<< . .

. 8
( : 12)



. . >>

durations. Both these errors could be lowered by in-
tion and solid angle, which is a constant, is therefore
creasing the separation between the central peak and
w2 2 2
. By multiplying the radiance by 2 , one
the sidebands, allowing reduced pulse widths and hence 0
shorter detection times and lower dark counts. Never- obtains the spectral power density. With an interference
theless, a compromise must be found since, in addition ¬lter of 1-nm width, the power incident on the detector
is 6 10 15 W, corresponding to 2 104 photons per sec-
to the technical drawbacks of high-speed modulation,
ond or 2 10 5 photons per nanosecond. This quantity
the polarization transformation in an optical ¬ber de-
pends on the wavelength. The remaining 2% of the is approximately two orders of magnitude larger than
QBERopt is due to polarization effects in the setup. the dark-count probability of Si APD™s, but still compat-
This system is another possible candidate. Its main ible with the requirements of QC. The performance of
advantage is that it could be used with a true single- free-space QC systems depends dramatically on atmo-
photon source if it existed. On the other hand, the con- spheric conditions and air quality. This is problematic for
tribution of imperfect interference visibility to the error urban applications where pollution and aerosols degrade
rate is signi¬cantly higher than that measured with plug- the transparency of air.

Rev. Mod. Phys., Vol. 74, No. 1, January 2002
175
Gisin et al.: Quantum cryptography


The ¬rst free-space QC experiment over a distance
of more than a few centimeters40 was performed by Ja-
cobs and Franson in 1996. They exchanged a key over a
distance of 150 m in a hallway illuminated with standard
¬‚uorescent lighting and over 75 m outdoors in bright
daylight without excessive QBER. Hughes and his team
were the ¬rst to exchange a key over more than one
FIG. 20. Multi-user implementation of quantum cryptography
kilometer under outdoor nighttime conditions (Buttler
with one Alice connected to three Bobs by optical ¬bers. The
et al., 1998; Hughes, Buttler, et al., 2000). More recently,
photons sent by Alice randomly choose to go to one or the
they even improved their system to reach a distance of
other Bob at a coupler.
1.6 km under daylight conditions (Buttler et al., 2000).
Finally, Rarity and co-workers performed a similar ex-
periment, in which they exchanged a key over a distance (Townsend et al., 1994; Phoenix et al., 1995; Townsend,
of 1.9 km under nighttime conditions (Gorman et al., 1997b). They used a passive optical ¬ber network archi-
2001). tecture in which one Alice, the network manager, is con-
Until quantum repeaters become available and allow nected to multiple network users (i.e., many Bobs; see
us to overcome the distance limitation of ¬ber-based Fig. 20). The goal is for Alice to establish a veri¬ably
QC, free-space systems seem to offer the only possibility secure and unique key with each Bob. In the classical
for QC over distances of more than a few dozen kilome- limit, the information transmitted by Alice is gathered
ters. A QC link could be established between ground- by all Bobs. However, because of their quantum behav-
based stations and a low-orbit (300“1200 km) satellite. ior, the photons are effectively routed at the beamsplit-
The idea is for Alice and Bob to each exchange a key ter to one, and only one, of the users. Using the double
(k A and k B , respectively) with the same satellite, using
Mach-Zehnder con¬guration discussed above, they
QC. Then the satellite publicly announces the value K
tested such an arrangement with three Bobs. Neverthe-
k A  k B , where  represents the XOR operator or,
less, because of the fact that QC requires a direct and
equivalently, the binary addition modulo 2 without carry.
low-attenuation optical channel between Alice and Bob,
Bob subtracts his key from this value to recover Alice™s
the ability to implement it over large and complex net-
key (k A Kk B ). 41 The fact that the key is known to
works appears limited.
the satellite operator may at ¬rst be seen as a disadvan-
tage. But this point might actually be conducive to the
development of QC, since governments always like to V. EXPERIMENTAL QUANTUM CRYPTOGRAPHY WITH
control communications. Although it has not yet been PHOTON PAIRS
demonstrated, Hughes as well as Rarity have
estimated”in view of their free-space experiments” The possibility of using entangled photon pairs for
that the dif¬culty can be overcome. The main dif¬culty quantum cryptography was ¬rst proposed by Ekert in
would come from beam pointing”do not forget that the 1991. In a subsequent paper, he investigated, with other
satellites will move with respect to the ground”and researchers, the feasibility of a practical system (Ekert
wandering induced by turbulence. In order to minimize et al., 1992). Although all tests of Bell™s inequalities (for
the latter problem, the photons would in practice prob- a review see, for example, Zeilinger, 1999) can be seen
ably be sent down from the satellite. Atmospheric tur-
as experiments in quantum cryptography, systems spe-
bulence is concentrated almost entirely in the ¬rst kilo-
ci¬cally designed to meet the special requirements of
meter above the earth™s surface. Another possibile way
QC, like quick changes of basis, have been implemented
to compensate for beam wander is to use adaptative op-
only recently.42 In 1999, three groups demonstrated
tics. Free-space QC experiments over distances of about
quantum cryptography based on the properties of en-
2 km constitute a major step towards key exchange
tangled photons. Their results were reported in the same
with a satellite. According to Buttler et al. (2000), the
issue of Phys. Rev. Lett. (Jennewein, Simon, et al., 2000;
optical depth is indeed similar to the effective atmo-
Naik et al., 2000; Tittel et al., 2000), illustrating the rapid
spheric thickness that would be encountered in a
progress in the still new ¬eld of quantum communica-
surface-to-satellite application.
tion.
One advantage of using photon pairs for QC is the
F. Multi-user implementations
fact that one can remove empty pulses, since the detec-
Paul Townsend and colleagues have investigated the
application of QC over multi-user optical ¬ber networks
42
This de¬nition of quantum cryptography applies to the fa-
mous experiment by Aspect and co-workers testing Bell™s in-
40
equalities with time-varying analyzers (Aspect et al., 1982). QC
Remember that Bennett and co-workers performed the
had, however, not yet been invented. It also applies to the
¬rst demonstration of QC over 30 cm in air (Bennett, Bessette,
more recent experiments closing locality loopholes, like the
et al., 1992).
41
one performed in Innsbruck using fast polarization modulators
This scheme could also be used with optical ¬ber implemen-
(Weihs et al., 1998) or the one performed in Geneva using two
tation provided that secure nodes existed. In the case of a
analyzers on each side (Tittel et al., 1999; Gisin and Zbinden,
satellite, one tacitly assumes that it constitutes such a secure
1999).
node.


Rev. Mod. Phys., Vol. 74, No. 1, January 2002
176 Gisin et al.: Quantum cryptography


tion of one photon of a pair reveals the presence of a
companion. In principle, it is thus possible to have a
probability of emitting a nonempty pulse equal to one.43
It is bene¬cial only because currently available single-
photon detectors feature a high dark-count probability.
The dif¬culty of always collecting both photons of a pair
somewhat reduces this advantage. One frequently hears
FIG. 21. Typical system for quantum cryptography exploiting
that photon pairs have the advantage of avoiding multi-
photon pairs entangled in polarization: PR, active polarization
photon pulses, but this is not correct. For a given mean
rotator; PBS, polarizing beamsplitter; APD, avalanche photo-
photon number, the probability that a nonempty pulse
diode.
contains more than one photon is essentially the same
for weak pulses as for photon pairs (see Sec. III.A.2).
A second advantage is that using entangled photons Generally speaking, entanglement-based systems are
pair prevents unintended information leakage in unused far more complex than setups based on faint laser
degrees of freedom (Mayers and Yao, 1998). Observing pulses. They will most certainly not be used in the near
a QBER lower than approximately 15%, or equivalently future for the realization of industrial prototypes. In ad-
observing that Bell™s inequality is violated, indeed guar- dition, the current experimental key creation rates ob-
tained with these systems are at least two orders of mag-
antees that the photons are entangled, so that the differ-
nitude smaller than those obtained with faint laser pulse
ent states are not fully distinguishable through other de-
setups (net rate on the order of a few tens of bits per
grees of freedom. A third advantage was indicated
second, in contrast to a few thousand bits per second for
recently by new and elaborate eavesdropping analyses.
a 10-km distance). Nevertheless, they offer interesting
The fact that passive state preparation can be imple-
possibilities in the context of cryptographic optical net-
mented prevents multiphoton splitting attacks (see Sec.
works. The photon-pair source can indeed be operated
VI.J).
by a key provider and situated somewhere in between
The coupling between the optical frequency and the
potential QC customers. In this case, the operator of the
property used to encode the qubit, i.e., decoherence, is
source has no way of getting any information about the
rather easy to master when using faint laser pulses.
key obtained by Alice and Bob.
However, this issue is more serious when using photon
It is interesting to emphasize the close analogy be-
pairs, because of the larger spectral width. For example,
tween one- and two-photon schemes, which was ¬rst
for a spectral width of 5 nm full width at half maximum
noted by Bennett, Brassard, and Mermin (1992). In a
(FWHM)”a typical value, equivalent to a coherence
two-photon scheme, when Alice detects her photon, she
time of 1 ps”and a ¬ber with a typical polarization
effectively prepares Bob™s photon in a given state. In the
mode dispersion of 0.2 ps/ km, transmission over a few
one-photon analog, Alice™s detectors are replaced by
kilometers induces signi¬cant depolarization, as dis-
sources, while the photon-pair source between Alice and
cussed in Sec. III.B.2. In the case of polarization-
Bob is bypassed. The difference between these schemes
entangled photons, this effect gradually destroys their
lies only in practical issues, like the spectral widths of
correlation. Although it is in principle possible to com-
the light. Alternatively, one can look at this analogy
pensate for this effect, the statistical nature of the polar-
ization mode dispersion makes this impractical.44 from a different point of view: in two-photon schemes, it
is as if Alice™s photon propagates backwards in time
Although perfectly ¬ne for free-space QC (see Sec.
from Alice to the source and then forward in time from
IV.E), polarization entanglement is thus not adequate
the source to Bob.
for QC over long optical ¬bers. A similar effect arises
when dealing with energy-time-entangled photons.
A. Polarization entanglement
Here, the chromatic dispersion destroys the strong time
correlations between the photons forming a pair. How-
A ¬rst class of experiments takes advantage of
ever, as discussed in Sec. III.B.3, it is possible to com-
polarization-entangled photon pairs. The setup, depicted
pensate passively for this effect either using additional
in Fig. 21, is similar to the scheme used for polarization
¬bers with opposite dispersion, or exploiting the inher-
coding based on faint pulses. A two-photon source emits
ent energy correlation of photon pairs.
pairs of entangled photons ¬‚ying back to back towards
Alice and Bob. Each photon is analyzed with a polariz-
ing beamsplitter whose orientation with respect to a
43
Photon-pair sources are often, though not always, pumped common reference system can be changed rapidly. The
continuously. In these cases, the time window determined by a results of two experiments were reported in the spring of
trigger detector and electronics de¬nes an effective pulse.
2000 (Jennewein, Simon, et al., 2000; Naik et al., 2000).
44
In the case of weak pulses, we saw that a full round trip
Both used photon pairs at a wavelength of 700 nm,
together with the use of Faraday mirrors circumvents the prob-
which were detected with commercial single-photon de-
lem (see Sec. IV.C.2). However, since the channel loss on the
tectors based on silicon APD™s. To create the photon
way from the source to the Faraday mirror inevitably increases
pairs, both groups took advantage of parametric down-
the fraction of empty pulses, the main advantage of photon
conversion in one or two -BaB2 O4 (BBO) crystals
pairs vanishes in such a con¬guration.


Rev. Mod. Phys., Vol. 74, No. 1, January 2002
177
Gisin et al.: Quantum cryptography




FIG. 22. Principle of phase-
coding quantum cryptography
using energy-time-entangled
photon pairs.




pumped by an argon-ion laser. The analyzers consisted In spite of their qualities, it would be dif¬cult to re-
of fast modulators that were used to rotate the polariza- produce these experiments over distances of more than
tion state of the photons, in front of polarizing beam- a few kilometers of optical ¬ber. As mentioned in the
splitters. introduction to this section, polarization is indeed not
The group of Anton Zeilinger, then at the University robust enough to avoid decoherence in optical ¬bers. In
of Innsbruck, demonstrated such a cryptosystem, includ- addition, the polarization state transformation induced
ing error correction, over a distance of 360 m (Jenne- by an installed ¬ber frequently ¬‚uctuates, making an ac-
wein, Simon, et al., 2000). Inspired by a test of Bell™s tive alignment system absolutely necessary. Neverthe-
inequalities performed with the same setup a year ear- less, these experiments are very interesting in the con-
lier (Weihs et al., 1998), they positioned the two-photon text of free-space QC.
source near the center between the two analyzers. Spe-
cial optical ¬bers, designed for guiding only a single
B. Energy-time entanglement
mode at 700 nm, were used to transmit the photons to
the two analyzers. The results of the remote measure- 1. Phase coding
ments were recorded locally, and the processes of key
Another class of experiments takes advantage of
sifting and error correction were implemented at a later
energy-time-entangled photon pairs. The idea originates
stage, long after the distribution of the qubits. Two dif-
from an arrangement proposed by Franson in 1989 to
ferent protocols were implemented: one based on Wig-
test Bell™s inequalities. As we shall see below, it is com-
ner™s inequality (a special form of Bell™s inequalities) and
parable to the double Mach-Zehnder con¬guration dis-
the other based on BB84.
cussed in Sec. IV.C.1. A source emits pairs of energy-
The group of Paul Kwiat, then at Los Alamos Na-
correlated photons, that were created at exactly the
tional Laboratory, demonstrated the Ekert protocol
same (unknown) time (see Fig. 22). This can be achieved
(Naik et al., 2000). This experiment was a table-top re-
by pumping a nonlinear crystal with a pump of long co-
alization in which the source and the analyzers were
herence time. The pairs of downconverted photons are
separated by only a few meters. The quantum channel
then split, and one photon is sent to each party down
consisted of a short free-space distance. In addition to
quantum channels. Both Alice and Bob possess a widely
performing QC, the researchers simulated different
but identically unbalanced Mach-Zehnder interferom-
eavesdropping strategies. As predicted by theory, they
eter, with photon-counting detectors connected to the
observed a rise in the QBER with an increase of the
outputs. Locally, if Alice or Bob change the phase of
information obtained by the eavesdropper. Moreover,
their interferometer, no effect on the count rates is ob-
they have also recently implemented the six-state proto-
served, since the imbalance prevents any single-photon
col described in Sec. II.D.2 and observed the predicted
interference. Looking at the detection time at Bob™s end
QBER increase to 33% (Enzer et al., 2001).
with respect to the arrival time at Alice™s end, three dif-
The main advantage of polarization entanglement is
ferent values are possible for each combination of detec-
that analyzers are simple and ef¬cient. It is therefore
tors. The different possibilities in a time spectrum are
relatively easy to obtain high contrast. Naik and co-
shown in Fig. 22. First, both photons can propagate
workers, for example, measured a polarization extinc-
through the short arms of the interferometers. Second,
tion of 97%, mainly limited by electronic imperfections
one can take the long arm at Alice™s end, while the other
of the fast modulators. This amounts to a QBERopt con-
one takes the short one at Bob™s, or vice versa. Finally,
tribution of only 1.5%. In addition, the constraint on the
both photons can propagate through the long arms.
coherence length of the pump laser is not very stringent
When the path differences of the interferometers are
(note that, if it is shorter than the length of the crystal,
matched to within a fraction of the coherence length of
some dif¬culties can arise, but we will not go into these
the downconverted photons, the short-short and the
here).

Rev. Mod. Phys., Vol. 74, No. 1, January 2002
178 Gisin et al.: Quantum cryptography




FIG. 24. Quantum cryptography system exploiting photons en-
FIG. 23. System for quantum cryptography based on phase-
tangled in energy-time and active basis choice. Note the simi-
coding entanglement: APD, avalanche photodiode. The pho-
larity to the faint-laser double Mach-Zehnder implementation
tons choose their bases randomly at Alice and Bob™s couplers.
depicted in Fig. 16.
long-long processes are indistinguishable, provided that
the coherence length of the pump photon is larger than 2001). It was the ¬rst experiment in which an asymmet-
the path-length difference. Conditioning detection ric setup optimized for QC was used instead of a system
only on the central time peak, one observes two- designed for tests of Bell™s inequality, with a source lo-
photon interferences”nonlocal quantum correlations cated midway between Alice and Bob (see Fig. 25). The
(Franson, 1989)45”that depend on the sum of the rela- two-photon source (a KNbO3 crystal pumped by a
tive phases in Alice™s and Bob™s interferometers (see Fig. doubled Nd-YAG laser) provided energy-time-
22). The phases of Alice™s and Bob™s interferometers can, entangled photons at nondegenerate wavelengths”one
for example, be adjusted so that both photons always at around 810 nm, the other centered at 1550 nm. This
emerge from the same output port. It is then possible to choice allowed the use of high-ef¬ciency silicon-based
exchange bits by associating values with the two ports. single-photon counters featuring low noise to detect the
This, however, is insuf¬cient. A second measurement ba- photons of the lower wavelength. To avoid the high
sis must be implemented to ensure security against transmission losses at this wavelength in optical ¬bers,
eavesdropping attempts. This measurement can be the distance between the source and the corresponding
made, for example, by adding a second interferometer analyzer was very short, of the order of a few meters.
to the systems (see Fig. 23). In this case, when reaching The other photon, at the wavelength where ¬ber losses
an analyzer, a photon chooses randomly to go to one or are minimal, was sent via an optical ¬ber to Bob™s inter-
the other interferometer. The second set of interferom- ferometer and then detected by InGaAs APD™s. The de-
eters can also be adjusted to yield perfect correlations coherence induced by chromatic dispersion was limited
between output ports. The relative phases between their by the use of dispersion-shifted optical ¬bers (see Sec.
arms should, however, be chosen so that when the pho- III.B.3).
tons go to interferometers that are not associated with Implementing the BB84 protocol in the manner dis-
each other, the outcomes are completely uncorrelated. cussed above, with a total of four interferometers, is dif-
Such a system features passive state preparation by ¬cult. Indeed, they must be aligned and their relative
Alice, yielding security against multiphoton splitting at- phase kept accurately stable during the whole key distri-
tacks (see Sec. VI.J). In addition, it also features a pas- bution session. To simplify this problem, we devised
sive basis choice by Bob, which constitutes an elegant birefringent interferometers with polarization multiplex-
solution: neither a random-number generator nor an ac- ing of the two bases. Consequently the constraint on the
tive modulator are necessary. It is nevertheless clear that stability of the interferometers was equivalent to that
QBERdet and QBERacc [de¬ned in Eq. (33)] are encountered in the faint-pulse double Mach-Zehnder
doubled, since the number of activated detectors is twice system. We obtained interference visibilities typically of
as high. This disadvantage is not as important as it ¬rst 92%, yielding in turn a QBERopt contribution of about
appears, since the alternative, a fast modulator, intro- 4%. We demonstrated QC over a transmission distance
duces losses close to 3 dB, also resulting in an increase of 8.5 km in a laboratory setting using a ¬ber on a spool
of these error contributions. The striking similarity be- and generated several megabits of key in hour-long ses-
tween this scheme and the double Mach-Zehnder ar-
rangement discussed in the context of faint laser pulses
in Sec. IV.C.1 is obvious when one compares Figs. 24
and 16.
This scheme was realized in the ¬rst half of 2000 by
our group at the University of Geneva (Ribordy et al.,


45
The imbalance of the interferometers must be large enough
so that the middle peak can easily be distinguished from the
satellite ones. This minimal imbalance is determined by the
FIG. 25. Schematic diagram of the ¬rst system designed and
convolution of the detector™s jitter (tens of picoseconds), the
optimized for long-distance quantum cryptography and ex-
electronic jitter (from tens to hundreds of picoseconds), and
the single-photon coherence time ( 1 ps). ploiting phase coding of entangled photons.


Rev. Mod. Phys., Vol. 74, No. 1, January 2002
179
Gisin et al.: Quantum cryptography


pump and A for Alice™s photon.46 However, the charac-
terization of the complete photon pair is still ambiguous,
since, at this point, the path of the photon that has trav-
eled to Bob (short or long in his interferometer) is un-
known to Alice. Figure 26 illustrates all processes lead-
ing to a detection in the different time slots both at
Alice™s and at Bob™s detector. Obviously, this reasoning
holds for any combination of two detectors. In order to
build up the secret key, Alice and Bob now publicly
agree about the events when both detected a photon in
one of the satellite peaks”without revealing in which
one”or both in the central peak”without revealing in
which detector. This procedure corresponds to key sift-
ing. For instance, in the example discussed above, if Bob
tells Alice that he has detected his photon in a satellite
peak, she knows that it must have been the left peak.
FIG. 26. Schematics of quantum cryptography using
This is because the pump photon has traveled via the
entangled-photon phase-time coding.
short arm, hence Bob can detect his photon either in the

<< . .

. 8
( : 12)



. . >>