<< . .

. 84
( : 97)

. . >>

through the use of better factorization algorithms or faster computers.
In classical cryptography, the only provably secure method is the one-time pad,
i.e. the key is only used once (Gisin et al., 2002). In one version of this scheme, the
key shared by Alice and Bob is a randomly generated number K which must have a
binary representation at least as long as the message. Since the binary digits of K are
random, the key itself contains no information. Alice encrypts her message as the signal
S = M • K, where • indicates bit-wise addition without carry, i.e. addition modulo
2. This means that corresponding bits are added according to the rules 0 + 0 = 0,
0 + 1 = 1, and 1 + 1 = 0.
The bits of S are as random as those of K, so the signal carries no information
for Eve, the lurking eavesdropper. On the other hand, Bob can decipher the message
by bit-wise subtraction of K from S to recover M . The security of the messages is
weakened by repeated use of the key. For example, if two messages M 1 and M 2 are
sent, then the identity K • K = 0 implies

S1 • S2 = M 1 • K • M 2 • K
= M1 • M2 • K • K
= M1 • M2 . (20.46)

The bits in M 1 and M 2 are not random; therefore, Eve gains some information about
the messages themselves. With enough messages, the encryption system could be bro-
Quantum cryptography

The use of a one-time pad solves the problem of secure communication, only to raise
a new problem. How is the key itself to be safely transmitted through a potentially
insecure channel? If Alice and Bob have to meet for this purpose, she might as well
deliver the message itself.
One of the most intriguing discoveries in recent years (Wiesner, 1983; Bennett and
Brassard, 1984, 1985) is that the peculiar features of quantum theory o¬er a solution
to the problem of secure transmission of cryptographic keys. Once this is done, the
message itself can be sent as a string of classical bits. Thus quantum cryptography
really reduces to the secure transmission of keys, i.e. quantum key distribution.
A quantum method for distributing a key evidently involves encoding the key in the
quantum states of some microscopic system. Since the electromagnetic ¬eld provides
the most useful classical communication channel, it is natural to use a property of
photons, e.g. polarization, to carry the information in a quantum channel.
As a concrete illustration, consider orthogonal linear polarizations eh (k) and ev (k)
that de¬ne the basis of single-photon states:

B = |h = a† |0 , |v = a† |0 . (20.47)
kh kv

One can then encode 0 as |h and 1 as |v . We will see below that a scheme based on
B alone is too simple to foil Eve, so we add a second basis

h = a† |0 , |v = a† |0
B= , (20.48)

where the new polarization basis
eh (k) = √ [eh (k) + ev (k)] ,
ev (k) = √ [ev (k) ’ eh (k)]
is the ¬rst polarization basis rotated through 45—¦ . The creation operators and the
single-photon basis states transform just like the polarization vectors. The correspond-
ing encoding for B is: 0 ” h and 1 ” |v .
The two basis sets have the essential property that no member of one basis is
orthogonal to either member of the other. The bases are also as di¬erent as possible,
in the sense that | s |s | = 1/2 for s = h, v and s = h, v. Pairs of bases related in this
way are said to be mutually unbiased, and they are a feature of many quantum key
distribution schemes.

20.3.1 The BB84 protocol
We now consider the BB84 protocol, named after Bennett and Brassard and the year
they proposed the scheme (Bennett and Brassard, 1984). In the initial step, Alice sends
a string of photons to Bob. For each photon, she uses a random number generator to
choose a polarization from the four possibilities in B and B. At this stage, the only
restriction is that Bob and Alice must be able to establish a one“one correspondence
between the transmitted and received photons.
½ Quantum information

Bob, who is equipped with an independent random number generator, chooses one
of the basis sets, B or B, in which to measure each incoming photon. If Alice sends |h
or |v and Bob happens to choose B, his measurement will pick out the correct state,
and his bit assignment will exactly match the one Alice sent. If, on the other hand,
Bob chooses B, then a measurement on |h will yield h or |v with equal probability.
Thus if Alice sent 0, Bob will assign 1 half the time. Since Bob will make the wrong
choice of basis about half the time, his average error rate will be 25%. The bit string
resulting from this procedure is called the raw key.
An error rate of 25% would overwhelm any standard error correction scheme, but
the BB84 protocol provides another option. For each bit, Bob announces”through
the insecure public channel”his choice of measurement basis, but not the result of
his measurement. Alice replies by stating whether or not the encoding basis and the
measurement basis agree for that bit. If their bases agree, the bit is kept; otherwise,
it is discarded. The remaining bit string, which is about half the length of the raw
string, is called the sifted key.
The ¬rst experimental demonstration of this scheme was a table top experiment
in which the signals from Alice to Bob were carried by faint pulses of light containing
less than one photon on average (Bennett et al., 1992). The distance between sender
and receiver in this experiment was only 30 cm, but within a few years quantum key
distribution was demonstrated (Muller et al., 1995, 1996) over a distance of 23 km with
signals carried by a commercial optical ¬ber network.
In order to understand the quantum basis for the security of the BB84 protocol,
let us ¬rst imagine an alternative in which the bits are encoded in classical pulses of
polarized light. If Eve intercepts a particular pulse, so that it does not arrive at Bob™s
detector, then Alice and Bob can agree to discard that bit from the string. This lowers
the bit rate for transmitting the key, but Eve gains no information.
Thus it is not enough for Eve to detect the pulse; she must also make a copy
for herself and send the original on to Bob. This tactic would provide information
about the key without alerting Alice and Bob. In the classical case, this procedure
is”at least in principle”always possible. For example, Eve could split o¬ a small
part of each pulse by means of a strongly unbalanced beam splitter, and record the
polarization. The remaining pulse could then be ampli¬ed to match the original, and
sent on to Bob.
Eve faces the same problem for the quantum BB84 protocol. She must make a
copy of each single-photon state sent by Alice, and then send the original on to Bob.
Furthermore, she must be able to do this for photons described by either of the bases
B or B. Since the basis vectors in B are not orthogonal to the basis vectors in B, this
is precisely what the no-cloning theorem says cannot be done.
Furthermore, when Eve intercepts a signal and sends a new signal on to Bob,
she is bound”again according to the no-cloning theorem”to make a certain number
of errors on average. If she carries out this strategy too often, Alice and Bob will
become aware of her activity. According to this ideal description, the BB84 protocol
is invulnerable to attack.
In practice”as one might expect”things are more complicated. Transmission of
the key will be degraded by technical imperfections as well as Eve™s machinations. It
Entanglement as a quantum resource

is also possible for Eve to gain some knowledge of the key by means of the imperfect
cloning methods discussed in Section 20.2.2, without necessarily revealing her presence
to Alice and Bob. The techniques for countering such attacks are primarily classical
in nature (Gisin et al., 2002), so we will not pursue them further.
Thus the no-cloning theorem”which was originally introduced as a purely negative
statement about quantum theory”is the conceptual basis for the security of quantum
key distribution protocols. In this connection, it is important to realize that the classi-
cal proof of the absolute security of the one-time pad depends on the assumption that
the bits of K are truly random. For this reason, the choices made by Alice and Bob
must be equally random.
This turns out to be a rather delicate issue. The standard random number gen-
erators for computers are deterministic programs of ¬nite length; consequently, their
output cannot be truly random. The ultimate security of BB84, or any other quantum
key distribution protocol, therefore depends on generating a truly random sequence
of numbers by some physical means. The behavior of a single photon at a beam split-
ter provides a natural way to satisfy this need. A single photon incident on an ideal
balanced beam splitter with 100% detectors at each output port will”according to
quantum theory”generate a perfectly random sequence of ¬rings in the detectors.
Associating 0 with one detector and 1 with the other de¬nes a perfect coin ¬‚ip.
As always, reality is more complicated; for example, the dead time of real detectors
can impose a strong anti-correlation between successive bits. This e¬ect limits the bit
rate of quantum random number generation to a few megahertz (Gisin et al., 2002).
Leaving these practical issues aside, we see that the security of quantum key distribu-
tion is guaranteed by the perfectly random nature of individual quantum events. This
is a historically unique situation; the security of quantum cryptography ultimately
depends on the validity of quantum theory itself.

20.4 Entanglement as a quantum resource
The quantum e¬ects on communications studied in the previous sections are primarily
a source of di¬culties. The use of phase-sensitive ampli¬ers to eliminate the quantum
noise added by ampli¬cation, and the injection of squeezed light to minimize branching
noise at an optical coupler are responses to these di¬culties.
The role of the no-cloning theorem in providing a basis for the secure transmission
of a cryptographic key is usually presented in a positive light, but this is a partisan
view. For the frustrated Eve, the no-cloning theorem is still a negative result.
In these applications, quantum theory may provide new options, but it does not
provide any new resources. For example, the qubits used by Alice and Bob in the key
distribution protocol each carry only one classical bit, sometimes called a cbit.
It is the fundamental quantum property of entanglement that provides a novel
communications resource. In the present section, we will consider two examples, quan-
tum dense coding and quantum teleportation, which employ this resource. In both
cases the ancilla is an entangled qubit pair provided by an external source, and Alice
and Bob are each provided with one qubit of the pair. Local operations carried out
by Alice and Bob on their respective qubits change the entangled state in a nonlocal
way, and detection of these changes can be used to transfer information.
¾¼ Quantum information

Before considering the speci¬c applications, we must discuss some special features
arising from the use of photons to carry the qubits. The abstract language used above
implicitly assumes that the qubits are distinguishable quantum systems with de¬nite
locations. Since photons are indistinguishable bosons that cannot be precisely local-
ized, there appears to be a conceptual problem.
The ¬rst point to note is that the indistinguishability of photons renders state-
ments like ˜Bob carries out a local operation on his photon™ meaningless. The correct
statement is ˜Bob carries out a local operation on a photon.™ This brings us to the
second point: the word ˜local™ in ˜local operation™ applies to the hardware that realizes
the theoretical manipulation, not to the photon.
We made this remark for detectors in Section 6.6.2, but it applies equally to retarder
plates, beam splitters, etc. These classical devices”unlike photons”are both distin-
guishable and localizable. On the other hand, the physical operations they perform are
represented by unitary operators that apply to the entire state of the electromagnetic
¬eld. By virtue of the peculiar properties of entangled states, this means that local
operations can have nonlocal e¬ects.
In the experiments we will discuss, the photons in the pair are ideally described
by plane waves, with wavevectors kA (directed toward Alice) and kB (directed to-
ward Bob), and equal frequencies, ωA = ωB . An example is shown in Fig. 20.4. The
polarization-entangled, two-photon state emitted by the source is therefore a super-
position of the states |1kA s , 1kB s , where s, s = h, v.
We will only consider situations with ¬xed directions for the wavevectors, so the
shorthand notation

2 bits 2 bits

1 photon
(Bell BOB
state (encoder)

Fig. 20.4 Quantum dense coding: a source
1 photon k) 1 photon k*
of polarization-entangled photons provides a
communications resource. Bob™s local opera-
Source of
tions on a photon alter the nonlocal entangled polarization-
state, so that a single photon sent from Bob to entangled
Alice allows her to receive two bits of informa-
Entanglement as a quantum resource

≡ a† γ s a † γ |0 for (γ, s) = (γ , s ) ,
s γ , sγ k k s
|sγ , sγ ≡ √ a†2 s |0 ,

with γ, γ ∈ {A, B}, s, s ∈ {h, v}, is adequate.
A third point related to local operations is that these plane waves are idealizations
of Gaussian wave packets with ¬nite transverse widths. This means that the realistic
kA -mode is e¬ectively zero at Bob™s location, and the kB -mode is e¬ectively zero at
Alice™s location. The mathematical consequence is that Bob™s local manipulations are
represented by unitary operators that only act on the kB -mode, i.e. on the second
argument of the two-photon state |sA , sB . By the same token, Alice™s operations
only act on the ¬rst argument. This is formally similar to performing operations on
distinguishable qubits, but we emphasize that it is the modes that are distinguishable,
not the photons.

20.4.1 Quantum dense coding
The common currency for classical digital communication and computation is the bit,
i.e. the binary digits 0 and 1, which are physically represented by classical two-state
systems. For storage, e.g. in a magnetic storage device, 0 and 1 can be respectively
represented by a spin-down state (a downwards-pointing net magnetization), and a
spin-up state of a magnetic resolution element. For transmission, 0 and 1 are typically
represented by two resolvable voltages V0 and V1 .
In either case, the two states of a macroscopic system encode the binary choice
between 0 and 1; that is, one bit of information is carried by a classical two-state
system. Conversely, the one-to-one relation between the two states of the classical
system and the two logical states 0 and 1 assures us that a classical, two-state system
can carry at most one bit of information.
For a two-state quantum system the outcome is quite di¬erent. A surprising result
of quantum theory is that two bits of information can be transmitted by sending
a single qubit. This apparent doubling of the transmission rate is called quantum
dense coding.

A A generic model for quantum dense coding
A thought experiment (Bennett and Wiesner, 1992) to implement quantum dense
coding is sketched in Fig. 20.4. In this scenario, Bob has received two bits of classical
information through his input port IN, and he wants to communicate this news to
Alice. Since there are four possible two-bit messages, an encoding scheme with four al-
ternatives is needed. The resource Bob will use is the pair of entangled qubits provided
by the source.
Bob can carry out local operations to change the original two-qubit state into any
one of the four Bell states, chosen according to a prearranged mapping of the four
possible messages onto the four Bell states. Once this is done, Bob sends the qubit in
his apparatus to Alice, so that she has the entire entangled state at her disposal. Alice
then performs a Bell state measurement, i.e. an observation that determines which
¾¾ Quantum information

of the four Bell states describes the two-qubit state. By means of this measurement
Alice acquires the two bits of information sent by Bob.
The fact that Alice obtains the message after receiving the qubit sent by Bob
suggests that the two classical bits were somehow packed into this single qubit. This
is an essentially classical point of view that does not really ¬t the present case. Alice
receives two qubits, one from the original source of the entangled state and one sent
by Bob. The qubit from the original source may well have been sent long before Bob™s
actions, so it seems eminently reasonable to assume that it carries no information.
On the other hand, Bob™s qubit by itself also carries no information. For example,
if the ever resourceful Eve manages to intercept Bob™s qubit, she will learn absolutely
nothing. Furthermore, if Alice™s qubit from the source does not arrive, then she also
will learn nothing from receiving Bob™s qubit. This should make it clear that the
information is carried, nonlocally, by the entangled state itself.
The real advantage of this scheme is that Bob can send two bits with a single
operation. This is twice the rate possible for a classical channel; consequently, quantum
dense coding might better be called quantum rapid coding.

B Quantum dense coding with photons
In an experimental demonstration of quantum dense coding (Mattle et al., 1996), a
polarization-entangled, two-photon state is generated by means of down-conversion in
a type II crystal, as shown for example in Fig. 13.5. The two down-converted photons
have the same frequency, but di¬erent propagation directions, selected by means of
irises. The source is adjusted so that it emits the state
i 1
|˜ = √ |hA , vB + √ |vA , hB . (20.51)
2 2
Bob allows the input photon in the kB -mode to pass successively through a half-
wave and a quarter-wave retarder. These devices are reviewed in Exercise 20.8. The
experimentally adjustable parameter for each retarder is the angle ‘ between the
fast axis and the horizontal polarization vector eh . The unitary operations needed to
generate the four Bell states,
1 1
¦± ≡ √ |hA , hB ± √ |vA , vB , (20.52)
2 2
1 1
Ψ± ≡ √ |hA , vB ± √ |vA , hB , (20.53)
2 2
correspond to di¬erent settings of the retarder angles, ‘»/2 and ‘»/4 .
The source of entangled pairs has been arranged so that the emitted state |˜
scatters into the Bell state |Ψ+ , for the settings ‘»/2 = ‘»/4 = 0. Using the operations
discussed in Exercise 20.9, Bob encodes his two bits by choosing the two angles ‘»/2
and ‘»/4 , and then sends the photon to Alice. Bob™s local operations have changed the
entangled state, but Alice can only detect these changes by a Bell state measurement
that requires both photons.
This means that Alice cannot begin to decode the message before she receives the
photon sent by Bob, as well as the photon from the source. In common with all other
Entanglement as a quantum resource

communication schemes, the time required for transmission of information by quantum
dense coding is restricted by the speed of light.
The next step is for Alice to decode the message, which turns out to be quite
a bit more di¬cult than encoding it. Linear optical techniques are constrained by a
no-go theorem, which states that the four Bell states cannot be distinguished with a
probability greater than 50% (Calsamiglia and Lutkenhaus, 2001). Indeed, the Bell
state analysis used in the particular experiment discussed above could not distinguish
between the states |¦+ and |¦’ .
However, for entangled photon pairs produced by down-conversion, there is a way
around this prohibition. The proof of the no-go theorem involves the assumption that
the Bell states are not entangled in any degrees of freedom other than the polarization;
consequently, the no-go theorem can be circumvented by the use of hyperentangled
states (Kwiat and Weinfurter, 1998). The example discussed in Section 13.3.5”in
which the photons are entangled in both polarization and momentum”is one candi-
An alternative, and experimentally easier, scheme exploits the fact that down-
conversion automatically produces photon pairs that are entangled in both energy
and polarization. As we have seen in Section 13.3.2-B, energy entanglement implies
that the two photons are produced at essentially the same time.
This feature is the basis for a complete Bell state analysis. In addition to its intrinsic
interest, this scheme illustrates the application of various theoretical and experimental
techniques; therefore, we will discuss it in some detail. A schematic diagram illustrating
the idea for this measurement is shown in Fig. 20.5.
As one can see from Exercise 20.10, the Bell state |Ψ’ has the curious property
that it is unchanged by scattering from a balanced beam splitter, i.e. |Ψ’ = |Ψ’ .
This implies that the photons exhibit anti-pairing, i.e. one photon exits through each
of the two output ports. The other Bell states display the opposite behavior; whenever
|Ψ+ or |¦± are incident, the photons are paired, as discussed in Section 10.2.1. In
other words, both scattered photons are emitted through one or the other of the two
output ports.
This di¬erence allows |Ψ’ to be distinguished from the remaining Bell states:
when |Ψ’ is incident, detectors in the A and B arms of the apparatus will both ¬re
so that a coincidence count is registered. For the other Bell states, only the detectors
in one arm will ¬re, so there will be no coincidence counts between the two arms. This
e¬ect only depends on the behavior at the beam splitter, so it would work even if the
photons were not hyperentangled.

Fig. 20.5 Schematic of an experiment for a
) *4.- * complete Bell state analysis using hyperentan-
gled photons. (1) The beam splitter (BS) iden-
2*5 ¬ «
ti¬es ¬Ψ’ . (2)¬ The birefringent elements (BR-
*5 «
FEs) identify ¬Ψ+ . (3) The¬ polarizing ¬ beam
* *4.- ) « «

from ¬¦+ .
splitters (PBSs) distinguish ¬¦
(Adapted from Kwiat and Weinfurter (1998).)
¾ Quantum information

Next we turn to the task of distinguishing |Ψ+ from |¦± . This is accomplished
by means of the two birefringent elements, which have optic axes aligned along the h-
and v-polarizations. The two down-converted photons are emitted simultaneously in
matched wave packets with widths of the order of 15 fs, but the h- and v-components
experience di¬erent group velocities due to the di¬erence between the indices of re-
fraction for the two polarizations.
The resulting separation between the two wave packets means that the detections
of the two photons will also be separated in time. In principle, it is only necessary
to separate the two packets by an amount greater than their widths, but in practice
the delay must be larger than the resolution time”of the order of 1 ns”of the detec-
tors. The detection events for |¦± are expected to be simultaneous, since |¦± is a
superposition of states with pairs of photons having the same polarization.
The ¬nal task of separating |¦+ and |¦’ begins with the action of the beam
¦± ’ ¦± = √ {|hA , hA ± |vA , vA } + (A ” B) . (20.54)
Applying eqn (8.2) to each polarization produces the scattering matrix for a birefrin-
gent element of length L:
Sks,k s = eiφs δkk δss , (20.55)
where φs = ns (ω) L/c is the phase shift for the s-polarization. Propagation through
the birefringent elements therefore produces

ie2iφ0 iδ
¦± e |hA , hA ± e’iδ |vA , vA
√ + (A ” B) ,
= (20.56)
where φ0 = (φh + φv ) /2, and δ = φh ’ φv .
For both |¦+ and |¦’ two photons will strike a single detector, so the two
states are still not distinguished. The last trick is to send the light into a polarizing
beam splitter oriented along the 45—¦ -rotated basis B de¬ned in eqn (20.48). In Exercise
20.11, it is shown that expressing |¦± in the new basis yields

<< . .

. 84
( : 97)

. . >>