<< . .

. 3
( : 12)



. . >>

and Alice and Bob keep the data only when they hap- col, Alice and Bob use the same bases to prepare and measure
pen to have made their measurements in the compatible ´
their particles. A representation of their states on the Poincare
basis. If the source is reliable, this protocol is equivalent sphere is shown. A similar setup, but with Bob™s bases rotated
to that of BB84: It is as if the qubit propagates back- by 45°, can be used to test the violation of Bell™s inequality.
wards in time from Alice to the source, and then for- Finally, in the Ekert protocol, Alice and Bob may use the vio-
lation of Bell™s inequality to test for eavesdropping.
ward to Bob. But better than trusting the source, which
could be in Eve™s hand, the Ekert protocol assumes that
the two qubits are emitted in a maximally entangled rity of QC and emphasizing the close connection
state like between the Ekert and the BB84 schemes. This criticism
might be missing an important point. Although the exact
1
‘,‘ “,“ ). (9) relation between security and Bell™s inequality is not yet
& fully known, there are clear results establishing fascinat-
ing connections (see Sec. VI.F). In October 1992, an ar-
Then, when Alice and Bob happen to use the same ba-
ticle by Bennett, Brassard, and Ekert demonstrated that
sis, either the x basis or the y basis, i.e., in about half of
the founding fathers of QC were able to join forces
the cases, their results are identical, providing them with
to develop the ¬eld in a pleasant atmosphere (Bennett,
a common key. Note the similarity between the one-
Brassard, and Ekert, 1992).
qubit BB84 protocol illustrated in Fig. 1 and the two-
qubit Ekert protocol of Fig. 3. The analogy can be made
even stronger by noting that for all unitary evolutions
4. Other variations
U 1 and U 2 , the following equality holds:
There is a large collection of variations on the BB84
1 U 2 U t1
() ()
U1  U2 , (10)
protocol. Let us mention a few, chosen somewhat arbi-
where U t1 denotes the transpose. trarily. First, one can assume that the two bases are not
chosen with equal probability (Ardehali et al., 1998).
In his 1991 paper Ekert suggested basing the security
This has the nice consequence that the probability that
of this two-qubit protocol on Bell™s inequality, an in-
1
Alice and Bob choose the same basis is greater than 2 ,
equality which demonstrates that some correlations pre-
thus increasing the transmission rate of the sifted key.
dicted by quantum mechanics cannot be reproduced by
However, this protocol makes Eve™s job easier, as she is
any local theory (Bell, 1964). To do this, Alice and Bob
more likely to guess correctly the basis that was used.
can use a third basis (see Fig. 4). In this way the prob-
Consequently, it is not clear whether the ¬nal key rate,
ability that they might happen to choose the same basis
1 2
after error correction and privacy ampli¬cation, is
is reduced from 2 to 9 , but at the same time as they
higher or not.
establish a key, they collect enough data to test Bell™s
inequality.13 They can thus check that the source really Another variation consists in using quantum systems
of dimension greater than 2 (Bechmann-Pasquinucci
emits the entangled state (9) and not merely product
and Peres, 2000; Bechmann-Pasquinucci and Tittel,
states. The following year Bennett, Brassard, and Mer-
¨
2000; Bourennane, Karlsson, and Bjorn, 2001). Again,
min (1992) criticized Ekert™s letter, arguing that the vio-
the practical value of this idea has not yet been fully
lation of Bell™s inequality is not necessary for the secu-
determined.
A third variation worth mentioning is due to Golden-
berg and Vaidman of Tel Aviv University (1995). They
13
A maximal violation of Bell™s inequality is necessary to rule
suggested preparing the qubits in a superposition of two
out tampering by Eve. In this case, the QBER must necessarily
spatially separated states, then sending one component
be equal to zero. With a nonmaximal violation, as typically
of this superposition and waiting until Bob receives it
obtained in experimental systems, Alice and Bob can distill a
before sending the second component. This does not
secure key using error correction and privacy ampli¬cation.


Rev. Mod. Phys., Vol. 74, No. 1, January 2002
154 Gisin et al.: Quantum cryptography


sound of great practical value, but has the nice concep- tum state, except if the state happens to be an eigenstate
tual feature that the minimal two states do not need to of the observable. Hence, if for some reason one conjec-
be mutually orthogonal. tures that a quantum system is in some state (or in a
state among a set of mutually orthogonal ones), one can
in principle test this conjecture repeatedly (Braginsky
E. Quantum teleportation as a ˜˜quantum one-time pad™™
and Khalili, 1992). However, if the state is only restricted
Since its discovery in 1993 by a surprisingly large to be in a ¬nite set containing nonorthogonal states, as
group of physicists, quantum teleportation (Bennett in QC, then there is no way to perform a measurement
et al., 1993) has received much attention from both the without ˜˜demolishing™™ (perturbing) the state. Now, in
scienti¬c community and the general public. The dream QC the term ˜˜nondemolition measurement™™ is also used
of beaming travelers through the universe is exciting, with a different meaning: one measures the number of
but completely out of the realm of any foreseeable tech- photons in a pulse without affecting the degree of free-
nology. However, quantum teleportation can be seen as dom coding the qubit (e.g., the polarization; see Sec.
the fully quantum version of the one-time pad (see Sec. VI.H), or one detects the presence of a photon without
II.B.3), hence as the ultimate form of QC. As in ˜˜classi- destroying it (Nogues et al., 1999). Such measurements
cal teleportation,™™ let us assume that Alice aims to trans-
are usually called ideal measurements, or projective mea-
fer a faithful copy of a quantum system to Bob. If Alice
surements, because they produce the least possible per-
has full knowledge of the quantum state, the problem is
turbation (Piron, 1990) and because they can be repre-
not really a quantum one (Alice™s information is classi-
sented by projectors. It is important to stress that these
cal). If, on the other hand, Alice does not know the
˜˜ideal measurements™™ do not invalidate the security of
quantum state, she cannot send a copy, since quantum
QC.
copying is impossible according to quantum physics (see
Let us now consider optical ampli¬ers (a laser me-
Sec. II.C.2). Nor can she send classical instructions, since
dium, but without mirrors, so that ampli¬cation takes
this would allow the production of many copies. How-
place in a single pass; see Desurvire, 1994). They are
ever, if Alice and Bob share arbitrarily many entangled
widely used in today™s optical communication networks.
qubits, sometimes called a quantum key, and share a
However, they are of no use for quantum communica-
classical communication channel, then the quantum tele-
tion. Indeed, as seen in Sec. II.C, the copying of quan-
portation protocol provides them with a means of trans-
tum information is impossible. Here we illustrate this
ferring the quantum state of the system from Alice to
Bob. In the course of running this protocol, Alice™s characteristic of quantum information by the example of
quantum system is destroyed without Alice™s having optical ampli¬ers: the necessary presence of spontane-
learned anything about the quantum state, while Bob™s ous emission whenever there is stimulated emission pre-
qubit ends in a state isomorphic to the state of the origi- vents perfect copying. Let us clarify this important and
nal system (but Bob does not learn anything about the often confusing point, following the work of Simon et al.
quantum state). If the initial quantum system is a quan- (1999, 2000; see also De Martini et al., 2000 and Kempe
tum message coded in the form of a sequence of qubits, et al., 2000). Let the two basic qubit states 0 and 1 be
then this quantum message is faithfully and securely physically implemented by two optical modes:
transferred to Bob, without any information leaking to 0,1 . Thus n,m ph  k,l a denotes
0 1,0 and 1
the outside world (i.e., to anyone not sharing the prior the state of n photons in mode 1 and m photons in mode
entanglement with Alice and Bob). Finally, the quantum 2, while k,l 0(1) denotes the ground (or excited) state
message could be formed of a four-letter quantum al- of two-level atoms coupled to mode 1 or 2, respectively.
phabet consisting of the four states of the BB84 proto- Hence spontaneous emission corresponds to
col. With futuristic but not impossible technology, Alice
1,0 a ’ 1,0
ph  ph 
0,0 0,0 a , (11)
and Bob could keep their entangled qubits in their re-
0,1 a ’ 0,1
spective wallets and could enjoy totally secure commu- ph  ph 
0,0 0,0 a , (12)
nication at any time, without even having to know where
and stimulated emission to
the other is located (provided they can communicate
1,0 a ’& 2,0
classically). ph  ph 
1,0 0,0 a , (13)
0,1 a ’& 0,2
ph  ph 
0,1 0,0 a , (14)
F. Optical ampli¬cation, quantum nondemolition
where the factor of & takes into account the ratio of
measurements, and optimal quantum cloning
stimulated to spontaneous emission. Let the initial state
After almost every general talk on QC, two questions of the atom be a mixture of the following two states,
arise: What about optical ampli¬ers? and What about each with equal (50%) weight:
quantum nondemolition measurements? In this section
0,1 and 1,0 a . (15)
a
we brie¬‚y address these questions.
By symmetry, it suf¬ces to consider one possible initial
Let us start with the second one, as it is the easiest.
state of the qubit, e.g., one photon in the ¬rst mode
The term ˜˜quantum nondemolition measurement™™ is
1,0 ph . The initial state of the photon atom system is
simply confusing. There is nothing like a quantum mea-
thus a mixture:
surement that does not perturb (i.e., modify) the quan-

Rev. Mod. Phys., Vol. 74, No. 1, January 2002
155
Gisin et al.: Quantum cryptography


on such systems here. There is also, however, some very
ph  ph 
1,0 1,0 or 1,0 0,1 a . (16)
a
signi¬cant research on free-space systems (see Sec.
This corresponds to the ¬rst-order term in an evolution
IV.E).
with a Hamiltonian (in the interaction picture): H
Once the medium has been chosen, there remain the
(a † 1 a 1 † a † 2 a 2 † ). After some time the
1 1 2 2 questions of the source and detectors. Since they have to
two-photon component of the evolved states becomes
be compatible, the crucial choice is that of the wave-
& 2,0 ph  ph 
0,0 or 1,1 0,0 a . (17) length. There are two main possibilities. Either one
a
chooses a wavelength around 800 nm, for which ef¬cient
1
The correspondence with a pair of spin goes as fol-
2
photon counters are commercially available, or one
lows:
chooses a wavelength compatible with today™s telecom-
‘‘ , ““ ,
2,0 0,2 (18) munications optical ¬bers, i.e., near 1300 or 1550 nm.
The ¬rst choice requires free-space transmission or the
1
‘“ “‘ ). use of special ¬bers, hence the installed telecommunica-
()
1,1 (19)
ph
& tions networks cannot be used. The second choice re-
quires the improvement or development of new detec-
Tracing over the ampli¬er (i.e., the two-level atom), an
tors, not based on silicon semiconductors, which are
(ideal) ampli¬er achieves the following transformation:
transparent above a wavelength of 1000 nm.
P ‘ ’2P ‘‘ P (20) In the case of transmission using optical ¬bers, it is
( ),

still unclear which of the two alternatives will turn out to
where the P™s indicate projectors (i.e., pure-state density
be the best choice. If QC ¬nds niche markets, it is con-
matrices) and the lack of normalization results from the
ceivable that special ¬bers will be installed for that pur-
¬rst-order expansion used in Eqs. (11)“(14). Accord-
pose. But it is equally conceivable that new commercial
ingly, after normalization, each photon is in the state
detectors will soon make it much easier to detect single
1
1
photons at telecommunications wavelengths. Actually,
2P ‘
2P ‘‘ P () 2
Tr1 . (21) the latter possibility is very likely, as several research
ph mode
3 3
groups and industries are already working on it. There is
The corresponding ¬delity is another good reason to bet on this solution: the quality
of telecommunications ¬bers is much higher than that of
1
2 5
2
any special ¬ber; in particular, the attenuation is much
F , (22)
3 6 lower (this is why the telecommunications industry
chose these wavelengths): at 800 nm, the attenuation is
which is precisely the optimal ¬delity compatible with
about 2 dB/km (i.e., half the photons are lost after 1.5
ˇ
quantum mechanics (Buzek and Hillery, 1996; Gisin and
km), while it is only of the order of 0.35 and 0.20 dB/km
Massar, 1997; Bruss et al., 1998). In other words, if we
at 1300 and 1550 nm, respectively (50% loss after about
start with a single photon in an arbitrary state and pass it
9 and 15 km).14
through an ampli¬er, then due to the effect of spontane-
In the case of free-space transmission, the choice of
ous emission the ¬delity of the state exiting the ampli-
wavelength is straightforward, since the region where
¬er, when it consists of exactly two photons, with the
good photon detectors exist”around 800 nm”coincides
initial state will be equal to at most 5/6. Note that if it
with that where absorption is low. However, free-space
were possible to make better copies, then signaling at
transmission is restricted to line-of-sight links and is very
arbitrarily fast speed, using EPR correlations between
weather dependent.
spatially separated systems, would also be possible (Gi-
In the next sections we successively consider the ques-
sin, 1998).
tions of how to produce single photons (Sec. III.A), how
to transmit them (Sec. III.B), how to detect single pho-
tons (Sec. III.C), and ¬nally how to exploit the intrinsic
III. TECHNOLOGICAL CHALLENGES
randomness of quantum processes to build random gen-
The very ¬rst demonstration of QC was a table-top erators (Sec. III.D).
experiment performed at the IBM laboratory in the
A. Photon sources
early 1990s over a distance of 30 cm (Bennett, Bessette,
et al., 1992), marking the start of a series of impressive
Optical quantum cryptography is based on the use of
experimental improvements over the past few years.
single-photon Fock states. Unfortunately, these states
The 30-cm distance is of little practical interest. Either
are dif¬cult to realize experimentally. Nowadays, practi-
the distance should be even shorter [think of a credit
cal implementations rely on faint laser pulses or en-
card and an ATM machine (Huttner, Imoto, and Bar-
tangled photon pairs, in which both the photon and the
nett, 1996), in which case all of Alice™s components
photon-pair number distribution obey Poisson statistics.
should ¬t on the credit card”a nice idea, but still im-
practical with present technology] or the distance should
be much longer, at least in the kilometer range. Most of
14
the research so far uses optical ¬bers to guide the pho- The losses in dB (l db ) can be calculated from the losses in
tons from Alice to Bob, and we shall mainly concentrate percent (l % ): l dB 10 log10 1 (l % /100) .


Rev. Mod. Phys., Vol. 74, No. 1, January 2002
156 Gisin et al.: Quantum cryptography


depending on the transmission losses.15 After key distil-
Hence both possibilities suffer from a small probability
lation, the security is just as good with faint laser pulses
of generating more than one photon or photon pair at
as with Fock states. The price to pay for using such
the same time. For large losses in the quantum channel,
states is a reduction of the bit rate.
even small fractions of these multiphotons can have im-
portant consequences on the security of the key (see
Sec. VI.H), leading to interest in ˜˜photon guns™™; see Sec. 2. Photon pairs generated by parametric downconversion
III.A.3). In this section we brie¬‚y comment on sources
Another way to create pseudo-single-photon states is
based on faint pulses as well as on entangled photon
the generation of photon pairs and the use of one pho-
pairs, and we compare their advantages and drawbacks.
ton as a trigger for the other one (Hong and Mandel,
1986). In contrast to the sources discussed earlier, the
second detector must be activated only whenever the
¬rst one has detected a photon, hence when 1, and
1. Faint laser pulses not whenever a pump pulse has been emitted, therefore
circumventing the problem of empty pulses.
There is a very simple solution to approximate single-
The photon pairs are generated by spontaneous para-
photon Fock states: coherent states with an ultralow
metric downconversion in a (2) nonlinear crystal.16 In
mean photon number . They can easily be realized us-
this process, the inverse of the well-known frequency
ing only standard semiconductor lasers and calibrated doubling, one photon spontaneously splits into two
attenuators. The probability of ¬nding n photons in such daughter photons”traditionally called signal and idler
a coherent state follows the Poisson statistics: photons”conserving total energy and momentum. In
this context, momentum conservation is called phase
n
matching and can be achieved despite chromatic disper-
P n, e . (23)
n! sion by exploiting the birefringence of the nonlinear
crystal. Phase matching allows one to choose the wave-
Accordingly, the probability that a nonempty weak co- length and determines the bandwidth of the downcon-
verted photons. The latter is in general rather large and
herent pulse contains more than one photon,
varies from a few nanometers up to some tens of na-
nometers. For the nondegenerate case one typically gets
1 P 0, P 1,
P n 1 n 0, a bandwith of 5“10 nm, whereas in the degenerate case
1 P 0,
(where the central frequency of both photons is equal),
the bandwidth can be as large as 70 nm.
1e 1
This photon-pair creation process is very inef¬cient;
, (24)
1e 2 typically it takes some 1010 pump photons to create one
pair in a given mode.17 The number of photon pairs per
can be made arbitrarily small. Weak pulses are thus ex- mode is thermally distributed within the coherence time
tremely practical and have indeed been used in the vast of the photons and follows a Poissonian distribution for
majority of experiments. However, they have one major larger time windows (Walls and Milburn, 1995). With a
pump power of 1 mW, about 106 pairs per second can be
drawback. When is small, most pulses are empty:
P(n 0) 1 . In principle, the resulting decrease in collected in single-mode ¬bers. Accordingly, in a time
window of roughly 1 ns, the conditional probability of
bit rate could be compensated for thanks to the achiev-
¬nding a second pair, having already detected one, is
able gigahertz modulation rates of telecommunications
106 10 9 0.1%. In the case of continuous pumping,
lasers. But in practice, the problem comes from the de-
this time window is given by the detector resolution. Tol-
tectors™ dark counts (i.e., a click without a photon™s ar-
erating, for example, 1% of these multipair events, one
riving). Indeed, the detectors must be active for all
can generate 107 pairs per second using a realistic
pulses, including the empty ones. Hence the total dark
counts increase with the laser™s modulation rate, and the
ratio of detected photons to dark counts (i.e., the signal-
15
to-noise ratio) decreases with (see Sec. IV.A). The Contrary to a frequent misconception, there is nothing spe-
cial about a value of 0.1, even though it has been selected by
problem is especially severe for longer wavelengths, at
most experimentalists. The optimal value”i.e., the value that
which photon detectors based on indium gallium ar-
yields the highest key exchange rate after distillation”
senide semiconductors (InGaAs) are needed (see Sec.
depends on the optical losses in the channel and on assump-
III.C), since the noise of these detectors explodes if they
tions about Eve™s technology (see Secs. VI.H and VI.I).
are opened too frequently (in practice with a rate larger 16
For a review see Rarity and Tapster (1988), and for more
than a few megahertz). This prevents the use of really recent developments see Kwiat et al. (1999), Tittel et al.
low photon numbers, smaller than approximately 1%. (1999), Jennewein, Simon, et al. (2000), and Tanzilli et al.
Most experiments to date have relied on 0.1, mean- (2001).
ing that 5% of the nonempty pulses contain more than 17
Recently we achieved a conversion rate of 10 6 using an
one photon. However, it is important to stress that, as optical waveguide in a periodically poled LiNbO3 crystal (Tan-
¨
pointed out by Lutkenhaus (2000), there is an optimal zilli et al., 2001).


Rev. Mod. Phys., Vol. 74, No. 1, January 2002
157
Gisin et al.: Quantum cryptography


3. Photon guns

The ideal single-photon source is a device that, when
one pulls the trigger, and only then, emits one and only
one photon. Hence the name photon gun. Although

<< . .

. 3
( : 12)



. . >>