<< . .

. 5
( : 12)



. . >>

lems with beam pointing). However, as the time scales
for atmospheric turbulences involved are rather small”
tems, not only for classical data transmission but also for around 0.1“0.01 s”the time jitter due to a variation of
quantum cryptography (see Hughes, Buttler, et al., 2000 the effective refractive index can be compensated for by
and Gorman et al., 2000). sending a reference pulse at a different wavelength a
Transmission over free space features some advan- short time (around 100 ns) before each signal pulse.
tages compared to the use of optical ¬bers. The atmo- Since this reference pulse experiences the same atmo-
sphere has a high transmission window at a wavelength spheric conditions as the subsequent one, the signal will
of around 770 nm (see Fig. 8), where photons can easily arrive essentially without jitter in the time window de-
¬ned by the arrival of the reference pulse. In addition,
be detected using commercial, high-ef¬ciency photon-
the reference pulse can be re¬‚ected back to the trans-
counting modules (see Sec. III.C.1). Furthermore, the
mitter and used to correct the direction of the laser
atmosphere is only weakly dispersive and essentially
nonbirefringent25 at these wavelengths. It will thus not beam by means of adaptive optics, hence compensating
for beam wander and ensuring good beam pointing.
alter the polarization state of a photon.
Another issue is beam divergence, hence increase of
However, there are some drawbacks concerning free-
spot size at the receiver end caused by diffraction at the
space links as well. In contrast to the signal transmitted
transmitter aperture. Using, for example, 20-cm-
in a guiding medium where the energy is ˜˜protected™™
diameter optics, one obtains a diffraction-limited spot
and remains localized in a small region of space, the
size after 300 km of 1 m. This effect can in principle be
energy transmitted via a free-space link spreads out,
kept small by taking advantage of larger optics. How-
leading to higher and varying transmission losses. In ad-
ever, it can also be advantageous to have a spot size that
dition to loss of energy, ambient daylight, or even moon-
is large compared to the receiver™s aperture in order to
light at night, can couple into the receiver, leading to a
ensure constant coupling in case of remaining beam
higher error rate. However, such errors can be kept to a wander. In their 2000 paper, Gilbert and Hamrick pro-
reasonable level by using a combination of spectral ¬l- vide a comprehensive discussion of free-space channels
tering (interference ¬lters 1 nm), spatial ¬ltering at the in the context of QC.
receiver, and timing discrimination using a coincidence
C. Single-photon detection

25 With the availability of pseudo-single-photon and
In contrast to an optical ¬ber, air is not subject to stress and
photon-pair sources, the success of quantum cryptogra-
is hence isotropic.


Rev. Mod. Phys., Vol. 74, No. 1, January 2002
162 Gisin et al.: Quantum cryptography


on faint laser pulses, for which the arrival times of the
phy essentially depends on the ability to detect single
photons are well known. However, it only applies if
photons. In principle, this can be achieved using a vari-
prior timing information is available. For two-photon
ety of techniques, for instance, photomultipliers, ava-
schemes, it is most often combined with a passive-
lanche photodiodes, multichannel plates, and supercon-
quenched detector, generating the trigger signal for the
ducting Josephson junctions. The ideal detector should
gated detector.
ful¬ll the following requirements:
In addition to Geiger mode, Brown and Daniels
• the quantum detection ef¬ciency should be high
(1989) have investigated the performance of silicon
over a large spectral range,
APD™s operated in sub-Geiger mode. In this mode, the
• the probability of generating noise, that is, a signal
without an arriving photon, should be small, bias voltage is kept slightly smaller than the breakdown
• the time between detection of a photon and genera- voltage such that the multiplication factor”around
tion of an electrical signal should be as constant as pos- 100”is suf¬cient to detect an avalanche, yet, is still
sible, i.e., the time jitter should be small, to ensure good small enough to prevent real breakdowns. Unfortu-
timing resolution, nately, the single-photon counting performance in this
• the recovery time (i.e., the dead time) should be mode is rather poor, and thus efforts have not been con-
short to allow high data rates. tinued, the major problem being the need for extremely
low-noise ampli¬ers.
In addition, it is important to keep the detectors prac-
tical. For instance, a detector that needs liquid helium or An avalanche engendered by carriers created in the
even nitrogen cooling would certainly render commer- conduction band of the diode can be set off not only by
cial development dif¬cult. an impinging photon, but also by unwanted causes.
Unfortunately, it turns out that it is impossible to ful- These might be thermal or band-to-band tunneling pro-
¬ll all the above criteria at the same time. Today, the cesses, or emissions from trapping levels populated
best choice is avalanche photodiodes (APD™s). Three while a current transits through the diode. The ¬rst two
different semiconductor materials are used: either sili- produce avalanches not due to photons and are referred
con, germanium, or indium gallium arsenide, depending to as dark counts. The third process depends on previous
on the wavelengths. avalanches and its effects are called afterpulses. Since
APDs are usually operated in the so-called Geiger the number of trapped charges decreases exponentially
mode. In this mode, the applied voltage exceeds the
with time, these afterpulses can be limited by applying
breakdown voltage, leading an absorbed photon to trig-
large dead times. Thus there is a tradeoff between high
ger an electron avalanche consisting of thousands of car-
count rates and low afterpulses. The time constant of the
riers. To reset the diode, this macroscopic current must
exponential decrease of afterpulses shortens for higher
be quenched”the emission of charges must be stopped
temperatures of the diode. Unfortunately, operating
and the diode recharged (Cova et al., 1996). Three main
APD™s at higher temperatures leads to a higher fraction
possibilities exist:
of thermal noise, that is, higher dark counts. Thus there
• In passive-quenching circuits, a large (50“500 k ) is again a tradeoff to be optimized. Finally, increasing
resistor is connected in series with the APD (see, for the bias voltage leads to a higher quantum ef¬ciency and
example, Brown et al., 1986). This causes a decrease in a smaller time jitter, at the cost of an increase in noise.
the voltage across the APD as soon as an avalanche We thus see that the optimal operating parameters”
starts. When it drops below breakdown voltage, the ava- voltage, temperature, and dead time (i.e., maximum
lanche stops and the diode recharges. The recovery time count rate)”depend on the speci¬c application. More-
of the diode is given by its capacitance and by the value over, since the relative magnitudes of ef¬ciency, thermal
of the quench resistor. The maximum count rate varies noise, and afterpulses vary with the type of semiconduc-
from a few hundred kilohertz to a few megahertz. tor material used, no general solution exists. In the next
• In active-quenching circuits, the bias voltage is ac- two sections we brie¬‚y discuss the different types of
tively lowered below the breakdown voltage as soon as APD™s. The ¬rst section focuses on silicon APD™s for the
the leading edge of the avalanche current is detected detection of photons at wavelengths below 1 m; the
(see, for example, Brown et al., 1987). This mode makes second comments on germanium and on indium gallium
possible higher count rates than those in passive quench- arsenide APD™s for photon counting at telecommunica-
ing (up to tens of megahertz), since the dead time can be tions wavelengths. The different behavior of the three
as short as tens of nanoseconds. However, the fast elec- types is shown in Fig. 9. Although the best ¬gure of
tronic feedback system makes active-quenching circuits merit for quantum cryptography is the ratio of dark-
much more complicated than passive ones. count rate R to detection ef¬ciency , we show here the
• Finally, in gated-mode operation, the bias voltage is better-known noise equivalent power (NEP), which
kept below the breakdown voltage and is raised above it shows similar behavior. The noise equivalent power is
only for a short time, typically a few nanosecods when a de¬ned as the optical power required to measure a unity
photon is expected to arrive. Maximum count rates simi- signal-to-noise ratio and is given by
lar to those in active-quenching circuits can be obtained
h
using less complicated electronics. Gated-mode opera-
NEP 2R. (25)
tion is commonly used in quantum cryptography based

Rev. Mod. Phys., Vol. 74, No. 1, January 2002
163
Gisin et al.: Quantum cryptography


ster (1993a) implemented a single-photon interference
scheme for quantum cryptography over a distance of 10
km, and in 1994, Tapster, Rarity, and Owens demon-
strated a violation of Bell™s inequalities over 4 km. These
experiments were the ¬rst to take advantage of Ge
APD™s operated in passively quenched Geiger mode. At
a temperature of 77 K, which can be achieved using ei-
ther liquid nitrogen or Stirling engine cooling, typical
quantum ef¬ciencies of about 15% at dark-count rates
of 25 kHz can be achieved (Owens et al., 1994), and time
jitter down to 100 ps has been observed (Lacaita et al.,
1994) a normal value being 200“300 ps.
Traditionally, germanium APD™s have been imple-
FIG. 9. Noise equivalent power as a function of wavelength for
mented in the domain of long-distance quantum com-
silicon, germanium, and InGaAs/InP APD™s.
munication. However, this type of diode is currently be-
ing replaced by InGaAs APD™s, and it has become more
Here, h is Planck™s constant and is the frequency of the and more dif¬cult to ¬nd germanium APD™s on the mar-
impinging photons. ket. Motivated by pioneering research reported in 1985
(Levine et al., 1985), the latest research focuses on
1. Photon counting at wavelengths below 1.1 m InGaAs APD™s, which allow single-photon detection in
both telecommunications windows. Starting with work
Since the beginning of the 1980s much work has been
by Zappa et al. (1994), InGaAs APD™s as single-photon
done to characterize silicon APD™s for single-photon
counters have meanwhile been thoroughly characterized
counting (Ingerson 1983; Brown et al., 1986, 1987;
(Lacaita et al., 1996; Ribordy et al., 1998; Karlsson et al.,
Brown and Daniels, 1989; Spinelli, 1996), and the perfor-
1999; Hiskett et al., 2000; Rarity et al., 2000; Stucki et al.,
mance of Si APD™s has continuously been improved.
2001), and the ¬rst implementations for quantum cryp-
Since the ¬rst test of Bell™s inequality using Si APD™s by
tography have been reported (Ribordy, 1998; Bouren-
Shih and Alley in 1988, they have completely replaced
nane et al., 1999; Bethune and Risk, 2000; Hughes, Mor-
the photomultipliers used until then in the domain of
gan, and Peterson, 2000; Ribordy et al., 2000). However,
fundamental quantum optics, now known as quantum
if operating Ge APD™s is already more inconvenient
communication. Today, quantum ef¬ciencies of up to
than using silicon APD™s, the practicality of InGaAs
76% (Kwiat et al., 1993) and time jitter as low as 28 ps
APD™s is even worse, the problem being an extremely
(Cova et al., 1989) have been reported. Commercial
high afterpulse fraction. Therefore operation in passive-
single-photon counting modules are available (for ex-
quenching mode is impossible for applications in which
ample, EG&G SPCM-AQ-151), featuring quantum ef¬-
low noise is crucial. In gated mode, InGaAs APD™s are
ciencies of 70% at a wavelength of 700 nm, a time jitter
better for single-photon counting at 1.3 m than Ge
of around 300 ps, and maximum count rates higher than
APD™s. For instance, at a temperature of 77 K and a
5 MHz. Temperatures of 20 °C”suf¬cient to keep
dark-count probability of 10 5 per 2.6-ns gate, quantum
thermally generated dark counts as low as 50 Hz”can
ef¬ciencies of around 30% and 17% have been reported
easily be achieved using Peltier cooling. Single-photon
for InGaAs and Ge APD™s, respectively (Ribordy et al.,
counters based on silicon APD™s thus offer an almost
1998), while the time jitter of both devices is compa-
perfect solution for all applications in which photons of
rable. If working at a wavelength of 1.55 m, the tem-
wavelengths below 1 m can be used. Apart from fun-
perature has to be increased for single-photon detection.
damental quantum optics, these applications include
At 173 K and a dark-count rate of 10 4 , a quantum
quantum cryptography in free space and in optical ¬-
ef¬ciency of 6% can still be observed using InGaAs/InP
bers; however, due to high losses, the latter works only
devices, while the same ¬gure for germanium APD™s is
over short distances.
close to zero.
To date, no industrial effort has been made to opti-
2. Photon counting at telecommunications wavelengths
mize APD™s operating at telecommunications wave-
lengths for photon counting, and their performance still
When working in the second telecommunications win-
lags far behind that one of silicon APD™s.26 However,
dow (1.3 m), one can take advantage of APD™s made
there is no fundamental reason why photon counting at
from germanium or InGaAs/InP semiconductor materi-
wavelengths above 1 m should be more dif¬cult than at
als. In the third window (1.55 m), the only option is
wavelengths below 1 m except that the high-
InGaAs/InP.
Photon counting with germanium APD™s, although
known for 30 years (Haecker et al., 1971), began to be
used in quantum communication as the need arose to 26
The ¬rst commercial photon counter at telecommunications
transmit single photons over long distances using optical wavelengths came out only this year (the Hamamatsu photo-
¬bers, which necessitated working at telecommunica- multiplier R5509-72). However, its ef¬ciency is not yet suf¬-
tions wavelengths. In 1993, Townsend, Rarity, and Tap- cient for use in quantum cryptography.


Rev. Mod. Phys., Vol. 74, No. 1, January 2002
164 Gisin et al.: Quantum cryptography


An elegant con¬guration integrating the random-
wavelength photons are less energetic. The real reasons
number generator into the QC system consists in using a
for the lack of commercial products are, ¬rst, that sili-
passive choice of bases, as discussed in Sec. V (Muller
con, the most common semiconductor material, is not
et al., 1993). However, the problem of detector-induced
sensitive enough (the band gap is too large), and second
correlation remains.
that the market for photon counting is not yet mature.
But, without great risk, one can predict that good com-
mercial photon counters will become available in the
near future and that they will have a major impact on E. Quantum repeaters
quantum cryptography.
Today™s ¬ber-based QC systems are limited to opera-
tion over tens of kilometers due to the combination of
¬ber losses and detector noise. The losses by themselves
D. Quantum random-number generators
only reduce the bit rate (exponentially with distance).
With perfect detectors the distance would not be limited.
The key used in the one-time pad must be secret and
However, because of the dark counts, each time a pho-
used only once. Consequently it must be as long as the
ton is lost there is a chance that a dark count produces
message, and it must be perfectly random. The latter
an error. Hence, when the probability of a dark count
point proves to be a delicate and interesting one. Com-
becomes comparable to the probability that a photon is
puters are deterministic systems that cannot create truly
correctly detected, the signal-to-noise ratio tends to 0
random numbers. However, all secure cryptosystems,
[more precisely, the mutual information I( , ) tends to
both classical and quantum ones, require truly random
a lower bound29]. In this section we brie¬‚y explain how
numbers.27 Hence the random numbers must be created
the use of entangled photons and of entanglement swap-
by a random physical process. Moreover, to make sure ™
ping (Zukowski et al., 1993) could offer ways to extend
that the process does not merely appear random while
the achievable distances in the foreseeable future (some
having some hidden deterministic pattern, the process
prior knowledge of entanglement swapping is assumed).
needs to be completely understood. It is thus of interest
Let t link denote the transmission coef¬cient (i.e., the
to implement a simple process in order to gain con¬-
probability that a photon sent by Alice gets to one of
dence in the randomness of its proper operation.
Bob™s detectors), the detector ef¬ciency, and p dark the
A natural solution is to rely on the random choice of a
dark-count probability per time bin. With a perfect
single photon at a beamsplitter28 (Rarity et al., 1994). In
single-photon source, the probability P raw of a correct
this case the randomness is in principle guaranteed by
qubit detection is P raw t link , while the probability
the laws of quantum mechanics, though one still has to
P det of an error is P det (1 t link )p dark . Accordingly,
be very careful not to introduce any experimental arti-
the QBER P det /(P raw P det ), and the normalized net
fact that could correlate adjacent bits. Different experi-
rate is net (P raw P det )•fct(QBER), where the func-
mental realizations have been demonstrated (Jenne-
tion fct denotes the fraction of bits remaining after error
wein, Achleitner, et al., 2000; Stefanov et al., 2000;
correction and privacy ampli¬cation. For the sake of il-
Hildebrand, 2001), and prototypes are commercially
lustration, we simply assume a linear dependence drop-
available (www.gap-optique.unige.ch). One particular
ping to zero for QBER 15% (this simpli¬cation does
problem is the dead time of the detectors, which may
not affect the qualitative results of this section; for a
introduce a strong anticorrelation between neighboring
¨
more precise calculation, see Lutkenhaus 2000):
bits. Similarly, afterpulses may provoke a correlation.
fct(QBER) 1 QBER/15%. The corresponding net
These detector-related effects increase with higher pulse
rate net is displayed in Fig. 10. Note that it drops to zero
rates, limiting the bit rate of a quantum number genera-
near 90 km.
tor to a few megahertz.
Let us now assume that instead of a perfect single-
In the BB84 protocol Alice has to choose randomly
photon source, Alice and Bob use a perfect two-photon
among four different states and Bob between two bases.
source set in the middle of their quantum channel. Each
The limited random-number generation rate may force
photon then has a probability t link of reaching a detec-
Alice to produce her numbers in advance and store
tor. The probability of a correct joined detection is thus
them, creating a security risk. On Bob™s side the random-
P raw t link 2 , while an error occurs with probability
bit creation rate can be lower, since, in principle, the
2
t link ) 2 p dark 2 t link (1
P det (1 t link )p dark
basis need be changed only after a photon has been de-
(both photons lost and two dark counts, or one photon
tected, which normally happens at rates below 1 MHz.
lost and one dark count). This can be conveniently re-
However, one must make sure that this does not give a
1/n
written as P raw t link n and P det t link (1
spy an opportunity for a Trojan horse attack (see Sec.
1/n n n
t link )p dark t link , valid for any division of the
VI.K).


29
27
The absolute lower bound is 0, but depending on the as-
The PIN number that the bank assigns to your ATM card
sumed eavesdropping strategy, Eve could take advantage of
must be random. If not, someone else knows it.
28
the losses. In the latter case, the lower bound is given by her
Strictly speaking, the choice is made only once the photons
are detected at one of the outports. mutual information I( , ).


Rev. Mod. Phys., Vol. 74, No. 1, January 2002
165
Gisin et al.: Quantum cryptography


ronment, also called decoherence, can be controlled and
moderated. In addition, researchers can bene¬t from all
the tools developed in the past two decades for optical
telecommunications. It is unlikely that other carriers will
be employed in the foreseeable future.
Comparing different QC setups is a dif¬cult task,
since several criteria must be taken into account. What
matters in the end, of course, is the rate of corrected
secret bits (the distilled bit rate R dist ) that can be trans-
mitted and the transmission distance. One can already
note that with present and near-future technology it will
probably not be possible to achieve rates of the order of
gigahertz, which are now common with conventional op-
FIG. 10. Normalized net key creation rate net as a function of
tical communication systems (in their comprehensive
distance in optical ¬bers. For n 1, Alice uses a perfect single-
paper published in 2000, Gilbert and Hamrick discuss
photon source. For n 1, the link is divided into n equal-length
practical methods for achieving high-bit-rate QC). This
sections, and n/2 two-photon sources are distributed between
implies that encryption with a key exchanged through
Alice and Bob. Parameters: detection ef¬ciency 10%,
QC will be limited to highly con¬dential information.
dark-count probability p dark 10 4 , and ¬ber attenuation
While the determination of the transmission distance
0.25 dB/km.
and rate of detection (the raw bit rate R raw ) is straight-
forward, estimating the net rate is rather dif¬cult. Al-
link into n equal-length sections and n detectors. Note though, in principle, errors in the bit sequence follow
that the measurements performed at the nodes between only from tampering by a malevolent eavesdropper, the
Alice and Bob transmit (swap) the entanglement to the situation is rather different in reality. Discrepancies be-
twin photons without revealing any information about tween the keys of Alice and Bob also happen because of
the qubit (these measurements are called Bell measure- experimental imperfections. The error rate QBER can
ments and are at the core of entanglement swapping and be easily determined. Similarly, the error correction pro-
of quantum teleportation). The corresponding net rates cedure is rather simple. Error correction leads to a re-
are displayed in Fig. 10. Clearly, the rates for short dis- duction of the key rate that depends strongly on the
tances are smaller when several detectors are used, be- QBER. The real problem is to estimate the information
cause of their limited ef¬ciencies (here we assume obtained by Eve, a quantity necessary for privacy ampli-
10%), but the distance before the net rate drops to ¬cation. This depends not only on the QBER, but also
zero is extended to longer distances! Intuitively, this can on other factors, such as the photon number statistics of
be understood as follows. Let us assume that a logical the source or the way the choice of the measurement
qubit propagates from Alice to Bob (although some basis is made. Moreover in a pragmatic approach, one
photons propagate in the opposite direction). Then, might also accept restrictions on Eve™s technology, limit-
each two-photon source and each Bell measurement acts ing her strategies and therefore also the information she
on this logical qubit as a kind of quantum nondemolition can obtain per error she introduces. Since the ef¬ciency
measurement, testing whether the logical qubit is still of privacy ampli¬cation rapidly decreases when the
there. In this way, Bob activates his detectors only when QBER increases, the distilled bit rate depends dramati-
1/n
there is a large chance t link that the photon gets to his cally on Eve™s information and hence on the assumptions

<< . .

. 5
( : 12)



. . >>