig. 27), also known as the Brei-

probability distribution P (Ī±, Ī², Ē«). Such classical scenar- dbart basis (Bennett et al. 1992a). In this way the

ios have been widely studied by the classical cryptology probability that Eve guesses the correct bit value is

ā

community and many results can thus be directly ap- p = cos(Ļ/8)2 = 1 + 42 ā 0.854, corresponding to a

2

plied. QBER=2p(1 ā’ p) = 25% and Shannon information gain

per bit of

D. Simple individual attacks: intercept-resend, I = 1 ā’ H(p) ā 0.399. (44)

measurement in the intermediate basis

Consequently, this strategy is less advantageous for Eve

than the intercept-resend one. Note however, that with

The simplest attack for Eve consists in intercepting all

this strategy Eveā™s probability to guess the correct bit

photons individually, to measure them in a basis cho-

value is 85.%, compared to only 75% in the intercept-

sen randomly among the two bases used by Alice and to

resend case. This is possible because in the latter case

send new photons to Bob prepared according to her re-

Eveā™s information is deterministic in half the cases, while

sult. As presented in paragraph II C 3 and assuming that

in the ļ¬rst one Eveā™s information is always probabilistic

the BB84 protocol is used, Eve gets thus 0.5 bit of infor-

(formally this results from the convexity of the entropy

mation per bit in the sifted key, for an induced QBER

function).

of 25%. Let us illustrate the general formalism on this

simple example. Eveā™s mean information gain on Aliceā™s

bit, I(Ī±, Ē«), equals their relative entropy decrease:

E. Symmetric individual attacks

I(Ī±, Ē«) = Ha ā’ Ha (40)

priori posteriori

In this section we present in some details how Eve

i.e. I(Ī±, Ī²) is the number of bits one can save writing Ī± could get a maximum Shannon information for a ļ¬xed

when knowing Ī². Since the a priori probability for Aliceā™s QBER, assuming a perfect single qubit source and re-

bit is uniform, Ha priori = 1. The a posteriori entropy stricting Eve to attacks on one qubit after the other (i.e.

individual attacks). The motivation is that this ideal-

ized situation is rather easy to treat and nicely illustrates

several of the subtleties of the subject. Here we concen-

49

trate on the BB84 4-state protocol, for related results on

With todayā™s technology, it might even be fair to assume,

the 2-state and the 6-state protocols see Fuchs and Peres

in individual attacks, that Eve must measure her probe before

(1996) and Bechmann-Pasquinucci and Gisin (1999), re-

the basis reconciliation.

spectively.

37

The general idea of eavesdropping on a quantum chan- U | ā“, 0 = | ā“ ā— Ļā“ + | ā‘ ā— Īøā“ (48)

nel goes as follows. When a qubit propagates from Al-

where the 4 states Ļā‘ , Ļā“ , Īøā‘ and Īøā“ belong to Eveā™s probe

ice to Bob, Eve can let a system of her choice, called a

Hilbert space HEve and satisfy Ļā‘ ā„ Īøā‘ and Ļā“ ā„ Īøā“ .

probe, interact with the qubit (see Fig. 28). She can

By symmetry |Ļā‘ |2 = |Ļā“ |2 ā” F and |Īøā‘ |2 = |Īøā“ |2 ā” D.

freely choose the probe and its initial state, but it has to

Unitarity imposes F + D = 1 and

be a system satisfying the quantum rules (i.e. described

in some Hilbert space). Eve can also choose the interac-

Ļā‘ |Īøā“ + Īøā‘ |Ļā“ = 0. (49)

tion, but it should be independent of the qubit state and

she should follow the laws of quantum mechanics, i.e. her

The Ļā™s correspond to Eveā™s state when Bob gets the

interaction is described by a unitary operator. After the

qubit undisturbed, while the Īøā™s are Eveā™s state when

interaction a qubit has to go to Bob (in section VI H we

the qubit is disturbed.

consider lossy channels, so that Bob does not always ex-

Let us emphasize that this is the most general unitary

pect a qubit, a fact that Eve can take advantage of). It

interaction satisfying (46). One ļ¬nds that the shrinking

makes no diļ¬erence whether this qubit is the original one

factor is given by: Ī· = F ā’ D. Accordingly, if Alice

(possibly in a modiļ¬ed state) or not. Actually the ques-

sends | ā‘ and Bob measures in the compatible basis,

tion does not even make sense since a qubit is nothing

then ā‘ |ĻBob (m)| ā‘ = F is the probability that Bob

but a qubit! But in the formalism it is convenient to use

gets the correct result. Hence F is the ļ¬delity and D the

the same Hilbert space for the qubit sent by Alice and

QBER.

that received by Bob (this is no loss of generality, since

ńņš. 2 |