pulse contains more than one photon is essentially the

same for weak pulses and for photon pairs (see paragraph

III A 2). Second, using entangled photons pairs prevents

unintended information leakage in unused degrees of free-

dom (Mayers and Yao 1998). Observing a QBER smaller

than approximately 15%, or equivalently that Bell™s in-

equality is violated, indeed guarantees that the photons

are entangled and so that the di¬erent states are not

fully distinguishable through other degrees of freedom.

A third advantage was indicated recently by new and

elaborate eavesdropping analyses. The fact that passive

state preparation can be implemented prevents multipho-

ton splitting attacks (see section VI J).

42

This de¬nition of quantum cryptography applies to the fa-

mous experiment by Aspect and his co-workers testing Bell

inequalities with time varying analyzers (Aspect et al., 1982).

QC had however not yet been invented. It also applies to the

more recent experiments closing the locality loopholes, like

the one performed in Innsbruck using fast polarization mod-

ulators (Weihs et al. 1998) or the one performed in Geneva

using two analyzers on each side (Tittel et al. 1999; Gisin and

Zbinden 1999).

43

Photon pair sources are often, though not always, pumped

continuously. In these cases, the time window determined by

a trigger detector and electronics de¬nes an e¬ective pulse.

31

The coupling between the optical frequency and the schemes, everything is as if Alice™s photon propagated

property used to encode the qubit, i.e. decoherence, is backwards in time from Alice to the source and then for-

rather easy to master when using faint laser pulses. How- wards from the source to Bob.

ever, this issue is more serious when using photon pairs,

because of the larger spectral width. For example, for a

spectral width of 5 nm FWHM “ a typical value, equiva- A. Polarization entanglement

lent to a coherence time of 1 ps “ and a ¬ber with a typical

√

PMD of 0.2 ps/ km, transmission over a few kilometers A ¬rst class of experiments takes advantage of

induces signi¬cant depolarization, as discussed in para- polarization-entangled photon pairs. The setup, depicted

graph III B 2. In case of polarization-entangled photons, in Fig. 21, is similar to the scheme used for polarization

this gradually destroys their correlation. Although it is in coding based on faint pulses. A two-photon source emits

principle possible to compensate this e¬ect, the statistical pairs of entangled photons ¬‚ying back to back towards

nature of the PMD makes this impractical44 . Although Alice and Bob. Each photon is analyzed with a polar-

perfectly ¬ne for free-space QC (see section IV E), polar- izing beamsplitter whose orientation with respect to a

ization entanglement is thus not adequate for QC over common reference system can be changed rapidly. Two

long optical ¬bers. A similar e¬ect arises when dealing experiments, have been reported in the spring of 2000

with energy-time entangled photons. Here, the chromatic (Jennewein et al. 2000b, Naik et al. 2000). Both used

dispersion destroys the strong time-correlations between photon pairs at a wavelength of 700 nm, which were de-

the photons forming a pair. However, as discussed in tected with commercial single photon detectors based on

paragraph III B 3, it is possible to passively compensate Silicon APD™s. To create the photon pairs, both groups

for this e¬ect using either additional ¬bers with opposite took advantage of parametric downconversion in one or

dispersion, or exploiting the inherent energy correlation two BBO crystals pumped by an argon-ion laser. The an-

of photon pairs. alyzers consisted of fast modulators, used to rotate the

Generally speaking, entanglement based systems are polarization state of the photons, in front of polarizing

far more complex than faint laser pulses set-ups. They beamsplitters.

will most certainly not be used in the short term for the The group of Anton Zeilinger, then at the University of

realization of industrial prototypes. In addition the cur- Innsbruck, demonstrated such a crypto-system, including

rent experimental key creation rates obtained with these error correction, over a distance of 360 meters (Jennewein

systems are at least two orders of magnitude smaller than et al. 2000b). Inspired by a test of Bell inequalities

those obtained with faint laser pulses set-ups (net rate in performed with the same set-up a year earlier (Weihs et

the order of a few tens of bits per second rather than a few al., 1998), the two-photon source was located near the

thousands bits per second for a 10 km distance). Nev- center between the two analyzers. Special optical ¬bers,

ertheless, they o¬er interesting possibilities in the con- designed for guiding only a single mode at 700 nm, were

text of cryptographic optical networks The photon pairs used to transmit the photons to the two analyzers. The

source can indeed be operated by a key provider and sit- results of the remote measurements were recorded locally

uated somewhere in between potential QC customers. In and the processes of key sifting and of error correction

this case, the operator of the source has no way to get any implemented at a later stage, long after the distribution

information about the key obtained by Alice and Bob. of the qubits. Two di¬erent protocols were implemented:

It is interesting to emphasize the close analogy between one based on Wigner™s inequality (a special form of Bell

1 and 2-photon schemes, which was ¬rst noted by Ben- inequalities), and the other one following BB84.

nett, Brassard and Mermin (1992). Indeed, in a 2-photon The group of Paul Kwiat then at Los Alamos National

scheme, one can always consider that when Alice detects Laboratory, demonstrated the Ekert protocol (Naik et al.

her photon, she e¬ectively prepares Bob™s photon in a 2000). This experiment was a table-top realization with

given state. In the 1-photon analog, Alice™s detectors the source and the analyzers only separated by a few

are replaced by sources, while the photon pair source be- meters. The quantum channel consisted of a short free

tween Alice and Bob is bypassed. The di¬erence between space distance. In addition to performing QC, the re-

these schemes lies only in practical issues, like the spec- searchers simulated di¬erent eavesdropping strategies as

tral widths of the light. Alternatively, one can look at well. As predicted by the theory, they observed a rise of

this analogy from a di¬erent point of view: in 2-photon the QBER with an increase of the information obtained

by the eavesdropper. Moreover, they also recently im-

plemented the six-state protocol described in paragraph

II D 2, and observed the predicted QBER increase to 33%

44

(Enzer et al. 2001).

In the case of weak pulses we saw that a full round trip to-

The main advantage of polarization entanglement is

gether with the use of Faraday mirrors circumvents the prob-

the fact that analyzers are simple and e¬cient. It is

lem (see paragraph IV C 2). However, since the channel loss

on the way from the source to the Faraday mirror inevitably therefore relatively easy to obtain high contrast. Naik

increases the empty pulses fraction, the main advantage of and co-workers, for example, measured a polarization

photon pairs vanishes in such a con¬guration.

32

extinction of 97%, mainly limited by electronic imper- in Alice™s and Bob™s interferometer “ non-local quantum

correlation (Franson 1989)45 “ see Fig. 22. The phase

fections of the fast modulators. This amounts to a

QBERopt contribution of only 1.5%. In addition, the in the interferometers at Alice™s and Bob™s can, for ex-

constraint on the coherence length of the pump laser is ample, be adjusted so that both photons always emerge

not very stringent (note that if it is shorter than the from the same output port. It is then possible to ex-

length of the crystal some di¬culties can appear, but we change bits by associating values to the two ports. This

will not mention them here). is, however, not su¬cient. A second measurement basis

In spite of their qualities, it would be di¬cult to repro- must be implemented, to ensure security against eaves-

duce these experiments on distances of more than a few dropping attempts. This can be done for example by

kilometers of optical ¬ber. As mentioned in the intro- adding a second interferometer to the systems (see Fig.

duction to this chapter, polarization is indeed not robust 23). In the latter case, when reaching an analyzer, a

enough to decoherence in optical ¬bers. In addition, the photon chooses randomly to go to one or the other in-

polarization state transformation induced by an installed terferometer. The second set of interferometers can be

¬ber frequently ¬‚uctuates, making an active alignment adjusted to also yield perfect correlations between out-

system absolutely necessary. Nevertheless, these exper- put ports. The relative phase between their arms should

iments are very interesting in the context of free space however be chosen so that when the photons go to inter-

QC. ferometers not associated, the outcomes are completely

uncorrelated.

Such a system features a passive state preparation by

Alice, yielding security against multiphoton splitting at-

B. Energy-time entanglement

tacks (see section VI J). In addition, it also features a

passive basis choice by Bob, which constitutes an elegant

1. Phase-coding

solution: neither a random number generator, nor an

active modulator are necessary. It is nevertheless clear

The other class of experiments takes advantage of

that QBERdet and QBERacc (de¬ned in eq. (33)) are

energy-time entangled photon pairs. The idea originates

doubled since the number of activated detectors is twice

from an arrangement proposed by Franson in 1989 to

as high. This disadvantage is however not as important

test Bell inequalities. As we will see below, it is com-

as it ¬rst appears since the alternative, a fast modula-

parable to the double Mach-Zehnder con¬guration dis-

tor, introduces losses close to 3dB, also resulting in an

cussed in section IV C 1. A source emits pairs of energy-

increase of these error contributions. The striking simi-

correlated photons with both particles created at exactly

larity between this scheme and the double Mach-Zehnder

the same, however uncertain time (see Fig. 22). This

arrangement discussed in the context of faint laser pulses

can be achieved by pumping a non-linear crystal with

in section IV C 1 is obvious when comparing Fig. 24 and

a pump of large coherence time. The pairs of down-

Fig. 16!

converted photons are then split, and one photon is sent

This scheme has been realized in the ¬rst half of 2000

to each party down quantum channels. Both Alice and

by our group at Geneva University (Ribordy et al., 2001).

Bob possess a widely, but identically unbalanced Mach-

It constitutes the ¬rst experiment in which an asymmet-

Zehnder interferometer, with photon counting detectors

ric setup, optimized for QC was used instead of a system

connected to the outputs. Locally, if Alice or Bob change

designed for tests of Bell inequality and having a source

the phase of their interferometer, no e¬ect on the count

located in the center between Alice and Bob (see Fig.

rates is observed, since the imbalancement prevents any

25). The two-photon source (a KNbO3 crystal pumped

single-photon interference. Looking at the detection-time

by a doubled Nd-YAG laser) provides energy-time entan-

at Bob™s with respect to the arrival time at Alice™s, three

gled photons at non-degenerate wavelengths “ one around

di¬erent values are possible for each combination of de-

810 nm, the other one centered at 1550 nm. This choice

tectors. The di¬erent possibilities in a time spectrum

allows to use high e¬ciency silicon based single photon

are shown in Fig. 22. First, both photons can propagate

counters featuring low noise to detect the photons of the

through the short arms of the interferometers. Next, one

lower wavelength. To avoid the high transmission losses

can take the long arm at Alice™s, while the other one

at this wavelength in optical ¬bers, the distance between

takes the short one at Bob™s. The opposite is also pos-

the source and the corresponding analyzer is very short,

sible. Finally, both photons can propagate through the

long arms. When the path di¬erences of the interferome-

ters are matched within a fraction of the coherence length

of the down-converted photons, the short-short and the

45

The imbalancement of the interferometers must be large

long-long processes are indistinguishable, provided that

enough so that the middle peak can easily be distinguished

the coherence length of the pump photon is larger than

from the satellite ones. This minimal imbalancement is de-

the path-length di¬erence. Conditioning detection only

termined by the convolution of the detector™s jitter (tens of

on the central time peak, one observes two-photon inter-

ps), the electronic jitter (from tens to hundreds of ps) and the

ferences which depends on the sum of the relative phases

single-photon coherence time (<1ps).

33

of the order of a few meters. The other photon, at the slots (note that she has two detectors to take into ac-

wavelength where ¬ber losses are minimal, is sent via count). For instance, detection of a photon in the ¬rst

an optical ¬ber to Bob™s interferometer and is then de- slot corresponds to “pump photon having traveled via the

tected by InGaAs APD™s. The decoherence induced by short arm and downconverted photon via the short arm”.

chromatic dispersion is limited by the use of dispersion- To keep it short, we refer to this process as | s P , | s A ,

shifted optical ¬ber (see section III B 3). where P stands for the pump- and A for Alice™s pho-

ton46 . However, the characterization of the complete

Implementing the BB84 protocols in the way discussed

above, with a total of four interferometers, is di¬cult. photon pair is still ambiguous, since, at this point, the

They must indeed be aligned and their relative phase path of the photon having traveled to Bob (short or long

kept accurately stable during the whole key distribution in his interferometer) is unknown to Alice. Figure 26

session. To simplify this problem, we devised birefringent illustrates all processes leading to a detection in the dif-

interferometers with polarization multiplexing of the two ferent time slots both at Alice™s and at Bob™s detector.

bases. Consequently, the constraint on the stability of the Obviously, this reasoning holds for any combination of

interferometers is equivalent to that encountered in the two detectors. In order to build up the secret key, Al-

faint pulses double Mach-Zehnder system. We obtained ice and Bob now publicly agree about the events where

interference visibilities of typically 92%, yielding in turn both detected a photon in one of the satellite peaks “

a QBERopt contribution of about 4%. We demonstrated without revealing in which one “ or both in the central

QC over a transmission distance of 8.5 km in a laboratory peak “ without revealing the detector. This procedure

setting using a ¬ber on a spool and generated several corresponds to key-sifting. For instance, in the example

Mbits of key in hour long sessions. This is the largest discussed above, if Bob tells Alice that he also detected

span realized to date for QC with photon pairs. his photon in a satellite peak, she knows that it must

As already mentioned, it is essential for this scheme to have been the left peak as well. This is due to the fact

have a pump laser whose coherence length is larger than that the pump photon has traveled via the short arm “

the path imbalancement of the interferometers. In addi- hence Bob can detect his photon either in the left satellite

tion, its wavelength must remain stable during a key ex- or in the central peak. The same holds for Bob who now

change session. These requirements imply that the pump knows that Alice™s photon traveled via the short arm in

laser must be somewhat more elaborate than in the case her interferometer. Therefore, in case of joint detection

of polarization entanglement. in a satellite peak, Alice and Bob must have correlated

detection times. Assigning a bit value to each side peak,

Alice and Bob can exchange a sequence of correlated bits.

The cases where both ¬nd the photon in the central

2. Phase-time coding

time slot are used to implement the second basis. They

correspond to the | s P , | l A | l B and | l P , | s A | s B

We have mentioned in section IV C that states gener-

possibilities. If these are indistinguishable, one obtains

ated by two-paths interferometers are two-levels quantum

two-photon interferences, exactly as in the case discussed

systems. They can also be represented on a Poincar´ e

in the previous paragraph on phase coding. Adjusting

sphere. The four-states used for phase coding in the

the phases, and maintaining them stable, perfect corre-

previous section would lie on the equator of the sphere,

lations between output ports chosen by the photons at

equally distributed. The coupling ratio of the beamsplit-

Alice™s and Bob™s interferometers are used to establish

ter is indeed 50%, and they di¬er only by a phase dif-

the key bits in this second basis.

ference introduced between the components propagating

Phase-time coding has recently been implemented in a

through either arm. In principle, the four-state proto-

laboratory experiment by our group (Tittel et al., 2000)

col can be equally well implemented with only two states

and was reported at the same time as the two polariza-

on the equator and the two other ones on the poles. In

tion entanglement-based schemes mentioned above. A

this section, we present a system exploiting such a set

contrast of approximately 93% was obtained, yielding a

of states. Proposed by our group in 1999 (Brendel et

QBERopt contribution of 3.5%, similar to that obtained

al., 1999), the scheme follows in principle the Franson

with the phase coding scheme. This experiment will be

con¬guration described in the context of phase coding.

repeated over long distances, since losses in optical ¬bers

However, it is based on a pulsed source emitting entan-

are low at the downconverted photons™ wavelength (1300

gled photons in so-called energy-time Bell states (Tittel

nm).

et al. 2000). The emission time of the photon pair is

An advantage of this set-up is that coding in the time

therefore given by a superposition of only two discrete

basis is particularly stable. In addition, the coherence

terms, instead of a wide and continuous range bounded

length of the pump laser is not critical anymore. It is

only by the large coherence length of the pump laser (see

paragraph V B 1).

Consider Fig. 26. If Alice registers the arrival times

of the photons with respect to the emission time of the

46

pump pulse t0 , she ¬nds the photons in one of three time Note that it does not constitute a product state.

34

however necessary to use relatively short pulses (≈ 500 VI. EAVESDROPPING

ps) powerful enough to induce a signi¬cant downconver-

sion probability. A. Problems and Objectives

Phase-time coding, as discussed in this section, can

also be realized with faint laser pulses (Bechmann- After the qubit exchange and bases reconciliation, Al-

Pasquinucci and Tittel, 2000). The 1-photon con¬gu- ice and Bob each have a sifted key. Ideally, these are

ration has though never been realized. It would be sim- identical. But in real life, there are always some errors

ilar to the double Mach-Zehnder discussed in paragraph and Alice and Bob must apply some classical information

IV C 1, but with the ¬rst coupler replaced by an active processing protocols, like error correction and privacy

switch. For the time-basis, Alice would set the switch ampli¬cation, to their data (see paragraph II C 4). The

either to full transmission or to full re¬‚ection, while for ¬rst protocol is necessary to obtain identical keys, the

the energy-basis she would set it at 50%. This illustrates second to obtain a secret key. Essentially, the problem

how considerations initiated on photon pairs can yield of eavesdropping is to ¬nd protocols which, given that

advances on faint pulses systems. Alice and Bob can only measure the QBER, either pro-

vides Alice and Bob with a provenly secure key, or stops

the protocol and informs the users that the key distribu-

3. Quantum secret sharing

tion has failed. This is a delicate question, really at the

intersection between quantum physics and information

In addition to QC using phase-time coding, we used the theory. Actually, there is not one, but several eavesdrop-

setup depicted in Fig. 26 for the ¬rst proof-of-principle ping problems, depending on the precise protocol, on the

demonstration of quantum secret sharing “ the general- degree of idealization one admits, on the technological

ization of quantum key distribution to more than two power one assumes Eve has and on the assumed ¬delity

parties (Tittel et al., 2001). In this new application of of Alice and Bob™s equipment. Let us immediately stress

quantum communication, Alice distributes a secret key to that the complete analysis of eavesdropping on quantum

two other users, Bob and Charlie, in a way that neither channel is by far not yet ¬nished. In this chapter we

Bob nor Charlie alone have any information about the review some of the problems and solutions, without any

key, but that together they have full information. Like claim of mathematical rigor nor complete cover of the

with traditional QC, an eavesdropper trying to get some huge and fast evolving literature.

information about the key creates errors in the transmis- The general objective of eavesdropping analysis is to

sion data and thus reveals her presence. The motivation ¬nd ultimate and practical proofs of security for some

behind quantum secret sharing is to guarantee that Bob quantum cryptosystems. Ultimate means that the se-

and Charlie cooperate “ one of them might be dishonest curity is guaranteed against entire classes of eavesdrop-

“ in order to obtain a given piece of information. In con- ping attacks, even if Eve uses not only the best of to-

trast with previous proposals using three-particle GHZ day™s technology, but any conceivable technology of to-

™

states (Zukowski et al.,1998, and Hillery et al., 1999), morrow. They take the form of theorems, with clearly

pairs of entangled photons in so-called energy-time Bell stated assumptions expressed in mathematical terms. In

states were used to mimic the necessary quantum cor- contrast, practical proofs deal with some actual pieces of

relation of three entangled qubits, albeit only two pho- hardware and software. There is thus a tension between

tons exist at the same time. This is possible because “ultimate” and “practical” proofs. Indeed the ¬rst ones

of the symmetry between the preparation device acting favor general abstract assumptions, whereas the second

on the pump pulse and the devices analyzing the down- ones concentrate on physical implementations of the gen-

converted photons. Therefore, the emission of a pump eral concepts. Nevertheless, it is worth aiming at ¬nding

pulse can be considered as the detection of a photon with such proofs. In addition to the security issue, they pro-

100% e¬ciency, and the scheme features a much higher vide illuminating lessons for our general understanding

coincidence rate than that expected with the initially pro- of quantum information.

posed “triple-photon” schemes. In the ideal game Eve has perfect technology: she is

only limited by the laws of quantum mechanics, but not

at all by today™s technology 47 . In particular, Eve can-

47

The question whether QC would survive the discovery of

the currently unknown validity limits of quantum mechanics

is interesting. Let us argue that it is likely that quantum me-

chanics will always adequately describe photons at telecom

and vsible wavelengths, like classical mechanics always ade-

quately describes the fall of apples, whatever the future of

35

not clone the qubits, as this is incompatible with quan- choose a value at random. Note also that the di¬erent

tum dynamics (see paragraph II C 2), but Eve is free to contributions of dark count to the total QBER depend

use any unitary interaction between one or several qubits on whether Bob™s choice of basis is implemented using an

and an auxiliary system of her choice. Moreover, after active or a passive switch (see section IV A).

the interaction, Eve may keep her auxiliary system un- Next, one usually assumes that Alice and Bob have

perturbed, in particular in complete isolation from the thoroughly checked their equipments and that it is func-

environment, for an arbitrarily long time. Finally, af- tioning according to the speci¬cations. This is not par-

ter listening to all the public discussion between Alice ticular to quantum cryptography, but is quite a delicate

and Bob, she can perform the measurement of her choice question, as Eve could be the actual manufacturer of the

on her system, being again limited only by the laws of equipment! Classical crypto-systems must also be care-

quantum mechanics. Moreover, one assumes that all er- fully tested, like any commercial apparatuses. Testing a

rors are due to Eve. It is tempting to assume that some crypto-system is however delicate, because in cryptogra-

errors are due to Alice™s and Bob™s instruments and this phy the client buys con¬dence and security, two qualities

probably makes sense in practice. But there is the danger di¬cult to quantify. D. Mayers and A. Yao (1998) pro-

that Eve replaces them with higher quality instruments posed to use Bell inequality to test that the equipments

(see next section)! really obey quantum mechanics, but even this is not en-

In the next section we elaborate on the most relevant tirely satisfactory. Indeed and interestingly, one of the

di¬erences between the above ideal game (ideal espe- most subtle loopholes in all present day tests of Bell in-

cially from Eve™s point of view!) and real systems. Next, equality, the detection loophole, can be exploited to pro-

we return to the idealized situation and present several duce a purely classical software mimicking all quantum

eavesdropping strategies, starting from the simplest ones, correlation (Gisin and Gisin 1999). This illustrates once

where explicit formulas can be written down and ending again how close practical issues in QC are to philosophi-

with a general abstract security proof. Finally, we dis- cal debates about the foundations of quantum physics!

cus practical eavesdropping attacks and comment on the Finally, one has to assume that Alice and Bob are per-

complexity of real system™s security. fectly isolated from Eve. Without such an assumption

the entire game would be meaningless: clearly, Eve is

not allowed to look over Alice™s shoulder! But this el-

ementary assumption is again a nontrivial one. What

B. Idealized versus real implementation

if Eve uses the quantum channel connecting Alice to the

outside world? Ideally, the channel should incorporate an

Alice and Bob use technology available today. This

isolator 48 to keep Eve from shining light into Alice™s out-

trivial remark has several implications. First, all real

put port to examine the interior of her laboratory. But

components are imperfect, so that the qubits are pre-

all isolators operate only on a ¬nite bandwidth, hence

pared and detected not exactly in the basis described by

there should also be a ¬lter. But ¬lters have only a ¬nite

the theory. Moreover, a real source always has a ¬nite

e¬ciency. And so on. Except for section VI K where this

probability to produce more than one photon. Depending

assumption is discussed, we henceforth assume that Alice

on the details of the encoding device, all photons carry

and Bob are isolated from Eve.

the same qubit (see section VI J). Hence, in principle,

Eve could measure the photon number, without perturb-

ing the qubit. This is discussed in section VI H. Recall

C. Individual, joint and collective attacks

that ideally, Alice should emit single qubit-photons, i.e.

each logical qubit should be encoded in a single degree

of freedom of a single photon. In order to simplify the problem, several eavesdrop-

On Bob™s side the situation is, ¬rst, that the e¬ciency ping strategies of restricted generalities have been de¬ned

of his detectors is quite limited and, next, that the dark (L¨ tkenhaus 1996, Biham and Mor 1997a and 1997b) and

u

counts (spontaneous counts not produced by photons) analyzed. Of particular interest is the assumption that

are non negligible. The limited e¬ciency is analogous to Eve attaches independent probes to each qubit and mea-

the losses in the quantum channel. The analysis of the sures her probes one after the other. This class of attacks

dark counts is more delicate and no complete solution is called individual attacks, also known as incoherent at-

is known. Conservatively, L¨ tkenhaus (2000) assumes

u tacks. This important class is analyzed in sections VI D

in his analysis that all dark counts provide information and VI E. Two other classes of eavesdropping strate-

to Eve. He also advises that whenever two detectors gies let Eve process several qubits coherently, hence the

¬re simultaneously (generally due to a real photon and name of coherent attacks. The most general coherent at-

a dark count), Bob should not disregard such events but