to photon pairs by Brendel et al. (1995).

based systems; but it is equally a concern for phase based

20

PM ¬bers might be of use for phase based QC systems.

systems, since the interference visibility depends on the

However, this requires the whole setup “ transmission lines

polarization states. Hence, although polarization e¬ects

as well as interferometers at Alice™s and Bob™s “ to be made

are not the only source of di¬culties, we shall describe

of PM ¬bers. While this is principally possible, the need of

them in some detail, distinguishing between 4 e¬ects: the

installing a completely new ¬ber network makes this solution

geometrical one, birefringence, polarization mode disper-

not very practical.

15

Alice and Bob can compensate for it. The e¬ect of bire- ni¬cant in components like phase modulators. In par-

fringence is thus similar to the geometrical e¬ect, though, ticular, some integrated optics waveguides actually guide

in addition to a rotation, it may also a¬ect the elliptic- only one mode and thus behave almost like polarizers

ity. Stability of birefringence requires slow thermal and (e.g. proton exchange waveguides in LiNbO3 ). PDL

mechanical variations. is usually stable, but if connected to a ¬ber with some

Polarization Mode Dispersion (PMD) is the pres- birefringence, the relation between the polarization state

ence of two di¬erent group velocities for two orthogonal and the PDL may ¬‚uctuate, producing random outcomes

polarization modes. It is due to a delicate combination (Elamari et al. 1998). PDL cannot be described by a uni-

of two causes. First, birefringence produces locally two tary operator acting in the polarization state space (but

group velocities. For optical ¬bers, this local modal dis- it is of course unitary in a larger space (Huttner et al.

persion is in good approximation equal to the phase dis- 1996a). It does thus not preserve the scalar product. In

persion, of the order of a few ps/km. Hence, locally an particular, it can turn non-orthogonal states into orthog-

optical pulse tends to split into a fast mode and a slow onal ones which can then be distinguished unambiguously

mode. But because the birefringence is small, the two (at the cost of some loss) (Huttner et al. 1996a, Clarke et

modes couple easily. Hence any small imperfection along al. 2000). Note that this could be used by Eve, specially

the ¬ber produces polarization mode coupling: some en- to eavesdrop on the 2-state protocol (paragraph II D 1).

ergy of the fast mode couples into the slow mode and Let us conclude this paragraph on polarization e¬ects

vice-versa. PMD is thus similar to a random walk21 and in ¬bers by mentioning that they can be passively com-

grows only with the square root of the ¬ber length. It pensated, provided one uses a go-&-return con¬guration,

is expressed in √ps , with values as low as 0.1 √ps for using Faraday mirrors, as described in section IV C 2.

km km

modern ¬bers and possibly as high as 0.5 or even 1 √ps km

for older ones.

3. Chromatic dispersion e¬ects in singlemode ¬bers

Typical lengths for the polarization mode coupling

vary from a few meters up to hundreds of meters. The

In addition to polarization e¬ects, chromatic disper-

stronger the coupling, the weaker the PMD (the two

sion (CD) can cause problems for quantum cryptography

modes do not have time to move away between the cou-

as well. For instance, as explained in sections IV C and

plings). In modern ¬bers, the couplings are even arti¬-

V B, schemes implementing phase- or phase-and-time-

cially increased during the drawing process of the ¬bers

coding rely on photons arriving at well de¬ned times,

(Hart et al. 1994, Li and Nolan 1998). Since the cou-

that is on photons well localized in space. However, in

plings are exceedingly sensitive, the only reasonable de-

dispersive media like optical ¬bers, di¬erent group ve-

scription is a statistical one, hence PMD is described as

locities act as a noisy environment on the localization of

a statistical distribution of delays δ„ . For long enough

the photon as well as on the phase acquired in an inter-

¬bers, the statistics is Maxwellian and PMD is related to

ferometer. Hence, the broadening of photons featuring

the ¬ber length „“, the mean coupling length h, the mean

non-zero bandwidth, or, in other words, the coupling be-

modal birefringence B and to the RMS delay as follows

tween frequency and position must be circumvented or

2

(Gisin et al. 1995): PMD≡ << δ„ >> = Bh „“/h.

controlled. This implies working with photons of small

PMD could cause depolarization which would be devas-

bandwidth, or, as long as the bandwidth is not too large,

tating for quantum communication, similar to any deco-

operating close to the wavelength »0 where chromatic

herence in quantum information processing. But fortu-

dispersion is zero, i.e. for standard ¬bers around 1310

nately, for quantum communication the remedy is easy, it

nm. Fortunately, ¬ber losses are relatively small at this

su¬ces to use a source with a coherence time larger than

wavelength and amount to ≈0.35 dB/km. This region

the largest delay δ„ . Hence, when laser pulses are used

is called the second telecommunication window22 . There

(with typical spectral widths ∆» ¤ 1 nm, corresponding

are also special ¬bers, called dispersion-shifted, with a

to a coherence time ≥ 3 ps, see paragraph III A 1), PMD

refractive index pro¬le such that the chromatic disper-

is no real problem. For photons created by parametric

sion goes to zero around 1550 nm, where the attenuation

down conversion, however, PMD can impose severe lim-

is minimal (Neumann 1988)23 .

itations since ∆» ≥ 10 nm (coherence time ¤ 300 fs) is

not unusual.

Polarization Dependent Losses (PDL) is a di¬er-

ential attenuation between two orthogonal polarization 22

The ¬rst one, around 800 nm, is almost no longer used. It

modes. This e¬ect is negligible in ¬bers, but can be sig-

was motivated by the early existence of sources and detectors

at this wavelength. The third window is around 1550 nm

where the attenuation reaches an absolute minimum (Thomas

et al. 2000) and where erbium doped ¬bers provide convenient

21

In contrast to Brownian motion describing particles di¬u- ampli¬ers (Desurvire 1994).

sion in space as time passes, here photons di¬use in time as 23

Chromatic dispersion in ¬bers is mainly due to the mate-

they propagate along the ¬ber. rial, essentially silicon, but also to the refractive index pro¬le.

16

CD does not constitute a problem in case of faint laser Transmission over free space features some advan-

pulses where the bandwidth is small. However, it be- tages compared to the use of optical ¬bers. The atmo-

comes a serious issue when utilizing photon pairs cre- sphere has a high transmission window at a wavelength

ated by parametric downconversion. For instance, send- of around 770 nm (see Fig. 8) where photons can eas-

ing photons of 70 nm bandwidth (as used in our long- ily be detected using commercial, high e¬ciency photon

distance Bell inequality tests, Tittel et al. 1998) down counting modules (see chapter III C 1). Furthermore, the

10 km of optical ¬bers leads to a temporal spread of atmosphere is only weakly dispersive and essentially non-

birefringent25 at these wavelengths. It will thus not alter

around 500 ps (assuming photons centered at »0 and a

ps

typical dispersion slope of 0.086 nm2 km ). However, this the polarization state of a photon.

can be compensated for when using energy-time entan- However, there are some drawbacks concerning free-

gled photons (Franson 1992, Steinberg et al. 1992a and space links as well. In contrast to transmitting a signal

1992b, Larchuk et al. 1995). In contrast to polariza- in a guiding medium where the energy is “protected” and

tion coding where frequency and the physical property remains localized in a small region in space, the energy

used to implement the qubit are not conjugate variables, transmitted via a free-space link spreads out, leading to

frequency and time (thus position) constitute a Fourier higher and varying transmission losses. In addition to

pair. The strict energy anti-correlation of signal and idler loss of energy, ambient daylight, or even light from the

photon enables one to achieve a dispersion for one pho- moon at night, might couple into the receiver, leading

ton which is equal in magnitude but opposite in sign to to a higher error rate. However, the latter errors can be

that of the sister photon, corresponding thus to the same maintained at a reasonable level by using a combination

delay24 (see Fig. 7). The e¬ect of broadening of the two of spectral ¬ltering (¤ 1 nm interference ¬lters), spatial

wave packets then cancels out and two simultaneously ¬ltering at the receiver and timing discrimination using

emitted photons stay coincident. However, note that the a coincidence window of typically a few ns. Finally, it

arrival time of the pair varies with respect to its emission is clear that the performance of free-space systems de-

time. The frequency anticorrelation provides also the pends dramatically on atmospheric conditions and is

basis for avoiding decrease of visibility due to di¬erent possible only with clear weather.

wavepacket broadening in the two arms of an interferom- Finally, let us brie¬‚y comment on the di¬erent sources

eter. And since the CD properties of optical ¬bers do leading to coupling losses. A ¬rst concern is the trans-

not change with time “ in contrast to birefringence “ no mission of the signals through a turbulent medium, lead-

on-line tracking and compensation is required. It thus ing to arrival-time jitter and beam wander (hence prob-

turns out that phase and phase-time coding is particu- lems with beam pointing). However, as the time-scales for

larly suited to transmission over long distances in optical atmospheric turbulences involved are rather small “

¬bers: nonlinear e¬ects decohering the qubit “energy” around 0.1 to 0.01 s “, the time jitter due to a varia-

are completely negligible, and CD e¬ects acting on the tion of the e¬ective refractive index can be compensated

localization can be avoided or compensated for in many for by sending a reference pulse at a di¬erent wavelength

cases. at short time (around 100 ns) before each signal pulse.

Since this reference pulse experiences the same atmo-

spheric conditions as the subsequent one, the signal will

4. Free-space links arrive essentially without jitter in the time-window de-

¬ned by the arrival of the reference pulse. In addition,

the reference pulse can be re¬‚ected back to the transmit-

Although telecommunication based on optical ¬bers is

ter and used to correct the direction of the laser beam by

very advanced nowadays, such channels may not always

means of adaptive optics, hence to compensate for beam

be available. Hence, there is also some e¬ort in devel-

wander and to ensure good beam pointing

oping free space line-of-sight communication systems -

Another issue is the beam divergence, hence increase of

not only for classical data transmission but for quantum

spot size at the receiver end caused by di¬raction at the

cryptography as well (see Hughes et al. 2000a and Gor-

transmitter aperture. Using for example 20 cm diameter

man et al. 2000).

optics, the di¬raction limited spot size after 300 km is

of ≈ 1 m. This e¬ect can in principle be kept small

taking advantage of larger optics. However, it can also

be of advantage to have a spot size large compared to the

Indeed, longer wavelengths feel regions further away from the

receiver™s aperture in order to ensure constant coupling

core where the refractive index is lower. Dispersion-shifted

in case of remaining beam wander. In their 2000 paper,

¬bers have, however, been abandoned by today™s industry, be-

cause it turned out to be simpler to compensate for the global

chromatic dispersion by adding an extra ¬ber with high neg-

ative dispersion. The additional loss is then compensated by

25

an erbium doped ¬ber ampli¬er. In contrast to an optical ¬ber, air is not subject to stress,

24

Assuming a predominantly linear dependence of CD in hence isotropic.

function of the optical frequency, a realistic assumption.

17

Gilbert and Hamrick provide a comprehensive discussion • In active quenching circuits, the bias voltage is

of free-space channels in the context of QC. actively lowered below the breakdown voltage as

soon as the leading edge of the avalanche current

is detected (see e.g. Brown et al. 1987). This

mode enables higher count rates compared to pas-

C. Single-photon detection

sive quenching (up to tens of MHz), since the dead-

time can be as short as some tens of ns. How-

With the availability of pseudo single-photon and

ever, the fast electronic feedback system renders

photon-pair sources, the success of quantum cryptogra-

active quenching circuits much more complicated

phy is essentially dependent on the possibility to detect

than passive ones.

single photons. In principle, this can be achieved using

a variety of techniques, for instance photo-multipliers,

• Finally, in gated mode operation, the bias volt-

avalanche-photodiodes, multichannel plates, supercon-

age is kept below the breakdown voltage and is

ducting Josephson junctions. The ideal detector should

raised above only for a short time when a photon

ful¬ll the following requirements:

is expected to arrive, typically a few ns. Maxi-

mum count-rates similar to active quenching cir-

cuits can be obtained using less complicated elec-

• it should feature a high quantum detection e¬- tronics. Gated mode operation is commonly used in

ciency over a large spectral range, quantum cryptography based on faint laser pulses

where the arrival-times of the photons are well

• the probability of generating noise, that is a signal

known. However, it only applies if prior timing

without a photon arriving, should be small,

information is available. For 2-photon schemes, it

• to ensure a good timing resolution, the time be- is most often combined with one passive quenched

tween detection of a photon and generation of an detector, generating the trigger signal for the gated

electrical signal should be as constant as possible, detector.

i.e. the time jitter should be small,

Apart from Geiger mode, Brown et al. also investi-

• the recovery time (i.e. the deadtime) should be gated the performance of Silicon APDs operated in sub-

small to allow high data rates. Geiger mode (Brown et al. 1989). In this mode, the bias

voltage is kept slightly smaller than the breakdown volt-

In addition, it is important to keep the detectors age such that the multiplication factor “ around 100 “

handy. For instance, a detector which needs liquid he- already enables to detect an avalanche, however, is still

lium or even nitrogen cooling would certainly render a small enough to prevent real breakdowns. Unfortunately,

commercial development di¬cult. the single-photon counting performance in this mode is

Unfortunately, it turns out that it is impossible to meet rather bad and initial e¬orts have not been continued,

all mentioned points at the same time. Today, the best the major problem being the need for extremely low-noise

choice is avalanche photodiodes (APD). Three di¬erent ampli¬ers.

semiconductor materials are used: either Silicon, Ger-

manium or Indium Gallium Arsenide, depending on the

An avalanche engendered by carriers created in the

wavelengths.

conduction band of the diode can not only be caused

APDs are usually operated in so-called Geiger mode.

by an impinging photon, but also by unwanted causes.

In this mode, the applied voltage exceeds the breakdown

These might be thermal or band-to-band tunneling pro-

voltage, leading an absorbed photon to trigger an elec-

cesses, or emissions from trapping levels populated while

tron avalanche consisting of thousands of carriers. To re-

a current transits through the diode. The ¬rst two causes

set the diode, this macroscopic current must be quenched

produce avalanches not due to photons and are referred

“ the emission of charges stopped and the diode recharged

to as darkcounts. The third process depends on previous

(Cova et al. 1996). Three main possibilities exist:

avalanches and its e¬ect is called afterpulses. Since the

number of trapped charges decreases exponentially with

• In passive-quenching circuits, a large (50-500 k„¦)

time, these afterpulses can be limited by applying large

resistor is connected in series with the APD (see

deadtimes. Thus, there is a trade-o¬ between high count

e.g. Brown et al. 1986). This causes a decrease of

rates and low afterpulses. The time-constant of the ex-

the voltage across the APD as soon as an avalanche

ponential decrease of afterpulses shortens for higher tem-

starts. When it drops below breakdown voltage,

peratures of the diode. Unfortunately, operating APDs

the avalanche stops and the diode recharges. The

at higher temperature leads to a higher fraction of ther-

recovery time of the diode is given by its capaci-

mal noise, that is higher dark counts. There is thus again

tance and by the value of the quench resistor. The

a tradeo¬ to be optimized. Finally, increasing the bias

maximum count rate varies from some hundred kHz

voltage leads to a larger quantum e¬ciency and a smaller

to a few MHz.

time jitter, at the cost of an increase in the noise.

18

We thus see that the optimal operating parameters, from Germanium or InGaAs/InP semiconductor materi-

voltage, temperature and dead time (i.e. maximum count als. In the third window (1.55 µm), the only option is

rate) depend on the very application. Besides, since the InGaAs/InP APDs.

relative magnitude of e¬ciency, thermal noise and af- Photon counting with Germanium APDs, although

ter pulses varies with the type of semiconductor material known for 30 years (Haecker, Groezinger and Pilkuhn

used, no general solution exists. In the two next para- 1971), started to be used in the domain of quantum com-

graphs we brie¬‚y present the di¬erent types of APDs. munication with the need of transmitting single photons

The ¬rst paragraph focuses on Silicon APDs which en- over long distances using optical ¬bers, hence with the

able the detection of photons at wavelengths below 1µm, necessity to work at telecommunications wavelength. In

the second one comments on Germanium and on Indium 1993, Townsend, Rarity and Tapster (Townsend et al.

Gallium Arsenide APDs for photon counting at telecom- 1993a) implemented a single photon interference scheme

munication wavelength. The di¬erent behaviour of the for quantum cryptography over a distance of 10 km, and

three types is shown in Fig. 9. Although the best ¬g- in 1994, Tapster, Rarity and Owens (1994) demonstrated

ure of merit for quantum cryptography is the ratio of a violation of Bell inequalities over 4 km. These experi-

dark count rate R per time unit to detection e¬ciency ·, ments where the ¬rst ones to take advantage of Ge APDs

we depict here the better-known noise equivalent power operated in passively quenched Geiger mode. At a tem-

NEP which shows similar behaviour. The NEP is de- perature of 77K which can be achieved using either liquid

¬ned as the optical power required to measure a unity nitrogen or Stirling engine cooling, typical quantum ef-

signal-to-noise ratio, and is given by ¬ciencies of about 15 % at dark count rates of 25 kHz

can be found (Owens et al. 1994), and time jitter down

hν √

N EP = 2R. (25) to 100 ps have been observed (Lacaita et al. 1994) “ a

·

normal value being 200-300 ps.

Here, h is Planck™s constant and ν is the frequency of the Traditionally, Germanium APDs have been imple-

impinging photons. mented in the domain of long-distance quantum com-

munication. However, this type of diode is currently get-

ting replaced by InGaAs APDs and it is more and more

1. Photon counting at wavelengths below 1.1 µm di¬cult to ¬nd Germanium APDs on the market. Mo-

tivated by pioneering research reported already in 1985

Since the beginning of the 80™s, a lot of work has (Levine, Bethea and Campbell 1985), latest research fo-

been done to characterize Silicon APDs for single pho- cusses on InGaAs APDs, allowing single photon detection

ton counting (Ingerson 1983, Brown 1986, Brown 1987, in both telecommunication windows. Starting with work

Brown 1989, Spinelli 1996), and the performance of Si- by Zappa et al. (1994), InGaAs APDs as single photon

APDs has continuously been improved. Since the ¬rst counters have meanwhile been characterized thoroughly

test of Bell inequality using Si-APDs by Shih and Al- (Lacaita et al. 1996, Ribordy et al. 1998, Hiskett et al.

ley in 1988, they have completely replaced the photo- 2000, Karlsson et al. 1999, and Rarity et al. 2000, Stucki

multipliers used until then in the domain of fundamental et al. 2001), and ¬rst implementations for quantum cryp-

quantum optics, known now as quantum communication. tography have been reported (Ribordy 1998, Bourennane

Today, quantum e¬ciencies of up to 76% (Kwiat et al. et al. 1999, Bethune and Risk 2000, Hughes et al. 2000b,

1993) and time jitter down to 28 ps (Cova et al. 1989) Ribordy et al. 2000). However, if operating Ge APDs

have been reported. Commercial single photon counting is already inconvenient compared to Silicon APDs, the

modules are available (EG&G SPCM-AQ-151), featuring handiness of InGaAs APDs is even worse, the problem

quantum e¬ciencies of 70 % at a wavelength of 700 nm, a being a extremely high afterpulse fraction. Therefore,

time jitter of around 300 psec and maximum count rates operation in passive quenching mode is impossible for

larger than 5 MHz. Temperatures of -20oC “ su¬cient to applications where noise is crucial. In gated mode, In-

keep thermally generated dark counts as low as 50 Hz “ GaAs APDs feature a better performance for single pho-

can easily be achieved using Peltier cooling. Single pho- ton counting at 1.3 µm compared to Ge APDs. For in-

ton counters based on Silicon APDs thus o¬er an almost stance, at a temperature of 77 K and a dark count prob-

ability of 10’5 per 2.6 ns gate, quantum e¬ciencies of

perfect solution for all applications where photons of a

wavelength below 1 µm can be used. Apart from funda- around 30% and of 17% have been reported for InGaAs

mental quantum optics, this includes quantum cryptog- and Ge APDs, respectively (Ribordy et al. 1998), while

raphy in free space and in optical ¬bers, however, due to the time jitter of both devices is comparable. If working

high losses, the latter one only over short distances. at a wavelength of 1.55 µm, the temperature has to be

increased for single photon detection. At 173 K and a

dark count rate of now 10’4 , a quantum e¬ciency of 6%

2. Photon counting at telecommunication wavelengths can still be observed using InGaAs/InP devices while the

same ¬gure for Germanium APDs is close to zero.

When working in the second telecommunication win- To date, no industrial e¬ort has been done to opti-

dow (1.3µm), one has to take advantage of APDs made mize APDs operating at telecommunication wavelength

19

for photon counting, and their performance is still far In the BB84 protocol Alice has to choose randomly

behind the one of Silicon APDs26 . However, there is between four di¬erent states and Bob between two bases.

no fundamental reasons why photon counting at wave- The limited random number generation rate may force

lengths above 1 µm should be more delicate than below, Alice to produce her numbers in advance and store them,

except that the photons are less energetic. The real rea- opening a security weakness. On Bob™s side the random

sons for the lack of commercial products are, ¬rst, that bit creation rate can be lower since, in principle, the basis

Silicon, the most common semiconductor, is not sensitive must be changed only after a photon has been detected,

(the band gap is too large), and secondly that the mar- which normally happens at rates below 1 MHz. However,

ket for photon counting is not yet mature. But, without one has to make sure that this doesn™t give the spy an

great risk, one can forecast that good commercial pho- opportunity for a Trojan horse attack (see section VI K)!

ton counters will become available in the near future, and An elegant con¬guration integrating the random num-

that this will have a major impact on quantum cryptog- ber generator into the QC system consists in using a pas-

raphy. sive choice of bases, as discussed in chapter V (Muller et

al. 1993). However, the problem of detector induced

correlation remains.

D. Quantum random number generators

E. Quantum repeaters

The key used in the one-time-pad must be secret and

used only once. Consequently, it must be as long as the

message and must be perfectly random. The later point Todays ¬ber based QC systems are limited to tens of

proves to be a delicate and interesting one. Computers kilometers. This is due to the combination of ¬ber losses

are deterministic systems that cannot create truly ran- and detectors™ noise. The losses by themselves do only

dom numbers. But all secure cryptosystems, both classi- reduce the bit rate (exponentially with the distance), but

cal and quantum ones, require truly random numbers27 ! with perfect detectors the distance would not be limited.

Hence, the random numbers must be created by a ran- However, because of the dark counts, each time a pho-

dom physical process. Moreover, to make sure that the ton is lost there is a chance that a dark count produces

random process is not merely looking random with some an error. Hence, when the probability of a dark count

hidden deterministic pattern, it is necessary that it is becomes comparable to the probability that a photon

completely understood. It is thus of interest to imple- is correctly detected, the signal to noise ratio tends to

ment a simple process in order to gain con¬dence in its 0 (more precisely the mutual information I(±, β) tends

to a lower bound29 ). In this section we brie¬‚y explain

proper operation.

A natural solution is to rely on the random choice of how the use of entangled photons and of entanglement

™

a single photon at a beamsplitter28 (Rarity et al. 1994). swapping (Zukowski et al. 1993) could open ways to

In this case the randomness is in principle guaranteed by extend the achievable distances in a foreseeable future

the laws of quantum mechanics, though, one still has to (some prior knowledge of entanglement swapping is as-

be very careful not to introduce any experimental arte- sumed). Let us denote tlink the transmission coe¬cient

fact that could correlate adjacent bits. Di¬erent experi- (i.e. tlink =probability that a photon sent by Alice gets

mental realizations have been demonstrated (Hildebrand to one of Bob™s detectors), · the detectors™ e¬ciency and

2001, Stefanov et al. 2000, Jennewein et al. 2000a) pdark the dark count probability per time bin. With a

and prototypes are commercially available (www.gap- perfect single photon source, the probability Praw of a

optique.unige.ch). One particular problem is the dead- correct qubit detection reads: Praw = tlink ·, while the

time of the detectors, that may introduce a strong an- probability Pdet of an error is: Pdet = (1 ’ tlink ·)pdark .

P

ticorrelation between neighboring bits. Similarly, after- Accordingly, the QBER= Prawdet det and the normalized

+P

pulses may provoke a correlation. These detector-related net rate reads: ρnet = (Praw + Pdet ) · f ct(QBER) where

e¬ects increase with higher pulse rates, limiting the bit the function f ct denotes the fraction of bits remaining

rate of quantum number generator to some MHz. after error correction and privacy ampli¬cation. For the

sake of illustration we simply assume a linear dependence

dropping to zero for QBER≥ 15% (This simpli¬cation

does not a¬ect the qualitative results of this section.

26

For a more precise calculation, see L¨ tkenhaus 2000.):

u

The ¬rst commercial photon counter at telecommunication

wavelengths came out only this year (Hamamatsu photomul-

tiplier R5509-72). However, the e¬ciency does not yet allow

an implementation for quantum cryptography.

27

The pin number that the bank attributes to your credit 29

The absolute lower bound is 0, but dependening on the

card must be random. If not, someone knows it! assumed eavesdropping strategy, Eve could take advantage of

28

Strictly speaking, the choice is made only once the photons the losses. In the latter case, the lower bound is given by her

are detected at one of the outports. mutual information I(±, «).

20

f ct(QBER) = 1 ’ QBER . The corresponding net rate IV. EXPERIMENTAL QUANTUM

15%