<< . .

. 7
( : 12)



. . >>

one corresponds to photons that chose both the long ferometer by replacing Bob™s input coupler with a polar-
paths. Finally, the central peak corresponds to photons ization splitter to suppress the lateral noninterfering
that chose the short path in Alice™s interferometer and peaks (1994). In this case, it is again unfortunately nec-
the long one in Bob™s, and vice versa. If these two pro- essary to align the polarization state of the photons at
cesses are indistinguishable, they produce interference. Bob™s end, in addition to stabilizing the imbalance in the
A timing window can be used to discriminate between interferometers. He later thoroughly investigated key
interfering and noninterfering events. If the latter are exchange with phase coding and improved the transmis-
disregarded, it is then possible for Alice and Bob to ex- sion distance (Marand and Townsend, 1995; Townsend,
change a key. 1998b). He also tested the possibility of multiplexing a
The advantage of this setup is that both ˜˜halves™™ of
the photon travel in the same optical ¬ber. They thus
experience the same optical length in the environmen- 34
Polarization coding requires the optimization of three pa-
rameters (three parameters are necessary for unitary polariza-
tion control). In comparison, phase coding requires optimiza-
33
Note, in addition, that using many-path interferometers tion of only one parameter. This is possible because the
opens up the possibility of coding quantum systems of dimen- coupling ratios of the beamsplitters are ¬xed. Both solutions
sions larger than 2, like qutrits, ququarts, etc. (Bechmann- would be equivalent if one could limit the polarization evolu-
Pasquinucci and Peres, 2000; Bechmann-Pasquinucci and Tit- tion to rotations of the elliptic states without changes in the
tel, 2000; Bourennane, Karlsson, and Bjorn, 2001). ellipticity.


Rev. Mod. Phys., Vol. 74, No. 1, January 2002
171
Gisin et al.: Quantum cryptography


quantum channel using two different wavelengths with
conventional data transmission over a single optical ¬ber
(Townsend, 1997a). Richard Hughes and co-workers
from Los Alamos National Laboratory have also exten-
sively tested such an interferometer (1996; Hughes, Mor-
gan, and Peterson, 2000) up to distances of 48 km of
installed optical ¬ber.35

2. ˜˜Plug-and-play™™ systems

As discussed in the two previous sections, both polar-
ization and phase coding require active compensation of
FIG. 17. Evolution of the polarization state of a light pulse
optical path ¬‚uctuations. A simple approach would be to
´
represented on the Poincare sphere over a round-trip propa-
alternate between adjustment periods”when pulses
gation along an optical ¬ber terminated by a Faraday mirror.
containing large numbers of photons are exchanged be-
tween Alice and Bob to adjust the compensating system
correcting for slow drifts in phase or polarization”and symmetry through the equatorial plane: the north and
qubits transmission periods, when the number of pho- m ’(m 1 ,m 2 ,
south hemispheres are exchanged
tons is reduced to a quantum level. m 3 ) , or in terms of the qubit state vector,
An approach invented in 1989 by Martinelli, then at
*
CISE Tecnologie Innovative in Milano, allows one to 1 2

T:
*. (37)
automatically and passively compensate for all polariza- 2 1
tion ¬‚uctuations in an optical ¬ber (see also Martinelli,
This is a simple representation, but some attention has
1992). Let us ¬rst consider what happens to the polar-
to be paid. This transformation is not unitary. Indeed,
ization state of a light pulse traveling through an optical
the above description switches from a right-handed ref-
¬ber, before being re¬‚ected by a Faraday mirror”a mir-
˜
ror with a /4 Faraday rotator36 in front. We must ¬rst erence frame XYZ to a left-handed one XYZ , where
˜
de¬ne a convenient description of the change in polar- Z Z. There is nothing wrong in doing this, and this
explains the nonunitary polarization transformation.37
ization of light re¬‚ected by a mirror at normal incidence.
Let the mirror be in the x-y plane and z be the optical Note that other descriptions are possible, but they re-
axis. Clearly, all linear polarization states are unchanged quire arti¬cially breaking the XY symmetry. The main
by a re¬‚ection. However, right-handed circular polariza- reason for choosing this particular transformation is that
tion is changed into left-handed and vice versa. Actually, the description of the polarization evolution in the opti-
after a re¬‚ection the rotation continues in the same cal ¬ber before and after the re¬‚ection is then straight-
sense, but since the propagation direction is reversed, forward. Indeed, let U e i B l /2 describe this evolu-
right-handed and left-handed polarizations are swapped.
tion under the effect of some modal birefringence B in a
The same holds for elliptic polarization states: the axes
¬ber section of length l (where is the vector whose
of the ellipse are unchanged, but right and left are ex-
components are the Pauli matrices). Then the evolution
´
changed. Accordingly, on a Poincare sphere the polar-
after re¬‚ection is simply described by the inverse opera-
ization transformation upon re¬‚ection is described by a
tor U 1 e i B l /2. Now that we have a description of
the mirror, let us add the Faraday rotator. It produces a
´
/2 rotation of the Poincare sphere around the north-
35
Note that in this experiment, Hughes and co-workers used i z /4 (see Fig. 17). Because the Fara-
south axis: F e
an unusually high mean number of photons per pulse. They
day effect is nonreciprocal (remember that it is due to a
used a mean photon number of approximately 0.6 in the cen-
magnetic ¬eld, which can be thought of as produced by a
tral interference peak, corresponding to a 1.2 in the pulses
spiraling electric current), the direction of rotation
leaving Alice. The latter value is the relevant one for eaves-
around the north-south axis is independent of the light
dropping analysis, since Eve could use an interferometer”
propagation direction. Accordingly, after re¬‚ection on
conceivable with present technology”in which the ¬rst cou-
pler was replaced by an optical switch and that allowed her to the mirror, the second passage through the Faraday ro-
exploit all the photons sent by Alice. In light of this high and tator rotates the polarization in the same direction (see
optical losses (22.8 dB), one may argue that this implementa- again Fig. 17) and is described by the same operator F.
tion was not secure, even when taking into account only so- Consequently, the total effect of a Faraday mirror is to
called realistic eavesdropping strategies (see Sec. VI.I). Finally,
it is possible to estimate the results that other groups would
have obtained if they had used a similar value of . One then
37
¬nds that key distribution distances of the same order could Note that this transformation is positive, but not completely
have been achieved. This illustrates that the distance is a some- positive. It is thus closely connected to the partial transposition
what arbitrary ¬gure of merit for a QC system. map (Peres, 1996). If several photons are entangled, then it is
36
These commercially available components are extremely crucial to describe all of them in frames with the same chirality.
compact and convenient when using telecommunications Actually that this is necessary is the content of the Peres-
wavelengths, which is not true for other wavelengths. Horodecki entanglement witness (Horodecki et al., 1996).


Rev. Mod. Phys., Vol. 74, No. 1, January 2002
172 Gisin et al.: Quantum cryptography


change any incoming polarization state into its orthogo-
nal state: m ’ m . This is best seen in Fig. 17 but can
also be expressed mathematically:
*
1 2

FTF:
*. (38)
2 1
FIG. 18. Self-aligned plug-and-play system: LD, laser diode;
Finally, the whole optical ¬ber can be modeled as con-
APD, avalanche photodiode; Ci , ¬ber coupler; PMj , phase
sisting of a discrete number of birefringent elements. If
modulator; PBS, polarizing beamsplitter; DL, optical delay
there are N such elements in front of the Faraday mir-
line; FM, Faraday mirror; DA , classical detector.
ror, the change in polarization during a round trip can be
expressed (recall that the operator FTF only changes
realization of this scheme in greater detail: A short and
the sign of the corresponding Bloch vector m )
bright laser pulse is injected into the system through a
as
circulator. It splits at a coupler. One of the half pulses,
U 1 1 ¯ U N 1 FTFU N ¯ U 1 FTF. (39)
labeled P 1 , propagates through the short arm of Bob™s
setup directly to a polarizing beamsplitter. The polariza-
The output polarization state is thus orthogonal to the
tion transformation in this arm is set so that it is fully
input one, regardless of any birefringence in the ¬bers.
transmitted. P 1 is then sent through the ¬ber optic link.
This approach can thus correct for time-varying birefrin-
The second half pulse, labeled P 2 , takes the long arm to
gence changes, provided that they are slow compared to
the polarizing beamsplitter. The polarization evolution is
the time required for the light to make a round trip (a
such that P 2 is re¬‚ected. A phase modulator present in
few hundred microseconds).
this long arm is left inactive so that it imparts no phase
By combining this approach with time multiplexing in
shift to the outgoing pulse. P 2 is also sent through the
a long-path interferometer, it is possible to implement a
link, with a delay on the order of 200 ns. Both half
quantum cryptography system based on phase coding in
pulses travel to Alice. P 1 goes through a coupler. The
which all optical and mechanical ¬‚uctuations are auto-
diverted light is detected with a classical detector to pro-
matically and passively compensated for (Muller et al.,
vide a timing signal. This detector is also important in
1997). We performed the ¬rst experiment on such a sys-
preventing so-called Trojan horse attacks, which are dis-
tem in early 1997 (Zbinden et al., 1997), and a key was
cussed in Sec. VI.K. The nondiverted light then propa-
exchanged over a 23-km installed optical ¬ber cable (the
gates through an attenuator and an optical delay line”
same one as was used in the polarization coding experi-
consisting simply of an optical ¬ber spool”whose role
ments mentioned above). This setup featured a high in-
will be explained later. Finally, it passes a phase modu-
terference contrast (fringe visibility of 99.8%) and excel-
lator before being re¬‚ected by the Faraday mirror. P 2
lent long-term stability and clearly established the value
follows the same path. Alice brie¬‚y activates her modu-
of the approach for QC. The fact that no optical adjust-
lator to apply a phase shift on P 1 only, in order to en-
ments were necessary earned it the nickname of ˜˜plug-
code a bit value exactly as in the traditional phase-
and-play™™ setup. It is interesting to note that the idea of
coding scheme. The attenuator is set so that when the
combining time multiplexing with Faraday mirrors was
pulses leave Alice, they contain no more than a fraction
¬rst used to implement an ˜˜optical microphone™™
(Breguet and Gisin, 1995).38
´ of a photon. When they reach the polarizing beamsplit-
ter after their return trip through the link, the polariza-
However, our ¬rst realization still suffered from cer-
tion state of the pulses is exactly orthogonal to what it
tain optical inef¬ciencies, and it has been improved since
was when they left, thanks to the effect of the Faraday
then. Like the setup tested in 1997, the new system is
mirror. P 1 is then re¬‚ected instead of being transmitted.
based on time multiplexing, in which the interfering
It takes the long arm to the coupler. When it passes, Bob
pulses travel along the same optical path, but now, in
activates his modulator to apply a phase shift used to
different time ordering. A schematic is shown in Fig. 18.
implement his basis choice. Similarly, P 2 is transmitted
Brie¬‚y, the general idea is that pulses emitted at Bob™s
and takes the short arm. Both pulses reach the coupler
end can travel along one of two paths: they can go via
at the same time and they interfere. Single-photon de-
the short arm, be re¬‚ected at the Faraday mirror (FM)
tectors are then used to record the output port chosen
at Alice™s end, and ¬nally, back at Bob™s, setup travel via
by the photon.
the long arm. Or, they travel ¬rst via the long arm at
We implemented the four full-state BB84 protocol
Bob™s end, get re¬‚ected at Alice™s end, and return via the
with this setup. The system was tested once again on the
short arm of Bob™s setup. These two possibilities then
same installed optical ¬ber cable linking Geneva and
superpose on beamsplitter C 1 . We shall now explain the
Nyon (23 km; see Fig. 13) at 1300 nm, and we observed
a very low QBERopt 1.4% (Ribordy et al., 1998, 2000).
Proprietary electronics and software were developed to
38
Note that since then, we have used this interferometer for
allow for fully automated and user-friendly operation of
various other applications: a nonlinear index-of-refraction
the system. Because of the intrinsically bidirectional na-
measurement in ¬bers (Vinegoni, Wegmuller, and Gisin, 2000)
ture of this system, great attention had to be paid to
and an optical switch (Vinegoni, Wegmuller, Huttner, and Gi-
Rayleigh backscattering. Light traveling in an optical ¬-
sin, 2000).


Rev. Mod. Phys., Vol. 74, No. 1, January 2002
173
Gisin et al.: Quantum cryptography


ber undergoes scattering by inhomogeneities. A small
fraction ( 1%) of this light is recaptured by the ¬ber in
the backward direction. When the repetition rate is high
enough, pulses traveling to and from Alice must inter-
sect at some point along the line. Their intensity, how-
ever, is strongly different. The pulses are more than a
thousand times brighter before than after re¬‚ection
from Alice. Backscattered photons can accompany a FIG. 19. Implementation of sideband modulation: LD, laser
quantum pulse propagating back to Bob and induce diode; A, attenuator; PMi , optical phase modulator; j , elec-
false counts. We avoided this problem by making sure tronic phase controller; RFOk , radio frequency oscillator; FP,
that pulses traveling to and from Bob are not present in Fabry-Perot ¬lter; APD, avalanche photodiode.
the line simultaneously. They are emitted by Bob in the
form of trains. Alice stores these trains in her optical of optical waves (approximately 200 THz at 1550 nm),
delay line, which consists of an optical ¬ber spool. Bob this condition is dif¬cult to ful¬ll. One solution is to use
waits until all the pulses of a train have reached him self-aligned systems like the plug-and-play setups dis-
before sending the next one. Although it completely cussed in the previous section. Goedgebuer and his team
solves the problem of Rayleigh backscattering-induced from the University of Besancon, in France, introduced
¸
errors, this con¬guration has the disadvantage of reduc- an alternative solution (Sun et al., 1995; Mazurenko
ing the effective repetition frequency. A storage line half ´
et al., 1997; Merolla et al., 1999; see also Molotkov,
as long as the transmission line amounts to a reduction 1998). Note that the title of this section is not completely
of the bit rate by a factor of approximately 3. accurate, since the value of the qubits is coded not in the
Researchers at IBM simultaneously and indepen- frequency of the light, but in the relative phase between
dently developed a similar system at 1300 nm (Bethune sidebands of a central optical frequency.
and Risk, 2000). However, they avoided the problems Their system is depicted in Fig. 19. A source emits
associated with Rayleigh backscattering by reducing the short pulses of classical monochromatic light with angu-
intensity of the pulses emitted by Bob. Since these could lar frequency S . A ¬rst phase modulator PMA modu-
not be used for synchronization purposes any longer, lates the phase of this beam with a frequency S and
they added a wavelength-multiplexed classical channel a small modulation depth. Two sidebands are thus gen-
(1550 nm) in the line to allow Bob and Alice to synchro- erated at frequencies S . The phase modulator is
nize their systems. They tested their setup on a 10-km driven by a radio-frequency oscillator RFOA whose
optical ¬ber spool. Both of these systems are equivalent phase A can be varied. Finally, the beam is attenuated
and exhibit similar performances. In addition, the group so that the sidebands contain much less than one photon
of Anders Karlsson at the Royal Institute of Technology per pulse, while the central peak remains classical. After
in Stockholm veri¬ed in 1999 that this technique also the transmission link, the beam experiences a second
works at a wavelength of 1550 nm (Bourennane et al., phase modulation applied by PMB . This phase modula-
1999, 2000). These experiments demonstrate the poten- tor is driven by a second radio-frequency oscillator
tial of plug-and-play-like systems for real-world quan- RFOB with the same frequency and phase B . These
tum key distribution. They certainly constitute a good oscillators must be synchronized. After passing through
candidate for the realization of prototypes. this device, the beam contains the original central fre-
Their main disadvantage with respect to the other sys- quency S , the sidebands created by Alice, and the
tems discussed in this section is that they are more sen- sidebands created by Bob. The sidebands at frequencies
sitive to Trojan horse strategies (see Sec. VI.K). Indeed, are mutually coherent and thus yield interfer-
S
Eve could send a probe beam and recover it through the ence. Bob can then record the interference pattern in
strong re¬‚ection by the mirror at the end of Alice™s sys- these sidebands after removal of the central frequency
tem. To prevent such an attack, Alice adds an attenuator and the higher-order sidebands with a spectral ¬lter.
to reduce the amount of light propagating through her To implement the B92 protocol (see Sec. II.D.1), Al-
system. In addition, she must monitor the incoming in- ice randomly chooses the value of the phase A for
tensity using a classical linear detector. Systems based on each pulse. She associates a bit value of 0 with phase 0
this approach cannot be operated with a true single- and a bit value of 1 with phase . Bob also randomly
photon source and thus will not bene¬t from the chooses whether to apply a phase B of 0 or . One can
progress in this ¬eld.39 see that if A 0, the interference is constructive
B
and Bob™s single-photon detector has a nonzero prob-
D. Frequency coding ability of recording a count. This probability depends on
the number of photons initially present in the sideband,
Phase-based systems for QC require phase synchroni- as well as on the losses induced by the channel. On the
zation and stabilization. Because of the high frequency other hand, if A , interference is destructive,
B
and no count will ever be recorded. Consequently, Bob
can infer, every time he records a count, that he applied
39 the same phase as Alice. When a given pulse does not
The fact that the pulses make a round trip implies that
yield a detection, the reason can be that the phases ap-
losses are doubled, yielding a reduced counting rate.


Rev. Mod. Phys., Vol. 74, No. 1, January 2002
174 Gisin et al.: Quantum cryptography


plied were different and destructive interference took and-play systems. In addition, if this system is to be truly
independent of polarization, it is essential to ensure that
place. It can also mean that the phases were actually
the phase modulators have very low polarization depen-
equal, but the pulse was empty or the photon got lost.
dency. In addition, the stability of the frequency ¬lter
Bob cannot decide between these two possibilities.
may constitute a practical dif¬culty.
From a conceptual point of view, Alice sends one of two
nonorthogonal states. There is then no way for Bob to
distinguish between them deterministically. However, he
can perform a generalized measurement, also known as E. Free-space line-of-sight applications
a positive operator value measurement, which will some-
Since optical ¬ber channels may not always be avail-
times fail to give an answer, but at all other times gives
able, several groups are trying to develop free-space
the correct one.
line-of-sight QC systems capable, for example, of dis-
Eve could perform the same measurement as Bob.
tributing a key between building rooftops in an urban
When she obtains an inconclusive result, she could just
setting.
block both the sideband and the central frequency so
Of course it may sound dif¬cult to detect single pho-
that she does not have to guess a value and does not risk
tons amidst background light, but the ¬rst experiments
introducing an error. To prevent her from doing that,
have already demonstrated the feasibility of free-space
Bob veri¬es the presence of this central frequency. Now
QC. Sending photons through the atmosphere also has
if Eve tries to conceal her presence by blocking only the
advantages, since this medium is essentially nonbirefrin-
sideband, the reference central frequency will still have
gent (see Sec. III.B.4). It is then possible to use plain
a certain probability of introducing an error. It is thus
polarization coding. In addition, one can ensure very
possible to catch Eve in both cases. The monitoring of
high channel transmission over long distances by care-
the reference beam is essential in all two-state protocols
fully choosing the wavelength of the photons (see again
to reveal eavesdropping. In addition, it was shown that
Sec. III.B.4). The atmosphere has, for example, a high
this reference-beam monitoring can be extended to the
transmission ˜˜window™™ in the vicinity of 770 nm (trans-
four-state protocol (Huttner et al., 1995).
mission as high as 80% can occur between a ground
The advantage of this setup is that the interference is
station and a satellite), which happens to be compatible
controlled by the phase of the radio-frequency oscilla-
with commercial silicon APD photon-counting modules
tors. Their frequency is six orders of magnitude smaller
(detection ef¬ciency can be as high as 65% with low
than the optical frequency and thus considerably easier
noise).
to stabilize and synchronize. It is indeed a relatively
The systems developed for free-space applications are
simple task, which can be achieved by electronic means.
actually very similar to that shown in Fig. 12. The main
The Besancon group performed key distribution with
¸
difference is that the emitter and receiver are connected
such a system. The source they used was a distributed
by telescopes pointing at each other, instead of by an
Bragg re¬‚ector (DBR) laser diode at a wavelength of
optical ¬ber. The contribution of background light to
1540 nm and a bandwidth of 1 MHz. It was externally
errors can be maintained at a reasonable level by using a
modulated to obtain 50-ns pulses, thus increasing the
combination of timing discrimination (coincidence win-
bandwidth to about 20 MHz. They used two identical
dows of typically a few nanoseconds), spectral ¬ltering
LiNbO3 phase modulators operating at a frequency
(interference ¬lters 1 nm), and spatial ¬ltering (cou-
/2 300 MHz. Their spectral ¬lter was a Fabry-Perot
pling into an optical ¬ber). This can be illustrated by the
cavity with a ¬nesse of 55. Its resolution was 36 MHz.
following simple calculation. Let us suppose that
They performed key distribution over a 20-km single-
the isotropic spectral background radiance is
mode optical ¬ber spool, recording a QBERopt contri-
10 2 W m 2 nm 1 sr 1 at 800 nm. This corresponds to
bution of approximately 4%. They estimated that 2%
the spectral radiance of a clear zenith sky with a sun
could be attributed to the transmission of the central
elevation of 77° (Zissis and Larocca, 1978). The diver-
frequency by the Fabry-Perot cavity. Note also that the
gence of a Gaussian beam with radius w 0 is given by
detector noise was relatively high due to the long pulse
/w 0 . The product of beam (telescope) cross sec-

<< . .

. 7
( : 12)



. . >>