<< . .

. 5
( : 11)



. . >>

ρnet is displayed on Fig. 10. Note that it drops to zero CRYPTOGRAPHY WITH FAINT LASER
near 90 km. PULSES
Let us now assume that instead of a perfect single-
photon source, Alice and Bob use a (perfect) 2-photon Experimental quantum key distribution was demon-
source set in the middle of their quantum channel. Each strated for the ¬rst time in 1989 (it was published only

photon has then a probability tlink to get to a detec- in 1992 by Bennett et al. 1992a). Since then, tremen-
tor. The probability of a correct joined detection is thus dous progress has been made. Today, several groups have
Praw = tlink√2 , while an error occurs with probability
· shown that quantum key distribution is possible, even
√ √
P det = (1 ’ tlink ·)2 p2 + 2 tlink ·(1 ’ tlink ·)pdark outside the laboratory. In principle, any two-level quan-
dark
(both photon lost and 2 dark counts, or one photon tum system could be used to implement QC. In practice,
lost and one dark count). This can be conveniently all implementations have relied on photons. The reason
1/n
rewritten as: Praw = tlink · n and Pdet = (tlink · + (1 ’ is that their interaction with the environment, also called
decoherence, can be controlled and moderated. In addi-
1/n
tlink ·)pdark )n ’ tlink · n valid for any division of the link
tion, researchers can bene¬t from all the tools developed
into n equal-length sections and n detectors. Note that
in the past two decades for optical telecommunications.
the measurements performed at the nodes between Alice
It is unlikely that other carriers will be employed in the
and Bob do transmit (swap) the entanglement to the twin
foreseeable future.
photons, without revealing any information about the
Comparing di¬erent QC-setups is a di¬cult task, since
qubit (these measurements are called Bell-measurements
several criteria must be taken into account. What mat-
and are the core of entanglement swapping and of quan-
ters in the end is of course the rate of corrected secret bits
tum teleportation). The corresponding net rates are dis-
(distilled bit rate, Rdist ) that can be transmitted and the
played in Fig. 10. Clearly, the rates for short distances
transmission distance. One can already note that with
are smaller when several detectors are used, because of
present and near future technology, it will probably not
their limited e¬ciencies (here we assume · = 10%). But
be possible to achieve rates of the order of gigahertz,
the distance before the net rate drops to zero is extended
nowadays common with conventional optical communi-
to longer distances! Intuitively, this can be understood
cation systems (in their comprehensive paper published
as follows. Let™s consider that a logical qubit propagates
in 2000, Gilbert and Hamrick discuss practical methods
from Alice to Bob (although some photons propagate in
to achieve high bit rate QC). This implies that encryp-
the opposite direction). Then, each 2-photon source and
tion with a key exchanged through QC is to be limited
each Bell-measurement acts on this logical qubit as a kind
to highly con¬dential information. While the determina-
of QND measurement: they test whether the logical qubit
tion of the transmission distance and rate of detection
is still there! In this way, Bob activates his detectors only
(the raw bit rate, Rraw ) is straightforward, estimating
1/n
when there is a large chance tlink that the photon gets
the net rate is rather di¬cult. Although in principle er-
to his detectors.
rors in the bit sequence follow only from tampering by
Note that if in addition to the detectors™ noise there
a malevolent eavesdropper, the situation is rather dif-
is noise due to decoherence, then the above idea can be
ferent in reality. Discrepancies in the keys of Alice and
extended, using entanglement puri¬cation. This is essen-
Bob also always happen because of experimental imper-
tially the idea of quantum repeaters (Briegel et al. 1998,
fections. The error rate (here called quantum bit error
Dur et al. 1999).
rate, or QBER) can be easily determined. Similarly, the
error correction procedure is rather simple. Error cor-
rection leads to a ¬rst reduction of the key rate that de-
pends strongly on the QBER. The real problem consist
in estimating the information obtained by Eve, a quan-
tity necessary for privacy ampli¬cation. It does not only
depend on the QBER, but also on other factors, like the
photon number statistics of the source, or the way the
choice of the measurement basis is made. Moreover in
a pragmatic approach, one might also accept restrictions
on Eve™s technology, limiting her strategies and there-
fore also the information she can obtain per error she
introduces. Since the e¬ciency of privacy ampli¬cation
rapidly decreases when the QBER increases, the distilled
bit rate depends dramatically on Eve™s information and
hence on the assumptions made. One can de¬ne as the
maximum transmission distance, the distance where the
distilled rate reaches zero. This can give an idea of the


21
di¬culty to evaluate a QC system from a physical point product of the sifted key rate and the probability popt of
of view. a photon going in the wrong detector:
Technological aspects must also be taken into account.
1
In this article we do not focus on all the published per- Ropt = Rsif t popt = q frep µ tlink popt · (28)
2
formances (in particular not on the key rates), which
strongly depend on present technology and the ¬nancial This contribution can be considered, for a given set-up,
possibilities of the research teams having carried out the as an intrinsic error rate indicating the suitability to use
experiments. On the contrary, we try to weight the in- it for QC. We will discuss it below in the case of each
trinsic technological di¬culties associated with each set- particular system.
up and to anticipate certain technological advances. And The second contribution, Rdet , arises from the detector
last but not least the cost of the realization of a prototype dark counts (or from remaining environmental stray light
should also be considered. in free space setups). This rate is independent of the bit
In this chapter, we ¬rst deduce a general formula for rate31 . Of course, only dark counts falling in a short time
the QBER and consider its impact on the distilled rate. window when a photon is expected give rise to errors.
We then review faint pulses implementations. We class
11
them according to the property used to encode the qubits
Rdet = frep pdark n (29)
value and follow a rough chronological order. Finally, we 22
assess the possibility to adopt the various set-ups for the
where pdark is the probability of registering a dark count
realization of an industrial prototype. Systems based on
per time-window and per detector, and n is the number of
entangled photon pairs are presented in the next chapter.
detectors. The two 1 -factors are related to the fact that
2
a dark count has a 50% chance to happen with Alice and
Bob having chosen incompatible bases (thus eliminated
A. Quantum Bit Error Rate
during sifting) and a 50% chance to arise in the correct
detector.
The QBER is de¬ned as the number of wrong bits to
Finally error counts can arise from uncorrelated pho-
the total number of received bits30 and is normally in
tons, because of imperfect photon sources:
the order of a few percent. In the following we will use
it expressed as a function of rates: 11
Racc = pacc frep tlink n· (30)
22
Nwrong Rerror Rerror
QBER = = ≈
This factor appears only in systems based on entangled
Nright + Nwrong Rsif t + Rerror Rsif t
photons, where the photons belonging to di¬erent pairs
(26)
but arriving in the same time window are not necessarily
in the same state. The quantity pacc is the probability to
where the sifted key corresponds to the cases in which
¬nd a second pair within the time window, knowing that
Alice and Bob made compatible choices of bases, hence
a ¬rst one was created32 .
its rate is half that of the raw key.
The QBER can now be expressed as follows:
The raw rate is essentially the product of the pulse
rate frep , the mean number of photon per pulse µ, the Ropt + Rdet + Racc
QBER = (31)
probability tlink of a photon to arrive at the analyzer and
Rsif t
the probability · of the photon being detected:
pdark · n pacc
= popt + + (32)
tlink · · · 2 · q · µ 2 · q · µ
1 1
Rsif t = Rraw = q frep µ tlink · (27)
= QBERopt + QBERdet + QBERacc (33)
2 2
1
The factor q (q¤1, typically 1 or 2 ) must be introduced We analyze now these three contributions. The ¬rst
for some phase-coding setups in order to correct for non- one, QBERopt , is independent on the transmission dis-
interfering path combinations (see, e.g., sections IV C tance (it is independent of tlink ). It can be considered as
and V B). a measure of the optical quality of the setup, depending
One can distinguish three di¬erent contributions to only on the polarisation or interference fringe contrast.
Rerror . The ¬rst one arises because of photons ending
up in the wrong detector, due to unperfect interference
or polarization contrast. The rate Ropt is given by the
31
This is true provided that afterpulses (see section III C)
do not contribute to the dark counts.
32
Note that a passive choice of measurement basis implies
30
In the followin we are considering systems implementing that four detectors (or two detectors during two time win-
the BB84 protocol. For other protocols some of the formulas dows) are activated for every pulse, leading thus to a doubling
have to be slightly adapted. of Rdet and Racc .


22
The technical e¬ort needed to obtain, and more impor- rate after error correction and privacy ampli¬cation) for
tant, to maintain a given QBERopt is an important crite- di¬erent wavelengths as shown in Fig. 11. There is ¬rst
rion for evaluating di¬erent QC-setups. In polarization an exponential decrease, then, due to error correction
based systems, it™s rather simple to achieve a polarisa- and privacy ampli¬cation, the bit rates fall rapidly down
tion contrast of 100:1, corresponding to a QBERopt of to zero. This is most evident comparing the curves 1550
1%. In ¬ber based QC, the problem is to maintain this nm and 1550 nm “single” since the latter features 10
value in spite of polarisation ¬‚uctuations and depolarisa- times less QBER. One can see that the maximum range
tion in the ¬ber link. For phase coding setups, QBERopt is about 100 km. In practice it is closer to 50 km, due
and the interference visibility are related by to non-ideal error correction and privacy ampli¬cation,
multiphoton pulses and other optical losses not consid-
1’V ered here. Finally, let us mention that typical key cre-
QBERopt = (34)
2 ation rates of the order of a thousand bits per second over
distances of a few tens of kilometers have been demon-
A visibility of 98% translates thus into an optical error
strated experimentally (see, for example, Ribordy et al.
rate of 1%. Such a value implies the use of well aligned
2000 or Townsend 1998b).
and stable interferometers. In bulk optics perfect mode
overlap is di¬cult to achieve, but the polarization is sta-
ble. In single-mode ¬ber interferometers, on the contrary,
B. Polarization coding
perfect mode overlap is automatically achieved, but the
polarisation must be controlled and chromatic dispersion
Encoding the qubits in the polarization of photons is
can constitute a problem.
a natural solution. The ¬rst demonstration of QC by
The second contribution, QBERdet , increases with dis-
Charles Bennett and his coworkers (Bennett et al. 1992a)
tance, since the darkcount rate remains constant while
made use of this choice. They realized a system where
the bit rate goes down like tlink . It depends entirely on
Alice and Bob exchanged faint light pulses produced by
the ratio of the dark count rate to the quantum e¬ciency.
a LED and containing less than one photon on average
At present, good single-photon detectors are not commer-
over a distance of 30 cm in air. In spite of the small scale
cially available for telecommunication wavelengths. The
of this experiment, it had an important impact on the
span of QC is not limited by decoherence. As QBERopt
community in the sense that it showed that it was not
is essentially independent of the ¬ber length, it is the
unreasonable to use single photons instead of classical
detector noise that limits the transmission distance.
pulses for encoding bits.
Finally, the QBERacc contribution is present only in
A typical system for QC with the BB84 four states
some 2-photon schemes in which multi-photon pulses are
protocol using the polarization of photons is shown in
processed in such a way that they do not necessarily
Fig. 12. Alice™s system consists of four laser diodes. They
encode the same bit value (see e.g. paragraphs V B 1
emit short classical photon pulses (≈ 1ns) polarized at
and V B 2). Indeed, although in all systems there is a
’45—¦ , 0—¦ , +45—¦ , and 90—¦ . For a given qubit, a single
probability for multi-photon pulses, in most these con-
diode is triggered. The pulses are then attenuated by a
tribute only to the information available to Eve (see sec-
set of ¬lters to reduce the average number of photons well
tion VI H) and not to the QBER. But for implementa-
below 1, and sent along the quantum channel to Alice.
tions featuring passive choice by each photon, the multi-
It is essential that the pulses remain polarized for Bob
photon pulses do not contribute to Eve™s information but
to be able to extract the information encoded by Alice.
to the error rate (see section VI J).
As discussed in paragraph III B 2, polarization mode dis-
Now, let us calculate the useful bit rate as a func-
persion may depolarize the photons, provided the delay
tion of the distance. Rsif t and QBER are given as a
it introduces between both polarization modes is larger
function of tlink in eq. (27) and (32) respectively. The
than the coherence time. This sets a constraint on the
¬ber link transmission decreases exponentially with the
type of lasers used by Alice.
length. The fraction of bits lost due to error correc-
When reaching Bob, the pulses are extracted from the
tion and privacy ampli¬cation is a function of QBER
¬ber. They travel through a set of waveplates used to re-
and depends on Eve™s strategy. The number of remain-
cover the initial polarization states by compensating the
ing bits Rnet is given by the sifted key rate multiplied
transformation induced by the optical ¬ber (paragraph
by the di¬erence of the Alice-Bob mutual Shannon infor-
III B 2). The pulses reach then a symmetric beamsplit-
mation I(±, β) and Eve™s maximal Shannon information
ter, implementing the basis choice. Transmitted photons
I max (±, «):
are analyzed in the vertical-horizontal basis with a po-
larizing beamsplitter and two photon counting detectors.
Rnet = Rsif t I(±, β) ’ I max (±, «) (35)
The polarization state of the re¬‚ected photons is ¬rst ro-
tated with a waveplate by 45—¦ (’45—¦ to 0—¦ ). The photons
The latter are calculated here according to eq. (64) and are then analyzed with a second set of polarizing beam-
(66) (section VI E), considering only individual attacks splitter and photon counting detectors. This implements
and no multiphoton pulses. We obtain Rnet (useful bit

23
the diagonal basis. For illustration, let us follow a photon with photons at 800nm. It is interesting to note that,
polarized at +45—¦ , we see that its state of polarization is although he used standard telecommunications ¬bers
arbitrarily transformed in the optical ¬ber. At Bob™s end, which can support more than one spatial mode at this
the polarization controller must be set to bring it back wavelength, he was able to ensure single-mode propa-
to +45—¦ . If it chooses the output of the beamsplitter gation by carefully controlling the launching conditions.
corresponding to the vertical-horizontal basis, it will ex- Because of the problem discussed above, polarization
perience equal re¬‚ection and transmission probability at coding does not seem to be the best choice for QC in
the polarizing beamsplittter, yielding a random outcome. optical ¬bers. Nevertheless, this problem is drastically
On the other hand, if it chooses the diagonal basis, its improved when considering free space key exchange, as
state will be rotated to 90—¦ . The polarizing beamsplit- the air has essentially no birefringence at all (see section
ter will then re¬‚ect it with unit probability, yielding a IV E).
deterministic outcome.
Instead of Alice using four lasers and Bob two polar-
izing beamsplitters, it is also possible to implement this C. Phase coding
system with active polarization modulators such as Pock-
els cells. For emission, the modulator is randomly acti- The idea of encoding the value of qubits in the phase
vated for each pulse to rotate the state of polarization of photons was ¬rst mentioned by Bennett in the paper
to one of the four states, while, at the receiver, it ran- where he introduced the two-states protocol (1992). It is
domly rotates half of the incoming pulses by 45—¦ . It is indeed a very natural choice for optics specialists. State
also possible to realize the whole system with ¬ber optics preparation and analysis are then performed with inter-
components. ferometers, that can be realized with single-mode optical
Antoine Muller and his coworkers at the University of ¬bers components.
Geneva used such a system to perform QC experiments Fig. 14 presents an optical ¬ber version of a Mach-
over optical ¬bers (1993, see also Br´guet et al. 1994).
e Zehnder interferometer. It is made out of two symmetric
They created a key over a distance of 1100 meters with couplers “ the equivalent of beamsplitters “ connected
photons at 800 nm. In order to increase the transmission to each other, with one phase modulator in each arm.
distance, they repeated the experiment with photons at One can inject light in the set-up using a continuous and
1300nm (Muller et al.1995 and 1996) and created a key classical source, and monitor the intensity at the output
over a distance of 23 kilometers. An interesting feature ports. Provided that the coherence length of the light
of this experiment is that the quantum channel connect- used is larger than the path mismatch in the interferom-
ing Alice and Bob consisted in an optical ¬ber part of an eters, interference fringes can be recorded. Taking into
installed cable, used by the telecommunication company account the π/2-phase shift experienced upon re¬‚ection
Swisscom for carrying phone conversations. It runs be- at a beamsplitter, the e¬ect of the phase modulators (φA
tween the Swiss cities of Geneva and Nyon, under Lake and φB ) and the path length di¬erence (∆L), the inten-
Geneva (Fig. 13). This was the ¬rst time QC was per- sity in the output port labeled “0” is given by:
formed outside of a physics laboratory. It had a strong
φA ’ φB + k∆L
impact on the interest of the wider public for the new
I0 = I · cos2 (36)
¬eld of quantum communication. 2
These two experiments highlighted the fact that the
polarization transformation induced by a long optical where k is the wave number and I the intensity of the
¬ber was unstable over time. Indeed, when monitoring source. If the phase term is equal to π/2 + nπ where n
the QBER of their system, Muller noticed that, although is an integer, destructive interference is obtained. There-
it remained stable and low for some time (of the order of fore the intensity registered in port “0” reaches a mini-
several minutes), it would suddenly increase after a while, mum and all the light exits in port “1”. When the phase
indicating a modi¬cation of the polarization transforma- term is equal to nπ, the situation is reversed: construc-
tion in the ¬ber. This implies that a real ¬ber based QC tive interference is obtained in port “0”, while the inten-
system requires active alignment to compensate for this sity in port “1” goes to a minimum. With intermediate
evolution. Although not impossible, such a procedure is phase settings, light can be recorded in both ports. This
certainly di¬cult. James Franson did indeed implement device acts like an optical switch. It is essential to keep
an active feedback aligment system ( 1995), but did not the path di¬erence stable in order to record stationary
pursue along this direction. It is interesting to note that interferences.
replacing standard ¬bers with polarization maintaining Although we discussed the behavior of this interferom-
¬bers does not solve the problem. The reason is that, in eter for classical light, it works exactly the same when a
spite of their name, these ¬bers do not maintain polar- single photon is injected. The probability to detect the
ization, as explained in paragraph III B 2. photon in one output port can be varied by changing the
Recently, Paul Townsend of BT Laboratories also in- phase. It is the ¬ber optic version of Young™s slits exper-
vestigated such polarization encoding systems for QC on iment, where the arms of the interferometer replace the
short-span links up to 10 kilometers (1998a and 1998b) apertures.

24
This interferometer combined with a single photon the ¬rst beamsplitter. States produced by a switch are
source and photon counting detectors can be used for on the poles, while those resulting from the use of a 50/50
QC. Alice™s set-up consists of the source, the ¬rst coupler beamsplitter lie on the equator. Figure 15 illustrates this
and the ¬rst phase modulator, while Bob takes the sec- analogy. Consequently, all polarization schemes can also
ond modulator and coupler, as well as the detectors. Let be implemented using phase coding. Similarly, every cod-
us consider the implementation of the four-states BB84 ing using 2-path interferometers can be realized using po-
protocol. On the one hand, Alice can apply one of four larization. However, in practice one choice is often more
phase shifts (0, π/2, π, 3π/2) to encode a bit value. She convenient than the other, depending on circumstances
like the nature of the quantum channel33 .
associates 0 and π/2 to bit 0, and π and 3π/2 to bit
1. On the other hand, Bob performs a basis choice by
applying randomly a phase shift of either 0 or π/2, and
he associates the detector connected to the output port 1. The double Mach-Zehnder implementation
“0” to a bit value of 0, and the detector connected to
the port “1” to 1. When the di¬erence of their phase is Although the scheme presented in the previous para-
equal to 0 or π, Alice and Bob are using compatible bases graph works perfectly well on an optical table, it is im-
and they obtain deterministic results. In such cases, Al- possible to keep the path di¬erence stable when Alice and
ice can infer from the phase shift she applied, the output Bob are separated by more than a few meters. As men-
port chosen by the photon at Bob™s end and hence the tioned above, the relative length of the arms should not
bit value he registered. Bob, on his side, deduces from change by more than a fraction of a wavelength. Consid-
the output port chosen by the photon, the phase that ering a separation between Alice and Bob of 1 kilometer
Alice selected. When the phase di¬erence equals π/2 or for example, it is clear that it is not possible to prevent
3π/2, the bases are incompatible and the photon chooses path di¬erence changes smaller than 1µm caused by en-
randomly which port it takes at Bob™s coupler. This is vironmental variations. In his 1992 letter, Bennett also
summarized in Table 1. We must stress that it is essen- showed how to get round this problem. He suggested to
tial with this scheme to keep the path di¬erence stable use two unbalanced Mach-Zehnder interferometers con-
during a key exchange session. It should not change by nected in series by a single optical ¬ber (see Fig. 16),
more than a fraction of a wavelength of the photons. A both Alice and Bob being equipped with one. When
drift of the length of one arm would indeed change the monitoring counts as a function of the time since the
phase relation between Alice and Bob, and induce errors emission of the photons, Bob obtains three peaks (see
in their bit sequence. the inset in Fig. 16). The ¬rst one corresponds to the
cases where the photons chose the short path both in
Alice Bob Alice™s and in Bob™s interferometers, while the last one
Bit value φA φB φA ’ φB Bit value corresponds to photons taking twice the long paths. Fi-
nally, the central peak corresponds to photons choosing
0 0 0 0 0
the short path in Alice™s interferometer and the long one
0 0 π/2 3π/2 ?
in Bob™s, and to the opposite. If these two processes are
1 π 0 π 1
indistinguishable, they produce interference. A timing
1 π π/2 π/2 ?
window can be used to discriminate between interfering
0 π/2 0 π/2 ?
and non-interfering events. Disregarding the latter, it is
0 π/2 π/2 0 0
then possible for Alice and Bob to exchange a key.
1 3π/2 0 3π/2 ?
The advantage of this set-up is that both “halves” of
1 3π/2 π/2 π 1
the photon travel in the same optical ¬ber. They experi-
ence thus the same optical length in the environmentally
Table 1: Implementation of the BB84 four-states pro-
sensitive part of the system, provided that the variations
tocol with phase encoding.
in the ¬ber are slower than their temporal separations,
determined by the interferometer™s imbalance (≈ 5ns).
It is interesting to note that encoding qubits with 2-
This condition is much less di¬cult to ful¬ll. In order to
paths interferometers is formally isomorphic to polar-
obtain a good interference visibility, and hence a low er-
ization encoding. The two arms correspond to a nat-
ror rate, the imbalancements of the interferometers must
ural basis, and the weights cj of each qubit state ψ =
c1 e’iφ/2 , c2 eiφ/2 are determined by the coupling ratio
of the ¬rst beam splitter while the relative phase φ is in-
troduced in the interferometer. The Poincar´ sphere rep-
e

<< . .

. 5
( : 11)



. . >>