In classical cryptography, the only provably secure method is the one-time pad,

i.e. the key is only used once (Gisin et al., 2002). In one version of this scheme, the

key shared by Alice and Bob is a randomly generated number K which must have a

binary representation at least as long as the message. Since the binary digits of K are

random, the key itself contains no information. Alice encrypts her message as the signal

S = M • K, where • indicates bit-wise addition without carry, i.e. addition modulo

2. This means that corresponding bits are added according to the rules 0 + 0 = 0,

0 + 1 = 1, and 1 + 1 = 0.

The bits of S are as random as those of K, so the signal carries no information

for Eve, the lurking eavesdropper. On the other hand, Bob can decipher the message

by bit-wise subtraction of K from S to recover M . The security of the messages is

weakened by repeated use of the key. For example, if two messages M 1 and M 2 are

sent, then the identity K • K = 0 implies

S1 • S2 = M 1 • K • M 2 • K

= M1 • M2 • K • K

= M1 • M2 . (20.46)

The bits in M 1 and M 2 are not random; therefore, Eve gains some information about

the messages themselves. With enough messages, the encryption system could be bro-

ken.

½

Quantum cryptography

The use of a one-time pad solves the problem of secure communication, only to raise

a new problem. How is the key itself to be safely transmitted through a potentially

insecure channel? If Alice and Bob have to meet for this purpose, she might as well

deliver the message itself.

One of the most intriguing discoveries in recent years (Wiesner, 1983; Bennett and

Brassard, 1984, 1985) is that the peculiar features of quantum theory o¬er a solution

to the problem of secure transmission of cryptographic keys. Once this is done, the

message itself can be sent as a string of classical bits. Thus quantum cryptography

really reduces to the secure transmission of keys, i.e. quantum key distribution.

A quantum method for distributing a key evidently involves encoding the key in the

quantum states of some microscopic system. Since the electromagnetic ¬eld provides

the most useful classical communication channel, it is natural to use a property of

photons, e.g. polarization, to carry the information in a quantum channel.

As a concrete illustration, consider orthogonal linear polarizations eh (k) and ev (k)

that de¬ne the basis of single-photon states:

B = |h = a† |0 , |v = a† |0 . (20.47)

kh kv

One can then encode 0 as |h and 1 as |v . We will see below that a scheme based on

B alone is too simple to foil Eve, so we add a second basis

h = a† |0 , |v = a† |0

B= , (20.48)

kv

kh

where the new polarization basis

1

eh (k) = √ [eh (k) + ev (k)] ,

2

(20.49)

1

ev (k) = √ [ev (k) ’ eh (k)]

2

is the ¬rst polarization basis rotated through 45—¦ . The creation operators and the

single-photon basis states transform just like the polarization vectors. The correspond-

ing encoding for B is: 0 ” h and 1 ” |v .

The two basis sets have the essential property that no member of one basis is

orthogonal to either member of the other. The bases are also as di¬erent as possible,

2

in the sense that | s |s | = 1/2 for s = h, v and s = h, v. Pairs of bases related in this

way are said to be mutually unbiased, and they are a feature of many quantum key

distribution schemes.

20.3.1 The BB84 protocol

We now consider the BB84 protocol, named after Bennett and Brassard and the year

they proposed the scheme (Bennett and Brassard, 1984). In the initial step, Alice sends

a string of photons to Bob. For each photon, she uses a random number generator to

choose a polarization from the four possibilities in B and B. At this stage, the only

restriction is that Bob and Alice must be able to establish a one“one correspondence

between the transmitted and received photons.

½ Quantum information

Bob, who is equipped with an independent random number generator, chooses one

of the basis sets, B or B, in which to measure each incoming photon. If Alice sends |h

or |v and Bob happens to choose B, his measurement will pick out the correct state,

and his bit assignment will exactly match the one Alice sent. If, on the other hand,

Bob chooses B, then a measurement on |h will yield h or |v with equal probability.

Thus if Alice sent 0, Bob will assign 1 half the time. Since Bob will make the wrong

choice of basis about half the time, his average error rate will be 25%. The bit string

resulting from this procedure is called the raw key.

An error rate of 25% would overwhelm any standard error correction scheme, but

the BB84 protocol provides another option. For each bit, Bob announces”through

the insecure public channel”his choice of measurement basis, but not the result of

his measurement. Alice replies by stating whether or not the encoding basis and the

measurement basis agree for that bit. If their bases agree, the bit is kept; otherwise,

it is discarded. The remaining bit string, which is about half the length of the raw

string, is called the sifted key.

The ¬rst experimental demonstration of this scheme was a table top experiment

in which the signals from Alice to Bob were carried by faint pulses of light containing

less than one photon on average (Bennett et al., 1992). The distance between sender

and receiver in this experiment was only 30 cm, but within a few years quantum key

distribution was demonstrated (Muller et al., 1995, 1996) over a distance of 23 km with

signals carried by a commercial optical ¬ber network.

In order to understand the quantum basis for the security of the BB84 protocol,

let us ¬rst imagine an alternative in which the bits are encoded in classical pulses of

polarized light. If Eve intercepts a particular pulse, so that it does not arrive at Bob™s

detector, then Alice and Bob can agree to discard that bit from the string. This lowers

the bit rate for transmitting the key, but Eve gains no information.

Thus it is not enough for Eve to detect the pulse; she must also make a copy

for herself and send the original on to Bob. This tactic would provide information

about the key without alerting Alice and Bob. In the classical case, this procedure

is”at least in principle”always possible. For example, Eve could split o¬ a small

part of each pulse by means of a strongly unbalanced beam splitter, and record the

polarization. The remaining pulse could then be ampli¬ed to match the original, and

sent on to Bob.

Eve faces the same problem for the quantum BB84 protocol. She must make a

copy of each single-photon state sent by Alice, and then send the original on to Bob.

Furthermore, she must be able to do this for photons described by either of the bases

B or B. Since the basis vectors in B are not orthogonal to the basis vectors in B, this

is precisely what the no-cloning theorem says cannot be done.

Furthermore, when Eve intercepts a signal and sends a new signal on to Bob,

she is bound”again according to the no-cloning theorem”to make a certain number

of errors on average. If she carries out this strategy too often, Alice and Bob will

become aware of her activity. According to this ideal description, the BB84 protocol

is invulnerable to attack.

In practice”as one might expect”things are more complicated. Transmission of

the key will be degraded by technical imperfections as well as Eve™s machinations. It

½

Entanglement as a quantum resource

is also possible for Eve to gain some knowledge of the key by means of the imperfect

cloning methods discussed in Section 20.2.2, without necessarily revealing her presence

to Alice and Bob. The techniques for countering such attacks are primarily classical

in nature (Gisin et al., 2002), so we will not pursue them further.

Thus the no-cloning theorem”which was originally introduced as a purely negative

statement about quantum theory”is the conceptual basis for the security of quantum

key distribution protocols. In this connection, it is important to realize that the classi-

cal proof of the absolute security of the one-time pad depends on the assumption that

the bits of K are truly random. For this reason, the choices made by Alice and Bob

must be equally random.

This turns out to be a rather delicate issue. The standard random number gen-

erators for computers are deterministic programs of ¬nite length; consequently, their

output cannot be truly random. The ultimate security of BB84, or any other quantum

key distribution protocol, therefore depends on generating a truly random sequence

of numbers by some physical means. The behavior of a single photon at a beam split-

ter provides a natural way to satisfy this need. A single photon incident on an ideal

balanced beam splitter with 100% detectors at each output port will”according to

quantum theory”generate a perfectly random sequence of ¬rings in the detectors.

Associating 0 with one detector and 1 with the other de¬nes a perfect coin ¬‚ip.

As always, reality is more complicated; for example, the dead time of real detectors

can impose a strong anti-correlation between successive bits. This e¬ect limits the bit

rate of quantum random number generation to a few megahertz (Gisin et al., 2002).

Leaving these practical issues aside, we see that the security of quantum key distribu-

tion is guaranteed by the perfectly random nature of individual quantum events. This

is a historically unique situation; the security of quantum cryptography ultimately

depends on the validity of quantum theory itself.

20.4 Entanglement as a quantum resource

The quantum e¬ects on communications studied in the previous sections are primarily

a source of di¬culties. The use of phase-sensitive ampli¬ers to eliminate the quantum

noise added by ampli¬cation, and the injection of squeezed light to minimize branching

noise at an optical coupler are responses to these di¬culties.

The role of the no-cloning theorem in providing a basis for the secure transmission

of a cryptographic key is usually presented in a positive light, but this is a partisan

view. For the frustrated Eve, the no-cloning theorem is still a negative result.

In these applications, quantum theory may provide new options, but it does not

provide any new resources. For example, the qubits used by Alice and Bob in the key

distribution protocol each carry only one classical bit, sometimes called a cbit.

It is the fundamental quantum property of entanglement that provides a novel

communications resource. In the present section, we will consider two examples, quan-

tum dense coding and quantum teleportation, which employ this resource. In both

cases the ancilla is an entangled qubit pair provided by an external source, and Alice

and Bob are each provided with one qubit of the pair. Local operations carried out

by Alice and Bob on their respective qubits change the entangled state in a nonlocal

way, and detection of these changes can be used to transfer information.

¾¼ Quantum information

Before considering the speci¬c applications, we must discuss some special features

arising from the use of photons to carry the qubits. The abstract language used above

implicitly assumes that the qubits are distinguishable quantum systems with de¬nite

locations. Since photons are indistinguishable bosons that cannot be precisely local-

ized, there appears to be a conceptual problem.

The ¬rst point to note is that the indistinguishability of photons renders state-

ments like ˜Bob carries out a local operation on his photon™ meaningless. The correct

statement is ˜Bob carries out a local operation on a photon.™ This brings us to the

second point: the word ˜local™ in ˜local operation™ applies to the hardware that realizes

the theoretical manipulation, not to the photon.

We made this remark for detectors in Section 6.6.2, but it applies equally to retarder

plates, beam splitters, etc. These classical devices”unlike photons”are both distin-

guishable and localizable. On the other hand, the physical operations they perform are

represented by unitary operators that apply to the entire state of the electromagnetic

¬eld. By virtue of the peculiar properties of entangled states, this means that local

operations can have nonlocal e¬ects.

In the experiments we will discuss, the photons in the pair are ideally described

by plane waves, with wavevectors kA (directed toward Alice) and kB (directed to-

ward Bob), and equal frequencies, ωA = ωB . An example is shown in Fig. 20.4. The

polarization-entangled, two-photon state emitted by the source is therefore a super-

position of the states |1kA s , 1kB s , where s, s = h, v.

We will only consider situations with ¬xed directions for the wavevectors, so the

shorthand notation

2 bits 2 bits

OUT IN

ALICE

1 photon

(Bell BOB

state (encoder)

measurer)

Fig. 20.4 Quantum dense coding: a source

1 photon k) 1 photon k*

of polarization-entangled photons provides a

communications resource. Bob™s local opera-

Source of

tions on a photon alter the nonlocal entangled polarization-

state, so that a single photon sent from Bob to entangled

photons

Alice allows her to receive two bits of informa-

tion.

¾½

Entanglement as a quantum resource

≡ a† γ s a † γ |0 for (γ, s) = (γ , s ) ,

s γ , sγ k k s

(20.50)

1

|sγ , sγ ≡ √ a†2 s |0 ,

k

2γ

with γ, γ ∈ {A, B}, s, s ∈ {h, v}, is adequate.

A third point related to local operations is that these plane waves are idealizations

of Gaussian wave packets with ¬nite transverse widths. This means that the realistic

kA -mode is e¬ectively zero at Bob™s location, and the kB -mode is e¬ectively zero at

Alice™s location. The mathematical consequence is that Bob™s local manipulations are

represented by unitary operators that only act on the kB -mode, i.e. on the second

argument of the two-photon state |sA , sB . By the same token, Alice™s operations

only act on the ¬rst argument. This is formally similar to performing operations on

distinguishable qubits, but we emphasize that it is the modes that are distinguishable,

not the photons.

20.4.1 Quantum dense coding

The common currency for classical digital communication and computation is the bit,

i.e. the binary digits 0 and 1, which are physically represented by classical two-state

systems. For storage, e.g. in a magnetic storage device, 0 and 1 can be respectively

represented by a spin-down state (a downwards-pointing net magnetization), and a

spin-up state of a magnetic resolution element. For transmission, 0 and 1 are typically

represented by two resolvable voltages V0 and V1 .

In either case, the two states of a macroscopic system encode the binary choice

between 0 and 1; that is, one bit of information is carried by a classical two-state

system. Conversely, the one-to-one relation between the two states of the classical

system and the two logical states 0 and 1 assures us that a classical, two-state system

can carry at most one bit of information.

For a two-state quantum system the outcome is quite di¬erent. A surprising result

of quantum theory is that two bits of information can be transmitted by sending

a single qubit. This apparent doubling of the transmission rate is called quantum

dense coding.

A A generic model for quantum dense coding

A thought experiment (Bennett and Wiesner, 1992) to implement quantum dense

coding is sketched in Fig. 20.4. In this scenario, Bob has received two bits of classical

information through his input port IN, and he wants to communicate this news to

Alice. Since there are four possible two-bit messages, an encoding scheme with four al-

ternatives is needed. The resource Bob will use is the pair of entangled qubits provided

by the source.

Bob can carry out local operations to change the original two-qubit state into any

one of the four Bell states, chosen according to a prearranged mapping of the four

possible messages onto the four Bell states. Once this is done, Bob sends the qubit in

his apparatus to Alice, so that she has the entire entangled state at her disposal. Alice

then performs a Bell state measurement, i.e. an observation that determines which

¾¾ Quantum information

of the four Bell states describes the two-qubit state. By means of this measurement

Alice acquires the two bits of information sent by Bob.

The fact that Alice obtains the message after receiving the qubit sent by Bob

suggests that the two classical bits were somehow packed into this single qubit. This

is an essentially classical point of view that does not really ¬t the present case. Alice

receives two qubits, one from the original source of the entangled state and one sent

by Bob. The qubit from the original source may well have been sent long before Bob™s

actions, so it seems eminently reasonable to assume that it carries no information.

On the other hand, Bob™s qubit by itself also carries no information. For example,

if the ever resourceful Eve manages to intercept Bob™s qubit, she will learn absolutely

nothing. Furthermore, if Alice™s qubit from the source does not arrive, then she also

will learn nothing from receiving Bob™s qubit. This should make it clear that the

information is carried, nonlocally, by the entangled state itself.

The real advantage of this scheme is that Bob can send two bits with a single

operation. This is twice the rate possible for a classical channel; consequently, quantum

dense coding might better be called quantum rapid coding.

B Quantum dense coding with photons

In an experimental demonstration of quantum dense coding (Mattle et al., 1996), a

polarization-entangled, two-photon state is generated by means of down-conversion in

a type II crystal, as shown for example in Fig. 13.5. The two down-converted photons

have the same frequency, but di¬erent propagation directions, selected by means of

irises. The source is adjusted so that it emits the state

i 1

|˜ = √ |hA , vB + √ |vA , hB . (20.51)

2 2

Bob allows the input photon in the kB -mode to pass successively through a half-

wave and a quarter-wave retarder. These devices are reviewed in Exercise 20.8. The

experimentally adjustable parameter for each retarder is the angle ‘ between the

fast axis and the horizontal polarization vector eh . The unitary operations needed to

generate the four Bell states,

1 1

¦± ≡ √ |hA , hB ± √ |vA , vB , (20.52)

2 2

1 1

Ψ± ≡ √ |hA , vB ± √ |vA , hB , (20.53)

2 2

correspond to di¬erent settings of the retarder angles, ‘»/2 and ‘»/4 .

The source of entangled pairs has been arranged so that the emitted state |˜

scatters into the Bell state |Ψ+ , for the settings ‘»/2 = ‘»/4 = 0. Using the operations

discussed in Exercise 20.9, Bob encodes his two bits by choosing the two angles ‘»/2

and ‘»/4 , and then sends the photon to Alice. Bob™s local operations have changed the

entangled state, but Alice can only detect these changes by a Bell state measurement

that requires both photons.

This means that Alice cannot begin to decode the message before she receives the

photon sent by Bob, as well as the photon from the source. In common with all other

¾¿

Entanglement as a quantum resource

communication schemes, the time required for transmission of information by quantum

dense coding is restricted by the speed of light.

The next step is for Alice to decode the message, which turns out to be quite

a bit more di¬cult than encoding it. Linear optical techniques are constrained by a

no-go theorem, which states that the four Bell states cannot be distinguished with a

probability greater than 50% (Calsamiglia and Lutkenhaus, 2001). Indeed, the Bell

state analysis used in the particular experiment discussed above could not distinguish

between the states |¦+ and |¦’ .

However, for entangled photon pairs produced by down-conversion, there is a way

around this prohibition. The proof of the no-go theorem involves the assumption that

the Bell states are not entangled in any degrees of freedom other than the polarization;

consequently, the no-go theorem can be circumvented by the use of hyperentangled

states (Kwiat and Weinfurter, 1998). The example discussed in Section 13.3.5”in

which the photons are entangled in both polarization and momentum”is one candi-

date.

An alternative, and experimentally easier, scheme exploits the fact that down-

conversion automatically produces photon pairs that are entangled in both energy

and polarization. As we have seen in Section 13.3.2-B, energy entanglement implies

that the two photons are produced at essentially the same time.

This feature is the basis for a complete Bell state analysis. In addition to its intrinsic

interest, this scheme illustrates the application of various theoretical and experimental

techniques; therefore, we will discuss it in some detail. A schematic diagram illustrating

the idea for this measurement is shown in Fig. 20.5.

As one can see from Exercise 20.10, the Bell state |Ψ’ has the curious property

that it is unchanged by scattering from a balanced beam splitter, i.e. |Ψ’ = |Ψ’ .

This implies that the photons exhibit anti-pairing, i.e. one photon exits through each

of the two output ports. The other Bell states display the opposite behavior; whenever

|Ψ+ or |¦± are incident, the photons are paired, as discussed in Section 10.2.1. In

other words, both scattered photons are emitted through one or the other of the two

output ports.

This di¬erence allows |Ψ’ to be distinguished from the remaining Bell states:

when |Ψ’ is incident, detectors in the A and B arms of the apparatus will both ¬re

so that a coincidence count is registered. For the other Bell states, only the detectors

in one arm will ¬re, so there will be no coincidence counts between the two arms. This

e¬ect only depends on the behavior at the beam splitter, so it would work even if the

photons were not hyperentangled.

Fig. 20.5 Schematic of an experiment for a

) *4.- * complete Bell state analysis using hyperentan-

gled photons. (1) The beam splitter (BS) iden-

2*5 ¬ «

ti¬es ¬Ψ’ . (2)¬ The birefringent elements (BR-

*5 «

FEs) identify ¬Ψ+ . (3) The¬ polarizing ¬ beam

* *4.- ) « «

’

from ¬¦+ .

splitters (PBSs) distinguish ¬¦

(Adapted from Kwiat and Weinfurter (1998).)

¾ Quantum information

Next we turn to the task of distinguishing |Ψ+ from |¦± . This is accomplished

by means of the two birefringent elements, which have optic axes aligned along the h-

and v-polarizations. The two down-converted photons are emitted simultaneously in

matched wave packets with widths of the order of 15 fs, but the h- and v-components

experience di¬erent group velocities due to the di¬erence between the indices of re-

fraction for the two polarizations.

The resulting separation between the two wave packets means that the detections

of the two photons will also be separated in time. In principle, it is only necessary

to separate the two packets by an amount greater than their widths, but in practice

the delay must be larger than the resolution time”of the order of 1 ns”of the detec-

tors. The detection events for |¦± are expected to be simultaneous, since |¦± is a

superposition of states with pairs of photons having the same polarization.

The ¬nal task of separating |¦+ and |¦’ begins with the action of the beam

splitter:

i

¦± ’ ¦± = √ {|hA , hA ± |vA , vA } + (A ” B) . (20.54)

22

Applying eqn (8.2) to each polarization produces the scattering matrix for a birefrin-

gent element of length L:

Sks,k s = eiφs δkk δss , (20.55)

where φs = ns (ω) L/c is the phase shift for the s-polarization. Propagation through

the birefringent elements therefore produces

ie2iφ0 iδ

¦± e |hA , hA ± e’iδ |vA , vA

√ + (A ” B) ,

= (20.56)

22

where φ0 = (φh + φv ) /2, and δ = φh ’ φv .

For both |¦+ and |¦’ two photons will strike a single detector, so the two

states are still not distinguished. The last trick is to send the light into a polarizing

beam splitter oriented along the 45—¦ -rotated basis B de¬ned in eqn (20.48). In Exercise

20.11, it is shown that expressing |¦± in the new basis yields

√