pen to have made their measurements in the compatible ´

their particles. A representation of their states on the Poincare

basis. If the source is reliable, this protocol is equivalent sphere is shown. A similar setup, but with Bob™s bases rotated

to that of BB84: It is as if the qubit propagates back- by 45°, can be used to test the violation of Bell™s inequality.

wards in time from Alice to the source, and then for- Finally, in the Ekert protocol, Alice and Bob may use the vio-

lation of Bell™s inequality to test for eavesdropping.

ward to Bob. But better than trusting the source, which

could be in Eve™s hand, the Ekert protocol assumes that

the two qubits are emitted in a maximally entangled rity of QC and emphasizing the close connection

state like between the Ekert and the BB84 schemes. This criticism

might be missing an important point. Although the exact

1

‘,‘ “,“ ). (9) relation between security and Bell™s inequality is not yet

& fully known, there are clear results establishing fascinat-

ing connections (see Sec. VI.F). In October 1992, an ar-

Then, when Alice and Bob happen to use the same ba-

ticle by Bennett, Brassard, and Ekert demonstrated that

sis, either the x basis or the y basis, i.e., in about half of

the founding fathers of QC were able to join forces

the cases, their results are identical, providing them with

to develop the ¬eld in a pleasant atmosphere (Bennett,

a common key. Note the similarity between the one-

Brassard, and Ekert, 1992).

qubit BB84 protocol illustrated in Fig. 1 and the two-

qubit Ekert protocol of Fig. 3. The analogy can be made

even stronger by noting that for all unitary evolutions

4. Other variations

U 1 and U 2 , the following equality holds:

There is a large collection of variations on the BB84

1 U 2 U t1

() ()

U1 U2 , (10)

protocol. Let us mention a few, chosen somewhat arbi-

where U t1 denotes the transpose. trarily. First, one can assume that the two bases are not

chosen with equal probability (Ardehali et al., 1998).

In his 1991 paper Ekert suggested basing the security

This has the nice consequence that the probability that

of this two-qubit protocol on Bell™s inequality, an in-

1

Alice and Bob choose the same basis is greater than 2 ,

equality which demonstrates that some correlations pre-

thus increasing the transmission rate of the sifted key.

dicted by quantum mechanics cannot be reproduced by

However, this protocol makes Eve™s job easier, as she is

any local theory (Bell, 1964). To do this, Alice and Bob

more likely to guess correctly the basis that was used.

can use a third basis (see Fig. 4). In this way the prob-

Consequently, it is not clear whether the ¬nal key rate,

ability that they might happen to choose the same basis

1 2

after error correction and privacy ampli¬cation, is

is reduced from 2 to 9 , but at the same time as they

higher or not.

establish a key, they collect enough data to test Bell™s

inequality.13 They can thus check that the source really Another variation consists in using quantum systems

of dimension greater than 2 (Bechmann-Pasquinucci

emits the entangled state (9) and not merely product

and Peres, 2000; Bechmann-Pasquinucci and Tittel,

states. The following year Bennett, Brassard, and Mer-

¨

2000; Bourennane, Karlsson, and Bjorn, 2001). Again,

min (1992) criticized Ekert™s letter, arguing that the vio-

the practical value of this idea has not yet been fully

lation of Bell™s inequality is not necessary for the secu-

determined.

A third variation worth mentioning is due to Golden-

berg and Vaidman of Tel Aviv University (1995). They

13

A maximal violation of Bell™s inequality is necessary to rule

suggested preparing the qubits in a superposition of two

out tampering by Eve. In this case, the QBER must necessarily

spatially separated states, then sending one component

be equal to zero. With a nonmaximal violation, as typically

of this superposition and waiting until Bob receives it

obtained in experimental systems, Alice and Bob can distill a

before sending the second component. This does not

secure key using error correction and privacy ampli¬cation.

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

154 Gisin et al.: Quantum cryptography

sound of great practical value, but has the nice concep- tum state, except if the state happens to be an eigenstate

tual feature that the minimal two states do not need to of the observable. Hence, if for some reason one conjec-

be mutually orthogonal. tures that a quantum system is in some state (or in a

state among a set of mutually orthogonal ones), one can

in principle test this conjecture repeatedly (Braginsky

E. Quantum teleportation as a ˜˜quantum one-time pad™™

and Khalili, 1992). However, if the state is only restricted

Since its discovery in 1993 by a surprisingly large to be in a ¬nite set containing nonorthogonal states, as

group of physicists, quantum teleportation (Bennett in QC, then there is no way to perform a measurement

et al., 1993) has received much attention from both the without ˜˜demolishing™™ (perturbing) the state. Now, in

scienti¬c community and the general public. The dream QC the term ˜˜nondemolition measurement™™ is also used

of beaming travelers through the universe is exciting, with a different meaning: one measures the number of

but completely out of the realm of any foreseeable tech- photons in a pulse without affecting the degree of free-

nology. However, quantum teleportation can be seen as dom coding the qubit (e.g., the polarization; see Sec.

the fully quantum version of the one-time pad (see Sec. VI.H), or one detects the presence of a photon without

II.B.3), hence as the ultimate form of QC. As in ˜˜classi- destroying it (Nogues et al., 1999). Such measurements

cal teleportation,™™ let us assume that Alice aims to trans-

are usually called ideal measurements, or projective mea-

fer a faithful copy of a quantum system to Bob. If Alice

surements, because they produce the least possible per-

has full knowledge of the quantum state, the problem is

turbation (Piron, 1990) and because they can be repre-

not really a quantum one (Alice™s information is classi-

sented by projectors. It is important to stress that these

cal). If, on the other hand, Alice does not know the

˜˜ideal measurements™™ do not invalidate the security of

quantum state, she cannot send a copy, since quantum

QC.

copying is impossible according to quantum physics (see

Let us now consider optical ampli¬ers (a laser me-

Sec. II.C.2). Nor can she send classical instructions, since

dium, but without mirrors, so that ampli¬cation takes

this would allow the production of many copies. How-

place in a single pass; see Desurvire, 1994). They are

ever, if Alice and Bob share arbitrarily many entangled

widely used in today™s optical communication networks.

qubits, sometimes called a quantum key, and share a

However, they are of no use for quantum communica-

classical communication channel, then the quantum tele-

tion. Indeed, as seen in Sec. II.C, the copying of quan-

portation protocol provides them with a means of trans-

tum information is impossible. Here we illustrate this

ferring the quantum state of the system from Alice to

Bob. In the course of running this protocol, Alice™s characteristic of quantum information by the example of

quantum system is destroyed without Alice™s having optical ampli¬ers: the necessary presence of spontane-

learned anything about the quantum state, while Bob™s ous emission whenever there is stimulated emission pre-

qubit ends in a state isomorphic to the state of the origi- vents perfect copying. Let us clarify this important and

nal system (but Bob does not learn anything about the often confusing point, following the work of Simon et al.

quantum state). If the initial quantum system is a quan- (1999, 2000; see also De Martini et al., 2000 and Kempe

tum message coded in the form of a sequence of qubits, et al., 2000). Let the two basic qubit states 0 and 1 be

then this quantum message is faithfully and securely physically implemented by two optical modes:

transferred to Bob, without any information leaking to 0,1 . Thus n,m ph k,l a denotes

0 1,0 and 1

the outside world (i.e., to anyone not sharing the prior the state of n photons in mode 1 and m photons in mode

entanglement with Alice and Bob). Finally, the quantum 2, while k,l 0(1) denotes the ground (or excited) state

message could be formed of a four-letter quantum al- of two-level atoms coupled to mode 1 or 2, respectively.

phabet consisting of the four states of the BB84 proto- Hence spontaneous emission corresponds to

col. With futuristic but not impossible technology, Alice

1,0 a ’ 1,0

ph ph

0,0 0,0 a , (11)

and Bob could keep their entangled qubits in their re-

0,1 a ’ 0,1

spective wallets and could enjoy totally secure commu- ph ph

0,0 0,0 a , (12)

nication at any time, without even having to know where

and stimulated emission to

the other is located (provided they can communicate

1,0 a ’& 2,0

classically). ph ph

1,0 0,0 a , (13)

0,1 a ’& 0,2

ph ph

0,1 0,0 a , (14)

F. Optical ampli¬cation, quantum nondemolition

where the factor of & takes into account the ratio of

measurements, and optimal quantum cloning

stimulated to spontaneous emission. Let the initial state

After almost every general talk on QC, two questions of the atom be a mixture of the following two states,

arise: What about optical ampli¬ers? and What about each with equal (50%) weight:

quantum nondemolition measurements? In this section

0,1 and 1,0 a . (15)

a

we brie¬‚y address these questions.

By symmetry, it suf¬ces to consider one possible initial

Let us start with the second one, as it is the easiest.

state of the qubit, e.g., one photon in the ¬rst mode

The term ˜˜quantum nondemolition measurement™™ is

1,0 ph . The initial state of the photon atom system is

simply confusing. There is nothing like a quantum mea-

thus a mixture:

surement that does not perturb (i.e., modify) the quan-

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

155

Gisin et al.: Quantum cryptography

on such systems here. There is also, however, some very

ph ph

1,0 1,0 or 1,0 0,1 a . (16)

a

signi¬cant research on free-space systems (see Sec.

This corresponds to the ¬rst-order term in an evolution

IV.E).

with a Hamiltonian (in the interaction picture): H

Once the medium has been chosen, there remain the

(a † 1 a 1 † a † 2 a 2 † ). After some time the

1 1 2 2 questions of the source and detectors. Since they have to

two-photon component of the evolved states becomes

be compatible, the crucial choice is that of the wave-

& 2,0 ph ph

0,0 or 1,1 0,0 a . (17) length. There are two main possibilities. Either one

a

chooses a wavelength around 800 nm, for which ef¬cient

1

The correspondence with a pair of spin goes as fol-

2

photon counters are commercially available, or one

lows:

chooses a wavelength compatible with today™s telecom-

‘‘ , ““ ,

2,0 0,2 (18) munications optical ¬bers, i.e., near 1300 or 1550 nm.

The ¬rst choice requires free-space transmission or the

1

‘“ “‘ ). use of special ¬bers, hence the installed telecommunica-

()

1,1 (19)

ph

& tions networks cannot be used. The second choice re-

quires the improvement or development of new detec-

Tracing over the ampli¬er (i.e., the two-level atom), an

tors, not based on silicon semiconductors, which are

(ideal) ampli¬er achieves the following transformation:

transparent above a wavelength of 1000 nm.

P ‘ ’2P ‘‘ P (20) In the case of transmission using optical ¬bers, it is

( ),

still unclear which of the two alternatives will turn out to

where the P™s indicate projectors (i.e., pure-state density

be the best choice. If QC ¬nds niche markets, it is con-

matrices) and the lack of normalization results from the

ceivable that special ¬bers will be installed for that pur-

¬rst-order expansion used in Eqs. (11)“(14). Accord-

pose. But it is equally conceivable that new commercial

ingly, after normalization, each photon is in the state

detectors will soon make it much easier to detect single

1

1

photons at telecommunications wavelengths. Actually,

2P ‘

2P ‘‘ P () 2

Tr1 . (21) the latter possibility is very likely, as several research

ph mode

3 3

groups and industries are already working on it. There is

The corresponding ¬delity is another good reason to bet on this solution: the quality

of telecommunications ¬bers is much higher than that of

1

2 5

2

any special ¬ber; in particular, the attenuation is much

F , (22)

3 6 lower (this is why the telecommunications industry

chose these wavelengths): at 800 nm, the attenuation is

which is precisely the optimal ¬delity compatible with

about 2 dB/km (i.e., half the photons are lost after 1.5

ˇ

quantum mechanics (Buzek and Hillery, 1996; Gisin and

km), while it is only of the order of 0.35 and 0.20 dB/km

Massar, 1997; Bruss et al., 1998). In other words, if we

at 1300 and 1550 nm, respectively (50% loss after about

start with a single photon in an arbitrary state and pass it

9 and 15 km).14

through an ampli¬er, then due to the effect of spontane-

In the case of free-space transmission, the choice of

ous emission the ¬delity of the state exiting the ampli-

wavelength is straightforward, since the region where

¬er, when it consists of exactly two photons, with the

good photon detectors exist”around 800 nm”coincides

initial state will be equal to at most 5/6. Note that if it

with that where absorption is low. However, free-space

were possible to make better copies, then signaling at

transmission is restricted to line-of-sight links and is very

arbitrarily fast speed, using EPR correlations between

weather dependent.

spatially separated systems, would also be possible (Gi-

In the next sections we successively consider the ques-

sin, 1998).

tions of how to produce single photons (Sec. III.A), how

to transmit them (Sec. III.B), how to detect single pho-

tons (Sec. III.C), and ¬nally how to exploit the intrinsic

III. TECHNOLOGICAL CHALLENGES

randomness of quantum processes to build random gen-

The very ¬rst demonstration of QC was a table-top erators (Sec. III.D).

experiment performed at the IBM laboratory in the

A. Photon sources

early 1990s over a distance of 30 cm (Bennett, Bessette,

et al., 1992), marking the start of a series of impressive

Optical quantum cryptography is based on the use of

experimental improvements over the past few years.

single-photon Fock states. Unfortunately, these states

The 30-cm distance is of little practical interest. Either

are dif¬cult to realize experimentally. Nowadays, practi-

the distance should be even shorter [think of a credit

cal implementations rely on faint laser pulses or en-

card and an ATM machine (Huttner, Imoto, and Bar-

tangled photon pairs, in which both the photon and the

nett, 1996), in which case all of Alice™s components

photon-pair number distribution obey Poisson statistics.

should ¬t on the credit card”a nice idea, but still im-

practical with present technology] or the distance should

be much longer, at least in the kilometer range. Most of

14

the research so far uses optical ¬bers to guide the pho- The losses in dB (l db ) can be calculated from the losses in

tons from Alice to Bob, and we shall mainly concentrate percent (l % ): l dB 10 log10 1 (l % /100) .

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

156 Gisin et al.: Quantum cryptography

depending on the transmission losses.15 After key distil-

Hence both possibilities suffer from a small probability

lation, the security is just as good with faint laser pulses

of generating more than one photon or photon pair at

as with Fock states. The price to pay for using such

the same time. For large losses in the quantum channel,

states is a reduction of the bit rate.

even small fractions of these multiphotons can have im-

portant consequences on the security of the key (see

Sec. VI.H), leading to interest in ˜˜photon guns™™; see Sec. 2. Photon pairs generated by parametric downconversion

III.A.3). In this section we brie¬‚y comment on sources

Another way to create pseudo-single-photon states is

based on faint pulses as well as on entangled photon

the generation of photon pairs and the use of one pho-

pairs, and we compare their advantages and drawbacks.

ton as a trigger for the other one (Hong and Mandel,

1986). In contrast to the sources discussed earlier, the

second detector must be activated only whenever the

¬rst one has detected a photon, hence when 1, and

1. Faint laser pulses not whenever a pump pulse has been emitted, therefore

circumventing the problem of empty pulses.

There is a very simple solution to approximate single-

The photon pairs are generated by spontaneous para-

photon Fock states: coherent states with an ultralow

metric downconversion in a (2) nonlinear crystal.16 In

mean photon number . They can easily be realized us-

this process, the inverse of the well-known frequency

ing only standard semiconductor lasers and calibrated doubling, one photon spontaneously splits into two

attenuators. The probability of ¬nding n photons in such daughter photons”traditionally called signal and idler

a coherent state follows the Poisson statistics: photons”conserving total energy and momentum. In

this context, momentum conservation is called phase

n

matching and can be achieved despite chromatic disper-

P n, e . (23)

n! sion by exploiting the birefringence of the nonlinear

crystal. Phase matching allows one to choose the wave-

Accordingly, the probability that a nonempty weak co- length and determines the bandwidth of the downcon-

verted photons. The latter is in general rather large and

herent pulse contains more than one photon,

varies from a few nanometers up to some tens of na-

nometers. For the nondegenerate case one typically gets

1 P 0, P 1,

P n 1 n 0, a bandwith of 5“10 nm, whereas in the degenerate case

1 P 0,

(where the central frequency of both photons is equal),

the bandwidth can be as large as 70 nm.

1e 1

This photon-pair creation process is very inef¬cient;

, (24)

1e 2 typically it takes some 1010 pump photons to create one

pair in a given mode.17 The number of photon pairs per

can be made arbitrarily small. Weak pulses are thus ex- mode is thermally distributed within the coherence time

tremely practical and have indeed been used in the vast of the photons and follows a Poissonian distribution for

majority of experiments. However, they have one major larger time windows (Walls and Milburn, 1995). With a

pump power of 1 mW, about 106 pairs per second can be

drawback. When is small, most pulses are empty:

P(n 0) 1 . In principle, the resulting decrease in collected in single-mode ¬bers. Accordingly, in a time

window of roughly 1 ns, the conditional probability of

bit rate could be compensated for thanks to the achiev-

¬nding a second pair, having already detected one, is

able gigahertz modulation rates of telecommunications

106 10 9 0.1%. In the case of continuous pumping,

lasers. But in practice, the problem comes from the de-

this time window is given by the detector resolution. Tol-

tectors™ dark counts (i.e., a click without a photon™s ar-

erating, for example, 1% of these multipair events, one

riving). Indeed, the detectors must be active for all

can generate 107 pairs per second using a realistic

pulses, including the empty ones. Hence the total dark

counts increase with the laser™s modulation rate, and the

ratio of detected photons to dark counts (i.e., the signal-

15

to-noise ratio) decreases with (see Sec. IV.A). The Contrary to a frequent misconception, there is nothing spe-

cial about a value of 0.1, even though it has been selected by

problem is especially severe for longer wavelengths, at

most experimentalists. The optimal value”i.e., the value that

which photon detectors based on indium gallium ar-

yields the highest key exchange rate after distillation”

senide semiconductors (InGaAs) are needed (see Sec.

depends on the optical losses in the channel and on assump-

III.C), since the noise of these detectors explodes if they

tions about Eve™s technology (see Secs. VI.H and VI.I).

are opened too frequently (in practice with a rate larger 16

For a review see Rarity and Tapster (1988), and for more

than a few megahertz). This prevents the use of really recent developments see Kwiat et al. (1999), Tittel et al.

low photon numbers, smaller than approximately 1%. (1999), Jennewein, Simon, et al. (2000), and Tanzilli et al.

Most experiments to date have relied on 0.1, mean- (2001).

ing that 5% of the nonempty pulses contain more than 17

Recently we achieved a conversion rate of 10 6 using an

one photon. However, it is important to stress that, as optical waveguide in a periodically poled LiNbO3 crystal (Tan-

¨

pointed out by Lutkenhaus (2000), there is an optimal zilli et al., 2001).

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

157

Gisin et al.: Quantum cryptography

3. Photon guns

The ideal single-photon source is a device that, when

one pulls the trigger, and only then, emits one and only

one photon. Hence the name photon gun. Although