near 90 km. PULSES

Let us now assume that instead of a perfect single-

photon source, Alice and Bob use a (perfect) 2-photon Experimental quantum key distribution was demon-

source set in the middle of their quantum channel. Each strated for the ¬rst time in 1989 (it was published only

√

photon has then a probability tlink to get to a detec- in 1992 by Bennett et al. 1992a). Since then, tremen-

tor. The probability of a correct joined detection is thus dous progress has been made. Today, several groups have

Praw = tlink√2 , while an error occurs with probability

· shown that quantum key distribution is possible, even

√ √

P det = (1 ’ tlink ·)2 p2 + 2 tlink ·(1 ’ tlink ·)pdark outside the laboratory. In principle, any two-level quan-

dark

(both photon lost and 2 dark counts, or one photon tum system could be used to implement QC. In practice,

lost and one dark count). This can be conveniently all implementations have relied on photons. The reason

1/n

rewritten as: Praw = tlink · n and Pdet = (tlink · + (1 ’ is that their interaction with the environment, also called

decoherence, can be controlled and moderated. In addi-

1/n

tlink ·)pdark )n ’ tlink · n valid for any division of the link

tion, researchers can bene¬t from all the tools developed

into n equal-length sections and n detectors. Note that

in the past two decades for optical telecommunications.

the measurements performed at the nodes between Alice

It is unlikely that other carriers will be employed in the

and Bob do transmit (swap) the entanglement to the twin

foreseeable future.

photons, without revealing any information about the

Comparing di¬erent QC-setups is a di¬cult task, since

qubit (these measurements are called Bell-measurements

several criteria must be taken into account. What mat-

and are the core of entanglement swapping and of quan-

ters in the end is of course the rate of corrected secret bits

tum teleportation). The corresponding net rates are dis-

(distilled bit rate, Rdist ) that can be transmitted and the

played in Fig. 10. Clearly, the rates for short distances

transmission distance. One can already note that with

are smaller when several detectors are used, because of

present and near future technology, it will probably not

their limited e¬ciencies (here we assume · = 10%). But

be possible to achieve rates of the order of gigahertz,

the distance before the net rate drops to zero is extended

nowadays common with conventional optical communi-

to longer distances! Intuitively, this can be understood

cation systems (in their comprehensive paper published

as follows. Let™s consider that a logical qubit propagates

in 2000, Gilbert and Hamrick discuss practical methods

from Alice to Bob (although some photons propagate in

to achieve high bit rate QC). This implies that encryp-

the opposite direction). Then, each 2-photon source and

tion with a key exchanged through QC is to be limited

each Bell-measurement acts on this logical qubit as a kind

to highly con¬dential information. While the determina-

of QND measurement: they test whether the logical qubit

tion of the transmission distance and rate of detection

is still there! In this way, Bob activates his detectors only

(the raw bit rate, Rraw ) is straightforward, estimating

1/n

when there is a large chance tlink that the photon gets

the net rate is rather di¬cult. Although in principle er-

to his detectors.

rors in the bit sequence follow only from tampering by

Note that if in addition to the detectors™ noise there

a malevolent eavesdropper, the situation is rather dif-

is noise due to decoherence, then the above idea can be

ferent in reality. Discrepancies in the keys of Alice and

extended, using entanglement puri¬cation. This is essen-

Bob also always happen because of experimental imper-

tially the idea of quantum repeaters (Briegel et al. 1998,

fections. The error rate (here called quantum bit error

Dur et al. 1999).

rate, or QBER) can be easily determined. Similarly, the

error correction procedure is rather simple. Error cor-

rection leads to a ¬rst reduction of the key rate that de-

pends strongly on the QBER. The real problem consist

in estimating the information obtained by Eve, a quan-

tity necessary for privacy ampli¬cation. It does not only

depend on the QBER, but also on other factors, like the

photon number statistics of the source, or the way the

choice of the measurement basis is made. Moreover in

a pragmatic approach, one might also accept restrictions

on Eve™s technology, limiting her strategies and there-

fore also the information she can obtain per error she

introduces. Since the e¬ciency of privacy ampli¬cation

rapidly decreases when the QBER increases, the distilled

bit rate depends dramatically on Eve™s information and

hence on the assumptions made. One can de¬ne as the

maximum transmission distance, the distance where the

distilled rate reaches zero. This can give an idea of the

21

di¬culty to evaluate a QC system from a physical point product of the sifted key rate and the probability popt of

of view. a photon going in the wrong detector:

Technological aspects must also be taken into account.

1

In this article we do not focus on all the published per- Ropt = Rsif t popt = q frep µ tlink popt · (28)

2

formances (in particular not on the key rates), which

strongly depend on present technology and the ¬nancial This contribution can be considered, for a given set-up,

possibilities of the research teams having carried out the as an intrinsic error rate indicating the suitability to use

experiments. On the contrary, we try to weight the in- it for QC. We will discuss it below in the case of each

trinsic technological di¬culties associated with each set- particular system.

up and to anticipate certain technological advances. And The second contribution, Rdet , arises from the detector

last but not least the cost of the realization of a prototype dark counts (or from remaining environmental stray light

should also be considered. in free space setups). This rate is independent of the bit

In this chapter, we ¬rst deduce a general formula for rate31 . Of course, only dark counts falling in a short time

the QBER and consider its impact on the distilled rate. window when a photon is expected give rise to errors.

We then review faint pulses implementations. We class

11

them according to the property used to encode the qubits

Rdet = frep pdark n (29)

value and follow a rough chronological order. Finally, we 22

assess the possibility to adopt the various set-ups for the

where pdark is the probability of registering a dark count

realization of an industrial prototype. Systems based on

per time-window and per detector, and n is the number of

entangled photon pairs are presented in the next chapter.

detectors. The two 1 -factors are related to the fact that

2

a dark count has a 50% chance to happen with Alice and

Bob having chosen incompatible bases (thus eliminated

A. Quantum Bit Error Rate

during sifting) and a 50% chance to arise in the correct

detector.

The QBER is de¬ned as the number of wrong bits to

Finally error counts can arise from uncorrelated pho-

the total number of received bits30 and is normally in

tons, because of imperfect photon sources:

the order of a few percent. In the following we will use

it expressed as a function of rates: 11

Racc = pacc frep tlink n· (30)

22

Nwrong Rerror Rerror

QBER = = ≈

This factor appears only in systems based on entangled

Nright + Nwrong Rsif t + Rerror Rsif t

photons, where the photons belonging to di¬erent pairs

(26)

but arriving in the same time window are not necessarily

in the same state. The quantity pacc is the probability to

where the sifted key corresponds to the cases in which

¬nd a second pair within the time window, knowing that

Alice and Bob made compatible choices of bases, hence

a ¬rst one was created32 .

its rate is half that of the raw key.

The QBER can now be expressed as follows:

The raw rate is essentially the product of the pulse

rate frep , the mean number of photon per pulse µ, the Ropt + Rdet + Racc

QBER = (31)

probability tlink of a photon to arrive at the analyzer and

Rsif t

the probability · of the photon being detected:

pdark · n pacc

= popt + + (32)

tlink · · · 2 · q · µ 2 · q · µ

1 1

Rsif t = Rraw = q frep µ tlink · (27)

= QBERopt + QBERdet + QBERacc (33)

2 2

1

The factor q (q¤1, typically 1 or 2 ) must be introduced We analyze now these three contributions. The ¬rst

for some phase-coding setups in order to correct for non- one, QBERopt , is independent on the transmission dis-

interfering path combinations (see, e.g., sections IV C tance (it is independent of tlink ). It can be considered as

and V B). a measure of the optical quality of the setup, depending

One can distinguish three di¬erent contributions to only on the polarisation or interference fringe contrast.

Rerror . The ¬rst one arises because of photons ending

up in the wrong detector, due to unperfect interference

or polarization contrast. The rate Ropt is given by the

31

This is true provided that afterpulses (see section III C)

do not contribute to the dark counts.

32

Note that a passive choice of measurement basis implies

30

In the followin we are considering systems implementing that four detectors (or two detectors during two time win-

the BB84 protocol. For other protocols some of the formulas dows) are activated for every pulse, leading thus to a doubling

have to be slightly adapted. of Rdet and Racc .

22

The technical e¬ort needed to obtain, and more impor- rate after error correction and privacy ampli¬cation) for

tant, to maintain a given QBERopt is an important crite- di¬erent wavelengths as shown in Fig. 11. There is ¬rst

rion for evaluating di¬erent QC-setups. In polarization an exponential decrease, then, due to error correction

based systems, it™s rather simple to achieve a polarisa- and privacy ampli¬cation, the bit rates fall rapidly down

tion contrast of 100:1, corresponding to a QBERopt of to zero. This is most evident comparing the curves 1550

1%. In ¬ber based QC, the problem is to maintain this nm and 1550 nm “single” since the latter features 10

value in spite of polarisation ¬‚uctuations and depolarisa- times less QBER. One can see that the maximum range

tion in the ¬ber link. For phase coding setups, QBERopt is about 100 km. In practice it is closer to 50 km, due

and the interference visibility are related by to non-ideal error correction and privacy ampli¬cation,

multiphoton pulses and other optical losses not consid-

1’V ered here. Finally, let us mention that typical key cre-

QBERopt = (34)

2 ation rates of the order of a thousand bits per second over

distances of a few tens of kilometers have been demon-

A visibility of 98% translates thus into an optical error

strated experimentally (see, for example, Ribordy et al.

rate of 1%. Such a value implies the use of well aligned

2000 or Townsend 1998b).

and stable interferometers. In bulk optics perfect mode

overlap is di¬cult to achieve, but the polarization is sta-

ble. In single-mode ¬ber interferometers, on the contrary,

B. Polarization coding

perfect mode overlap is automatically achieved, but the

polarisation must be controlled and chromatic dispersion

Encoding the qubits in the polarization of photons is

can constitute a problem.

a natural solution. The ¬rst demonstration of QC by

The second contribution, QBERdet , increases with dis-

Charles Bennett and his coworkers (Bennett et al. 1992a)

tance, since the darkcount rate remains constant while

made use of this choice. They realized a system where

the bit rate goes down like tlink . It depends entirely on

Alice and Bob exchanged faint light pulses produced by

the ratio of the dark count rate to the quantum e¬ciency.

a LED and containing less than one photon on average

At present, good single-photon detectors are not commer-

over a distance of 30 cm in air. In spite of the small scale

cially available for telecommunication wavelengths. The

of this experiment, it had an important impact on the

span of QC is not limited by decoherence. As QBERopt

community in the sense that it showed that it was not

is essentially independent of the ¬ber length, it is the

unreasonable to use single photons instead of classical

detector noise that limits the transmission distance.

pulses for encoding bits.

Finally, the QBERacc contribution is present only in

A typical system for QC with the BB84 four states

some 2-photon schemes in which multi-photon pulses are

protocol using the polarization of photons is shown in

processed in such a way that they do not necessarily

Fig. 12. Alice™s system consists of four laser diodes. They

encode the same bit value (see e.g. paragraphs V B 1

emit short classical photon pulses (≈ 1ns) polarized at

and V B 2). Indeed, although in all systems there is a

’45—¦ , 0—¦ , +45—¦ , and 90—¦ . For a given qubit, a single

probability for multi-photon pulses, in most these con-

diode is triggered. The pulses are then attenuated by a

tribute only to the information available to Eve (see sec-

set of ¬lters to reduce the average number of photons well

tion VI H) and not to the QBER. But for implementa-

below 1, and sent along the quantum channel to Alice.

tions featuring passive choice by each photon, the multi-

It is essential that the pulses remain polarized for Bob

photon pulses do not contribute to Eve™s information but

to be able to extract the information encoded by Alice.

to the error rate (see section VI J).

As discussed in paragraph III B 2, polarization mode dis-

Now, let us calculate the useful bit rate as a func-

persion may depolarize the photons, provided the delay

tion of the distance. Rsif t and QBER are given as a

it introduces between both polarization modes is larger

function of tlink in eq. (27) and (32) respectively. The

than the coherence time. This sets a constraint on the

¬ber link transmission decreases exponentially with the

type of lasers used by Alice.

length. The fraction of bits lost due to error correc-

When reaching Bob, the pulses are extracted from the

tion and privacy ampli¬cation is a function of QBER

¬ber. They travel through a set of waveplates used to re-

and depends on Eve™s strategy. The number of remain-

cover the initial polarization states by compensating the

ing bits Rnet is given by the sifted key rate multiplied

transformation induced by the optical ¬ber (paragraph

by the di¬erence of the Alice-Bob mutual Shannon infor-

III B 2). The pulses reach then a symmetric beamsplit-

mation I(±, β) and Eve™s maximal Shannon information

ter, implementing the basis choice. Transmitted photons

I max (±, «):

are analyzed in the vertical-horizontal basis with a po-

larizing beamsplitter and two photon counting detectors.

Rnet = Rsif t I(±, β) ’ I max (±, «) (35)

The polarization state of the re¬‚ected photons is ¬rst ro-

tated with a waveplate by 45—¦ (’45—¦ to 0—¦ ). The photons

The latter are calculated here according to eq. (64) and are then analyzed with a second set of polarizing beam-

(66) (section VI E), considering only individual attacks splitter and photon counting detectors. This implements

and no multiphoton pulses. We obtain Rnet (useful bit

23

the diagonal basis. For illustration, let us follow a photon with photons at 800nm. It is interesting to note that,

polarized at +45—¦ , we see that its state of polarization is although he used standard telecommunications ¬bers

arbitrarily transformed in the optical ¬ber. At Bob™s end, which can support more than one spatial mode at this

the polarization controller must be set to bring it back wavelength, he was able to ensure single-mode propa-

to +45—¦ . If it chooses the output of the beamsplitter gation by carefully controlling the launching conditions.

corresponding to the vertical-horizontal basis, it will ex- Because of the problem discussed above, polarization

perience equal re¬‚ection and transmission probability at coding does not seem to be the best choice for QC in

the polarizing beamsplittter, yielding a random outcome. optical ¬bers. Nevertheless, this problem is drastically

On the other hand, if it chooses the diagonal basis, its improved when considering free space key exchange, as

state will be rotated to 90—¦ . The polarizing beamsplit- the air has essentially no birefringence at all (see section

ter will then re¬‚ect it with unit probability, yielding a IV E).

deterministic outcome.

Instead of Alice using four lasers and Bob two polar-

izing beamsplitters, it is also possible to implement this C. Phase coding

system with active polarization modulators such as Pock-

els cells. For emission, the modulator is randomly acti- The idea of encoding the value of qubits in the phase

vated for each pulse to rotate the state of polarization of photons was ¬rst mentioned by Bennett in the paper

to one of the four states, while, at the receiver, it ran- where he introduced the two-states protocol (1992). It is

domly rotates half of the incoming pulses by 45—¦ . It is indeed a very natural choice for optics specialists. State

also possible to realize the whole system with ¬ber optics preparation and analysis are then performed with inter-

components. ferometers, that can be realized with single-mode optical

Antoine Muller and his coworkers at the University of ¬bers components.

Geneva used such a system to perform QC experiments Fig. 14 presents an optical ¬ber version of a Mach-

over optical ¬bers (1993, see also Br´guet et al. 1994).

e Zehnder interferometer. It is made out of two symmetric

They created a key over a distance of 1100 meters with couplers “ the equivalent of beamsplitters “ connected

photons at 800 nm. In order to increase the transmission to each other, with one phase modulator in each arm.

distance, they repeated the experiment with photons at One can inject light in the set-up using a continuous and

1300nm (Muller et al.1995 and 1996) and created a key classical source, and monitor the intensity at the output

over a distance of 23 kilometers. An interesting feature ports. Provided that the coherence length of the light

of this experiment is that the quantum channel connect- used is larger than the path mismatch in the interferom-

ing Alice and Bob consisted in an optical ¬ber part of an eters, interference fringes can be recorded. Taking into

installed cable, used by the telecommunication company account the π/2-phase shift experienced upon re¬‚ection

Swisscom for carrying phone conversations. It runs be- at a beamsplitter, the e¬ect of the phase modulators (φA

tween the Swiss cities of Geneva and Nyon, under Lake and φB ) and the path length di¬erence (∆L), the inten-

Geneva (Fig. 13). This was the ¬rst time QC was per- sity in the output port labeled “0” is given by:

formed outside of a physics laboratory. It had a strong

φA ’ φB + k∆L

impact on the interest of the wider public for the new

I0 = I · cos2 (36)

¬eld of quantum communication. 2

These two experiments highlighted the fact that the

polarization transformation induced by a long optical where k is the wave number and I the intensity of the

¬ber was unstable over time. Indeed, when monitoring source. If the phase term is equal to π/2 + nπ where n

the QBER of their system, Muller noticed that, although is an integer, destructive interference is obtained. There-

it remained stable and low for some time (of the order of fore the intensity registered in port “0” reaches a mini-

several minutes), it would suddenly increase after a while, mum and all the light exits in port “1”. When the phase

indicating a modi¬cation of the polarization transforma- term is equal to nπ, the situation is reversed: construc-

tion in the ¬ber. This implies that a real ¬ber based QC tive interference is obtained in port “0”, while the inten-

system requires active alignment to compensate for this sity in port “1” goes to a minimum. With intermediate

evolution. Although not impossible, such a procedure is phase settings, light can be recorded in both ports. This

certainly di¬cult. James Franson did indeed implement device acts like an optical switch. It is essential to keep

an active feedback aligment system ( 1995), but did not the path di¬erence stable in order to record stationary

pursue along this direction. It is interesting to note that interferences.

replacing standard ¬bers with polarization maintaining Although we discussed the behavior of this interferom-

¬bers does not solve the problem. The reason is that, in eter for classical light, it works exactly the same when a

spite of their name, these ¬bers do not maintain polar- single photon is injected. The probability to detect the

ization, as explained in paragraph III B 2. photon in one output port can be varied by changing the

Recently, Paul Townsend of BT Laboratories also in- phase. It is the ¬ber optic version of Young™s slits exper-

vestigated such polarization encoding systems for QC on iment, where the arms of the interferometer replace the

short-span links up to 10 kilometers (1998a and 1998b) apertures.

24

This interferometer combined with a single photon the ¬rst beamsplitter. States produced by a switch are

source and photon counting detectors can be used for on the poles, while those resulting from the use of a 50/50

QC. Alice™s set-up consists of the source, the ¬rst coupler beamsplitter lie on the equator. Figure 15 illustrates this

and the ¬rst phase modulator, while Bob takes the sec- analogy. Consequently, all polarization schemes can also

ond modulator and coupler, as well as the detectors. Let be implemented using phase coding. Similarly, every cod-

us consider the implementation of the four-states BB84 ing using 2-path interferometers can be realized using po-

protocol. On the one hand, Alice can apply one of four larization. However, in practice one choice is often more

phase shifts (0, π/2, π, 3π/2) to encode a bit value. She convenient than the other, depending on circumstances

like the nature of the quantum channel33 .

associates 0 and π/2 to bit 0, and π and 3π/2 to bit

1. On the other hand, Bob performs a basis choice by

applying randomly a phase shift of either 0 or π/2, and

he associates the detector connected to the output port 1. The double Mach-Zehnder implementation

“0” to a bit value of 0, and the detector connected to

the port “1” to 1. When the di¬erence of their phase is Although the scheme presented in the previous para-

equal to 0 or π, Alice and Bob are using compatible bases graph works perfectly well on an optical table, it is im-

and they obtain deterministic results. In such cases, Al- possible to keep the path di¬erence stable when Alice and

ice can infer from the phase shift she applied, the output Bob are separated by more than a few meters. As men-

port chosen by the photon at Bob™s end and hence the tioned above, the relative length of the arms should not

bit value he registered. Bob, on his side, deduces from change by more than a fraction of a wavelength. Consid-

the output port chosen by the photon, the phase that ering a separation between Alice and Bob of 1 kilometer

Alice selected. When the phase di¬erence equals π/2 or for example, it is clear that it is not possible to prevent

3π/2, the bases are incompatible and the photon chooses path di¬erence changes smaller than 1µm caused by en-

randomly which port it takes at Bob™s coupler. This is vironmental variations. In his 1992 letter, Bennett also

summarized in Table 1. We must stress that it is essen- showed how to get round this problem. He suggested to

tial with this scheme to keep the path di¬erence stable use two unbalanced Mach-Zehnder interferometers con-

during a key exchange session. It should not change by nected in series by a single optical ¬ber (see Fig. 16),

more than a fraction of a wavelength of the photons. A both Alice and Bob being equipped with one. When

drift of the length of one arm would indeed change the monitoring counts as a function of the time since the

phase relation between Alice and Bob, and induce errors emission of the photons, Bob obtains three peaks (see

in their bit sequence. the inset in Fig. 16). The ¬rst one corresponds to the

cases where the photons chose the short path both in

Alice Bob Alice™s and in Bob™s interferometers, while the last one

Bit value φA φB φA ’ φB Bit value corresponds to photons taking twice the long paths. Fi-

nally, the central peak corresponds to photons choosing

0 0 0 0 0

the short path in Alice™s interferometer and the long one

0 0 π/2 3π/2 ?

in Bob™s, and to the opposite. If these two processes are

1 π 0 π 1

indistinguishable, they produce interference. A timing

1 π π/2 π/2 ?

window can be used to discriminate between interfering

0 π/2 0 π/2 ?

and non-interfering events. Disregarding the latter, it is

0 π/2 π/2 0 0

then possible for Alice and Bob to exchange a key.

1 3π/2 0 3π/2 ?

The advantage of this set-up is that both “halves” of

1 3π/2 π/2 π 1

the photon travel in the same optical ¬ber. They experi-

ence thus the same optical length in the environmentally

Table 1: Implementation of the BB84 four-states pro-

sensitive part of the system, provided that the variations

tocol with phase encoding.

in the ¬ber are slower than their temporal separations,

determined by the interferometer™s imbalance (≈ 5ns).

It is interesting to note that encoding qubits with 2-

This condition is much less di¬cult to ful¬ll. In order to

paths interferometers is formally isomorphic to polar-

obtain a good interference visibility, and hence a low er-

ization encoding. The two arms correspond to a nat-

ror rate, the imbalancements of the interferometers must

ural basis, and the weights cj of each qubit state ψ =

c1 e’iφ/2 , c2 eiφ/2 are determined by the coupling ratio

of the ¬rst beam splitter while the relative phase φ is in-

troduced in the interferometer. The Poincar´ sphere rep-

e