<< . .

. 6
( : 12)

. . >>

detectors. made. One can de¬ne as the maximum transmission dis-
Note that if in addition to detector noise there is noise tance the distance at which the distilled rate reaches
due to decoherence, then the above idea can be ex- zero. This distance can give one an idea of the dif¬culty
tended, using entanglement puri¬cation. This is essen- of evaluating a QC system from a physical point of view.
tially the idea behind quantum repeaters (Briegel et al., Technological aspects must also be taken into account.
1998; Dur et al., 1999). In this article we do not focus on all the published per-
formances (in particular not on the key rates), which
strongly depend on current technology and the ¬nancial
resources of the research teams who carried out the ex-
periments. Rather, we try to weigh the intrinsic techno-
Experimental quantum key distribution was demon- logical dif¬culties associated with each setup and to an-
strated for the ¬rst time in 1989 (the results were pub- ticipate certain technological advances. Last but not
lished only in 1992 by Bennett, Bessette, et al.). Since least, the cost of realizing a prototype should also be
then, tremendous progress has been made. Today, sev- considered.
eral groups have shown that quantum key distribution is In this section, we ¬rst deduce a general formula for
possible, even outside the laboratory. In principle, any the QBER and consider its impact on the distilled rate.
two-level quantum system could be used to implement We then review faint-pulse implementations. We class
QC. In practice, all implementations have relied on pho- them according to the property used to encode the qu-
tons. The reason is that their interaction with the envi- bits value and follow a rough chronological order. Fi-

Rev. Mod. Phys., Vol. 74, No. 1, January 2002
166 Gisin et al.: Quantum cryptography

nally, we assess the possibility of adopting the various of detectors. The two factors of 2 are related to the fact
setups for the realization of an industrial prototype. Sys- that a dark count has a 50% chance of happening when
tems based on entangled photon pairs are presented in Alice and Bob have chosen incompatible bases (and is
the next section. thus eliminated during sifting) and a 50% chance of oc-
curring in the correct detector.
Finally, error counts can arise from uncorrelated pho-
A. Quantum bit error rate
tons due to imperfect photon sources:
The QBER is de¬ned as the ratio of wrong bits to the 11
total number of bits received30 and is normally on the R acc p f t n. (30)
2 2 acc rep link
order of a few percent. We can express it as a function of
This factor appears only in systems based on entangled
photons, where the photons belonging to different pairs
N wrong R error R error but arriving in the same time window are not necessarily
QBER . (26)
N right N wrong R sift R error R sift in the same state. The quantity p acc is the probability of
¬nding a second pair within the time window, knowing
Here the sifted key corresponds to the cases in which
that a ¬rst one was created.32
Alice and Bob made compatible choices of bases, hence
The QBER can now be expressed as follows:
its rate is half that of the raw key.
The raw rate is essentially the product of the pulse R opt R det R acc
QBER (31)
rate f rep , the mean number of photons per pulse , the R sift
probability t link of a photons arriving at the analyzer,
p dark n p acc
and the probability of the photon™s being detected:
p opt (32)
t link 2q 2q
1 1
R sift R raw qf t . (27)
2 rep link
2 QBERopt QBERdet QBERacc . (33)
The factor q (q 1, typically 1 or 2 ) must be introduced We now analyze these three contributions. The ¬rst one,
for some phase-coding setups in order to correct for QBERopt , is independent of the transmission distance
noninterfering path combinations (see, for example, (it is independent of t link ). It can be considered as a
Secs. IV.C and V.B). measure of the optical quality of the setup, depending
One can identify three different contributions to only on the polarization or interference fringe contrast.
R error . The ¬rst arises from photons that end up in the The technical effort needed to obtain and, more impor-
wrong detector due to imperfect interference or polar- tantly, to maintain a given QBERopt is an important cri-
ization contrast. The rate R opt is given by the product of terion for evaluating different QC setups. In
the sifted-key rate and the probability p opt of a photon™s polarization-based systems, it is rather simple to achieve
going to the wrong detector: a polarization contrast of 100:1, corresponding to a
QBERopt of 1%. In ¬ber-based QC, the problem is to
maintain this value in spite of polarization ¬‚uctuations
R opt R sift p opt qf tp . (28)
2 rep link opt and depolarization in the ¬ber link. For phase-coding
setups, QBERopt and the interference visibility are re-
For a given setup, this contribution can be considered as
lated by
an intrinsic error rate indicating its suitability for use in
QC. We shall discuss it below in the case of each par- 1V
ticular system. QBERopt . (34)
The second contribution, R det , arises from the detec-
tor dark counts (or from remaining environmental stray A visibility of 98% thus translates into an optical error
light in free-space setups). This rate is independent of rate of 1%. Such a value implies the use of well-aligned
the bit rate.31 Of course, only dark counts falling within and stable interferometers. In bulk optics, perfect mode
the short time window when a photon is expected give overlap is dif¬cult to achieve, but the polarization is
rise to errors, stable. In single-mode ¬ber interferometers, on in con-
trast, perfect mode overlap is automatically achieved,
but the polarization must be controlled, and chromatic
R det fp n, (29)
2 2 rep dark dispersion can constitute a problem.
The second contribution, QBERdet , increases with
where p dark is the probability of registering a dark count
distance, since the dark-count rate remains constant
per time window and per detector, and n is the number
while the bit rate goes down like t link . It depends en-

In the following section we consider systems implementing
Note that a passive choice of measurement basis implies
the BB84 protocol. For other protocols, some of the formulas
that four detectors (or two detectors during two time windows)
have to be slightly adapted.
are activated for every pulse, thus leading to a doubling of R det
This is true provided that afterpulses (see Sec. III.C) do not
contribute to the dark counts. and R acc .

Rev. Mod. Phys., Vol. 74, No. 1, January 2002
Gisin et al.: Quantum cryptography

FIG. 12. Typical system for quantum cryptography using po-
larization coding: LD, laser diode; BS, beamsplitter; F, neutral
density ¬lter; PBS, polarizing beamsplitter; /2, half wave-
FIG. 11. Bit rate, after error correction and privacy ampli¬ca- plate; APD, avalanche photodiode.
tion, vs ¬ber length. The chosen parameters are as follows:
pulse rates of 10 MHz for faint laser pulses ( 0.1) and 1
most evident when comparing the curves 1550 and 1550
MHz for the case of ideal single photons (1550-nm ˜˜single™™);
nm ˜˜single,™™ since the latter features a QBER that is 10
losses of 2, 0.35, and 0.25 dB/km; detector ef¬ciencies of 50, 20,
times lower. One can see that the maximum range is
and 10; dark-count probabilities of 10 7 , and 10 5 , and 10 5
about 100 km. In practice it is closer to 50 km, due to
for 800, 1300, and 1550 nm, respectively. Losses at Bob™s end
nonideal error correction and privacy ampli¬cation,
and QBERopt are neglected.
multiphoton pulses, and other optical losses not consid-
ered here. Finally, let us mention that typical key cre-
tirely on the ratio of the dark-count rate to the quantum
ation rates on the order of a thousand bits per second
ef¬ciency. At present, good single-photon detectors are
over distances of a few tens of kilometers have been
not commercially available for telecommunications
demonstrated experimentally (see, for example,
wavelengths. The span of QC is not limited by decoher-
Townsend, 1998b or Ribordy et al., 2000).
ence. As QBERopt is essentially independent of the ¬ber
length, it is detector noise that limits the transmission
distance. B. Polarization coding
Finally, the QBERacc contribution is present only in
Encoding the qubits in the polarization of photons is a
some two-photon schemes in which multiphoton pulses
natural solution. The ¬rst demonstration of QC by Ben-
are processed in such a way that they do not necessarily
nett and co-workers (Bennett, Bessette, et al., 1992)
encode the same bit value (see, for example, Secs. V.B.1
made use of this choice. They realized a system in which
and V.B.2). Although all systems have some probability
Alice and Bob exchanged faint light pulses produced by
of multiphoton pulses, in most these contribute only to
a light-emitting diode and containing less than one pho-
the information available to Eve (see Sec. VI.H) and not
ton on average over a distance of 30 cm in air. In spite of
to the QBER. However, for implementations featuring
the small scale of this experiment, it had an important
passive choice by each photon, the multiphoton pulses
impact on the community, as it showed that it was not
do not contribute to Eve™s information but only to the
unreasonable to use single photons instead of classical
error rate (see Sec. VI.J).
pulses for encoding bits.
Now, let us calculate the useful bit rate as a function
A typical QC system with the BB84 four-state proto-
of the distance. R sift and QBER are given as a function
col using the polarization of photons is shown in Fig. 12.
of t link in Eqs. (27) and (32), respectively. The ¬ber link
Alice™s system consists of four laser diodes. They emit
transmission decreases exponentially with length. The
short classical photon pulses ( 1 ns) polarized at 45°,
fraction of bits lost due to error correction and privacy
0°, 45°, and 90°. For a given qubit, a single diode is
ampli¬cation is a function of QBER and depends on
triggered. The pulses are then attenuated by a set of
Eve™s strategy. The number of remaining bits R net is
¬lters to reduce the average number of photons to well
given by the sifted-key rate multiplied by the difference
below 1, and sent along the quantum channel to Alice.
between the Alice-Bob mutual Shannon information
It is essential that the pulses remain polarized for Bob
I( , ) and Eve™s maximal Shannon information
I max( , ): to be able to extract the information encoded by Alice.
As discussed in Sec. III.B.2, polarization mode disper-
I max
R net R sift I , , . (35)
sion may depolarize the photons, provided the delay it
The difference between I( , ) and I max( , ) is calcu- introduces between polarization modes is longer than
the coherence time. This sets a constraint on the type of
lated here according to Eqs. (63) and (65) (Sec. VI.E),
lasers used by Alice.
considering only individual attacks and no multiphoton
Upon reaching Bob, the pulses are extracted from the
pulses. We obtain R net (the useful bit rate after error
¬ber. They travel through a set of waveplates used to
correction and privacy ampli¬cation) for different wave-
recover the initial polarization states by compensating
lengths as shown in Fig. 11. There is ¬rst an exponential
for the transformation induced by the optical ¬ber (Sec.
decrease, then, due to error correction and privacy am-
III.B.2). The pulses then reach a symmetric beamsplit-
pli¬cation, the bit rates fall rapidly down to zero. This is

Rev. Mod. Phys., Vol. 74, No. 1, January 2002
168 Gisin et al.: Quantum cryptography

ter, implementing the basis choice. Transmitted photons
are analyzed in the vertical-horizontal basis with a po-
larizing beamsplitter and two photon-counting detec-
tors. The polarization state of the re¬‚ected photons is
¬rst rotated with a waveplate by 45° ( 45°’0°). The
photons are then analyzed with a second set of polariz-
ing beamsplitters and photon-counting detectors. This
implements the diagonal basis. For illustration, let us
follow a photon polarized at 45°. We see that its state
of polarization is arbitrarily transformed in the optical
¬ber. At Bob™s end, the polarization controller must be
set to bring it back to 45°. If it chooses the output of
the beamsplitter corresponding to the vertical-horizontal
basis, it will experience an equal probability of re¬‚ection
or transmission at the polarizing beamsplittter, yielding a
FIG. 13. Geneva and Lake Geneva. The Swisscom optical ¬-
random outcome. On the other hand, if it chooses the
ber cable used for quantum cryptography experiments runs
diagonal basis, its state will be rotated to 90°. The po-
under the lake between the town of Nyon, about 23 km north
larizing beamsplitter will then re¬‚ect it with unit prob-
of Geneva, and the center of the city.
ability, yielding a deterministic outcome.
Instead of having Alice use four lasers and Bob two
polarizing beamsplitters, one can also implement this dard ¬bers with polarization-maintaining ¬bers does not
system with active polarization modulators such as solve the problem. The reason is that, in spite of their
Pockels cells. For emission, the modulator is randomly name, these ¬bers do not maintain polarization, as ex-
activated for each pulse to rotate the state of polariza- plained in Sec. III.B.2.
tion to one of the four states, while, at the receiver, it Recently, Townsend has also investigated such
randomly rotates half of the incoming pulses by 45°. It is polarization-encoding systems for QC on short-span
also possible to realize the whole system with ¬ber op- links up to 10 kilometers (1998a, 1998b) with photons at
tics components. 800 nm. It is interesting to note that, although he used
Antoine Muller and co-workers at the University of standard telecommunications ¬bers which could support
Geneva have used such a system to perform QC experi- more than one spatial mode at this wavelength, he was
ments over optical ¬bers (1993; see also Breguet et al., able to ensure single-mode propagation by carefully
1994). They created a key over a distance of 1100 meters controlling the launching conditions. Because of the
with photons at 800 nm. In order to increase the trans- problem discussed above, polarization coding does not
mission distance, they repeated the experiment with seem to be the best choice for QC in optical ¬bers. Nev-
photons at 1300 nm (Muller et al., 1995, 1996) and cre- ertheless, this problem is drastically reduced when con-
ated a key over a distance of 23 km. An interesting fea- sidering free-space key exchange, as air has essentially
ture of this experiment is that the quantum channel con- no birefringence at all (see Sec. IV.E).
necting Alice and Bob consisted of an optical ¬ber part
of an installed cable used by the telecommunications
company Swisscom for carrying phone conversations. It
runs between the Swiss cities of Geneva and Nyon, un- C. Phase coding
der Lake Geneva (Fig. 13). This was the ¬rst time QC
was performed outside of a physics laboratory. These The idea of encoding the value of qubits in the phase
experiments had a strong impact on the interest of the of photons was ¬rst mentioned by Bennett in the paper
wider public in the new ¬eld of quantum communica- in which he introduced the two-state protocol (1992). It
tion. is indeed a very natural choice for optics specialists.
These two experiments highlighted the fact that the State preparation and analysis are then performed with
polarization transformation induced by a long optical ¬- interferometers, which can be realized with single-mode
ber was unstable over time. Indeed, when monitoring optical ¬ber components.
the QBER of their system, Muller noticed that, although Figure 14 presents an optical ¬ber version of a Mach-
it remained stable and low for some time (on the order Zehnder interferometer. It is made out of two symmetric
of several minutes), it would suddenly increase after a couplers”the equivalent of beamsplitters”connected
while, indicating a modi¬cation of the polarization trans- to each other, with one phase modulator in each arm.
formation in the ¬ber. This implies that a real ¬ber- One can inject light into the setup, using a continuous
based QC system would require active alignment to and classical source, and monitor the intensity at the
compensate for this evolution. Although not impossible, output ports. Provided that the coherence length of the
such a procedure is certainly dif¬cult. James Franson did light used is larger than the path mismatch in the inter-
indeed implement an active-feedback alignment system ferometers, interference fringes can be recorded. Taking
(Franson and Jacobs, 1995), but did not pursue this line into account the /2 phase shift experienced upon re-
of research. It is interesting to note that replacing stan- ¬‚ection at a beamsplitter, the effect of the phase modu-

Rev. Mod. Phys., Vol. 74, No. 1, January 2002
Gisin et al.: Quantum cryptography

TABLE I. Implementation of the BB84 four-state protocol
with phase encoding.

Alice Bob
Bit value Bit value

0 0 0 0 0
0 0 /2 3 /2 ?
1 0 1
1 /2 /2 ?
0 /2 0 /2 ?
FIG. 14. Conceptual interferometric setup for quantum cryp- 0 /2 /2 0 0
tography using an optical ¬ber Mach-Zehnder interferometer: 1 3 /2 0 3 /2 ?
LD, laser diode; PM, phase modulator; APD, avalanche pho- 1 3 /2 /2 1

lators ( A and B ), and the path-length difference
Alice selected. When the phase difference equals /2 or
( L), the intensity in the output port labeled ˜˜0™™ is
3 /2, the bases are incompatible and the photon ran-
given by
domly chooses which port it takes at Bob™s coupler. This
kL scheme is summarized in Table I. We must stress that it
I 0 ¯ • cos2
I , (36) is essential with this scheme to keep the path difference
stable during a key exchange session. It should not
where k is the wave number and ¯ the intensity of the
I change by more than a fraction of a wavelength of the
source. If the phase term is equal to /2 n , where n is photons. A drift of the length of one arm would indeed
an integer, destructive interference is obtained. There- change the phase relation between Alice and Bob and
fore the intensity registered in port 0 reaches a mini- induce errors in their bit sequence.
mum, and all the light exits from port 1. When the phase It is interesting to note that encoding qubits with two-
term is equal to n , the situation is reversed: construc- path interferometers is formally isomorphic to polariza-
tive interference is obtained in port 0, while the intensity tion encoding. The two arms correspond to a natural
in port 1 goes to a minimum. With intermediate phase basis, and the weights c j of each qubit state
settings, light can be recorded in both ports. This device (c 1 e i /2,c 2 e i /2) are determined by the coupling ratio
acts like an optical switch. It is essential to keep the path of the ¬rst beamsplitter, while the relative phase is
difference stable in order to record stationary interfer- ´
introduced in the interferometer. The Poincare sphere
ences. representation, which applies to all two-level quantum
Although we have discussed the behavior of this inter- systems, can also be used to represent phase-coding
ferometer for classical light, it works exactly the same states. In this case, the azimuth angle represents the
when a single photon is injected. The probability of de- relative phase between the light that has propagated
tecting the photon in one output port can be varied by along the two arms. The elevation corresponds to the
changing the phase. It is the ¬ber optic version of coupling ratio of the ¬rst beamsplitter. States produced
Young™s double-slit experiment, in which the arms of the by a switch are on the poles, while those resulting from
interferometer replace the apertures. the use of a 50/50 beamsplitter lie on the equator. Figure
This interferometer combined with a single-photon 15 illustrates this analogy. Consequently, all polarization
source and photon-counting detectors can be used for schemes can also be implemented using phase coding.
QC. Alice™s setup consists of the source, the ¬rst coupler,
and the ¬rst phase modulator, while Bob takes the sec-
ond modulator and coupler, as well as the detectors. Let
us consider the implementation of the four-state BB84
protocol. On the one hand, Alice can apply one of four
phase shifts (0, /2, ,3 /2) to encode a bit value. She
associates 0 and /2 with bit 0, and and 3 /2 with bit
1. On the other hand, Bob performs a basis choice by
randomly applying a phase shift of either 0 or /2. He
associates the detector connected to the output port 0
with a bit value of 0, and the detector connected to port
1 with bit 1. When the difference of their phase is equal
to 0 or , Alice and Bob are using compatible bases and ´
FIG. 15. Poincare sphere representation of two-level quantum
they obtain deterministic results. In such cases, Alice states generated by two-path interferometers. The poles corre-
can infer from the phase shift she applied the output spond to the states generated by an interferometer in which
port chosen by the photon at Bob™s end and hence the the ¬rst coupler is replaced by a switch. The states generated
bit value he registered. Bob, on his side, deduces from with a symmetrical beamsplitter are on the equator. The azi-
the output port chosen by the photon the phase that muth indicates the phase between the two paths.

Rev. Mod. Phys., Vol. 74, No. 1, January 2002
170 Gisin et al.: Quantum cryptography

tally sensitive part of the system, provided that the
variations in the ¬ber are slower than their temporal
separations, determined by the interferometer™s imbal-
ance ( 5 ns). This condition is much less dif¬cult to
ful¬ll. In order to obtain good fringe visibility, and hence
a low error rate, the imbalances of the interferometers
must be equal to within a fraction of the coherence time
of the photons. This implies that the path differences
FIG. 16. Double Mach-Zehnder implementation of an inter- must be matched to within a few millimeters, which does
ferometric system for quantum cryptography: LD, laser diode; not constitute a problem. The imbalance must be chosen
PM, phase modulator; APD, avalanche photodiode. The inset so that it is possible to distinguish the three temporal
represents the temporal count distribution recorded as a func-
peaks clearly and thus discriminate interfering from
tion of the time passed since the emission of the pulse by Al-
noninterfering events. It must typically be larger than
ice. Interference is observed in the central peak.
the pulse length and the timing jitter of the photon-
counting detectors. In practice, the second condition is
Similarly, every coding using two-path interferometers the more stringent one. Assuming a time jitter of the
can be realized using polarization. However, in practice order of 500 ps, an imbalance of at least 1.5 ns keeps
one choice is often more convenient than the other, de- the overlap between the peaks low.
pending on circumstances like the nature of the quan- The main dif¬culty associated with this QC scheme is
tum channel.33 that the imbalances of Alice™s and Bob™s interferometers
must be kept stable to within a fraction of the wave-
length of the photons during a key exchange to maintain
1. The double Mach-Zehnder implementation
correct phase relations. This implies that the interferom-
Although the scheme presented in the previous sec- eters must lie in containers whose temperature is stabi-
tion works perfectly well on an optical table, it is impos- lized. In addition, for long key exchanges an active sys-
sible to keep the path difference stable when Alice and tem is necessary to compensate for drift.34 Finally, in
Bob are separated by more than a few meters. As men- order to ensure the indistinguishability of both interfer-
tioned above, the relative length of the arms should not ing processes, one must make sure that in each interfer-
change by more than a fraction of a wavelength. If Alice ometer the polarization transformation induced by the
and Bob are separated by 1 kilometer, for example, it is short path is the same as that induced by the long path.
clearly impossible to prevent path difference changes Both Alice and Bob must then use a polarization con-
smaller than 1 m caused by environmental variations. troller to ful¬ll this condition. However, the polarization
In his 1992 letter, Bennett also showed how to circum- transformation is rather stable in short optical ¬bers
vent this problem. He suggested using two unbalanced whose temperature is kept stable and which do not ex-
Mach-Zehnder interferometers, one for Alice and one perience strains. Thus this adjustment does not need to
for Bob, connected in series by a single optical ¬ber (see be repeated frequently.
Fig. 16). When monitoring counts as a function of the Paul Tapster and John Rarity of DERA, the Defence
time since the emission of the photons, Bob obtains Evalution and Research Agency (Malvern, England),
three peaks (see the inset in Fig. 16). The ¬rst one cor- working with Paul Townsend, were the ¬rst to test this
responds to the photons that chose the short path in system over a ¬ber optic spool of 10 km (Townsend
both Alice™s and Bob™s interferometers, while the last et al., 1993a, 1993b). Townsend later improved the inter-

<< . .

. 6
( : 12)

. . >>