(Kimble et al., 1977), a practical and handy device is still

awaited. At present, there are essentially three different

experimental approaches that more or less come close to

this ideal.

A ¬rst idea is to work with a single two-level quantum

system that obviously cannot emit two photons at a

time. The manipulation of single trapped atoms or ions

requires a much too involved technical effort. Single or-

ganic dye molecules in solvents (Kitson et al., 1998) or

solids (Brunel et al., 1999; Fleury et al., 2000) are easier

to handle but offer only limited stability at room tem-

perature. A promising candidate, however, is the

nitrogen-vacancy center in diamond, a substitutional ni-

trogen atom with a vacancy trapped at an adjacent lat-

FIG. 5. Photo of our entangled photon-pair source as used in

tice position (Brouri et al., 2000; Kurtsiefer et al., 2000).

the ¬rst long-distance test of Bell™s inequalities (Tittel et al.,

1998). Note that the whole source ¬ts into a box only 40 45 It is possible to excite individual nitrogen atoms with a

15 cm3 in size and that neither a special power supply nor 532-nm laser beam, which will subsequently emit a ¬‚uo-

water cooling is necessary. rescence photon around 700 nm (12-ns decay time). The

¬‚uorescence exhibits strong photon antibunching, and

the samples are stable at room temperature. However,

10-mW pump. To detect, for example, 10% of the trigger

the big remaining experimental challenge is to increase

photons, the second detector has to be activated 106

the collection ef¬ciency (currently about 0.1%) in order

times per second. In comparison, the example of 1% of

to obtain mean photon numbers close to 1. To obtain

multiphoton events corresponds in the case of faint laser

this ef¬ciency, an optical cavity or a photonic band-gap

pulses to a mean photon number of 0.02. In order to

structure must suppress emission in all spatial modes but

6

get the same number (10 ) of nonempty pulses per sec-

one. In addition, the spectral bandwidth of this type of

ond, a pulse rate of 50 MHz is needed. For a given pho-

source is broad (on the order of 100 nm), enhancing the

ton statistics, photon pairs thus allow one to work with

effect of perturbations in a quantum channel.

lower pulse rates (e.g., 50 times lower) and hence re-

A second approach is to generate photons by single

duced detector-induced errors. However, due to limited

electrons in a mesoscopic p-n junction. The idea is to

coupling ef¬ciency in optical ¬bers, the probability of

pro¬t from the fact that thermal electrons show anti-

¬nding the sister photon after detection of the trigger

bunching (the Pauli exclusion principle) in contrast to

photon in the respective ¬ber is in practice less than 1.

photons (Imamoglu and Yamamoto, 1994). The ¬rst ex-

This means that the effective photon number is not 1 but

perimental results have been presented (Kim et al.,

rather 2/3 (Ribordy et al., 2001), still well above

1999), but with extremely low ef¬ciencies and only at a

0.02.

temperature of 50 mK!

Photon pairs generated by parametric downconver-

Finally, another approach is to use the photon emis-

sion offer a further major advantage if they are not

sion of electron-hole pairs in a semiconductor quantum

merely used as a pseudo-single-photon source, but if

dot. The frequency of the emitted photon depends on

their entanglement is exploited. Entanglement leads to

the number of electron-hole pairs present in the dot.

quantum correlations that can be used for key genera-

After one creates several such pairs by optical pumping,

tion (see Secs. II.D.3 and V). In this case, if two photon

they will sequentially recombine and hence emit pho-

pairs are emitted within the same time window but their tons at different frequencies. Therefore, a single-photon

measurement basis is chosen independently, they pro- ´

pulse can be obtained by spectral ¬ltering (Gerard et al.,

duce completely uncorrelated results. Hence, depending 1999; Michler et al., 2000; Santori et al., 2000). These

on the realization, the problem of multiple photons can dots can be integrated in solid-state microcavities with

be avoided; see Sec. VI.J. ´

strong enhancements of spontaneous emission (Gerard

Figure 5 shows one of our sources creating entangled et al., 1998).

photon pairs at a wavelength of 1310 nm, as used in tests In summary, today™s photon guns are still too compli-

of Bell™s inequalities over 10 kilometers (Tittel et al., cated to be used in a QC prototype. Moreover, due to

1998). Although not as simple as faint laser sources, their low quantum ef¬ciencies, they do not offer an ad-

diode-pumped photon-pair sources emitting in the near vantage over faint laser pulses with extremely low mean

photon numbers .

infrared can be made compact, robust, and rather handy.

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

158 Gisin et al.: Quantum cryptography

B. Quantum channels

The single-photon source and the detectors must be

connected by a ˜˜quantum channel.™™ Such a channel is

not especially quantum, except that it is intended to

carry information encoded in individual quantum sys-

tems. Here ˜˜individual™™ does not mean ˜˜nondecom-

posible,™™ but only the opposite of ˜˜ensemble.™™ The idea

is that the information is coded in a physical system only

once, in contrast to classical communication, in which

many photons carry the same information. Note that the

present-day limit for ¬ber-based classical optical com-

munication is already down to a few tens of photons,

although in practice one usually uses many more. With FIG. 6. Transmission losses vs wavelength in optical ¬bers.

increasing bit rate and limited mean power”imposed to Electronic transitions in SiO2 lead to absorption at lower

avoid nonlinear effects in silica ¬bers”these ¬gures are wavelengths, and excitation of vibrational modes leads to

losses at higher wavelengths. Superposed is the absorption due

likely to get closer and closer to the quantum domain.

to Rayleigh backscattering and to transitions in OH groups.

Individual quantum systems are usually two-level sys-

Modern telecommunications are based on wavelengths around

tems, called qubits. During their propagation they must

1.3 m (the second telecommunications window) and 1.5 m

be protected from environmental noise. Here ˜˜environ-

(the third telecommunications window).

ment™™ refers to everything outside the degree of free-

dom used for the encoding, which is not necessarily out-

side the physical system. If, for example, the information core is large, many bound modes exist, corresponding to

is encoded in the polarization state, then the optical fre- many guided modes in the ¬ber. Such ¬bers are called

quencies of the photon are part of the environment. multimode ¬bers, They usually have cores 50 m in di-

Hence coupling between the polarization and the optical ameter. The modes couple easily, acting on the qubit like

frequency has to be mastered18 (e.g., by avoiding wave- a nonisolated environment. Hence multimode ¬bers are

length-sensitive polarizers and birefringence). Moreover, not appropriate as quantum channels (see, however,

the sender of the qubits should avoid any correlation Townsend, 1998a, 1998b). If, however, the core is small

between the polarization and the spectrum of the pho- enough (diameter of the order of a few wavelengths),

tons. then a single spatial mode is guided. Such ¬bers are

Another dif¬culty is that the bases used by Alice to called single-mode ¬bers. For telecommunications wave-

code the qubits and the bases used by Bob for his mea- lengths (i.e., 1.3 and 1.5 m), their core is typically 8 m

surements must be related by a known and stable uni- in diameter. Single-mode ¬bers are very well suited to

tary transformation. Once this unitary transformation is carry single quanta. For example, the optical phase at

known, Alice and Bob can compensate for it and get the the output of a ¬ber is in a stable relation with the phase

expected correlation between their preparations and at the input, provided the ¬ber does not become elon-

measurements. If it changes with time, they need active gated. Hence ¬ber interferometers are very stable, a fact

feedback to track it, and if the changes are too fast, the exploited in many instruments and sensors (see, for ex-

communication must be interrupted. ample, Cancellieri, 1993).

Accordingly, a single-mode ¬ber with perfect cylindric

1. Single-mode ¬bers

symmetry would provide an ideal quantum channel. But

all real ¬bers have some asymmetries, so that the two

Light is guided in optical ¬bers thanks to the refrac-

polarization modes are no longer degenerate, but rather

tive index pro¬le n(x,y) across the section of the ¬bers

each has its own propagation constant. A similar effect

(traditionally, the z axis is along the propagation direc-

is caused by chromatic dispersion, in which the group

tion). Over the last 25 years, a lot of effort has gone into

delay depends on the wavelength. Both dispersion ef-

reducing transmission losses”initially several dB per

fects are the subject of the next subsections.

km”and today the attenuation is as low as 2 dB/km at

800-nm wavelength, 0.35 dB/km at 1310 nm, and 0.2

dB/km at 1550 nm (see Fig. 6). It is amusing to note that

2. Polarization effects in single-mode ¬bers

the dynamical equation describing optical pulse propa-

gation (in the usual slowly varying envelope aproxima- Polarization effects in single-mode ¬bers are a com-

¨

tion) is identical to the Schrodinger equation, with mon source of problems in all optical communication

V(x,y) n(x,y) (Snyder, 1983). Hence a positive schemes, classical as well as quantum ones. In recent

bump in the refractive index corresponds to a potential years these effects have been the subject of a major re-

well. The region of the well is called the ¬ber core. If the search effort in classical optical communication (Gisin

et al., 1995). As a result, today™s ¬bers are much better

than the ¬bers of a decade ago. Today, the remaining

18 birefringence is small enough for the telecommunica-

Note that, as we shall see in Sec. V, using entangled photons

tions industry, but for quantum communication any

prevents such information leakage.

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

159

Gisin et al.: Quantum cryptography

based QC systems.20 The global effect of the birefrin-

birefringence, even extremely small, will always remain

a concern. All ¬ber-based implementations of QC have gence is equivalent to an arbitrary combination of two

to face this problem. This is clearly true for polarization- waveplates; that is, it corresponds to a unitary transfor-

based systems, but it is equally a concern for phase- mation. If this transformation is stable, Alice and Bob

based systems, since interference visibility depends on can compensate for it. The effect of birefringence is thus

the polarization states. Hence, although polarization ef- similar to the effect of the geometric phase, though, in

fects are not the only source of dif¬culties, we shall de- addition to causing a rotation, it may also affect the el-

scribe them in some detail, distinguishing among four lipticity. Stability of birefringence requires slow thermal

effects: the geometric phase, birefringence, polarization and mechanical variations.

mode dispersion, and polarization-dependent losses. Polarization mode dispersion (PMD) is the presence

The geometric phase as encountered when guiding of two different group velocities for two orthogonal po-

light in an optical ¬ber is a special case of the Berry larization modes. It is due to a delicate combination of

phase,19 which results when any parameter describing a two causes. First, birefringence produces locally two

group velocities. For optical ¬bers, this local dispersion

property of the system under concern, here the k vector

is in good approximation equal to the phase dispersion,

characterizing the propagation of the light ¬eld, under-

of the order of a few picoseconds per kilometer. Hence,

goes an adiabatic change. Think ¬rst of a linear polar-

an optical pulse tends to split locally into a fast mode

ization state, let us say vertical at the input. Will it still

and a slow mode. But because the birefringence is small,

be vertical at the output? Vertical with respect to what?

the two modes couple easily. Hence any small imperfec-

Certainly not the gravitational ¬eld! One can follow that

tion along the ¬ber produces polarization mode cou-

linear polarization by hand along the ¬ber and see how

pling: some energy of the fast mode couples into the

it may change even along a closed loop. If the loop stays

slow mode and vice versa. PMD is thus similar to a ran-

in a plane, the state after a loop coincides with the input

dom walk21 and grows only with the square root of the

state, but if the loop explores the three dimensions of

¬ber length. It is expressed in ps km 1/2, with values as

our space, then the ¬nal state will differ from the initial

low as 0.1 ps km 1/2 for modern ¬bers and possibly as

one by an angle. Similar reasoning holds for the axes of

high as 0.5 or even 1ps km 1/2 for older ones.

elliptical polarization states. The two circular polariza-

Typical lengths for polarization mode coupling vary

tion states are the eigenstates. During parallel transport

from a few meters up to hundreds of meters. The stron-

they acquire opposite phases, called the Berry phases.

ger the coupling, the weaker the PMD (the two modes

The presence of a geometrical phase is not fatal for

do not have time to move apart between the couplings).

quantum communication. It simply means that initially

In modern ¬bers, the couplings are even arti¬cially in-

Alice and Bob have to align their systems by de¬ning, creased during the drawing process of the ¬bers (Hart

for instance, the vertical and diagonal directions (i.e., et al., 1994; Li and Nolan, 1998). Since the couplings are

performing the unitary transformation mentioned be- exceedingly sensitive, the only reasonable description is

fore). If these vary slowly, they can be tracked, though a statistical one, hence PMD is described as a statistical

this requires active feedback. However, if the variations distribution of delays . For suf¬ciently long ¬bers, the

are too fast, the communication might be interrupted. statistics are Maxwellian, and PMD is related to the ¬-

Hence aerial cables that swing in the wind are not ap- ber length l , the mean coupling length h, the mean

propriate (except with self-compensating con¬gurations; modal birefringence B, and the rms delay as follows

2

see Sec. IV.C.2). (Gisin et al., 1995): PMD Bh l /h. Polar-

Birefringence is the presence of two different phase ization mode dispersion could cause depolarization,

velocities for two orthogonal polarization states. It is which would be devastating for quantum communica-

caused by asymmetries in the ¬ber geometry and in the tion, similar to any decoherence in quantum information

processing. Fortunately, for quantum communication the

residual stress distribution inside and around the core.

remedy is easy; it suf¬ces to use a source with a coher-

Some ¬bers are made birefringent on purpose. Such ¬-

ence time longer than the largest delay . Hence, when

bers are called polarization-maintaining ¬bers because

laser pulses are used (with typical spectral widths

the birefringence is large enough to effectively uncouple

1 nm, corresponding to a coherence time 3 ps; see

the two polarization eigenmodes. Note that only these

Sec. III.A.1), PMD is no real problem. For photons cre-

two orthogonal polarization modes are maintained; all

other modes, in contrast, evolve very quickly, making

this kind of ¬ber completely unsuitable for polarization-

20

Polarization-maintaining ¬bers may be of use for phase-

based QC systems. However, this requires that the whole

setup”transmission lines as well as interferometers at each

end”be made of polarization-maintaining ¬bers. While this is

19

The Berry phase was introduced by Michael Berry in 1984, possible in principle, the need to install a completely new ¬ber

and was then observed in optical ¬ber by Tomita and Chiao network makes this solution not very practical.

21

(1986) and on the single-photon level by Hariharan et al. In contrast to Brownian motion, which describes particle

(1993). It was studied in connection with photon pairs by Bren- diffusion in space as time passes, here photons diffuse over

del et al. (1995). time as they propagate along the ¬ber.

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

160 Gisin et al.: Quantum cryptography

ated by parametric downconversion, however, PMD can dispersion goes to zero around 1550 nm, where the at-

tenuation is minimal (Neumann, 1988).23

impose severe limitations, since 10 nm (coherence

Chromatic dispersion does not constitute a problem in

time 300 fs) is not unusual.

the case of faint laser pulses, for which the bandwidth is

Polarization-dependent loss is a differential attenua-

small. However, it becomes a serious issue when utilizing

tion between two orthogonal polarization modes. This

photon pairs created by parametric downconversion.

effect is negligible in ¬bers, but can be signi¬cant in

For instance, sending photons of 70-nm bandwidth (as

components like phase modulators. In particular, some

used in our long-distance tests of Bell™s inequality; Tittel

integrated optics waveguides actually guide only one

et al., 1998) down 10 km of optical ¬bers leads to a tem-

mode and thus behave almost like polarizers (e.g., pro-

poral spread of around 500 ps (assuming photons cen-

ton exchange waveguides in LiNbO3 ). Polarization-

tered at 0 and a typical dispersion slope of

dependent losses are usually stable, but if connected to a

0.086 ps nm 2 km 1 ). However, this can be compen-

¬ber with some birefringence, the relation between the

sated for when using energy-time-entangled photons

polarization state and the loss may ¬‚uctuate, producing

(Franson, 1992; Steinberg et al., 1992a, 1992b, Larchuk

random outcomes (Elamari et al., 1998). Polarization-

et al., 1995). In contrast to polarization coding, in which

dependent loss cannot be described by a unitary opera-

frequency and the physical property used to implement

tor acting in the polarization state space (but it is of

the qubit are not conjugate variables, frequency and

course unitary in a larger space (Huttner, Gautier, et al.,

time (thus position) constitute a Fourier pair. The strict

1996). Thus it does not preserve the scalar product. In

energy anticorrelation of signal and idler photons en-

particular, it can turn nonorthogonal states into orthogo-

ables one to achieve a dispersion for one photon that is

nal ones, which can then be distinguished unambigu-

equal in magnitude but opposite in sign to that of the

ously (at the cost of some loss; Huttner, Gautier, et al.,

sister photon, thus corresponding to the same delay24

1996; Clarke et al., 2000). Note that this attenuation

(see Fig. 7). The effect of broadening of the two wave

could be used by Eve, especially to eavesdrop on the

packets then cancels out, and two simultaneously emit-

two-state protocol (Sec. II.D.1).

ted photons stay coincident. However, note that the ar-

Let us conclude this section on polarization effects in

rival time of the pair varies with respect to its emission

¬bers by mentioning that they can be passively compen-

time. The frequency anticorrelation also provides the

sated for, provided one uses a go-and-return con¬gura-

basis for avoiding a decrease in visibility due to different

tion, with Faraday mirrors, as described in Sec. IV.C.2.

wave packet broadening in the two arms of an interfer-

ometer. Since the choromatic dispersion properties of

optical ¬bers do not change with time”in contrast to

3. Chromatic dispersion effects in single-mode ¬bers

birefringence”no active tracking and compensation are

In addition to polarization effects, chromatic disper-

required. It thus turns out that phase and phase-time

sion can also cause problems for quantum cryptography.

coding are particularly suited to transmission over long

For instance, as explained in Secs. IV.C and V.B,

distances in optical ¬bers: nonlinear effects decohering

schemes implementing phase or phase-and-time coding

the qubit ˜˜energy™™ are completely negligible, and chro-

rely on photons arriving at well-de¬ned times, that is, on

matic dispersion effects acting on the localization can be

photons well localized in space. However, in dispersive

avoided or compensated for in many cases.

media like optical ¬bers, different group velocities act as

a noisy environment on the localization of the photon as

well as on the phase acquired in an interferometer.

Hence the broadening of photons featuring nonzero

bandwidth, or, in other words, the coupling between fre- 4. Free-space links

quency and position, must be circumvented or con-

Although today™s telecommunications based on opti-

trolled. This implies working with photons of small

cal ¬bers are very advanced, such channels may not al-

bandwidth, or, as long as the bandwidth is not too large,

ways be available. Hence there is also some effort in

operating close to the wavelength 0 at which chromatic

developing free-space line-of-sight communication sys-

dispersion is zero, i.e., for standard ¬bers around 1310

nm. Fortunately, ¬ber losses are relatively small at this

wavelength and amount to 0.35 dB/km. This region is

23

called the second telecommunications window.22 There Chromatic dispersion in ¬bers is mainly due to the material,

essentially silicon, but also to the refractive index pro¬le. In-

are also special ¬bers, called dispersion-shifted ¬bers,

deed, longer wavelengths feel regions farther away from the

with a refractive index pro¬le such that the chromatic

core where the refractive index is lower. Dispersion-shifted ¬-

bers have, however, been abandoned by today™s industry, be-

cause it has turned out to be simpler to compensate for the

22

The ¬rst one, around 800 nm, is almost no longer used. It global chromatic dispersion by adding an extra ¬ber with high

was motivated by the early existence of sources and detectors negative dispersion. The additional loss is then compensated

at this wavelength. The third window is around 1550 nm, for by an erbium-doped ¬ber ampli¬er.

24

where the attenuation reaches an absolute minimum (Thomas Here we assume a predominantly linear dependence of

et al., 2000) and where erbium-doped ¬bers provide conve- chromatic dispersion as a function of the optical frequency, a

nient ampli¬ers (Desurvire, 1994). realistic assumption.

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

161

Gisin et al.: Quantum cryptography

FIG. 7. Illustration of cancellation of chromatic dispersion ef-

FIG. 8. Transmission losses in free space as calculated using

fects in the ¬bers connecting an entangled-particle source and

the LOWTRAN code for earth-to-space transmission at the el-

two detectors. The ¬gure shows differential group delay curves

evation and location of Los Alamos, USA. Note that there is a

for two slightly different ¬bers approximately 10 km long. Us-

low-loss window at around 770 nm”a wavelength at which

ing frequency-correlated photons with central frequency

high-ef¬ciency silicon APD™s can be used for single-photon de-

0 ”determined by the properties of the ¬bers”the difference

tection (see also Fig. 9 and compare to Fig. 6). Figure courtesy

in propagation times t 2 t 1 between the signal (at s 1, s 2)

of Richard Hughes.

and idler (at i 1, i 2) photon is the same for all s , i . Note

that this cancellation scheme is not restricted to signal and

window of typically a few nanoseconds. Finally, it is clear

idler photons at nearly equal wavelengths. It also applies to

that the performance of free-space systems depends dra-

asymmetrical setups in which the signal photon (generating the

matically on atmospheric conditions and is possible only

trigger to indicate the presence of the idler photon) is at a

in clear weather.

short wavelength of around 800 nm and travels only a short

Finally, let us brie¬‚y comment on the different sources

distance. Using a ¬ber with appropriate zero dispersion wave-

leading to coupling losses. A ¬rst concern is the trans-

length 0 , it is still possible to achieve equal differential group

mission of the signals through a turbulent medium, lead-

delay with respect to the energy-correlated idler photon sent

ing to arrival-time jitter and beam wander (hence prob-

through a long ¬ber at a telecommunications wavelength.