for atmospheric turbulences involved are rather small”

tems, not only for classical data transmission but also for around 0.1“0.01 s”the time jitter due to a variation of

quantum cryptography (see Hughes, Buttler, et al., 2000 the effective refractive index can be compensated for by

and Gorman et al., 2000). sending a reference pulse at a different wavelength a

Transmission over free space features some advan- short time (around 100 ns) before each signal pulse.

tages compared to the use of optical ¬bers. The atmo- Since this reference pulse experiences the same atmo-

sphere has a high transmission window at a wavelength spheric conditions as the subsequent one, the signal will

of around 770 nm (see Fig. 8), where photons can easily arrive essentially without jitter in the time window de-

¬ned by the arrival of the reference pulse. In addition,

be detected using commercial, high-ef¬ciency photon-

the reference pulse can be re¬‚ected back to the trans-

counting modules (see Sec. III.C.1). Furthermore, the

mitter and used to correct the direction of the laser

atmosphere is only weakly dispersive and essentially

nonbirefringent25 at these wavelengths. It will thus not beam by means of adaptive optics, hence compensating

for beam wander and ensuring good beam pointing.

alter the polarization state of a photon.

Another issue is beam divergence, hence increase of

However, there are some drawbacks concerning free-

spot size at the receiver end caused by diffraction at the

space links as well. In contrast to the signal transmitted

transmitter aperture. Using, for example, 20-cm-

in a guiding medium where the energy is ˜˜protected™™

diameter optics, one obtains a diffraction-limited spot

and remains localized in a small region of space, the

size after 300 km of 1 m. This effect can in principle be

energy transmitted via a free-space link spreads out,

kept small by taking advantage of larger optics. How-

leading to higher and varying transmission losses. In ad-

ever, it can also be advantageous to have a spot size that

dition to loss of energy, ambient daylight, or even moon-

is large compared to the receiver™s aperture in order to

light at night, can couple into the receiver, leading to a

ensure constant coupling in case of remaining beam

higher error rate. However, such errors can be kept to a wander. In their 2000 paper, Gilbert and Hamrick pro-

reasonable level by using a combination of spectral ¬l- vide a comprehensive discussion of free-space channels

tering (interference ¬lters 1 nm), spatial ¬ltering at the in the context of QC.

receiver, and timing discrimination using a coincidence

C. Single-photon detection

25 With the availability of pseudo-single-photon and

In contrast to an optical ¬ber, air is not subject to stress and

photon-pair sources, the success of quantum cryptogra-

is hence isotropic.

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

162 Gisin et al.: Quantum cryptography

on faint laser pulses, for which the arrival times of the

phy essentially depends on the ability to detect single

photons are well known. However, it only applies if

photons. In principle, this can be achieved using a vari-

prior timing information is available. For two-photon

ety of techniques, for instance, photomultipliers, ava-

schemes, it is most often combined with a passive-

lanche photodiodes, multichannel plates, and supercon-

quenched detector, generating the trigger signal for the

ducting Josephson junctions. The ideal detector should

gated detector.

ful¬ll the following requirements:

In addition to Geiger mode, Brown and Daniels

• the quantum detection ef¬ciency should be high

(1989) have investigated the performance of silicon

over a large spectral range,

APD™s operated in sub-Geiger mode. In this mode, the

• the probability of generating noise, that is, a signal

without an arriving photon, should be small, bias voltage is kept slightly smaller than the breakdown

• the time between detection of a photon and genera- voltage such that the multiplication factor”around

tion of an electrical signal should be as constant as pos- 100”is suf¬cient to detect an avalanche, yet, is still

sible, i.e., the time jitter should be small, to ensure good small enough to prevent real breakdowns. Unfortu-

timing resolution, nately, the single-photon counting performance in this

• the recovery time (i.e., the dead time) should be mode is rather poor, and thus efforts have not been con-

short to allow high data rates. tinued, the major problem being the need for extremely

low-noise ampli¬ers.

In addition, it is important to keep the detectors prac-

tical. For instance, a detector that needs liquid helium or An avalanche engendered by carriers created in the

even nitrogen cooling would certainly render commer- conduction band of the diode can be set off not only by

cial development dif¬cult. an impinging photon, but also by unwanted causes.

Unfortunately, it turns out that it is impossible to ful- These might be thermal or band-to-band tunneling pro-

¬ll all the above criteria at the same time. Today, the cesses, or emissions from trapping levels populated

best choice is avalanche photodiodes (APD™s). Three while a current transits through the diode. The ¬rst two

different semiconductor materials are used: either sili- produce avalanches not due to photons and are referred

con, germanium, or indium gallium arsenide, depending to as dark counts. The third process depends on previous

on the wavelengths. avalanches and its effects are called afterpulses. Since

APDs are usually operated in the so-called Geiger the number of trapped charges decreases exponentially

mode. In this mode, the applied voltage exceeds the

with time, these afterpulses can be limited by applying

breakdown voltage, leading an absorbed photon to trig-

large dead times. Thus there is a tradeoff between high

ger an electron avalanche consisting of thousands of car-

count rates and low afterpulses. The time constant of the

riers. To reset the diode, this macroscopic current must

exponential decrease of afterpulses shortens for higher

be quenched”the emission of charges must be stopped

temperatures of the diode. Unfortunately, operating

and the diode recharged (Cova et al., 1996). Three main

APD™s at higher temperatures leads to a higher fraction

possibilities exist:

of thermal noise, that is, higher dark counts. Thus there

• In passive-quenching circuits, a large (50“500 k ) is again a tradeoff to be optimized. Finally, increasing

resistor is connected in series with the APD (see, for the bias voltage leads to a higher quantum ef¬ciency and

example, Brown et al., 1986). This causes a decrease in a smaller time jitter, at the cost of an increase in noise.

the voltage across the APD as soon as an avalanche We thus see that the optimal operating parameters”

starts. When it drops below breakdown voltage, the ava- voltage, temperature, and dead time (i.e., maximum

lanche stops and the diode recharges. The recovery time count rate)”depend on the speci¬c application. More-

of the diode is given by its capacitance and by the value over, since the relative magnitudes of ef¬ciency, thermal

of the quench resistor. The maximum count rate varies noise, and afterpulses vary with the type of semiconduc-

from a few hundred kilohertz to a few megahertz. tor material used, no general solution exists. In the next

• In active-quenching circuits, the bias voltage is ac- two sections we brie¬‚y discuss the different types of

tively lowered below the breakdown voltage as soon as APD™s. The ¬rst section focuses on silicon APD™s for the

the leading edge of the avalanche current is detected detection of photons at wavelengths below 1 m; the

(see, for example, Brown et al., 1987). This mode makes second comments on germanium and on indium gallium

possible higher count rates than those in passive quench- arsenide APD™s for photon counting at telecommunica-

ing (up to tens of megahertz), since the dead time can be tions wavelengths. The different behavior of the three

as short as tens of nanoseconds. However, the fast elec- types is shown in Fig. 9. Although the best ¬gure of

tronic feedback system makes active-quenching circuits merit for quantum cryptography is the ratio of dark-

much more complicated than passive ones. count rate R to detection ef¬ciency , we show here the

• Finally, in gated-mode operation, the bias voltage is better-known noise equivalent power (NEP), which

kept below the breakdown voltage and is raised above it shows similar behavior. The noise equivalent power is

only for a short time, typically a few nanosecods when a de¬ned as the optical power required to measure a unity

photon is expected to arrive. Maximum count rates simi- signal-to-noise ratio and is given by

lar to those in active-quenching circuits can be obtained

h

using less complicated electronics. Gated-mode opera-

NEP 2R. (25)

tion is commonly used in quantum cryptography based

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

163

Gisin et al.: Quantum cryptography

ster (1993a) implemented a single-photon interference

scheme for quantum cryptography over a distance of 10

km, and in 1994, Tapster, Rarity, and Owens demon-

strated a violation of Bell™s inequalities over 4 km. These

experiments were the ¬rst to take advantage of Ge

APD™s operated in passively quenched Geiger mode. At

a temperature of 77 K, which can be achieved using ei-

ther liquid nitrogen or Stirling engine cooling, typical

quantum ef¬ciencies of about 15% at dark-count rates

of 25 kHz can be achieved (Owens et al., 1994), and time

jitter down to 100 ps has been observed (Lacaita et al.,

1994) a normal value being 200“300 ps.

Traditionally, germanium APD™s have been imple-

FIG. 9. Noise equivalent power as a function of wavelength for

mented in the domain of long-distance quantum com-

silicon, germanium, and InGaAs/InP APD™s.

munication. However, this type of diode is currently be-

ing replaced by InGaAs APD™s, and it has become more

Here, h is Planck™s constant and is the frequency of the and more dif¬cult to ¬nd germanium APD™s on the mar-

impinging photons. ket. Motivated by pioneering research reported in 1985

(Levine et al., 1985), the latest research focuses on

1. Photon counting at wavelengths below 1.1 m InGaAs APD™s, which allow single-photon detection in

both telecommunications windows. Starting with work

Since the beginning of the 1980s much work has been

by Zappa et al. (1994), InGaAs APD™s as single-photon

done to characterize silicon APD™s for single-photon

counters have meanwhile been thoroughly characterized

counting (Ingerson 1983; Brown et al., 1986, 1987;

(Lacaita et al., 1996; Ribordy et al., 1998; Karlsson et al.,

Brown and Daniels, 1989; Spinelli, 1996), and the perfor-

1999; Hiskett et al., 2000; Rarity et al., 2000; Stucki et al.,

mance of Si APD™s has continuously been improved.

2001), and the ¬rst implementations for quantum cryp-

Since the ¬rst test of Bell™s inequality using Si APD™s by

tography have been reported (Ribordy, 1998; Bouren-

Shih and Alley in 1988, they have completely replaced

nane et al., 1999; Bethune and Risk, 2000; Hughes, Mor-

the photomultipliers used until then in the domain of

gan, and Peterson, 2000; Ribordy et al., 2000). However,

fundamental quantum optics, now known as quantum

if operating Ge APD™s is already more inconvenient

communication. Today, quantum ef¬ciencies of up to

than using silicon APD™s, the practicality of InGaAs

76% (Kwiat et al., 1993) and time jitter as low as 28 ps

APD™s is even worse, the problem being an extremely

(Cova et al., 1989) have been reported. Commercial

high afterpulse fraction. Therefore operation in passive-

single-photon counting modules are available (for ex-

quenching mode is impossible for applications in which

ample, EG&G SPCM-AQ-151), featuring quantum ef¬-

low noise is crucial. In gated mode, InGaAs APD™s are

ciencies of 70% at a wavelength of 700 nm, a time jitter

better for single-photon counting at 1.3 m than Ge

of around 300 ps, and maximum count rates higher than

APD™s. For instance, at a temperature of 77 K and a

5 MHz. Temperatures of 20 °C”suf¬cient to keep

dark-count probability of 10 5 per 2.6-ns gate, quantum

thermally generated dark counts as low as 50 Hz”can

ef¬ciencies of around 30% and 17% have been reported

easily be achieved using Peltier cooling. Single-photon

for InGaAs and Ge APD™s, respectively (Ribordy et al.,

counters based on silicon APD™s thus offer an almost

1998), while the time jitter of both devices is compa-

perfect solution for all applications in which photons of

rable. If working at a wavelength of 1.55 m, the tem-

wavelengths below 1 m can be used. Apart from fun-

perature has to be increased for single-photon detection.

damental quantum optics, these applications include

At 173 K and a dark-count rate of 10 4 , a quantum

quantum cryptography in free space and in optical ¬-

ef¬ciency of 6% can still be observed using InGaAs/InP

bers; however, due to high losses, the latter works only

devices, while the same ¬gure for germanium APD™s is

over short distances.

close to zero.

To date, no industrial effort has been made to opti-

2. Photon counting at telecommunications wavelengths

mize APD™s operating at telecommunications wave-

lengths for photon counting, and their performance still

When working in the second telecommunications win-

lags far behind that one of silicon APD™s.26 However,

dow (1.3 m), one can take advantage of APD™s made

there is no fundamental reason why photon counting at

from germanium or InGaAs/InP semiconductor materi-

wavelengths above 1 m should be more dif¬cult than at

als. In the third window (1.55 m), the only option is

wavelengths below 1 m except that the high-

InGaAs/InP.

Photon counting with germanium APD™s, although

known for 30 years (Haecker et al., 1971), began to be

used in quantum communication as the need arose to 26

The ¬rst commercial photon counter at telecommunications

transmit single photons over long distances using optical wavelengths came out only this year (the Hamamatsu photo-

¬bers, which necessitated working at telecommunica- multiplier R5509-72). However, its ef¬ciency is not yet suf¬-

tions wavelengths. In 1993, Townsend, Rarity, and Tap- cient for use in quantum cryptography.

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

164 Gisin et al.: Quantum cryptography

An elegant con¬guration integrating the random-

wavelength photons are less energetic. The real reasons

number generator into the QC system consists in using a

for the lack of commercial products are, ¬rst, that sili-

passive choice of bases, as discussed in Sec. V (Muller

con, the most common semiconductor material, is not

et al., 1993). However, the problem of detector-induced

sensitive enough (the band gap is too large), and second

correlation remains.

that the market for photon counting is not yet mature.

But, without great risk, one can predict that good com-

mercial photon counters will become available in the

near future and that they will have a major impact on E. Quantum repeaters

quantum cryptography.

Today™s ¬ber-based QC systems are limited to opera-

tion over tens of kilometers due to the combination of

¬ber losses and detector noise. The losses by themselves

D. Quantum random-number generators

only reduce the bit rate (exponentially with distance).

With perfect detectors the distance would not be limited.

The key used in the one-time pad must be secret and

However, because of the dark counts, each time a pho-

used only once. Consequently it must be as long as the

ton is lost there is a chance that a dark count produces

message, and it must be perfectly random. The latter

an error. Hence, when the probability of a dark count

point proves to be a delicate and interesting one. Com-

becomes comparable to the probability that a photon is

puters are deterministic systems that cannot create truly

correctly detected, the signal-to-noise ratio tends to 0

random numbers. However, all secure cryptosystems,

[more precisely, the mutual information I( , ) tends to

both classical and quantum ones, require truly random

a lower bound29]. In this section we brie¬‚y explain how

numbers.27 Hence the random numbers must be created

the use of entangled photons and of entanglement swap-

by a random physical process. Moreover, to make sure ™

ping (Zukowski et al., 1993) could offer ways to extend

that the process does not merely appear random while

the achievable distances in the foreseeable future (some

having some hidden deterministic pattern, the process

prior knowledge of entanglement swapping is assumed).

needs to be completely understood. It is thus of interest

Let t link denote the transmission coef¬cient (i.e., the

to implement a simple process in order to gain con¬-

probability that a photon sent by Alice gets to one of

dence in the randomness of its proper operation.

Bob™s detectors), the detector ef¬ciency, and p dark the

A natural solution is to rely on the random choice of a

dark-count probability per time bin. With a perfect

single photon at a beamsplitter28 (Rarity et al., 1994). In

single-photon source, the probability P raw of a correct

this case the randomness is in principle guaranteed by

qubit detection is P raw t link , while the probability

the laws of quantum mechanics, though one still has to

P det of an error is P det (1 t link )p dark . Accordingly,

be very careful not to introduce any experimental arti-

the QBER P det /(P raw P det ), and the normalized net

fact that could correlate adjacent bits. Different experi-

rate is net (P raw P det )•fct(QBER), where the func-

mental realizations have been demonstrated (Jenne-

tion fct denotes the fraction of bits remaining after error

wein, Achleitner, et al., 2000; Stefanov et al., 2000;

correction and privacy ampli¬cation. For the sake of il-

Hildebrand, 2001), and prototypes are commercially

lustration, we simply assume a linear dependence drop-

available (www.gap-optique.unige.ch). One particular

ping to zero for QBER 15% (this simpli¬cation does

problem is the dead time of the detectors, which may

not affect the qualitative results of this section; for a

introduce a strong anticorrelation between neighboring

¨

more precise calculation, see Lutkenhaus 2000):

bits. Similarly, afterpulses may provoke a correlation.

fct(QBER) 1 QBER/15%. The corresponding net

These detector-related effects increase with higher pulse

rate net is displayed in Fig. 10. Note that it drops to zero

rates, limiting the bit rate of a quantum number genera-

near 90 km.

tor to a few megahertz.

Let us now assume that instead of a perfect single-

In the BB84 protocol Alice has to choose randomly

photon source, Alice and Bob use a perfect two-photon

among four different states and Bob between two bases.

source set in the middle of their quantum channel. Each

The limited random-number generation rate may force

photon then has a probability t link of reaching a detec-

Alice to produce her numbers in advance and store

tor. The probability of a correct joined detection is thus

them, creating a security risk. On Bob™s side the random-

P raw t link 2 , while an error occurs with probability

bit creation rate can be lower, since, in principle, the

2

t link ) 2 p dark 2 t link (1

P det (1 t link )p dark

basis need be changed only after a photon has been de-

(both photons lost and two dark counts, or one photon

tected, which normally happens at rates below 1 MHz.

lost and one dark count). This can be conveniently re-

However, one must make sure that this does not give a

1/n

written as P raw t link n and P det t link (1

spy an opportunity for a Trojan horse attack (see Sec.

1/n n n

t link )p dark t link , valid for any division of the

VI.K).

29

27

The absolute lower bound is 0, but depending on the as-

The PIN number that the bank assigns to your ATM card

sumed eavesdropping strategy, Eve could take advantage of

must be random. If not, someone else knows it.

28

the losses. In the latter case, the lower bound is given by her

Strictly speaking, the choice is made only once the photons

are detected at one of the outports. mutual information I( , ).

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

165

Gisin et al.: Quantum cryptography

ronment, also called decoherence, can be controlled and

moderated. In addition, researchers can bene¬t from all

the tools developed in the past two decades for optical

telecommunications. It is unlikely that other carriers will

be employed in the foreseeable future.

Comparing different QC setups is a dif¬cult task,

since several criteria must be taken into account. What

matters in the end, of course, is the rate of corrected

secret bits (the distilled bit rate R dist ) that can be trans-

mitted and the transmission distance. One can already

note that with present and near-future technology it will

probably not be possible to achieve rates of the order of

gigahertz, which are now common with conventional op-

FIG. 10. Normalized net key creation rate net as a function of

tical communication systems (in their comprehensive

distance in optical ¬bers. For n 1, Alice uses a perfect single-

paper published in 2000, Gilbert and Hamrick discuss

photon source. For n 1, the link is divided into n equal-length

practical methods for achieving high-bit-rate QC). This

sections, and n/2 two-photon sources are distributed between

implies that encryption with a key exchanged through

Alice and Bob. Parameters: detection ef¬ciency 10%,

QC will be limited to highly con¬dential information.

dark-count probability p dark 10 4 , and ¬ber attenuation

While the determination of the transmission distance

0.25 dB/km.

and rate of detection (the raw bit rate R raw ) is straight-

forward, estimating the net rate is rather dif¬cult. Al-

link into n equal-length sections and n detectors. Note though, in principle, errors in the bit sequence follow

that the measurements performed at the nodes between only from tampering by a malevolent eavesdropper, the

Alice and Bob transmit (swap) the entanglement to the situation is rather different in reality. Discrepancies be-

twin photons without revealing any information about tween the keys of Alice and Bob also happen because of

the qubit (these measurements are called Bell measure- experimental imperfections. The error rate QBER can

ments and are at the core of entanglement swapping and be easily determined. Similarly, the error correction pro-

of quantum teleportation). The corresponding net rates cedure is rather simple. Error correction leads to a re-

are displayed in Fig. 10. Clearly, the rates for short dis- duction of the key rate that depends strongly on the

tances are smaller when several detectors are used, be- QBER. The real problem is to estimate the information

cause of their limited ef¬ciencies (here we assume obtained by Eve, a quantity necessary for privacy ampli-

10%), but the distance before the net rate drops to ¬cation. This depends not only on the QBER, but also

zero is extended to longer distances! Intuitively, this can on other factors, such as the photon number statistics of

be understood as follows. Let us assume that a logical the source or the way the choice of the measurement

qubit propagates from Alice to Bob (although some basis is made. Moreover in a pragmatic approach, one

photons propagate in the opposite direction). Then, might also accept restrictions on Eve™s technology, limit-

each two-photon source and each Bell measurement acts ing her strategies and therefore also the information she

on this logical qubit as a kind of quantum nondemolition can obtain per error she introduces. Since the ef¬ciency

measurement, testing whether the logical qubit is still of privacy ampli¬cation rapidly decreases when the

there. In this way, Bob activates his detectors only when QBER increases, the distilled bit rate depends dramati-

1/n

there is a large chance t link that the photon gets to his cally on Eve™s information and hence on the assumptions