Note that if in addition to detector noise there is noise tance the distance at which the distilled rate reaches

due to decoherence, then the above idea can be ex- zero. This distance can give one an idea of the dif¬culty

tended, using entanglement puri¬cation. This is essen- of evaluating a QC system from a physical point of view.

tially the idea behind quantum repeaters (Briegel et al., Technological aspects must also be taken into account.

1998; Dur et al., 1999). In this article we do not focus on all the published per-

formances (in particular not on the key rates), which

strongly depend on current technology and the ¬nancial

IV. EXPERIMENTAL QUANTUM CRYPTOGRAPHY WITH

resources of the research teams who carried out the ex-

FAINT LASER PULSES

periments. Rather, we try to weigh the intrinsic techno-

Experimental quantum key distribution was demon- logical dif¬culties associated with each setup and to an-

strated for the ¬rst time in 1989 (the results were pub- ticipate certain technological advances. Last but not

lished only in 1992 by Bennett, Bessette, et al.). Since least, the cost of realizing a prototype should also be

then, tremendous progress has been made. Today, sev- considered.

eral groups have shown that quantum key distribution is In this section, we ¬rst deduce a general formula for

possible, even outside the laboratory. In principle, any the QBER and consider its impact on the distilled rate.

two-level quantum system could be used to implement We then review faint-pulse implementations. We class

QC. In practice, all implementations have relied on pho- them according to the property used to encode the qu-

tons. The reason is that their interaction with the envi- bits value and follow a rough chronological order. Fi-

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

166 Gisin et al.: Quantum cryptography

1

nally, we assess the possibility of adopting the various of detectors. The two factors of 2 are related to the fact

setups for the realization of an industrial prototype. Sys- that a dark count has a 50% chance of happening when

tems based on entangled photon pairs are presented in Alice and Bob have chosen incompatible bases (and is

the next section. thus eliminated during sifting) and a 50% chance of oc-

curring in the correct detector.

Finally, error counts can arise from uncorrelated pho-

A. Quantum bit error rate

tons due to imperfect photon sources:

The QBER is de¬ned as the ratio of wrong bits to the 11

total number of bits received30 and is normally on the R acc p f t n. (30)

2 2 acc rep link

order of a few percent. We can express it as a function of

This factor appears only in systems based on entangled

rates,

photons, where the photons belonging to different pairs

N wrong R error R error but arriving in the same time window are not necessarily

QBER . (26)

N right N wrong R sift R error R sift in the same state. The quantity p acc is the probability of

¬nding a second pair within the time window, knowing

Here the sifted key corresponds to the cases in which

that a ¬rst one was created.32

Alice and Bob made compatible choices of bases, hence

The QBER can now be expressed as follows:

its rate is half that of the raw key.

The raw rate is essentially the product of the pulse R opt R det R acc

QBER (31)

rate f rep , the mean number of photons per pulse , the R sift

probability t link of a photons arriving at the analyzer,

p dark n p acc

and the probability of the photon™s being detected:

p opt (32)

t link 2q 2q

1 1

R sift R raw qf t . (27)

2 rep link

2 QBERopt QBERdet QBERacc . (33)

1

The factor q (q 1, typically 1 or 2 ) must be introduced We now analyze these three contributions. The ¬rst one,

for some phase-coding setups in order to correct for QBERopt , is independent of the transmission distance

noninterfering path combinations (see, for example, (it is independent of t link ). It can be considered as a

Secs. IV.C and V.B). measure of the optical quality of the setup, depending

One can identify three different contributions to only on the polarization or interference fringe contrast.

R error . The ¬rst arises from photons that end up in the The technical effort needed to obtain and, more impor-

wrong detector due to imperfect interference or polar- tantly, to maintain a given QBERopt is an important cri-

ization contrast. The rate R opt is given by the product of terion for evaluating different QC setups. In

the sifted-key rate and the probability p opt of a photon™s polarization-based systems, it is rather simple to achieve

going to the wrong detector: a polarization contrast of 100:1, corresponding to a

QBERopt of 1%. In ¬ber-based QC, the problem is to

1

maintain this value in spite of polarization ¬‚uctuations

R opt R sift p opt qf tp . (28)

2 rep link opt and depolarization in the ¬ber link. For phase-coding

setups, QBERopt and the interference visibility are re-

For a given setup, this contribution can be considered as

lated by

an intrinsic error rate indicating its suitability for use in

QC. We shall discuss it below in the case of each par- 1V

ticular system. QBERopt . (34)

2

The second contribution, R det , arises from the detec-

tor dark counts (or from remaining environmental stray A visibility of 98% thus translates into an optical error

light in free-space setups). This rate is independent of rate of 1%. Such a value implies the use of well-aligned

the bit rate.31 Of course, only dark counts falling within and stable interferometers. In bulk optics, perfect mode

the short time window when a photon is expected give overlap is dif¬cult to achieve, but the polarization is

rise to errors, stable. In single-mode ¬ber interferometers, on in con-

trast, perfect mode overlap is automatically achieved,

11

but the polarization must be controlled, and chromatic

R det fp n, (29)

2 2 rep dark dispersion can constitute a problem.

The second contribution, QBERdet , increases with

where p dark is the probability of registering a dark count

distance, since the dark-count rate remains constant

per time window and per detector, and n is the number

while the bit rate goes down like t link . It depends en-

30

In the following section we consider systems implementing

32

Note that a passive choice of measurement basis implies

the BB84 protocol. For other protocols, some of the formulas

that four detectors (or two detectors during two time windows)

have to be slightly adapted.

31

are activated for every pulse, thus leading to a doubling of R det

This is true provided that afterpulses (see Sec. III.C) do not

contribute to the dark counts. and R acc .

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

167

Gisin et al.: Quantum cryptography

FIG. 12. Typical system for quantum cryptography using po-

larization coding: LD, laser diode; BS, beamsplitter; F, neutral

density ¬lter; PBS, polarizing beamsplitter; /2, half wave-

FIG. 11. Bit rate, after error correction and privacy ampli¬ca- plate; APD, avalanche photodiode.

tion, vs ¬ber length. The chosen parameters are as follows:

pulse rates of 10 MHz for faint laser pulses ( 0.1) and 1

most evident when comparing the curves 1550 and 1550

MHz for the case of ideal single photons (1550-nm ˜˜single™™);

nm ˜˜single,™™ since the latter features a QBER that is 10

losses of 2, 0.35, and 0.25 dB/km; detector ef¬ciencies of 50, 20,

times lower. One can see that the maximum range is

and 10; dark-count probabilities of 10 7 , and 10 5 , and 10 5

about 100 km. In practice it is closer to 50 km, due to

for 800, 1300, and 1550 nm, respectively. Losses at Bob™s end

nonideal error correction and privacy ampli¬cation,

and QBERopt are neglected.

multiphoton pulses, and other optical losses not consid-

ered here. Finally, let us mention that typical key cre-

tirely on the ratio of the dark-count rate to the quantum

ation rates on the order of a thousand bits per second

ef¬ciency. At present, good single-photon detectors are

over distances of a few tens of kilometers have been

not commercially available for telecommunications

demonstrated experimentally (see, for example,

wavelengths. The span of QC is not limited by decoher-

Townsend, 1998b or Ribordy et al., 2000).

ence. As QBERopt is essentially independent of the ¬ber

length, it is detector noise that limits the transmission

distance. B. Polarization coding

Finally, the QBERacc contribution is present only in

Encoding the qubits in the polarization of photons is a

some two-photon schemes in which multiphoton pulses

natural solution. The ¬rst demonstration of QC by Ben-

are processed in such a way that they do not necessarily

nett and co-workers (Bennett, Bessette, et al., 1992)

encode the same bit value (see, for example, Secs. V.B.1

made use of this choice. They realized a system in which

and V.B.2). Although all systems have some probability

Alice and Bob exchanged faint light pulses produced by

of multiphoton pulses, in most these contribute only to

a light-emitting diode and containing less than one pho-

the information available to Eve (see Sec. VI.H) and not

ton on average over a distance of 30 cm in air. In spite of

to the QBER. However, for implementations featuring

the small scale of this experiment, it had an important

passive choice by each photon, the multiphoton pulses

impact on the community, as it showed that it was not

do not contribute to Eve™s information but only to the

unreasonable to use single photons instead of classical

error rate (see Sec. VI.J).

pulses for encoding bits.

Now, let us calculate the useful bit rate as a function

A typical QC system with the BB84 four-state proto-

of the distance. R sift and QBER are given as a function

col using the polarization of photons is shown in Fig. 12.

of t link in Eqs. (27) and (32), respectively. The ¬ber link

Alice™s system consists of four laser diodes. They emit

transmission decreases exponentially with length. The

short classical photon pulses ( 1 ns) polarized at 45°,

fraction of bits lost due to error correction and privacy

0°, 45°, and 90°. For a given qubit, a single diode is

ampli¬cation is a function of QBER and depends on

triggered. The pulses are then attenuated by a set of

Eve™s strategy. The number of remaining bits R net is

¬lters to reduce the average number of photons to well

given by the sifted-key rate multiplied by the difference

below 1, and sent along the quantum channel to Alice.

between the Alice-Bob mutual Shannon information

It is essential that the pulses remain polarized for Bob

I( , ) and Eve™s maximal Shannon information

I max( , ): to be able to extract the information encoded by Alice.

As discussed in Sec. III.B.2, polarization mode disper-

I max

R net R sift I , , . (35)

sion may depolarize the photons, provided the delay it

The difference between I( , ) and I max( , ) is calcu- introduces between polarization modes is longer than

the coherence time. This sets a constraint on the type of

lated here according to Eqs. (63) and (65) (Sec. VI.E),

lasers used by Alice.

considering only individual attacks and no multiphoton

Upon reaching Bob, the pulses are extracted from the

pulses. We obtain R net (the useful bit rate after error

¬ber. They travel through a set of waveplates used to

correction and privacy ampli¬cation) for different wave-

recover the initial polarization states by compensating

lengths as shown in Fig. 11. There is ¬rst an exponential

for the transformation induced by the optical ¬ber (Sec.

decrease, then, due to error correction and privacy am-

III.B.2). The pulses then reach a symmetric beamsplit-

pli¬cation, the bit rates fall rapidly down to zero. This is

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

168 Gisin et al.: Quantum cryptography

ter, implementing the basis choice. Transmitted photons

are analyzed in the vertical-horizontal basis with a po-

larizing beamsplitter and two photon-counting detec-

tors. The polarization state of the re¬‚ected photons is

¬rst rotated with a waveplate by 45° ( 45°’0°). The

photons are then analyzed with a second set of polariz-

ing beamsplitters and photon-counting detectors. This

implements the diagonal basis. For illustration, let us

follow a photon polarized at 45°. We see that its state

of polarization is arbitrarily transformed in the optical

¬ber. At Bob™s end, the polarization controller must be

set to bring it back to 45°. If it chooses the output of

the beamsplitter corresponding to the vertical-horizontal

basis, it will experience an equal probability of re¬‚ection

or transmission at the polarizing beamsplittter, yielding a

FIG. 13. Geneva and Lake Geneva. The Swisscom optical ¬-

random outcome. On the other hand, if it chooses the

ber cable used for quantum cryptography experiments runs

diagonal basis, its state will be rotated to 90°. The po-

under the lake between the town of Nyon, about 23 km north

larizing beamsplitter will then re¬‚ect it with unit prob-

of Geneva, and the center of the city.

ability, yielding a deterministic outcome.

Instead of having Alice use four lasers and Bob two

polarizing beamsplitters, one can also implement this dard ¬bers with polarization-maintaining ¬bers does not

system with active polarization modulators such as solve the problem. The reason is that, in spite of their

Pockels cells. For emission, the modulator is randomly name, these ¬bers do not maintain polarization, as ex-

activated for each pulse to rotate the state of polariza- plained in Sec. III.B.2.

tion to one of the four states, while, at the receiver, it Recently, Townsend has also investigated such

randomly rotates half of the incoming pulses by 45°. It is polarization-encoding systems for QC on short-span

also possible to realize the whole system with ¬ber op- links up to 10 kilometers (1998a, 1998b) with photons at

tics components. 800 nm. It is interesting to note that, although he used

Antoine Muller and co-workers at the University of standard telecommunications ¬bers which could support

Geneva have used such a system to perform QC experi- more than one spatial mode at this wavelength, he was

´

ments over optical ¬bers (1993; see also Breguet et al., able to ensure single-mode propagation by carefully

1994). They created a key over a distance of 1100 meters controlling the launching conditions. Because of the

with photons at 800 nm. In order to increase the trans- problem discussed above, polarization coding does not

mission distance, they repeated the experiment with seem to be the best choice for QC in optical ¬bers. Nev-

photons at 1300 nm (Muller et al., 1995, 1996) and cre- ertheless, this problem is drastically reduced when con-

ated a key over a distance of 23 km. An interesting fea- sidering free-space key exchange, as air has essentially

ture of this experiment is that the quantum channel con- no birefringence at all (see Sec. IV.E).

necting Alice and Bob consisted of an optical ¬ber part

of an installed cable used by the telecommunications

company Swisscom for carrying phone conversations. It

runs between the Swiss cities of Geneva and Nyon, un- C. Phase coding

der Lake Geneva (Fig. 13). This was the ¬rst time QC

was performed outside of a physics laboratory. These The idea of encoding the value of qubits in the phase

experiments had a strong impact on the interest of the of photons was ¬rst mentioned by Bennett in the paper

wider public in the new ¬eld of quantum communica- in which he introduced the two-state protocol (1992). It

tion. is indeed a very natural choice for optics specialists.

These two experiments highlighted the fact that the State preparation and analysis are then performed with

polarization transformation induced by a long optical ¬- interferometers, which can be realized with single-mode

ber was unstable over time. Indeed, when monitoring optical ¬ber components.

the QBER of their system, Muller noticed that, although Figure 14 presents an optical ¬ber version of a Mach-

it remained stable and low for some time (on the order Zehnder interferometer. It is made out of two symmetric

of several minutes), it would suddenly increase after a couplers”the equivalent of beamsplitters”connected

while, indicating a modi¬cation of the polarization trans- to each other, with one phase modulator in each arm.

formation in the ¬ber. This implies that a real ¬ber- One can inject light into the setup, using a continuous

based QC system would require active alignment to and classical source, and monitor the intensity at the

compensate for this evolution. Although not impossible, output ports. Provided that the coherence length of the

such a procedure is certainly dif¬cult. James Franson did light used is larger than the path mismatch in the inter-

indeed implement an active-feedback alignment system ferometers, interference fringes can be recorded. Taking

(Franson and Jacobs, 1995), but did not pursue this line into account the /2 phase shift experienced upon re-

of research. It is interesting to note that replacing stan- ¬‚ection at a beamsplitter, the effect of the phase modu-

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

169

Gisin et al.: Quantum cryptography

TABLE I. Implementation of the BB84 four-state protocol

with phase encoding.

Alice Bob

Bit value Bit value

A B A B

0 0 0 0 0

0 0 /2 3 /2 ?

1 0 1

1 /2 /2 ?

0 /2 0 /2 ?

FIG. 14. Conceptual interferometric setup for quantum cryp- 0 /2 /2 0 0

tography using an optical ¬ber Mach-Zehnder interferometer: 1 3 /2 0 3 /2 ?

LD, laser diode; PM, phase modulator; APD, avalanche pho- 1 3 /2 /2 1

todiode.

lators ( A and B ), and the path-length difference

Alice selected. When the phase difference equals /2 or

( L), the intensity in the output port labeled ˜˜0™™ is

3 /2, the bases are incompatible and the photon ran-

given by

domly chooses which port it takes at Bob™s coupler. This

kL scheme is summarized in Table I. We must stress that it

A B

I 0 ¯ • cos2

I , (36) is essential with this scheme to keep the path difference

2

stable during a key exchange session. It should not

where k is the wave number and ¯ the intensity of the

I change by more than a fraction of a wavelength of the

source. If the phase term is equal to /2 n , where n is photons. A drift of the length of one arm would indeed

an integer, destructive interference is obtained. There- change the phase relation between Alice and Bob and

fore the intensity registered in port 0 reaches a mini- induce errors in their bit sequence.

mum, and all the light exits from port 1. When the phase It is interesting to note that encoding qubits with two-

term is equal to n , the situation is reversed: construc- path interferometers is formally isomorphic to polariza-

tive interference is obtained in port 0, while the intensity tion encoding. The two arms correspond to a natural

in port 1 goes to a minimum. With intermediate phase basis, and the weights c j of each qubit state

settings, light can be recorded in both ports. This device (c 1 e i /2,c 2 e i /2) are determined by the coupling ratio

acts like an optical switch. It is essential to keep the path of the ¬rst beamsplitter, while the relative phase is

difference stable in order to record stationary interfer- ´

introduced in the interferometer. The Poincare sphere

ences. representation, which applies to all two-level quantum

Although we have discussed the behavior of this inter- systems, can also be used to represent phase-coding

ferometer for classical light, it works exactly the same states. In this case, the azimuth angle represents the

when a single photon is injected. The probability of de- relative phase between the light that has propagated

tecting the photon in one output port can be varied by along the two arms. The elevation corresponds to the

changing the phase. It is the ¬ber optic version of coupling ratio of the ¬rst beamsplitter. States produced

Young™s double-slit experiment, in which the arms of the by a switch are on the poles, while those resulting from

interferometer replace the apertures. the use of a 50/50 beamsplitter lie on the equator. Figure

This interferometer combined with a single-photon 15 illustrates this analogy. Consequently, all polarization

source and photon-counting detectors can be used for schemes can also be implemented using phase coding.

QC. Alice™s setup consists of the source, the ¬rst coupler,

and the ¬rst phase modulator, while Bob takes the sec-

ond modulator and coupler, as well as the detectors. Let

us consider the implementation of the four-state BB84

protocol. On the one hand, Alice can apply one of four

phase shifts (0, /2, ,3 /2) to encode a bit value. She

associates 0 and /2 with bit 0, and and 3 /2 with bit

1. On the other hand, Bob performs a basis choice by

randomly applying a phase shift of either 0 or /2. He

associates the detector connected to the output port 0

with a bit value of 0, and the detector connected to port

1 with bit 1. When the difference of their phase is equal

to 0 or , Alice and Bob are using compatible bases and ´

FIG. 15. Poincare sphere representation of two-level quantum

they obtain deterministic results. In such cases, Alice states generated by two-path interferometers. The poles corre-

can infer from the phase shift she applied the output spond to the states generated by an interferometer in which

port chosen by the photon at Bob™s end and hence the the ¬rst coupler is replaced by a switch. The states generated

bit value he registered. Bob, on his side, deduces from with a symmetrical beamsplitter are on the equator. The azi-

the output port chosen by the photon the phase that muth indicates the phase between the two paths.

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

170 Gisin et al.: Quantum cryptography

tally sensitive part of the system, provided that the

variations in the ¬ber are slower than their temporal

separations, determined by the interferometer™s imbal-

ance ( 5 ns). This condition is much less dif¬cult to

ful¬ll. In order to obtain good fringe visibility, and hence

a low error rate, the imbalances of the interferometers

must be equal to within a fraction of the coherence time

of the photons. This implies that the path differences

FIG. 16. Double Mach-Zehnder implementation of an inter- must be matched to within a few millimeters, which does

ferometric system for quantum cryptography: LD, laser diode; not constitute a problem. The imbalance must be chosen

PM, phase modulator; APD, avalanche photodiode. The inset so that it is possible to distinguish the three temporal

represents the temporal count distribution recorded as a func-

peaks clearly and thus discriminate interfering from

tion of the time passed since the emission of the pulse by Al-

noninterfering events. It must typically be larger than

ice. Interference is observed in the central peak.

the pulse length and the timing jitter of the photon-

counting detectors. In practice, the second condition is

Similarly, every coding using two-path interferometers the more stringent one. Assuming a time jitter of the

can be realized using polarization. However, in practice order of 500 ps, an imbalance of at least 1.5 ns keeps

one choice is often more convenient than the other, de- the overlap between the peaks low.

pending on circumstances like the nature of the quan- The main dif¬culty associated with this QC scheme is

tum channel.33 that the imbalances of Alice™s and Bob™s interferometers

must be kept stable to within a fraction of the wave-

length of the photons during a key exchange to maintain

1. The double Mach-Zehnder implementation

correct phase relations. This implies that the interferom-

Although the scheme presented in the previous sec- eters must lie in containers whose temperature is stabi-

tion works perfectly well on an optical table, it is impos- lized. In addition, for long key exchanges an active sys-

sible to keep the path difference stable when Alice and tem is necessary to compensate for drift.34 Finally, in

Bob are separated by more than a few meters. As men- order to ensure the indistinguishability of both interfer-

tioned above, the relative length of the arms should not ing processes, one must make sure that in each interfer-

change by more than a fraction of a wavelength. If Alice ometer the polarization transformation induced by the

and Bob are separated by 1 kilometer, for example, it is short path is the same as that induced by the long path.

clearly impossible to prevent path difference changes Both Alice and Bob must then use a polarization con-

smaller than 1 m caused by environmental variations. troller to ful¬ll this condition. However, the polarization

In his 1992 letter, Bennett also showed how to circum- transformation is rather stable in short optical ¬bers

vent this problem. He suggested using two unbalanced whose temperature is kept stable and which do not ex-

Mach-Zehnder interferometers, one for Alice and one perience strains. Thus this adjustment does not need to

for Bob, connected in series by a single optical ¬ber (see be repeated frequently.

Fig. 16). When monitoring counts as a function of the Paul Tapster and John Rarity of DERA, the Defence

time since the emission of the photons, Bob obtains Evalution and Research Agency (Malvern, England),

three peaks (see the inset in Fig. 16). The ¬rst one cor- working with Paul Townsend, were the ¬rst to test this

responds to the photons that chose the short path in system over a ¬ber optic spool of 10 km (Townsend

both Alice™s and Bob™s interferometers, while the last et al., 1993a, 1993b). Townsend later improved the inter-