plug&play system

D Stucki1 , N Gisin1 , O Guinnard1,2 , G Ribordy1,2 and

H Zbinden1

1

GAP-Optique, University of Geneva, rue de l™Ecole-de-M´ decine 20,

e

CH-1211 Geneva 4, Switzerland

2

id Quantique SA, rue Cingria 10, CH-1205 Geneva, Switzerland

E-mail: hugo.zbinden@physics.unige.ch

New Journal of Physics 4 (2002) 41.1“41.8 (http://www.njp.org/)

Received 7 March 2002

Published 12 July 2002

Abstract. We present a ¬bre-optical quantum key distribution system. It works

at 1550 nm and is based on the plug&play set-up. We tested the stability under

¬eld conditions using aerial and terrestrial cables and performed a key exchange

over 67 km between Geneva and Lausanne.

1. Introduction

Quantum cryptography or, more exactly, quantum key distribution (QKD) is the most advanced

subject in the ¬eld of quantum information technologies. Since the introduction of the BB84

protocol by Bennett and Brassard in 1984 [1] and their ¬rst implementation in 1992 [2], many

experiments have been performed by numerous groups (see e.g. [3] for a review). However, to

our knowledge, all experiments to date have been performed in laboratories or used laboratory

equipment (e.g. liquid nitrogen cooled detectors) or needed frequent alignments (e.g. control of

polarization or phase). In this paper, we present a turn-key, ¬bre-optic QKD-prototype that ¬ts

into two 19 inch boxes, one for Alice and one for Bob (see ¬gure 1). We tested the stability of

the auto-compensating plug&play (p&p) system [4] over installed terrestrial and aerial cables.

Keys were exchanged over a distance of 67 km.

We start with a short introduction to the p&p auto-compensating set-up and describe the

features of the prototype. We then recall the relevant parameters of a QKD system and brie¬‚y

discuss some security issues. Finally the results of the ¬eld tests are presented.

2. Plug&play prototype

Let us recall the principle of the so-called p&p auto-compensating set-up [4]“[8], where the key

is encoded in the phase between two pulses travelling from Bob to Alice and back (see ¬gure 2).

New Journal of Physics 4 (2002) 41.1“41.8 PII: S1367-2630(02)34654-8

1367-2630/02/000041+8$30.00 © IOP Publishing Ltd and Deutsche Physikalische Gesellschaft

41.2

Figure 1. Picture of the p&p system.

Figure 2. Schematic of the p&p prototype.

A strong laser pulse (@1550 nm) emitted at Bob is separated at a ¬rst 50/50 beamsplitter (BS).

The two pulses impinge on the input ports of a polarization beamsplitter (PBS), after having

travelled through a short arm and a long arm, including a phase modulator (PMB ) and a 50 ns

delay line (DL), respectively. All ¬bres and optical elements at Bob are polarization maintaining.

The linear polarization is turned by 90—¦ in the short arm, therefore the two pulses exit Bob™s set-

up by the same port of the PBS. The pulses travel down to Alice, are re¬‚ected on a Faraday

mirror, attenuated and come back orthogonally polarized. In turn, both pulses now take the

other path at Bob and arrive at the same time at the BS where they interfere. Then, they are

detected either in D1 , or after passing through the circulator (C) in D2 . Since the two pulses

take the same path, inside Bob in reversed order, this interferometer is auto-compensated. To

implement the BB84 protocol, Alice applies a phase shift of 0 or π and π or 3π on the second

2 2

pulse with PMA . Bob chooses the measurement basis by applying a 0 or π shift on the ¬rst pulse

2

on its way back.

The prototype is easy to use. The two boxes just have to be connected via an optical

¬bre. They are exclusively driven by two computers via the USB port. The two computers

communicate via an ethernet/internet link. The system monitors on-line the temperature of

the detectors, heat sinks and casings. The photon counters are Peltier-cooled, actively gated,

InGaAs/InP APDs [9]. The dark count noise of the detectors is measured during the initialization

(the dark count probability pdark is ≈10’5 per gate). Although the set-up needs no optical

alignment, the phases and the detection gates must be applied at the right time. Therefore,

the system measures in a next step the length of the link (the operator has only to estimate

the line™s length to within 5 km). The variable attenuator (VA) at Alice is set to a low level

and bright laser pulses are emitted by Bob. The time delay between the triggering of the laser

New Journal of Physics 4 (2002) 41.1“41.8 (http://www.njp.org/)

41.3

and a train of gates of the detectors is scanned until the re¬‚ected pulses are detected. The

delays for the two 2.5 ns detection gates are adjusted, as well as the timing for the 50 ns

pulse applied on the phasemodulator PMB . In the p&p scheme, where pulses travel back and

forth, (Rayleigh) backscattered light can considerably increase the noise. Therefore, the laser is

not continuously pulsed, but trains of pulses are sent, the length of these trains corresponding

to the length of the storage-line introduced for this purpose behind the attenuator at Alice™s

station [5]. Consequently, the backward propagating pulses no longer cross bright pulses in

the ¬bre. For a storage line measuring approximately 10 km, a pulse train contains 480 pulses

at a frequency of 5 MHz. A 90% coupler (BS10/90 ) directs most of the incoming light pulses

to a APD-detector module (DA ). It generates the trigger signal used to synchronize Alice™s

20 MHz clock with the one of Bob. This synchronized clock allows Alice to apply a 50 ns

pulse at the phasemodulator PMA exactly when the second, weaker pulse passes. Only this

second pulse contains phase information and must be attenuated below the one-photon-per-

pulse level. Measuring the height of the incoming pulses with DA would allow one to adjust

the attenuator in order to obtain the correct average number of photons per outgoing pulse.

For this purpose, the attenuator and the detector must be calibrated beforehand. In practice,

we measure the incoming power with a power metre. Random numbers are generated on both

sides with a quantum random number generator [10]. At Bob, clicks from each of the photon

counters are written together with the index of the pulse into a buffer and transferred to the

computer.

As a measure of security, the number of coincident clicks at both detectors is registered,

which is important to limit beamsplitting attacks (see below). Moreover, the incoming power at

Alice is continuously measured with DA , in order to detect so-called Trojan horse attacks.

3. Key parameters in QKD

3.1. Key and error rates

The ¬rst important parameter is the raw key rate Rraw between Alice, the transmitter, and Bob,

the receiver:

(1)

Rraw = qνµtAB tB ·B

where q depends on the implementation ( 1 for the BB84 protocol, because half the time Alice

2

and Bob bases are not compatible), ν is the repetition frequency, µ is the average number of

photons per pulse, tAB is the transmission on the line Alice“Bob, tB is Bob™s internal transmission

(tB ≈ 0.6) and ·B is Bob™s detection ef¬ciency (·B ≈ 0.1).

After Rraw the second most important parameter is the quantum bit error rate (QBER) which

consists of four major contributions:

false counts

(2)

QBER = = QBERopt + QBERdark + QBERaf ter + QBERstray .

total counts

QBERopt is simply the probability for a photon to hit the wrong detector. It can be measured

with strong pulses, by always applying the same phases and measuring the ratio of the count rates

at the two detectors. This is a measure of the quality of the optical alignment of the polarization

maintaining components and the stability of the ¬bre link. In the ideal case, QBERopt is

independent of the ¬bre length. QBERdark and QBERaf ter , the errors due to dark counts and

after-pulses, depend on the characteristics of the photon counters [9]. QBERdark is the most

New Journal of Physics 4 (2002) 41.1“41.8 (http://www.njp.org/)

41.4

important, it is the probability to have a dark count per gate pdark , divided by the probability to

have a click pdet :

pdark

QBERdark ∼ .

=

µtAB tB ·B

QBERdark increases with distance and consequently limits the range of QKD. QBERaf ter is

the probability to have an after-pulse paf ter (t) summed over all gates between two detections:

n= p 1

1

det

∼ (3)

QBERaf ter paf ter „ + n

=

ν

n=0

where „ is the dead time, during which the detectors™ gate are inhibited after each detection.

The probability paf ter depends on the type of APD as well as on the temperature, and decreases

rapidly with time [9]. Nevertheless, for high pulse rates (ν = 5 MHz) QBERaf ter can become

signi¬cant. For instance, for pdet = 0.15% (corresponding to about 7 dB loss with µ = 0.1) we

measured a QBERaf ter of about 4%. By introducing a dead time „ of 4 µs (during this time,

following a detection, no gates are applied), QBERaf ter can be reduced to 1.5%. The bit rate

Rraw in contrast, is only slightly reduced by a factor ·„ :

1 <

(4)

·„ = ≈ 1.

1 + νpdet „

In this example, ·„ becomes 0.97 and 0.92, for 4 and 12 µs, respectively. In our prototype the

dead time can be varied between 0 and 12 µs. The optimum dead time varies as a function

of distance, in our measurements, however, we applied a constant dead time of 4 µs. Finally,

QBERstray , the errors induced by stray light, essentially Rayleigh back-scattered light, is a

problem proper to the p&p set-up. It can be almost completely removed with the help of Alice™s

storage line and by sending trains of pulses as mentioned above. However, we have to introduce

another factor ·duty that reduces our bit rate. It gives the duty cycle of the emitted pulse trains

and depends on the length of Alice™s DL lD and the length of the ¬bre link lAB :

lD

(5)

·duty = .

lAB + lD

Hence with our prototype we can expect a raw rate of Rraw of about

lD

Rraw = qνµtAB tB ·B ·duty ·„ ≈ 140 kHz µtAB (6)

.

lAB + lD

3.2. Error correction, privacy ampli¬cation and eavesdropping

The net secret key rate is further reduced during the error correction and privacy ampli¬cation

processes by a factor of ·dist . We did not implement error correction and privacy ampli¬cation

for our ¬eld tests, but we would like to roughly estimate the net key rate that could be obtained

with our system. In theory, ·dist is simply given as the difference between the mutual information

of Alice and Bob, IAB , and Alice and Eve, IAE [3]:

·dist = IAB (D) ’ IAE . (7)

Due to the errors, IAB is smaller than 1. It is a function of the disturbance D, which is equal to

the total QBER:

IAB = 1 + D log2 D + (1 ’ D) log2 (1 ’ D). (8)

New Journal of Physics 4 (2002) 41.1“41.8 (http://www.njp.org/)

41.5

In the following we estimate the information of Eve, IAE . In the line of Felix et al [11] we make

the following assumptions:

• The measured QBER should, within the statistical limits, be equal to what is estimated

according equation (2). If this is not the case, a real user will not proceed and blindly apply

privacy ampli¬cation, he will stop the key exchange and look for the problem. If the QBER is

within these limits, we attribute to Eve the QBERopt ( < 0.5%) plus the error (2σ) of the error

∼

< 0.5% for reasonably long keys), say 1% in total. In the case of perfect equipment

estimation ( ∼

of the eavesdropper and true single-photon source this error corresponds to an information of

1% ∼ 3% [13].

2

=

ln 2

• In the case of faint laser pulses and especially in the presence of high ¬bre losses, Eve can

take advantage of multi-photon pulses and gain information while creating few or no errors [11].

In this case, it is important to measure the length of the line and to register coincident clicks at

Bob™s two detectors in order to limit Eve™s possibilities. We assume that Eve possesses perfect

technology, but cannot ef¬ciently measure the number of photons without disturbing them and

cannot store them. Furthermore, she uses ¬bres with losses as low as 0.15 dB km’1 . Under

these assumptions one can calculate Eve™s information per bit due to multi-photon pulses I2ν

and obtains about 0.06, 0.14 and 0.40 for, 5, 10 and 20 dB losses, respectively (for µ = 0.2,

0.25 dB km’1 ¬bre loss and 108 pulses sent). Consequently, we obtain

IAE ∼ 0.03 + I2ν . (9)

=

With equations (7)“(9) we can calculate a theoretical value of ·dist . In practice, ·dist will be

smaller due to the limitations of the used algorithm. Privacy ampli¬cation can be performed

without additional bit loss in contrast to error correction. For our estimation, we use the results

of Tancewsky et al [12] for IAB after error correction

IAB = 1 + D log2 D ’ 7 D (10)

2

which is in fact considerably smaller than IAB . The information of Eve IAE is reduced by the

I

same factor IAB , too. Finally, we obtain the following estimate of Rnet :

AB

I

Rnet = ·dist Rraw ∼ (IAB ’ IAE ) AB Rraw

=

IAB

≈ [1 + D log2 D ’ 7 D ’ (0.03 + I2ν )(1 ’ (1 ’ D) log2 (1 ’ D) ’ 7 D)]Rraw .

2 2

(11)

4. Field measurements

4.1. Visibilities

In principle, the prototype can be tested in the laboratory by performing key exchange with

different ¬bre losses and comparing the measured QBER and bit rates with the estimated values

according to the simple formulae developed above. There are two motivations for ¬eld tests on

installed cables. The ¬rst reason is to check if the auto-compensating set-up is robust in many

different situations. Several effects could reduce the visibility of the interference. First, we have

previously shown that Faraday rotation due to the Earth™s magnetic ¬eld cannot considerably

decrease the visibility [14]. Second, the time delay between the two pulses, travelling back and

forth between Alice and Bob, could change due to a temperature drift. Let us assume that the

temperature of the ¬bre increases with a rate θ[ K ]. The time delay ∆t between the two pulses

h

New Journal of Physics 4 (2002) 41.1“41.8 (http://www.njp.org/)

41.6

Table 1. Visibility measurements on different ¬bres.

Fibre Length (km) Loss (dB) Visibility (%)

99.70 ± 0.03

Geneva“Nyon (under lake) 22.0 4.8

99.81 ± 0.03

Geneva“Nyon (terrestrial) 22.6 7.4

99.63 ± 0.05

Nyon“Lausanne (terrestrial) 37.8 10.6

99.62 ± 0.06

Geneva“Lausanne (under lake) A 67.1 14.4

99.66 ± 0.05

Geneva“Lausanne (under lake) B 67.1 14.3

99.70 ± 0.01

Ste croix (aerial) A 8.7 3.8

99.71 ± 0.01

Ste croix (aerial) B 23.7 7.2

is 54 ns. If θ is constant for the whole trip of the pulses, the second pulse will see a ¬bre that is

longer by ∆l:

∆l

(12)

= ±∆T

l

(13)

∆l = ±2lAB ∆T = ±2lAB θ∆t.

With ± = 10’5 [ K ], lAB = 50 km, θ = 10[ K ] we obtain 150 pm

1

». Hence this effect should

h

be negligible especially since installed ¬bres have slow temperature drifts. In contrast, slow

temperature induced length drifts can be large enough that frequent readjustment of Bob™s delay

becomes necessary. In fact, we noticed that during the heating up of Alice™s box within the ¬rst

hour of operation, the changes in the DL require a recalibration every 10 min or so. However,

a bad synchronization of the detection window does not affect QBERopt . Finally, mechanical

stress could change the ¬bre length and/or birefringence. If the birefringence changes rapidly,

the pulses are no longer orthogonally polarized at the input of Bob, despite the Faraday mirror. In

this case the two pulses might suffer different losses at Bob™s polarizing BS and the interference

will no longer be perfect. Rapid changes in stress are unlikely in installed cables, a couple of

meters below the surface. For this reason we also tested the prototype over an aerial cable. We

had at our disposal two ¬bres of 4.35 km length, of which 2.5 km in an aerial cable. In order to

amplify a hypothetical effect we put Alice and Bob side by side and passed twice through the

cable (con¬g. A). In con¬guration B we inserted one spool of about 15 km at the other end of

the cable. Hence, the pulses made the following trip: Bob, the aerial cable, 15 km spool, the

aerial cable, Alice (with her 10 km storage line), and back.

To measure the visibilities we sent relatively strong pulses (a couple of photons per pulse),

always with the same compatible phase values and look at the counts on the two detectors, Rright

and Rwrong (subtracting the counts due to detector noise). We then obtain the fringe visibility

according to the standard de¬nition

Rright ’ Rwrong

(14)

V=

Rright + Rwrong

and the corresponding QBERopt :

1’V

(15)

QBERopt = .

2

Table 1 summarizes the result of visibility measurements over different cables. The indicated

visibilities are the mean values over all four possible compatible phase settings. There was no

New Journal of Physics 4 (2002) 41.1“41.8 (http://www.njp.org/)

41.7

Figure 3. Satellite view of Lake Geneva with the cities of Geneva, Nyon and

Lausanne.

Table 2. Overview of exchanged keys over different ¬bres (µ = 0.2).

Fibre Length (km) Key (kbit) Rraw (kHz) QBER (%) Rnet (kHz)

2.0 ± 0.1

Geneva“Nyon (under lake) 22.0 27.9 2.06 1.51

2.1 ± 0.1

Geneva“Nyon (terrestrial) 22.6 27.5 2.02 1.39

3.9 ± 0.2

Nyon“Lausanne (terrestrial) 37.8 25.1 0.50 0.26

6.1 ± 0.4

Geneva“Lausanne (under lake) A 67.1 12.9 0.15 0.044

5.6 ± 0.3

Geneva“Lausanne (under lake) B 67.1 12.9 0.16 0.051

3.0 ± 0.1

Ste Croix (aerial) A 8.7 63.8 6.29 4.34

3.0 ± 0.1

Ste Croix (aerial) B 23.7 117.6 2.32 1.57

considerable decrease of the visibility in any ¬bre, hence the auto-compensating interferometers

worked well under all conditions tested.

We tried to simulate an extremely unstable ¬bre link in the lab. For this purpose, we put

a ¬bre-optical polarization scrambler (GAP-optique) at the output of Bob followed by 25 km

of ¬bre. We measured the visibility as a function of the scrambler frequency. This frequency

is de¬ned as the number of complete circles that the vector of polarization would describe per

second on the Poincar´ sphere, if the birefringence changed uniformly. The visibility drops

e

from 99.7 to 99.5% and 98% at frequencies of 40 and 100 Hz, respectively. This shows that the

visibilities can decrease under rapid perturbations, however, it is unlikely to ¬nd such conditions

using installed ¬bres.

4.2. Key exchange

We performed key exchange over different installed cables, the longest connecting the cities of

Lausanne and Geneva (see ¬gure 3). For testing we always used the same ¬le of random numbers

so that Bob could make the sifting and calculation of error rate without communication. We

estimated the net key rate using equation (11). Table 2 gives an overview of the exchanged keys

with µ = 0.2.

New Journal of Physics 4 (2002) 41.1“41.8 (http://www.njp.org/)

41.8

We notice that secure key exchange is possible over more than 60 km with about 50 Hz of

net key rate.

5. Conclusion

We presented a QKD prototype, which can be simply plugged into the wall, connected to a

standard optical ¬bre and a computer via the USB port. It allows key exchange over more than

60 km, with a net key rate of about 50 bits s’1 . The system is commercially available [15].

Acknowledgments

We would like to thank Michel Peris and Christian Durussel from Swisscom for giving us

access to their ¬bre links, as well as Laurent Guinnard and Mario Pasquali for their help with

the software and ¬rmware, Jean-Daniel Gautier and Claudio Barreiro for their help with the

electronics. Finally, we thank R´ gis Caloz for the satellite picture. This work was supported by

e

the Esprit project 28139 (EQCSPOT) through Swiss OFES and the NCCR ˜Quantum Photonics™.

We also acknowledge the support of Sun Microsystems.

References

[1] Bennett Ch H and Brassard G 1984 Quantum cryptography: public key distribution and coin tossing Int. Conf.

on Computers, Systems and Signal Processing (Bangalore, India, Dec. 1984) pp 175“9

[2] Bennett Ch H, Bessette F, Brassard G, Salvail L and Smolin J 1992 Experimental quantum cryptography J.

Cryptol. 5 3“28

[3] Gisin N, Ribordy G, Tittel W and Zbinden H 2002 Quantum cryptograpy Rev. Mod. Phys. at press

(Gisin N, Ribordy G, Tittel W and Zbinden H 2002 Preprint quant-ph/0101098)

[4] Muller A, Herzog T, Huttner B, Tittel W, Zbinden H and Gisin N 1997 Plug&play systems for quantum

cryptography Appl. Phys. Lett. 70 793“5

[5] Ribordy G, Gautier J-D, Gisin N, Guinnard O and Zbinden H 2000 Fast and user-friendly quantum key

distribution J. Mod. Opt. 47 517“31

[6] Bethune D and Risk W 2000 An auto-compensating ¬ber-optic quantum cryptography system based on

polarization splitting of light IEEE J. Quantum Electron. 36 340“7

[7] Nielsen P M, Schori C, Sorensen J L, Savail L, Damgard I and Polzik E 2001 Experimental quantum key

distribution with proven security against realistic attacks J. Mod. Opt. 48 1921“42

[8] Bourennane M, Ljunggren D, Karlsson A, Jonsson P, Hening A and Ciscar J P 2000 Experimental long

wavelength quantum cryptography: from single-photon transmission to key extraction protocols J. Mod.

Opt. 47 563“79

[9] Stucki D, Ribordy G, Stefanov A, Zbinden H, Rarity J G and Wall T 2001 Photon counting for quantum key

distribution with Peltier cooled InGaAs APDs J. Mod. Opt. 48 1967“82

[10] Stefanov A, Guinnard O, Guinnard L, Zbinden H and Gisin N 2000 Optical quantum random number generator

J. Mod. Opt. 47 595“8 (available from id Quantique, www.idquantique.com.)

[11] F´ lix S, Gisin N, Stefanov A and Zbinden H 2001 Faint laser quantum key distribution: eavesdropping

e