<< . .

. 7
( : 11)



. . >>

mean photon number, the probability that a non-empty
pulse contains more than one photon is essentially the
same for weak pulses and for photon pairs (see paragraph
III A 2). Second, using entangled photons pairs prevents
unintended information leakage in unused degrees of free-
dom (Mayers and Yao 1998). Observing a QBER smaller
than approximately 15%, or equivalently that Bell™s in-
equality is violated, indeed guarantees that the photons
are entangled and so that the di¬erent states are not
fully distinguishable through other degrees of freedom.
A third advantage was indicated recently by new and
elaborate eavesdropping analyses. The fact that passive
state preparation can be implemented prevents multipho-
ton splitting attacks (see section VI J).



42
This de¬nition of quantum cryptography applies to the fa-
mous experiment by Aspect and his co-workers testing Bell
inequalities with time varying analyzers (Aspect et al., 1982).
QC had however not yet been invented. It also applies to the
more recent experiments closing the locality loopholes, like
the one performed in Innsbruck using fast polarization mod-
ulators (Weihs et al. 1998) or the one performed in Geneva
using two analyzers on each side (Tittel et al. 1999; Gisin and
Zbinden 1999).
43
Photon pair sources are often, though not always, pumped
continuously. In these cases, the time window determined by
a trigger detector and electronics de¬nes an e¬ective pulse.


31
The coupling between the optical frequency and the schemes, everything is as if Alice™s photon propagated
property used to encode the qubit, i.e. decoherence, is backwards in time from Alice to the source and then for-
rather easy to master when using faint laser pulses. How- wards from the source to Bob.
ever, this issue is more serious when using photon pairs,
because of the larger spectral width. For example, for a
spectral width of 5 nm FWHM “ a typical value, equiva- A. Polarization entanglement
lent to a coherence time of 1 ps “ and a ¬ber with a typical

PMD of 0.2 ps/ km, transmission over a few kilometers A ¬rst class of experiments takes advantage of
induces signi¬cant depolarization, as discussed in para- polarization-entangled photon pairs. The setup, depicted
graph III B 2. In case of polarization-entangled photons, in Fig. 21, is similar to the scheme used for polarization
this gradually destroys their correlation. Although it is in coding based on faint pulses. A two-photon source emits
principle possible to compensate this e¬ect, the statistical pairs of entangled photons ¬‚ying back to back towards
nature of the PMD makes this impractical44 . Although Alice and Bob. Each photon is analyzed with a polar-
perfectly ¬ne for free-space QC (see section IV E), polar- izing beamsplitter whose orientation with respect to a
ization entanglement is thus not adequate for QC over common reference system can be changed rapidly. Two
long optical ¬bers. A similar e¬ect arises when dealing experiments, have been reported in the spring of 2000
with energy-time entangled photons. Here, the chromatic (Jennewein et al. 2000b, Naik et al. 2000). Both used
dispersion destroys the strong time-correlations between photon pairs at a wavelength of 700 nm, which were de-
the photons forming a pair. However, as discussed in tected with commercial single photon detectors based on
paragraph III B 3, it is possible to passively compensate Silicon APD™s. To create the photon pairs, both groups
for this e¬ect using either additional ¬bers with opposite took advantage of parametric downconversion in one or
dispersion, or exploiting the inherent energy correlation two BBO crystals pumped by an argon-ion laser. The an-
of photon pairs. alyzers consisted of fast modulators, used to rotate the
Generally speaking, entanglement based systems are polarization state of the photons, in front of polarizing
far more complex than faint laser pulses set-ups. They beamsplitters.
will most certainly not be used in the short term for the The group of Anton Zeilinger, then at the University of
realization of industrial prototypes. In addition the cur- Innsbruck, demonstrated such a crypto-system, including
rent experimental key creation rates obtained with these error correction, over a distance of 360 meters (Jennewein
systems are at least two orders of magnitude smaller than et al. 2000b). Inspired by a test of Bell inequalities
those obtained with faint laser pulses set-ups (net rate in performed with the same set-up a year earlier (Weihs et
the order of a few tens of bits per second rather than a few al., 1998), the two-photon source was located near the
thousands bits per second for a 10 km distance). Nev- center between the two analyzers. Special optical ¬bers,
ertheless, they o¬er interesting possibilities in the con- designed for guiding only a single mode at 700 nm, were
text of cryptographic optical networks The photon pairs used to transmit the photons to the two analyzers. The
source can indeed be operated by a key provider and sit- results of the remote measurements were recorded locally
uated somewhere in between potential QC customers. In and the processes of key sifting and of error correction
this case, the operator of the source has no way to get any implemented at a later stage, long after the distribution
information about the key obtained by Alice and Bob. of the qubits. Two di¬erent protocols were implemented:
It is interesting to emphasize the close analogy between one based on Wigner™s inequality (a special form of Bell
1 and 2-photon schemes, which was ¬rst noted by Ben- inequalities), and the other one following BB84.
nett, Brassard and Mermin (1992). Indeed, in a 2-photon The group of Paul Kwiat then at Los Alamos National
scheme, one can always consider that when Alice detects Laboratory, demonstrated the Ekert protocol (Naik et al.
her photon, she e¬ectively prepares Bob™s photon in a 2000). This experiment was a table-top realization with
given state. In the 1-photon analog, Alice™s detectors the source and the analyzers only separated by a few
are replaced by sources, while the photon pair source be- meters. The quantum channel consisted of a short free
tween Alice and Bob is bypassed. The di¬erence between space distance. In addition to performing QC, the re-
these schemes lies only in practical issues, like the spec- searchers simulated di¬erent eavesdropping strategies as
tral widths of the light. Alternatively, one can look at well. As predicted by the theory, they observed a rise of
this analogy from a di¬erent point of view: in 2-photon the QBER with an increase of the information obtained
by the eavesdropper. Moreover, they also recently im-
plemented the six-state protocol described in paragraph
II D 2, and observed the predicted QBER increase to 33%
44
(Enzer et al. 2001).
In the case of weak pulses we saw that a full round trip to-
The main advantage of polarization entanglement is
gether with the use of Faraday mirrors circumvents the prob-
the fact that analyzers are simple and e¬cient. It is
lem (see paragraph IV C 2). However, since the channel loss
on the way from the source to the Faraday mirror inevitably therefore relatively easy to obtain high contrast. Naik
increases the empty pulses fraction, the main advantage of and co-workers, for example, measured a polarization
photon pairs vanishes in such a con¬guration.


32
extinction of 97%, mainly limited by electronic imper- in Alice™s and Bob™s interferometer “ non-local quantum
correlation (Franson 1989)45 “ see Fig. 22. The phase
fections of the fast modulators. This amounts to a
QBERopt contribution of only 1.5%. In addition, the in the interferometers at Alice™s and Bob™s can, for ex-
constraint on the coherence length of the pump laser is ample, be adjusted so that both photons always emerge
not very stringent (note that if it is shorter than the from the same output port. It is then possible to ex-
length of the crystal some di¬culties can appear, but we change bits by associating values to the two ports. This
will not mention them here). is, however, not su¬cient. A second measurement basis
In spite of their qualities, it would be di¬cult to repro- must be implemented, to ensure security against eaves-
duce these experiments on distances of more than a few dropping attempts. This can be done for example by
kilometers of optical ¬ber. As mentioned in the intro- adding a second interferometer to the systems (see Fig.
duction to this chapter, polarization is indeed not robust 23). In the latter case, when reaching an analyzer, a
enough to decoherence in optical ¬bers. In addition, the photon chooses randomly to go to one or the other in-
polarization state transformation induced by an installed terferometer. The second set of interferometers can be
¬ber frequently ¬‚uctuates, making an active alignment adjusted to also yield perfect correlations between out-
system absolutely necessary. Nevertheless, these exper- put ports. The relative phase between their arms should
iments are very interesting in the context of free space however be chosen so that when the photons go to inter-
QC. ferometers not associated, the outcomes are completely
uncorrelated.
Such a system features a passive state preparation by
Alice, yielding security against multiphoton splitting at-
B. Energy-time entanglement
tacks (see section VI J). In addition, it also features a
passive basis choice by Bob, which constitutes an elegant
1. Phase-coding
solution: neither a random number generator, nor an
active modulator are necessary. It is nevertheless clear
The other class of experiments takes advantage of
that QBERdet and QBERacc (de¬ned in eq. (33)) are
energy-time entangled photon pairs. The idea originates
doubled since the number of activated detectors is twice
from an arrangement proposed by Franson in 1989 to
as high. This disadvantage is however not as important
test Bell inequalities. As we will see below, it is com-
as it ¬rst appears since the alternative, a fast modula-
parable to the double Mach-Zehnder con¬guration dis-
tor, introduces losses close to 3dB, also resulting in an
cussed in section IV C 1. A source emits pairs of energy-
increase of these error contributions. The striking simi-
correlated photons with both particles created at exactly
larity between this scheme and the double Mach-Zehnder
the same, however uncertain time (see Fig. 22). This
arrangement discussed in the context of faint laser pulses
can be achieved by pumping a non-linear crystal with
in section IV C 1 is obvious when comparing Fig. 24 and
a pump of large coherence time. The pairs of down-
Fig. 16!
converted photons are then split, and one photon is sent
This scheme has been realized in the ¬rst half of 2000
to each party down quantum channels. Both Alice and
by our group at Geneva University (Ribordy et al., 2001).
Bob possess a widely, but identically unbalanced Mach-
It constitutes the ¬rst experiment in which an asymmet-
Zehnder interferometer, with photon counting detectors
ric setup, optimized for QC was used instead of a system
connected to the outputs. Locally, if Alice or Bob change
designed for tests of Bell inequality and having a source
the phase of their interferometer, no e¬ect on the count
located in the center between Alice and Bob (see Fig.
rates is observed, since the imbalancement prevents any
25). The two-photon source (a KNbO3 crystal pumped
single-photon interference. Looking at the detection-time
by a doubled Nd-YAG laser) provides energy-time entan-
at Bob™s with respect to the arrival time at Alice™s, three
gled photons at non-degenerate wavelengths “ one around
di¬erent values are possible for each combination of de-
810 nm, the other one centered at 1550 nm. This choice
tectors. The di¬erent possibilities in a time spectrum
allows to use high e¬ciency silicon based single photon
are shown in Fig. 22. First, both photons can propagate
counters featuring low noise to detect the photons of the
through the short arms of the interferometers. Next, one
lower wavelength. To avoid the high transmission losses
can take the long arm at Alice™s, while the other one
at this wavelength in optical ¬bers, the distance between
takes the short one at Bob™s. The opposite is also pos-
the source and the corresponding analyzer is very short,
sible. Finally, both photons can propagate through the
long arms. When the path di¬erences of the interferome-
ters are matched within a fraction of the coherence length
of the down-converted photons, the short-short and the
45
The imbalancement of the interferometers must be large
long-long processes are indistinguishable, provided that
enough so that the middle peak can easily be distinguished
the coherence length of the pump photon is larger than
from the satellite ones. This minimal imbalancement is de-
the path-length di¬erence. Conditioning detection only
termined by the convolution of the detector™s jitter (tens of
on the central time peak, one observes two-photon inter-
ps), the electronic jitter (from tens to hundreds of ps) and the
ferences which depends on the sum of the relative phases
single-photon coherence time (<1ps).


33
of the order of a few meters. The other photon, at the slots (note that she has two detectors to take into ac-
wavelength where ¬ber losses are minimal, is sent via count). For instance, detection of a photon in the ¬rst
an optical ¬ber to Bob™s interferometer and is then de- slot corresponds to “pump photon having traveled via the
tected by InGaAs APD™s. The decoherence induced by short arm and downconverted photon via the short arm”.
chromatic dispersion is limited by the use of dispersion- To keep it short, we refer to this process as | s P , | s A ,
shifted optical ¬ber (see section III B 3). where P stands for the pump- and A for Alice™s pho-
ton46 . However, the characterization of the complete
Implementing the BB84 protocols in the way discussed
above, with a total of four interferometers, is di¬cult. photon pair is still ambiguous, since, at this point, the
They must indeed be aligned and their relative phase path of the photon having traveled to Bob (short or long
kept accurately stable during the whole key distribution in his interferometer) is unknown to Alice. Figure 26
session. To simplify this problem, we devised birefringent illustrates all processes leading to a detection in the dif-
interferometers with polarization multiplexing of the two ferent time slots both at Alice™s and at Bob™s detector.
bases. Consequently, the constraint on the stability of the Obviously, this reasoning holds for any combination of
interferometers is equivalent to that encountered in the two detectors. In order to build up the secret key, Al-
faint pulses double Mach-Zehnder system. We obtained ice and Bob now publicly agree about the events where
interference visibilities of typically 92%, yielding in turn both detected a photon in one of the satellite peaks “
a QBERopt contribution of about 4%. We demonstrated without revealing in which one “ or both in the central
QC over a transmission distance of 8.5 km in a laboratory peak “ without revealing the detector. This procedure
setting using a ¬ber on a spool and generated several corresponds to key-sifting. For instance, in the example
Mbits of key in hour long sessions. This is the largest discussed above, if Bob tells Alice that he also detected
span realized to date for QC with photon pairs. his photon in a satellite peak, she knows that it must
As already mentioned, it is essential for this scheme to have been the left peak as well. This is due to the fact
have a pump laser whose coherence length is larger than that the pump photon has traveled via the short arm “
the path imbalancement of the interferometers. In addi- hence Bob can detect his photon either in the left satellite
tion, its wavelength must remain stable during a key ex- or in the central peak. The same holds for Bob who now
change session. These requirements imply that the pump knows that Alice™s photon traveled via the short arm in
laser must be somewhat more elaborate than in the case her interferometer. Therefore, in case of joint detection
of polarization entanglement. in a satellite peak, Alice and Bob must have correlated
detection times. Assigning a bit value to each side peak,
Alice and Bob can exchange a sequence of correlated bits.
The cases where both ¬nd the photon in the central
2. Phase-time coding
time slot are used to implement the second basis. They
correspond to the | s P , | l A | l B and | l P , | s A | s B
We have mentioned in section IV C that states gener-
possibilities. If these are indistinguishable, one obtains
ated by two-paths interferometers are two-levels quantum
two-photon interferences, exactly as in the case discussed
systems. They can also be represented on a Poincar´ e
in the previous paragraph on phase coding. Adjusting
sphere. The four-states used for phase coding in the
the phases, and maintaining them stable, perfect corre-
previous section would lie on the equator of the sphere,
lations between output ports chosen by the photons at
equally distributed. The coupling ratio of the beamsplit-
Alice™s and Bob™s interferometers are used to establish
ter is indeed 50%, and they di¬er only by a phase dif-
the key bits in this second basis.
ference introduced between the components propagating
Phase-time coding has recently been implemented in a
through either arm. In principle, the four-state proto-
laboratory experiment by our group (Tittel et al., 2000)
col can be equally well implemented with only two states
and was reported at the same time as the two polariza-
on the equator and the two other ones on the poles. In
tion entanglement-based schemes mentioned above. A
this section, we present a system exploiting such a set
contrast of approximately 93% was obtained, yielding a
of states. Proposed by our group in 1999 (Brendel et
QBERopt contribution of 3.5%, similar to that obtained
al., 1999), the scheme follows in principle the Franson
with the phase coding scheme. This experiment will be
con¬guration described in the context of phase coding.
repeated over long distances, since losses in optical ¬bers
However, it is based on a pulsed source emitting entan-
are low at the downconverted photons™ wavelength (1300
gled photons in so-called energy-time Bell states (Tittel
nm).
et al. 2000). The emission time of the photon pair is
An advantage of this set-up is that coding in the time
therefore given by a superposition of only two discrete
basis is particularly stable. In addition, the coherence
terms, instead of a wide and continuous range bounded
length of the pump laser is not critical anymore. It is
only by the large coherence length of the pump laser (see
paragraph V B 1).
Consider Fig. 26. If Alice registers the arrival times
of the photons with respect to the emission time of the
46
pump pulse t0 , she ¬nds the photons in one of three time Note that it does not constitute a product state.



34
however necessary to use relatively short pulses (≈ 500 VI. EAVESDROPPING
ps) powerful enough to induce a signi¬cant downconver-
sion probability. A. Problems and Objectives
Phase-time coding, as discussed in this section, can
also be realized with faint laser pulses (Bechmann- After the qubit exchange and bases reconciliation, Al-
Pasquinucci and Tittel, 2000). The 1-photon con¬gu- ice and Bob each have a sifted key. Ideally, these are
ration has though never been realized. It would be sim- identical. But in real life, there are always some errors
ilar to the double Mach-Zehnder discussed in paragraph and Alice and Bob must apply some classical information
IV C 1, but with the ¬rst coupler replaced by an active processing protocols, like error correction and privacy
switch. For the time-basis, Alice would set the switch ampli¬cation, to their data (see paragraph II C 4). The
either to full transmission or to full re¬‚ection, while for ¬rst protocol is necessary to obtain identical keys, the
the energy-basis she would set it at 50%. This illustrates second to obtain a secret key. Essentially, the problem
how considerations initiated on photon pairs can yield of eavesdropping is to ¬nd protocols which, given that
advances on faint pulses systems. Alice and Bob can only measure the QBER, either pro-
vides Alice and Bob with a provenly secure key, or stops
the protocol and informs the users that the key distribu-
3. Quantum secret sharing
tion has failed. This is a delicate question, really at the
intersection between quantum physics and information
In addition to QC using phase-time coding, we used the theory. Actually, there is not one, but several eavesdrop-
setup depicted in Fig. 26 for the ¬rst proof-of-principle ping problems, depending on the precise protocol, on the
demonstration of quantum secret sharing “ the general- degree of idealization one admits, on the technological
ization of quantum key distribution to more than two power one assumes Eve has and on the assumed ¬delity
parties (Tittel et al., 2001). In this new application of of Alice and Bob™s equipment. Let us immediately stress
quantum communication, Alice distributes a secret key to that the complete analysis of eavesdropping on quantum
two other users, Bob and Charlie, in a way that neither channel is by far not yet ¬nished. In this chapter we
Bob nor Charlie alone have any information about the review some of the problems and solutions, without any
key, but that together they have full information. Like claim of mathematical rigor nor complete cover of the
with traditional QC, an eavesdropper trying to get some huge and fast evolving literature.
information about the key creates errors in the transmis- The general objective of eavesdropping analysis is to
sion data and thus reveals her presence. The motivation ¬nd ultimate and practical proofs of security for some
behind quantum secret sharing is to guarantee that Bob quantum cryptosystems. Ultimate means that the se-
and Charlie cooperate “ one of them might be dishonest curity is guaranteed against entire classes of eavesdrop-
“ in order to obtain a given piece of information. In con- ping attacks, even if Eve uses not only the best of to-
trast with previous proposals using three-particle GHZ day™s technology, but any conceivable technology of to-

states (Zukowski et al.,1998, and Hillery et al., 1999), morrow. They take the form of theorems, with clearly
pairs of entangled photons in so-called energy-time Bell stated assumptions expressed in mathematical terms. In
states were used to mimic the necessary quantum cor- contrast, practical proofs deal with some actual pieces of
relation of three entangled qubits, albeit only two pho- hardware and software. There is thus a tension between
tons exist at the same time. This is possible because “ultimate” and “practical” proofs. Indeed the ¬rst ones
of the symmetry between the preparation device acting favor general abstract assumptions, whereas the second
on the pump pulse and the devices analyzing the down- ones concentrate on physical implementations of the gen-
converted photons. Therefore, the emission of a pump eral concepts. Nevertheless, it is worth aiming at ¬nding
pulse can be considered as the detection of a photon with such proofs. In addition to the security issue, they pro-
100% e¬ciency, and the scheme features a much higher vide illuminating lessons for our general understanding
coincidence rate than that expected with the initially pro- of quantum information.
posed “triple-photon” schemes. In the ideal game Eve has perfect technology: she is
only limited by the laws of quantum mechanics, but not
at all by today™s technology 47 . In particular, Eve can-



47
The question whether QC would survive the discovery of
the currently unknown validity limits of quantum mechanics
is interesting. Let us argue that it is likely that quantum me-
chanics will always adequately describe photons at telecom
and vsible wavelengths, like classical mechanics always ade-
quately describes the fall of apples, whatever the future of



35
not clone the qubits, as this is incompatible with quan- choose a value at random. Note also that the di¬erent
tum dynamics (see paragraph II C 2), but Eve is free to contributions of dark count to the total QBER depend
use any unitary interaction between one or several qubits on whether Bob™s choice of basis is implemented using an
and an auxiliary system of her choice. Moreover, after active or a passive switch (see section IV A).
the interaction, Eve may keep her auxiliary system un- Next, one usually assumes that Alice and Bob have
perturbed, in particular in complete isolation from the thoroughly checked their equipments and that it is func-
environment, for an arbitrarily long time. Finally, af- tioning according to the speci¬cations. This is not par-
ter listening to all the public discussion between Alice ticular to quantum cryptography, but is quite a delicate
and Bob, she can perform the measurement of her choice question, as Eve could be the actual manufacturer of the
on her system, being again limited only by the laws of equipment! Classical crypto-systems must also be care-
quantum mechanics. Moreover, one assumes that all er- fully tested, like any commercial apparatuses. Testing a
rors are due to Eve. It is tempting to assume that some crypto-system is however delicate, because in cryptogra-
errors are due to Alice™s and Bob™s instruments and this phy the client buys con¬dence and security, two qualities
probably makes sense in practice. But there is the danger di¬cult to quantify. D. Mayers and A. Yao (1998) pro-
that Eve replaces them with higher quality instruments posed to use Bell inequality to test that the equipments
(see next section)! really obey quantum mechanics, but even this is not en-
In the next section we elaborate on the most relevant tirely satisfactory. Indeed and interestingly, one of the
di¬erences between the above ideal game (ideal espe- most subtle loopholes in all present day tests of Bell in-
cially from Eve™s point of view!) and real systems. Next, equality, the detection loophole, can be exploited to pro-
we return to the idealized situation and present several duce a purely classical software mimicking all quantum
eavesdropping strategies, starting from the simplest ones, correlation (Gisin and Gisin 1999). This illustrates once
where explicit formulas can be written down and ending again how close practical issues in QC are to philosophi-
with a general abstract security proof. Finally, we dis- cal debates about the foundations of quantum physics!
cus practical eavesdropping attacks and comment on the Finally, one has to assume that Alice and Bob are per-
complexity of real system™s security. fectly isolated from Eve. Without such an assumption
the entire game would be meaningless: clearly, Eve is
not allowed to look over Alice™s shoulder! But this el-
ementary assumption is again a nontrivial one. What
B. Idealized versus real implementation
if Eve uses the quantum channel connecting Alice to the
outside world? Ideally, the channel should incorporate an
Alice and Bob use technology available today. This
isolator 48 to keep Eve from shining light into Alice™s out-
trivial remark has several implications. First, all real
put port to examine the interior of her laboratory. But
components are imperfect, so that the qubits are pre-
all isolators operate only on a ¬nite bandwidth, hence
pared and detected not exactly in the basis described by
there should also be a ¬lter. But ¬lters have only a ¬nite
the theory. Moreover, a real source always has a ¬nite
e¬ciency. And so on. Except for section VI K where this
probability to produce more than one photon. Depending
assumption is discussed, we henceforth assume that Alice
on the details of the encoding device, all photons carry
and Bob are isolated from Eve.
the same qubit (see section VI J). Hence, in principle,
Eve could measure the photon number, without perturb-
ing the qubit. This is discussed in section VI H. Recall
C. Individual, joint and collective attacks
that ideally, Alice should emit single qubit-photons, i.e.
each logical qubit should be encoded in a single degree
of freedom of a single photon. In order to simplify the problem, several eavesdrop-
On Bob™s side the situation is, ¬rst, that the e¬ciency ping strategies of restricted generalities have been de¬ned
of his detectors is quite limited and, next, that the dark (L¨ tkenhaus 1996, Biham and Mor 1997a and 1997b) and
u
counts (spontaneous counts not produced by photons) analyzed. Of particular interest is the assumption that
are non negligible. The limited e¬ciency is analogous to Eve attaches independent probes to each qubit and mea-
the losses in the quantum channel. The analysis of the sures her probes one after the other. This class of attacks
dark counts is more delicate and no complete solution is called individual attacks, also known as incoherent at-
is known. Conservatively, L¨ tkenhaus (2000) assumes
u tacks. This important class is analyzed in sections VI D
in his analysis that all dark counts provide information and VI E. Two other classes of eavesdropping strate-
to Eve. He also advises that whenever two detectors gies let Eve process several qubits coherently, hence the
¬re simultaneously (generally due to a real photon and name of coherent attacks. The most general coherent at-
a dark count), Bob should not disregard such events but

<< . .

. 7
( : 11)



. . >>