<< . .

. 4
( : 12)



. . >>

photon antibunching was ¬rst demonstrated years ago
(Kimble et al., 1977), a practical and handy device is still
awaited. At present, there are essentially three different
experimental approaches that more or less come close to
this ideal.
A ¬rst idea is to work with a single two-level quantum
system that obviously cannot emit two photons at a
time. The manipulation of single trapped atoms or ions
requires a much too involved technical effort. Single or-
ganic dye molecules in solvents (Kitson et al., 1998) or
solids (Brunel et al., 1999; Fleury et al., 2000) are easier
to handle but offer only limited stability at room tem-
perature. A promising candidate, however, is the
nitrogen-vacancy center in diamond, a substitutional ni-
trogen atom with a vacancy trapped at an adjacent lat-
FIG. 5. Photo of our entangled photon-pair source as used in
tice position (Brouri et al., 2000; Kurtsiefer et al., 2000).
the ¬rst long-distance test of Bell™s inequalities (Tittel et al.,
1998). Note that the whole source ¬ts into a box only 40 45 It is possible to excite individual nitrogen atoms with a
15 cm3 in size and that neither a special power supply nor 532-nm laser beam, which will subsequently emit a ¬‚uo-
water cooling is necessary. rescence photon around 700 nm (12-ns decay time). The
¬‚uorescence exhibits strong photon antibunching, and
the samples are stable at room temperature. However,
10-mW pump. To detect, for example, 10% of the trigger
the big remaining experimental challenge is to increase
photons, the second detector has to be activated 106
the collection ef¬ciency (currently about 0.1%) in order
times per second. In comparison, the example of 1% of
to obtain mean photon numbers close to 1. To obtain
multiphoton events corresponds in the case of faint laser
this ef¬ciency, an optical cavity or a photonic band-gap
pulses to a mean photon number of 0.02. In order to
structure must suppress emission in all spatial modes but
6
get the same number (10 ) of nonempty pulses per sec-
one. In addition, the spectral bandwidth of this type of
ond, a pulse rate of 50 MHz is needed. For a given pho-
source is broad (on the order of 100 nm), enhancing the
ton statistics, photon pairs thus allow one to work with
effect of perturbations in a quantum channel.
lower pulse rates (e.g., 50 times lower) and hence re-
A second approach is to generate photons by single
duced detector-induced errors. However, due to limited
electrons in a mesoscopic p-n junction. The idea is to
coupling ef¬ciency in optical ¬bers, the probability of
pro¬t from the fact that thermal electrons show anti-
¬nding the sister photon after detection of the trigger
bunching (the Pauli exclusion principle) in contrast to
photon in the respective ¬ber is in practice less than 1.
photons (Imamoglu and Yamamoto, 1994). The ¬rst ex-
This means that the effective photon number is not 1 but
perimental results have been presented (Kim et al.,
rather 2/3 (Ribordy et al., 2001), still well above
1999), but with extremely low ef¬ciencies and only at a
0.02.
temperature of 50 mK!
Photon pairs generated by parametric downconver-
Finally, another approach is to use the photon emis-
sion offer a further major advantage if they are not
sion of electron-hole pairs in a semiconductor quantum
merely used as a pseudo-single-photon source, but if
dot. The frequency of the emitted photon depends on
their entanglement is exploited. Entanglement leads to
the number of electron-hole pairs present in the dot.
quantum correlations that can be used for key genera-
After one creates several such pairs by optical pumping,
tion (see Secs. II.D.3 and V). In this case, if two photon
they will sequentially recombine and hence emit pho-
pairs are emitted within the same time window but their tons at different frequencies. Therefore, a single-photon
measurement basis is chosen independently, they pro- ´
pulse can be obtained by spectral ¬ltering (Gerard et al.,
duce completely uncorrelated results. Hence, depending 1999; Michler et al., 2000; Santori et al., 2000). These
on the realization, the problem of multiple photons can dots can be integrated in solid-state microcavities with
be avoided; see Sec. VI.J. ´
strong enhancements of spontaneous emission (Gerard
Figure 5 shows one of our sources creating entangled et al., 1998).
photon pairs at a wavelength of 1310 nm, as used in tests In summary, today™s photon guns are still too compli-
of Bell™s inequalities over 10 kilometers (Tittel et al., cated to be used in a QC prototype. Moreover, due to
1998). Although not as simple as faint laser sources, their low quantum ef¬ciencies, they do not offer an ad-
diode-pumped photon-pair sources emitting in the near vantage over faint laser pulses with extremely low mean
photon numbers .
infrared can be made compact, robust, and rather handy.

Rev. Mod. Phys., Vol. 74, No. 1, January 2002
158 Gisin et al.: Quantum cryptography


B. Quantum channels

The single-photon source and the detectors must be
connected by a ˜˜quantum channel.™™ Such a channel is
not especially quantum, except that it is intended to
carry information encoded in individual quantum sys-
tems. Here ˜˜individual™™ does not mean ˜˜nondecom-
posible,™™ but only the opposite of ˜˜ensemble.™™ The idea
is that the information is coded in a physical system only
once, in contrast to classical communication, in which
many photons carry the same information. Note that the
present-day limit for ¬ber-based classical optical com-
munication is already down to a few tens of photons,
although in practice one usually uses many more. With FIG. 6. Transmission losses vs wavelength in optical ¬bers.
increasing bit rate and limited mean power”imposed to Electronic transitions in SiO2 lead to absorption at lower
avoid nonlinear effects in silica ¬bers”these ¬gures are wavelengths, and excitation of vibrational modes leads to
losses at higher wavelengths. Superposed is the absorption due
likely to get closer and closer to the quantum domain.
to Rayleigh backscattering and to transitions in OH groups.
Individual quantum systems are usually two-level sys-
Modern telecommunications are based on wavelengths around
tems, called qubits. During their propagation they must
1.3 m (the second telecommunications window) and 1.5 m
be protected from environmental noise. Here ˜˜environ-
(the third telecommunications window).
ment™™ refers to everything outside the degree of free-
dom used for the encoding, which is not necessarily out-
side the physical system. If, for example, the information core is large, many bound modes exist, corresponding to
is encoded in the polarization state, then the optical fre- many guided modes in the ¬ber. Such ¬bers are called
quencies of the photon are part of the environment. multimode ¬bers, They usually have cores 50 m in di-
Hence coupling between the polarization and the optical ameter. The modes couple easily, acting on the qubit like
frequency has to be mastered18 (e.g., by avoiding wave- a nonisolated environment. Hence multimode ¬bers are
length-sensitive polarizers and birefringence). Moreover, not appropriate as quantum channels (see, however,
the sender of the qubits should avoid any correlation Townsend, 1998a, 1998b). If, however, the core is small
between the polarization and the spectrum of the pho- enough (diameter of the order of a few wavelengths),
tons. then a single spatial mode is guided. Such ¬bers are
Another dif¬culty is that the bases used by Alice to called single-mode ¬bers. For telecommunications wave-
code the qubits and the bases used by Bob for his mea- lengths (i.e., 1.3 and 1.5 m), their core is typically 8 m
surements must be related by a known and stable uni- in diameter. Single-mode ¬bers are very well suited to
tary transformation. Once this unitary transformation is carry single quanta. For example, the optical phase at
known, Alice and Bob can compensate for it and get the the output of a ¬ber is in a stable relation with the phase
expected correlation between their preparations and at the input, provided the ¬ber does not become elon-
measurements. If it changes with time, they need active gated. Hence ¬ber interferometers are very stable, a fact
feedback to track it, and if the changes are too fast, the exploited in many instruments and sensors (see, for ex-
communication must be interrupted. ample, Cancellieri, 1993).
Accordingly, a single-mode ¬ber with perfect cylindric
1. Single-mode ¬bers
symmetry would provide an ideal quantum channel. But
all real ¬bers have some asymmetries, so that the two
Light is guided in optical ¬bers thanks to the refrac-
polarization modes are no longer degenerate, but rather
tive index pro¬le n(x,y) across the section of the ¬bers
each has its own propagation constant. A similar effect
(traditionally, the z axis is along the propagation direc-
is caused by chromatic dispersion, in which the group
tion). Over the last 25 years, a lot of effort has gone into
delay depends on the wavelength. Both dispersion ef-
reducing transmission losses”initially several dB per
fects are the subject of the next subsections.
km”and today the attenuation is as low as 2 dB/km at
800-nm wavelength, 0.35 dB/km at 1310 nm, and 0.2
dB/km at 1550 nm (see Fig. 6). It is amusing to note that
2. Polarization effects in single-mode ¬bers
the dynamical equation describing optical pulse propa-
gation (in the usual slowly varying envelope aproxima- Polarization effects in single-mode ¬bers are a com-
¨
tion) is identical to the Schrodinger equation, with mon source of problems in all optical communication
V(x,y) n(x,y) (Snyder, 1983). Hence a positive schemes, classical as well as quantum ones. In recent
bump in the refractive index corresponds to a potential years these effects have been the subject of a major re-
well. The region of the well is called the ¬ber core. If the search effort in classical optical communication (Gisin
et al., 1995). As a result, today™s ¬bers are much better
than the ¬bers of a decade ago. Today, the remaining
18 birefringence is small enough for the telecommunica-
Note that, as we shall see in Sec. V, using entangled photons
tions industry, but for quantum communication any
prevents such information leakage.


Rev. Mod. Phys., Vol. 74, No. 1, January 2002
159
Gisin et al.: Quantum cryptography


based QC systems.20 The global effect of the birefrin-
birefringence, even extremely small, will always remain
a concern. All ¬ber-based implementations of QC have gence is equivalent to an arbitrary combination of two
to face this problem. This is clearly true for polarization- waveplates; that is, it corresponds to a unitary transfor-
based systems, but it is equally a concern for phase- mation. If this transformation is stable, Alice and Bob
based systems, since interference visibility depends on can compensate for it. The effect of birefringence is thus
the polarization states. Hence, although polarization ef- similar to the effect of the geometric phase, though, in
fects are not the only source of dif¬culties, we shall de- addition to causing a rotation, it may also affect the el-
scribe them in some detail, distinguishing among four lipticity. Stability of birefringence requires slow thermal
effects: the geometric phase, birefringence, polarization and mechanical variations.
mode dispersion, and polarization-dependent losses. Polarization mode dispersion (PMD) is the presence
The geometric phase as encountered when guiding of two different group velocities for two orthogonal po-
light in an optical ¬ber is a special case of the Berry larization modes. It is due to a delicate combination of
phase,19 which results when any parameter describing a two causes. First, birefringence produces locally two
group velocities. For optical ¬bers, this local dispersion
property of the system under concern, here the k vector
is in good approximation equal to the phase dispersion,
characterizing the propagation of the light ¬eld, under-
of the order of a few picoseconds per kilometer. Hence,
goes an adiabatic change. Think ¬rst of a linear polar-
an optical pulse tends to split locally into a fast mode
ization state, let us say vertical at the input. Will it still
and a slow mode. But because the birefringence is small,
be vertical at the output? Vertical with respect to what?
the two modes couple easily. Hence any small imperfec-
Certainly not the gravitational ¬eld! One can follow that
tion along the ¬ber produces polarization mode cou-
linear polarization by hand along the ¬ber and see how
pling: some energy of the fast mode couples into the
it may change even along a closed loop. If the loop stays
slow mode and vice versa. PMD is thus similar to a ran-
in a plane, the state after a loop coincides with the input
dom walk21 and grows only with the square root of the
state, but if the loop explores the three dimensions of
¬ber length. It is expressed in ps km 1/2, with values as
our space, then the ¬nal state will differ from the initial
low as 0.1 ps km 1/2 for modern ¬bers and possibly as
one by an angle. Similar reasoning holds for the axes of
high as 0.5 or even 1ps km 1/2 for older ones.
elliptical polarization states. The two circular polariza-
Typical lengths for polarization mode coupling vary
tion states are the eigenstates. During parallel transport
from a few meters up to hundreds of meters. The stron-
they acquire opposite phases, called the Berry phases.
ger the coupling, the weaker the PMD (the two modes
The presence of a geometrical phase is not fatal for
do not have time to move apart between the couplings).
quantum communication. It simply means that initially
In modern ¬bers, the couplings are even arti¬cially in-
Alice and Bob have to align their systems by de¬ning, creased during the drawing process of the ¬bers (Hart
for instance, the vertical and diagonal directions (i.e., et al., 1994; Li and Nolan, 1998). Since the couplings are
performing the unitary transformation mentioned be- exceedingly sensitive, the only reasonable description is
fore). If these vary slowly, they can be tracked, though a statistical one, hence PMD is described as a statistical
this requires active feedback. However, if the variations distribution of delays . For suf¬ciently long ¬bers, the
are too fast, the communication might be interrupted. statistics are Maxwellian, and PMD is related to the ¬-
Hence aerial cables that swing in the wind are not ap- ber length l , the mean coupling length h, the mean
propriate (except with self-compensating con¬gurations; modal birefringence B, and the rms delay as follows
2
see Sec. IV.C.2). (Gisin et al., 1995): PMD Bh l /h. Polar-
Birefringence is the presence of two different phase ization mode dispersion could cause depolarization,
velocities for two orthogonal polarization states. It is which would be devastating for quantum communica-
caused by asymmetries in the ¬ber geometry and in the tion, similar to any decoherence in quantum information
processing. Fortunately, for quantum communication the
residual stress distribution inside and around the core.
remedy is easy; it suf¬ces to use a source with a coher-
Some ¬bers are made birefringent on purpose. Such ¬-
ence time longer than the largest delay . Hence, when
bers are called polarization-maintaining ¬bers because
laser pulses are used (with typical spectral widths
the birefringence is large enough to effectively uncouple
1 nm, corresponding to a coherence time 3 ps; see
the two polarization eigenmodes. Note that only these
Sec. III.A.1), PMD is no real problem. For photons cre-
two orthogonal polarization modes are maintained; all
other modes, in contrast, evolve very quickly, making
this kind of ¬ber completely unsuitable for polarization-
20
Polarization-maintaining ¬bers may be of use for phase-
based QC systems. However, this requires that the whole
setup”transmission lines as well as interferometers at each
end”be made of polarization-maintaining ¬bers. While this is
19
The Berry phase was introduced by Michael Berry in 1984, possible in principle, the need to install a completely new ¬ber
and was then observed in optical ¬ber by Tomita and Chiao network makes this solution not very practical.
21
(1986) and on the single-photon level by Hariharan et al. In contrast to Brownian motion, which describes particle
(1993). It was studied in connection with photon pairs by Bren- diffusion in space as time passes, here photons diffuse over
del et al. (1995). time as they propagate along the ¬ber.


Rev. Mod. Phys., Vol. 74, No. 1, January 2002
160 Gisin et al.: Quantum cryptography


ated by parametric downconversion, however, PMD can dispersion goes to zero around 1550 nm, where the at-
tenuation is minimal (Neumann, 1988).23
impose severe limitations, since 10 nm (coherence
Chromatic dispersion does not constitute a problem in
time 300 fs) is not unusual.
the case of faint laser pulses, for which the bandwidth is
Polarization-dependent loss is a differential attenua-
small. However, it becomes a serious issue when utilizing
tion between two orthogonal polarization modes. This
photon pairs created by parametric downconversion.
effect is negligible in ¬bers, but can be signi¬cant in
For instance, sending photons of 70-nm bandwidth (as
components like phase modulators. In particular, some
used in our long-distance tests of Bell™s inequality; Tittel
integrated optics waveguides actually guide only one
et al., 1998) down 10 km of optical ¬bers leads to a tem-
mode and thus behave almost like polarizers (e.g., pro-
poral spread of around 500 ps (assuming photons cen-
ton exchange waveguides in LiNbO3 ). Polarization-
tered at 0 and a typical dispersion slope of
dependent losses are usually stable, but if connected to a
0.086 ps nm 2 km 1 ). However, this can be compen-
¬ber with some birefringence, the relation between the
sated for when using energy-time-entangled photons
polarization state and the loss may ¬‚uctuate, producing
(Franson, 1992; Steinberg et al., 1992a, 1992b, Larchuk
random outcomes (Elamari et al., 1998). Polarization-
et al., 1995). In contrast to polarization coding, in which
dependent loss cannot be described by a unitary opera-
frequency and the physical property used to implement
tor acting in the polarization state space (but it is of
the qubit are not conjugate variables, frequency and
course unitary in a larger space (Huttner, Gautier, et al.,
time (thus position) constitute a Fourier pair. The strict
1996). Thus it does not preserve the scalar product. In
energy anticorrelation of signal and idler photons en-
particular, it can turn nonorthogonal states into orthogo-
ables one to achieve a dispersion for one photon that is
nal ones, which can then be distinguished unambigu-
equal in magnitude but opposite in sign to that of the
ously (at the cost of some loss; Huttner, Gautier, et al.,
sister photon, thus corresponding to the same delay24
1996; Clarke et al., 2000). Note that this attenuation
(see Fig. 7). The effect of broadening of the two wave
could be used by Eve, especially to eavesdrop on the
packets then cancels out, and two simultaneously emit-
two-state protocol (Sec. II.D.1).
ted photons stay coincident. However, note that the ar-
Let us conclude this section on polarization effects in
rival time of the pair varies with respect to its emission
¬bers by mentioning that they can be passively compen-
time. The frequency anticorrelation also provides the
sated for, provided one uses a go-and-return con¬gura-
basis for avoiding a decrease in visibility due to different
tion, with Faraday mirrors, as described in Sec. IV.C.2.
wave packet broadening in the two arms of an interfer-
ometer. Since the choromatic dispersion properties of
optical ¬bers do not change with time”in contrast to
3. Chromatic dispersion effects in single-mode ¬bers
birefringence”no active tracking and compensation are
In addition to polarization effects, chromatic disper-
required. It thus turns out that phase and phase-time
sion can also cause problems for quantum cryptography.
coding are particularly suited to transmission over long
For instance, as explained in Secs. IV.C and V.B,
distances in optical ¬bers: nonlinear effects decohering
schemes implementing phase or phase-and-time coding
the qubit ˜˜energy™™ are completely negligible, and chro-
rely on photons arriving at well-de¬ned times, that is, on
matic dispersion effects acting on the localization can be
photons well localized in space. However, in dispersive
avoided or compensated for in many cases.
media like optical ¬bers, different group velocities act as
a noisy environment on the localization of the photon as
well as on the phase acquired in an interferometer.
Hence the broadening of photons featuring nonzero
bandwidth, or, in other words, the coupling between fre- 4. Free-space links
quency and position, must be circumvented or con-
Although today™s telecommunications based on opti-
trolled. This implies working with photons of small
cal ¬bers are very advanced, such channels may not al-
bandwidth, or, as long as the bandwidth is not too large,
ways be available. Hence there is also some effort in
operating close to the wavelength 0 at which chromatic
developing free-space line-of-sight communication sys-
dispersion is zero, i.e., for standard ¬bers around 1310
nm. Fortunately, ¬ber losses are relatively small at this
wavelength and amount to 0.35 dB/km. This region is
23
called the second telecommunications window.22 There Chromatic dispersion in ¬bers is mainly due to the material,
essentially silicon, but also to the refractive index pro¬le. In-
are also special ¬bers, called dispersion-shifted ¬bers,
deed, longer wavelengths feel regions farther away from the
with a refractive index pro¬le such that the chromatic
core where the refractive index is lower. Dispersion-shifted ¬-
bers have, however, been abandoned by today™s industry, be-
cause it has turned out to be simpler to compensate for the
22
The ¬rst one, around 800 nm, is almost no longer used. It global chromatic dispersion by adding an extra ¬ber with high
was motivated by the early existence of sources and detectors negative dispersion. The additional loss is then compensated
at this wavelength. The third window is around 1550 nm, for by an erbium-doped ¬ber ampli¬er.
24
where the attenuation reaches an absolute minimum (Thomas Here we assume a predominantly linear dependence of
et al., 2000) and where erbium-doped ¬bers provide conve- chromatic dispersion as a function of the optical frequency, a
nient ampli¬ers (Desurvire, 1994). realistic assumption.


Rev. Mod. Phys., Vol. 74, No. 1, January 2002
161
Gisin et al.: Quantum cryptography




FIG. 7. Illustration of cancellation of chromatic dispersion ef-
FIG. 8. Transmission losses in free space as calculated using
fects in the ¬bers connecting an entangled-particle source and
the LOWTRAN code for earth-to-space transmission at the el-
two detectors. The ¬gure shows differential group delay curves
evation and location of Los Alamos, USA. Note that there is a
for two slightly different ¬bers approximately 10 km long. Us-
low-loss window at around 770 nm”a wavelength at which
ing frequency-correlated photons with central frequency
high-ef¬ciency silicon APD™s can be used for single-photon de-
0 ”determined by the properties of the ¬bers”the difference
tection (see also Fig. 9 and compare to Fig. 6). Figure courtesy
in propagation times t 2 t 1 between the signal (at s 1, s 2)
of Richard Hughes.
and idler (at i 1, i 2) photon is the same for all s , i . Note
that this cancellation scheme is not restricted to signal and
window of typically a few nanoseconds. Finally, it is clear
idler photons at nearly equal wavelengths. It also applies to
that the performance of free-space systems depends dra-
asymmetrical setups in which the signal photon (generating the
matically on atmospheric conditions and is possible only
trigger to indicate the presence of the idler photon) is at a
in clear weather.
short wavelength of around 800 nm and travels only a short
Finally, let us brie¬‚y comment on the different sources
distance. Using a ¬ber with appropriate zero dispersion wave-
leading to coupling losses. A ¬rst concern is the trans-
length 0 , it is still possible to achieve equal differential group
mission of the signals through a turbulent medium, lead-
delay with respect to the energy-correlated idler photon sent
ing to arrival-time jitter and beam wander (hence prob-
through a long ¬ber at a telecommunications wavelength.

<< . .

. 4
( : 12)



. . >>