Quantum Communication and Security (NATO Science for Peace and Security Series: Information and Communication Security) (NATO Security Through Science Series. D: Information and Com)

QUANTUM COMMUNICATION AND SECURITY

NATO Science for Peace and Security Series This Series presents the results of scientific meetings supported under the NATO Programme: Science for Peace and Security (SPS). The NATO SPS Programme supports meetings in the following Key Priority areas: (1) Defence Against Terrorism; (2) Countering other Threats to Security and (3) NATO, Partner and Mediterranean Dialogue Country Priorities. The types of meeting supported are generally “Advanced Study Institutes” and “Advanced Research Workshops”. The NATO SPS Series collects together the results of these meetings. The meetings are co-organized by scientists from NATO countries and scientists from NATO’s “Partner” or “Mediterranean Dialogue” countries. The observations and recommendations made at the meetings, as well as the contents of the volumes in the Series, reflect those of participants and contributors only; they should not necessarily be regarded as reflecting NATO views or policy. Advanced Study Institutes (ASI) are high-level tutorial courses to convey the latest developments in a subject to an advanced-level audience. Advanced Research Workshops (ARW) are expert meetings where an intense but informal exchange of views at the frontiers of a subject aims at identifying directions for future action. Following a transformation of the programme in 2006 the Series has been re-named and reorganised. Recent volumes on topics not related to security, which result from meetings supported under the programme earlier, may be found in the NATO Science Series. The Series is published by IOS Press, Amsterdam, and Springer Science and Business Media, Dordrecht, in conjunction with the NATO Public Diplomacy Division. Sub-Series A. B. C. D. E.

Chemistry and Biology Physics and Biophysics Environmental Security Information and Communication Security Human and Societal Dynamics

Springer Science and Business Media Springer Science and Business Media Springer Science and Business Media IOS Press IOS Press

http://www.nato.int/science http://www.springer.com http://www.iospress.nl

Sub-Series D: Information and Communication Security – Vol. 11

ISSN 1874-6268

Quantum Communication and Security

Edited by

Marek Żukowski University of Gdańsk, Poland

Sergei Kilin B.I. Stephanov Institute of Physics, Belarus

and

Janusz Kowalik University of Gdańsk, Poland

Amsterdam • Berlin • Oxford • Tokyo • Washington, DC Published in cooperation with NATO Public Diplomacy Division

Proceedings of the NATO Advanced Research Workshop on Quantum Communication and Security Gdańsk, Poland 10–13 September 2006

© 2007 IOS Press. All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, without prior written permission from the publisher. ISBN 978-1-58603-749-9 Library of Congress Control Number: 2007926784 Publisher IOS Press Nieuwe Hemweg 6B 1013 BG Amsterdam Netherlands fax: +31 20 687 0019 e-mail: [email protected] Distributor in the UK and Ireland Gazelle Books Services Ltd. White Cross Mills Hightown Lancaster LA1 4XS United Kingdom fax: +44 1524 63232 e-mail: [email protected]

Distributor in the USA and Canada IOS Press, Inc. 4502 Rachael Manor Drive Fairfax, VA 22032 USA fax: +1 703 323 3668 e-mail: [email protected]

LEGAL NOTICE The publisher is not responsible for the use which might be made of the following information. PRINTED IN THE NETHERLANDS

v

Quantum Communication and Security M. Żukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

Preface This volume contains a selection of papers invited and presented at the NATO sponsored Advanced Research Workshop on ``Quantum Communication and Security’’ held at the Gdańsk University in Gdańsk, Poland from September 10th to 13th, 2006. The purpose of the workshop was to assess the state of the art in the workshop subject area and identify new research challenges. The workshop was an opportunity for many experts from Western Europe, USA and former Soviet Union Republics for discussing theoretical and applied aspects of quantum communication and cryptography. We wish to thank the NATO Security Through Science Division and more specifically Dr. Hadassa Jakobovits, Director of Information and Communication Security Program for the generous support of the workshop. Special thanks are due to the Gdańsk University administration officials, Rector, Prof. Andrzej Ceynowa and Dean, Prof. Andrzej Kowalski who made available all workshop facilities at no cost. Without any reservation, we say that Gdańsk University was the highest quality host of this NATO workshop. There are several persons who contributed directly to the success of the workshop. They provided an excellent office and technical support. They include Prof. Wiesław Miklaszewski, Mrs Elżbieta Bandura, Mrs Anita Charkot, Mr Tomasz Paterek, and Mr Wiesław Laskowski. But above all we are deeply grateful to the participants of the workshop, especially those who contributed papers to this book. Marek Żukowski, Sergei Kilin and Janusz Kowalik

This page intentionally left blank

vii

List of Speakers 1. 2.

3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. 21.

Markus Aspelmeyer, Physics Faculty, University of Vienna, Boltzmanngasse 3, 1090 Wien, Austria Časlav Brukner, Institut für Quantenoptik und Quanteninformation, Österreichische Akademie der Wissenschaften, Boltzmanngasse 3, 1090 Wien, Austria, Anton Zeilinger, Institut for Experimentolphyscis, University of Vienna, Bolzmanngasse 5, 1090 Vienna, Austria Dmitri Horoshko, B.I. Stepanov Institute of Physics, National Academy of Sciences of Belarus, Nezavisimosti Avenue 68, 220072 Minsk, Belarus Sergei Kilin, Stepanov Institute of Physics, National Academy of Sciences of Belarus, Nezavisimosti Avenue 68, 220072 Minsk, Belarus Serge Massar, Laboratoire d'Information Quantique CP, Universite Libre de Bruxelles, 50 Av. F.-D. Roosevelt, 1050 Bruxelles, Belgium Zdeněk Hradil, Department of Optics, 17. listopadu 50, 772 00 Olomouc, Czech Republic Philippe Grangier, Laboratoire Charles Fabry de l’Institut d’Optique (UMR 8501), Campus Polytechnique, RD 128, 91127 Palaiseau Cedex, France Sebastien Tanzilli, Laboratoire de Physique de la Matière Condensée – LPMC, Université de Nice Sophia Antipolis, Parc Valrose, 06108 Nice Cedex, France Harald Weinfurter, Max Planck Institute for Quantum Optics, Munich LMU University, Munich, Germany Richard Gill, Math. Institut, University Utrecht, Box 80010, 3508 TA Utecht, Netherlands Robert Alicki, Wydział Matematyki, Fizyki i Informatyki, Uniwersytet Gdański, Wita Stwosza 57, 80-952 Gdańsk, Poland Karol Horodecki, Wydział Matematyki, Fizyki i Informatyki, Uniwersytet Gdański, Wita Stwosza 57, 80-952 Gdańsk, Poland Konrad Banaszek, Instytut Fizyki, Uniwerystet Mikołaja Kopernika, ul. Grudziądzka 5, 87-100 Toruń, Poland Michał Horodecki, Wydział Matematyki, Fizyki i Informatyki, Uniwersytet Gdański, Wita Stwosza 57, 80-952 Gdansk, Poland Marek Kuś, Centrum Fizyki Teoretycznej, Polska Akademia Nauk, Al. Lotników 32/46, 02-668 Warszawa, Poland Władyslaw Adam Majewski, Wydział Matematyki, Fizyki i Informatyki, Uniwersytet Gdański, Wita Stwosza 57, 80-952 Gdańsk, Poland Karol Życzkowski, Instytut Fizyki, Uniwersytet Jagielloński, Reymonta 4, 30-059 Kraków, Poland Marek Żukowski, Wydział Matematyki, Fizyki i Informatyki, Uniwersytet Gdański, Wita Stwosza 57, 80-952 Gdańsk, Poland Yuri Golubev, V.A. Fock Physics Instytute, St. Petersburg State University, Ul'yanovskaya 1, 198504 St. Petersburg, Russia Alexandr Kazakov, Department of Higher Mathematics, State University of AeroSpace Instrumentation, B. Morskaya 67, 190000 St.-Petersburg, Russia

viii

22. Sergei Kulik, Department of Quantum Electronics, Moscow M.V. Lomonosov State University, Leninskie Gory 1, str. 2, 119992 Moscow, Russia 23. Dmitriy Kupriyanov, Department of Theoretical Physics, St.-Petersburg StatePolytechnic University, Polytechnicheskaya Str. 29, 195251 St.-Petersburg, Russia 24. Vladimir Kurochkin, Institute of Semiconductor Physics Siberian, Academician M.A. Lavrentjev ave. 13, 630090 Novosibirsk, Russia 25. Sergei Molotkov, Institute of Solid State Physics RAS, Russian Academy of Sciences, Institutskaya 2, Mocow District 142432 Chernogolovka, Russia 26. Yuri Ozhigov, Kafedra Quantum Informatics, Moscow State University, VMK 2 Gum. Building, Vorobievi Gori, 119992 GSP-2 Moskow, Russia 27. Ivan Sokolov, V.A. Fock Institute of Physics, St. Petersburg State University, Ul'yanovskaya, 1198504 Stary Petershof, St.-Petersburg, Russia 28. Mário Ziman, Research Center for Quantum Information, Institute of Physics, Slovak Academy of Sciences, Dubravská cesta 9, 845 11 Bratislava, Slovak Republic 29. Antonio Acín, ICFO Institut de Ciencies Fotoniques, Meditarranean Technology Park, Av. Del Canal Olimpic, Castelldefels, 08860 Barcelona, Spain 30. Adán Cabello, Departamento de Física Aplicada II, University of Seville, Avda. Reina Mercedes s/n, 41012 Sevilla, Spain 31. Mohammed Bourennane, Physics Department, Stockholm Univeristy, Albanova universitetcentrum, 10691 Stockholm, Sweden 32. Hugo Zbinden, GAP-O, Université de Genève, 20, rue de l'Ecole-de-Médecine, 1211 Genève 4, Switzerland 33. Jeremy O’Brien, Department of Physics & Department of Electrical Engineering Merchant Venturers Building, Woodland Rd, BRISTOL BS8 1UB, UK 34. Ruediger Schack, Department of Mathematics, Royal Holloway University of London, Egham, TW20 0EX Surrey, UK 35. Ian Walmsley, Department of Physics, University of Oxford, Parks Road, OX1 3PU Oxford, UK 36. Robert Young, Toshiba Reserarch Europe Ltd., Unit 260 Cambridge Science Park, Milton Road, CB4 0WE Cambridge, UK 37. Constantin V. Usenko, Theoretical Physics Division, Physics Department, Univerity of Kyiv, Glushkova 2, 03127 Kyiv, Ukraine 38. Mark Hillery, Department of Physics, Hunter College, 695 Park Avenue, New York, NY 10021, USA 39. Alexei Trifonov, Ioffe Institute RAS, RUSSIA and MagiQ Technologies, Inc., 11 Ward Street, 02143 Somerville MA, USA 40. Marek Czachor, Technical University of Gdańsk, Narutowicza 11/12, 80-952 Gdańsk, Poland

ix

Technical Summary of the Workshop ˙ Compiled by Marek ZUKOWSKI The presentations and discussions of the workshop concentrated mainly around quantum cryptography (both technical and experimental aspects and pure theory), general problems of theoretical quantum information and its realizations (laboratories and applied physics), and finally the related topics concerning quantum theory itself – the most fundamental questions. The general feeling of both the organizers and the participants was that a very broad spectrum of advances in quantum information and communication was presented and discussed during the workshop.

1. Quantum cryptography • Massar discussed protocols for Quantum Communication. In his talk he covered three topics. First of all he discussed quantum coin tossing and quantum string flipping: the task in which two parties that do not trust each other want to generate a single random coin, or a string of random coins. He showed that better security is possible using quantum communication than classical communication. These results are illustrated by an experimental demonstration based on the plug and play scheme for quantum cryptography. Second, he presented a method, called error filtration, for detecting errors during quantum communication. An experimental demonstration was presented in which a quantum key distribution scheme which is insecure is rendered secure by using error filtration. Third, he presented preliminary results concerning a novel source of photon pairs: parametric fluorescence in periodically poled twin hole fibers. • Horoshko presented a definition of asymmetric universal entangling machine which entangles a system in an unknown state to a specially prepared ancilla. The machine produces a fixed state-independent amount of entanglement in exchange to a fixed degradation of the system state fidelity. We describe explicitly such a machine for any quantum system having d levels and prove its optimality. A d2 -dimensional ancilla is sufficient for reaching optimality. The introduced machine is a generalization to a number of widely investigated universal quantum devices such as the symmetric and asymmetric quantum cloners, the symmetric quantum entangler, the quantum information distributor and the universal-NOT gate. He discussed the application of the asymmetric universal entangling machine to eavesdropping on a quantum cryptographic line with BB84 or 6-state protocols and one-way error correction. The entangling machine is optimal for intercepting the key when the bit error rate in the line is higher than the maximal value required by the unconditional security.

x

• Kulik discussed the security of Quantum Key Distribution protocol based on ququarts. The QKD protocol with four-state system is based on single spatial and frequency non-degenerate down converted photons. A simple scheme for biphoton generation and their deterministic measurements was analyzed. Also he discussed the ways how to control the biphoton polarization state using optical fiber and Mach-Zehnder interferometer. The critical noise level was estimated for the measurement scheme operated with coincidence which is typical for biphotons. Three main incoherent attacks (intersept-resend, intermediate basis and optimal attack) on QKD protocol in Hilbert space with dimension D = 4 using three mutually unbiased bases were analyzed. QKD protocol with four-dimensional states belonging to three mutually unbiased bases provides better security against the noise and eavesdropping than protocols exploited two bases with qubits and ququarts. A intensive debate on the validity of this approach followed this talk. • Quantum information science overcomes a number of barriers for conventional information transfer, cryptography and computation (Bourennane). In quantum cryptography, and in particular in secret sharing protocol, a protocol where a secret message is split among several parties in a way that it reconstruction require the collaboration of the participating parties. It has been proven that assisted multipartite entanglement secret sharing protocol is secure. It has been also shown that quantum multiparty communication complexity protocols assisted with multipartite entanglement are clearly superior with respect to classical ones. However, so far the only quantum scheme that reached the stage of commercial application is quantum key distribution. Bourennane showed that one can experimentally realize multiparty communication complexity and secret sharing protocols by using single qubit communication. • Standard Quantum Key Distribution schemes base their security on Quantum Mechanics laws plus the assumption that the honest parties have a perfect knowledge on their devices. Actually, any protocol built from correlation data that do not violate any Bell’s inequality requires some assumptions on the devices for its security proof. On the other hand, starting from data producing a violation of a Bell’s inequality, it is possible to construct a QKD scheme without making any assumption on the devices (Acín). • Trifonov overviewed the recent progress of deploying quantum key distribution technique to be used in existing optical networks. He emphasized problems specific for optical networking, such as wavelength division multiplexing (WDM), routing of the signal, etc. The perspective and benefits of entanglement-based QKD was reviewed. • Zbinden discussed long distance quantum communication, practical QKD up to the goal of constructing quantum repeaters. He presented, experimentally demonstrated new protocol for practical quantum cryptography. An implementation with weak coherent pulses giving a high key generation rate. The key is obtained by a simple time-of-arrival measurement on the data line the presence of an eavesdropper is checked by an interferometer on an additional monitoring line. The setup is experimentally simple; moreover, it is tolerant to reduced interference visibility and to photon number splitting attacks, thus featuring a high efficiency in terms of distilled secret bit per qubit. He also presented recent results of a quantum teleportation experiment over installed optical fibers and a new source of coherent pho-

xi

ton pairs, which allows Bell-state measurements after many kilometers of fibers. These are a necessary ingredients for a future quantum repeater. • Walmsey discussed two novel protocols relevant to quantum information processing, specifically in quantum state detection and in quantum cryptography. First, he described an implementation of a new method for optimal state discrimination based on maximizing the a posteriori probability for correctly assigning the input state given a particular measurement outcome. This procedure enables each of three non-orthogonal states to be identified with probability 2/3 independent of the other states in the ensemble. Second, he analyzed the utility of the continuous degrees of freedom of photon pairs (e.g. the transverse wavevector and frequency) to enable a secure key distribution protocol with several bits per photon transmitted. It was shown that the security characteristics are not the same as those of conventional continuous variable cryptography, and that secure communications of about bits per photon over links with up to 25 dB of attenuation were possible with realistic source and detectors designs. This results from the inherent non-Gaussian character of the detector noise in single-photon measurements as compared with homodyne detection, which constrain the sorts of attacks that an eavesdropper may use and remain undetected. • Molotkov presented a free-space relativistic quantum cryptography. Whereas quantum cryptography ensures security by virtue of complete indistinguishability of nonorthogonal quantum states, attenuation in quantum communication channels and unavailability of single-photon source present major problems. In view of these difficulties, the security of quantum cryptography can change from unconditional to conditional. Since the restrictions imposed by non-relativistic quantum mechanics and used to formulate key distribution protocols are largely exhausted, new principles are required. The fundamental relativistic causality principle in quantum cryptography can be used to formulate a new approach to ensuring unconditional security of quantum cryptosystems that eliminates the aforementioned difficulties. Quantum cryptosystems of this kind should be called relativistic. It can be shown that relativistic quantum cryptosystems remain unconditionally secure: first, attenuation in a quantum communication channel can only reduce the key generation rate, but not the security of the key: second, the source may not generate pure single-photon states, and a nonzero single-photon probability will suffice. The scheme remains secure even if the contribution of a single-photon component is small. This formally implies that a state may be characterized by an medium mean photon number. • Czachor discussed the relation between Bohm’s interpretation of quantum mechanics and quantum cryptography based on entanglement (Ekert type protocols). He showed that standard quantum cryptographic protocols are not secure if one assumes that nonlocal hidden variables exist and can be measured with arbitrary precision. The security can be restored if one of the communicating parties randomly switches between two standard protocols.

2. General experimental methods for quantum communication • The guest of the workshop, Zeilinger, gave a broad introduction to various experimental methods used in test of quantum mechanics and in practical quantum

xii

•

•

•

•

•

communication. This ranged from the early neutron interferometry experiments, to test the linearity of the Schroedinger equation, up to the proposed quantum communication schemes with and via satellites. Banaszek presented a demonstration that passive linear-optics manipulations of optical codes capable of correcting for photon loss exhibit limitations resulting directly from the recoverability condition. A three-photon code protecting against a single photon loss was introduced. He also discussed its preparation and transformations using linear optics and auxiliary photons. Weinfurter showed that multiphoton entanglement is ideal for multiparty quantum communication. He reported observations of various states. They were analyzed for their entanglement, entanglement persistency. He also demonstrated multi party protocols realized in his lab, e.g., secret sharing and quantum telecloning. Grangier reported on the findings of the recent paper “Single photons for quantum information processing”. A brief review of existing single photon sources was given. Next he focused on experiments using single NV centers in diamond nanocrystals, which have been used for quantum cryptography (A. Beveratos et al., Phys. Rev. Lett. 89 (18), 187901, 2002) and for observing single-photon interferences (V. Jacques et al., Eur. Phys. J. D 35, 561-565, 2005). Finally he describe an experiment using individual Rubidium atoms trapped in a microscopic optical tweezer. This single-atom source can produce single mode single photons (B. Darquié et al., Science 309, 454, 15 July 2005), which are shown to be indistinguishable (J. Beugnon et al., Nature 440, 779, 6 April 2006), and thus potentially useful for linear quantum computing. Over the past 10 years, people have tried to link the technology of guided-wave optics to quantum communication protocols. One of the best examples was perhaps the demonstration, in 1998, by the Geneva Group of Applied Physics (GAP), that nonclassical quantum correlations were not affected when energy-time entangled photons are physically separated by more than 10 km using telecom optical fibers. The use of integrated optics on Lithium Niobate combined with quasi-phase matched second order non-linear interactions, extensively developed in their own laboratory on Lithium Niobate, were presented by Tanzilli within the framework of quantum communication experiments. This technology is very attractive as it allows the integration of various optical components on a single chip, such as entangled photon-pair sources based on spontaneous parametric down-conversion, electrically controllable beam splitters, and tapered waveguides. Eventually this implies eliminating the need for bulk optical interconnections by simple fiber pigtailing. Such integrated components permit the realization of compact, robust and efficient key elements for various quantum communication protocols such as photonic quantum interfaces and integrated quantum relays, which are presented individually. Kilin presented and advocated for diamond-based quantum information technologies Different color centers in diamond (NV, NE8, NV+N) have been considered. It was shown that these color centers are perspective for QI tasks. With the help of modern experimental techniques it is possible: (i) to store QI at the level of single electron and nuclear spins belonging to one color center, (ii) efficiently read-out QI written on quantum states of the spins, (iii) to control and to operate with the

xiii

systems of qubits (make Q-gates, purify and swap entanglement), (iv) to create single photon source integrated into optical fibers, (v) to implement quantum repeaters. Technological tasks towards practical implementations of diamond-based QIT have been discussed including: ultra-pure diamond thin films and nanocrystals, new color centers; fabrication of systems and arrays of defects by means of electron beam and ion (N+) beam lithography; incorporation diamond nanocrystals containing a single color centre inside micro-cavities, so as to enhance collection efficiency of the emitted photons • Young showed that single InAs quantum dots embedded can be a useful source of both triggered single photons as well as polarization-entangled photon pairs. The former was demonstrated with a second order correlation function under 0.05 and the latter with a fidelity exceeding 70%. Such quantum dot devices may be useful in quantum communications and quantum information processing. • Kazakov discussed theoretically exponential superradiance and macroscopic entangled states Interaction between ensemble of two-level identical atoms and three-mode light is considered, when one of the modes is classical and its Rabi frequency much exceeds the effective Rabi frequencies of the remainder modes to be quantized. It is supposed that initial states are coherent state for the first quantized mode and vacuum state for the second quantized mode. It was found that occupation number of each quantized mode can exponentially depend on the number of atoms and time and the field in the quantized modes may be entangled. The obtained entanglement is nearly perfect and results is an continuous analog of the maximally entangled EPR state of the light with macroscopic large number of photons. • The process of lossless light propagation in a transparent and extended atomic medium was discussed by Kupryanov in context of light-matter quantum interface. We consider the scheme when the fluctuating linear polarization components of the circularly polarized light wave effectively interfere with the alignment fluctuations in the spin subsystem of a spin oriented macroscopic atomic ensemble. For this particular process there is a convenient symmetric interaction between atomic alignment components and linear polarization Stokes components of light. This interaction can be employed for the creation of the quantum memory and in entanglement protocols. As a practically relevant example one can consider the interaction of a light pulse with the system of hyperfine transitions for D1 line of 87 Rb. The quality of the proposed protocols can be verified via evaluation of their basic characteristics and numerical analysis.

3. Quantum theory and quantum information • A novel theoretical approach to macroscopic realism and classical physics within quantum theory can be formulated Brukner. While conceptually different from the decoherence program, it is not at variance with it. It puts the stress on the limits of observability of quantum effects of macroscopic objects, i.e., on the required precision of our measurement apparatuses such that quantum effects can still be observed. Brukner shows that for unrestricted measurement accuracy a violation of macrorealism is possible for arbitrary large systems. Also, given the restric-

xiv

tion of coarse-grained measurement resolution, not only macrorealism becomes valid but even the classical Newtonian laws emerge out quantum laws. Classical physics can thus be seen as implied by quantum mechanics under the course grained measurements. • Aspelmeyer presented anexperimental test of nonlocal hidden variable theories. Nonlocal hidden variable theories are often being discussed as possible extensions of quantum theory. They could explain intrinsic quantum phenomena, above all quantum entanglement, by nonlocal interactions while maintaining a realistic description of nature. Up to now, however, no experiments have investigated such theories. He presented an inequality, similar in spirit to the one given by Clauser, Horne, Shimony and Holt (CHSH) on local hidden variables, that allows to test an important class of nonlocal hidden variable theories against quantum theory. The theories under test provide an explanation of all existing two-qubit Bell-type experiments. The derivation is based on a recent theorem by Leggett, which was extended to apply to real experimental situations and to simultaneously test against all local hidden variable models. Finally, an experiment was performed which showed violations of the new inequality and hence excludes for the first time a broad class of nonlocal hidden variable theories as possible models underlying quantum theory. • Ku´s discussed new measures of multiparticle entanglement: an approach to a quantitative characterization of entanglement properties of, possibly mixed, bi- and multipartite quantum states of arbitrary finite dimension. Particular emphasis was given to: 1) the derivation of reliable estimates which allow for an efficient evaluation of entanglement measures, 2) construction of measures of entanglement useful in the monitoring of the time evolution of multipartite correlations under incoherent environment coupling and experimental production of entangled states, 3) construction of quantities characterizing entanglement which are directly measurable (defined in terms of physically realizable operators). To this end were proposed generalizations of concurrence for multipartite quantum systems that can distinguish qualitatively distinct quantum correlations (generalized multipartite and multidimensional concurrences). A lower bound was derived for the concurrence of mixed quantum states, valid in arbitrary dimensions. As a corollary, a weaker, purely algebraic estimate was found, which can be used to detect mixed entangled states with a positive partial transpose. The monotonicity of the constructed quantities under local operations and classical communication (LOCC) was discussed. A necessary and sufficient condition for the monotonicity of generalized multipartite concurrences, what qualifies them as legitimate entanglement measures, was proposed. The constructed measures were used in an optical experiment showing that it is possible to directly quantify the pure-state entanglement via a measurement of a physical observable. Similar experiment could be, in principle, performed also in a multipartite case. • Essentially multivariate entanglement based schemes of quantum teleportation were presented by Sokolov. He examined some parallel models of quantum holographic teleportation and telecloning of optical images, based on essentially multivariate continuous variables entanglement. It was shown that one can consider the models as an extension of conventional holography to quantum domain. In particular, a new version of holographic teleportation and telecloning was described that

xv

•

•

•

•

allows for the color (frequency) conversion between the input and the teleported image(s), when an input image is teleported or telecloned to the output image(s) at different frequency with preservation of its original multimode quantum state. This new phenomenon may of importance for parallel quantum interface between light and resonant atoms, where it is often desirable to have a tunable source of light that does not change its quantum state in the tuning process. Horodecki M. discussed the quantum coding theorem, its new proofs, and the relation with privacy and distinguishability. Originally, the coding theorem was provided by Lloyd, Shor and Devetak. The first fully rigorous proof is due to Devetak, based on random CSS codes. The aim was to simplify the proof of coding theorem, and show that one can obtain it by applying various type of codes. Also, a formula was obtained that bounds so called “quantum error” in terms of distinguishability by receiver and by environment: the faithful transmission of quantum information requires that receiver can distinguish the codewords, while the environment cannot. the authors have quantified this relation, generalizing in this way its special application of Devetak. Horodecki K. showed that there are channels with zero quantum capacity but through which one can establish unconditionally secure key. This is achieved by showing, that we can verify untrusted key distillable states without need of quantum communication, but with just local measurements and classical communication. A general class of protocols was pinpointed, which distill key if only the channel allows to share key-distillable states. This applies even if the shared state is bound entangled. The authors also show how in certain cases turn this protocol into a prepare and measure one. The example of a two-qubit channel with zero quantum but nonzero private capacity, based on states already found in quantph/0506203 which allows for one-way prepare end measure key distillation is presented. Entanglement in continuous-variable systems is not as well understood as entanglement in finite-dimensional systems. Hillery discussed a class of inequalities whose violation shows the presence of entanglement in two-mode systems. The authors initially consider observables that are quadratic in the mode creation and annihilation operators and find conditions under which a two-mode state is entangled. Further examination allows one to formulate additional conditions for detecting entanglement that contain expectation values of arbitrarily high powers of creation and annihilation operators. It was shown how these conditions can be used to find inputs of optical devices that lead to entangled outputs. He also present non-Gaussian states whose entanglement can be detected by our new conditions but whose entanglement is not demonstrated by previously known conditions. Finally, he concluded by showing how the methods used here can be extended to find entanglement in systems of more than two modes. Ziman analyzed how entanglement between two components of a bipartite system behaves under the action of local channels of the form [E ⊗ I]. it can be shown that a set of maximally entangled states is by the action of [E ⊗ I] transformed into the set of states that exhibit the same degree of entanglement. The entanglement-induced state ordering is “relative” and can be changed by the action (in) (in) of local channels. That is, two states ρ1 and ρ2 such that the entanglement (in) (in) E[ρ1 ] of the first state is larger than the entanglement E[ρ2 ] of the second

xvi (out)

•

•

•

•

(out)

(out)

(out)

state are transformed into states ρ1 and ρ2 such that E[ρ2 ] > E[ρ1 ]. The result is that almost any unilocal channel affects the ordering for arbitrary (nondiscrete) entanglement measure. This implies a weaknesses of the concept of abstract entanglement measures. Majewski provided new arguments indicating that non-completely positive maps can describe open quantum evolution. In particular, it can be shown, that for the subsystem given by the fermionic algebra associated with n sites of 1D lattice, the reduced “hamiltonian” type dynamics is positive unital only, i.e. dynamical maps are given by non-decomposable transformations. Single photons are ideal systems for quantum information science applications – including quantum communication and quantum metrology – due to intrinsically low decoherence and easy one-qubit rotations. However, realizing twoqubit logic gates for quantum computation requires a massive optical nonlinearity. In 2001 Knill, Laflamme and Milburn (KLM) discovered that a “measurementinduced” nonlinearity can be realized nondeterministically using only single photon sources, linear optical networks, and single photon detectors. There have been a number of important theoretical improvements – including cluster state approaches to optical quantum computing – and experimental proof-o-principal demonstrations. In addition, it has been recognized that the measurement-induced optical nonlinearity at the heart of the KLM scheme can be applied to other quantum information protocols: including generalized quantum measurements, nonlinear absorption of single photons, and quantum metrology. O’Brien described an approach to building and characterizing entangling quantum logic gates for single photon qubits, along with recent architecture simplifications. Then he showed how optical nonlinearities can be used in the context of generalized measurements – i.e. non-destructive and arbitrary strength, for the realization of weak values, and as non-local measuring devices for a demonstration of non-locality without entanglement. Finally, he described how the ideas of KLM can be extended from non-linear phase shifts to non-linear absorption. Alicki presented a proof of a no-go theorem for storing quantum information in equilibrium systems. Namely, quantum information cannot be stored in a system with time-independent Hamiltonian interacting with heat bath of temperature T > 0 during time that grows with the number of used qubits. The result implies fundamental difference between quantum and classical information in physical terms. He also presented a general definition of a qubit and discuss its implications for two physical systems which might be used to carry quantum information. The first one, polarization degrees of freedom of light beam, can correspond to a qubit only for a single photon “beam”. In particular the amount of entanglement which can be encoded into two beams is inversely proportional to the larger averaged number of photons. Similarly, it was argued that the so-called superconducting qubits might be essentially classical objects that not carry genuine quantum information. Ozhigov attempted to substantiate an algorithmic approach to quantum mechanics, that can give the more appropriate mathematical formalism of quantum theory than the standard one. It can be shown how to construct the universal effective classical algorithm which can simulate quantum dynamics of n particles with the linear memory O(n). The decoherence is treated as the influence of the limitation

xvii

•

•

•

•

on the classical computational resources in the quantum simulation. He showed how Born rule for quantum probability arises from the existence of the grain of amplitude. He also represented an economical way of simulation of entanglement. Christandl discussed a new kind of quantum de Finetti theorem for representations of the unitary group U (d). Consider a pure state that lies in the irreducible representation Uμ+ν for Young diagrams mu and nu. Uμ+ν is contained in the tensor product of Uμ and Uν ; let ξ be the state obtained by tracing out Uν . It can be shown that ξ is close to a convex combination of states Uv , where U is in U (d) and v is the highest weight vector in Uμ . When Uμ+ν is the symmetric representation, this yields the conventional quantum de Finetti theorem for symmetric states, and the presented method of proof gives near-optimal bounds for the approximation of ξ by a convex combination of product states. For the class of symmetric Werner states, was given a second de Finetti-style theorem (“half” theorem); the de Finetti-approximation in this case takes a particularly simple form, involving only product states with a fixed spectrum. The proof uses purely group theoretic methods, and makes a link with the shifted Schur functions. It also provides some useful examples, and gives some insight into the structure of the set of convex combinations of product states. ˙ Zyczkowski conducted an analysis of ideal error correcting codes for randomized unitary channels determined by two unitary error operators – what we call “binary unitary channels” – on multipartite quantum systems. In a wide variety of cases one can give a constructive description of the code structure for such channels. Specifically, and find a practical geometric technique to determine the existence of codes of arbitrary dimension, and then derive an explicit construction of codes of a given dimension when they exist. For instance, given any binary unitary noise model on an n-qubit system, one can design codes that support n − 2 qubits. This is accomplishable by verifying a conjecture for higher rank numerical ranges of normal operators in many cases. Really the title of Gill’s presentation should have been “better Bell experiments”. He described the convex sets of joint probability distributions of outcomes of a Bell-type experiment with p parties, q measurements per party, r outcomes per measurement. One can distinguish between the big non-signalling polytope, the smaller quantum body, and the still smaller classical (local realism) polytope. A good experiment corresponds to supQ inf P D(Q : P ) where D is some distance measure, P varies through all local realist theories, and Q varies over the design space of the quantum experimenter (state, measurements, joint setting probabilities . . . ). Euclidean distance corresponds to noise resistance, relative entropy corresponds to statistical power. It turns out that the GHZ experiment is no better than CHSH according to the latter criterion, when implemented as in current experiments, and assuming everything perfect! There are many good conjectures to be made about 2 × 2 × r experiments (CGLMP inequalities) and the best experiments of this type use not-maximally entangled states! New ladder type experiments have been constructed, based on singlets, better than traditional CHSH (though using correlated settings). New CH-type inequalities have been derived for taking account of non-detections by seeing this as a 2 × 2 × 3 experiment. Cabello’s presentation was about Bell inequalities based on equalities. Bell’s original inequality can be considered the first of a family of Bell inequalities based on

xviii

Einstein-Podolsky-Rosen’s definition of elements of reality, whose scaling properties, together with some recent developments, like the possibility of achieving almost perfect correlations and the possibility of preparing pairs of particles in hyperentangled states make them useful to solve two still-open experimental problems: (i) The experimental verification that the violation of local realism grows exponentially with the size of the subsystems. (ii) The design of a loophole-free refutation of local realism with currently available photo-detection efficiencies. • Usenko pointed that one of the most interesting phenomena in quantum physics is the ability of quantum system to create information, for instance, in measurement of electron spins for an EPR-pair. This property is actively used in different areas of quantum physics, like Quantum Key Distribution. States of quantum system with such peculiarity are known as entangled states. Recently a lot of entangled states has been studied and there exists an urgent problem of classification of all the set of entangled states. Subject of the talk dealt with the idea of the invariance of entangled states under transformations of a group of symmetry. Each state of quantum system is invariant under phase coefficient thus composite system is to be invariant under transformations of the group of symmetry of each subsystem. These groups form the group of symmetry of the whole system so the set of all states of the system can be classified through irreducible representations of that group. Almost of each space of irreducible representation consists entangled states only. Entropy of sub-states from each space with nontrivial representation exceeds entropy of whole state. Excess of entropy of a subsystem over entropy of the whole system indicates the presence of entanglement in the system. An extended public discussion with Horodecki R followed the talk. • Schack asked the following fundamental question: In precisely what way are random numbers generated by a quantum device superior to classically generated random numbers? Properties of the generated string such as its algorithmic complexity are not directly relevant to this question, and then shows that any answer to this question must depend on the interpretation of probabilities, and thus on the interpretation of quantum states. Most authors interpret probabilities derived from quantum states as objective. The talk explained why the objectivist approach is unlikely to provide insight into the nature of quantum random numbers. Alternatively, quantum states can be interpreted in a subjectivist way as representing Bayesian degrees of belief. Within the subjectivist approach, one can formulate and prove a theorem that captures in a precise way what is uniquely quantum about quantum random numbers. ˙ • Zukowski presented new methods of deriving Bell inequalities, and new applications of Bell inequalities (especially in communication complexity problems).

xix

Contents Preface Marek Żukowski, Sergei Kilin and Janusz Kowalik

v

List of Speakers

vii

Technical Summary of the Workshop Marek Żukowski

ix

1. Quantum Cryptography Three Topics in Quantum Communication: Error filtration, Quantum String Flipping, Photon Pair Generation in Periodically Poled Twin Hole Fibers Serge Massar, Kien Phan Huy, Edouard Brainis, Anh-Tuan Nguyen, Marc Haelterman, Philippe Emplit, Nicolas Cerf, Louis-Philippe Lamoureux, David Amans, Costantino Corbari, Albert Canagasabey, Morten Ibsen, Peter G. Kazansky, Andrei Fotiadi, Patrice Mégret and Olivier Deparis

3

Entanglement and Eavesdropping in Quantum Cryptography Dmitri Horoshko and Sergei Kilin

11

Experimental Single Qubit Quantum Multiparty Communication Mohamed Bourennane, Christian Schmid, Pavel Trojek, Christain Kurtsiefer, Časlav Brukner, Marek Żukowski and Harald Weinfurter

22

Relativistic No-Cloning Theorem Sergey N. Molotkov and D.I. Pomozov

31

Fast Quantum Key Distribution with Photon Number Decoys Daryl Achilles, Ekaterina Rogacheva and Alexei Trifonov

37

Cryptographic Properties of Non-Local Correlations Antonio Acín, Nicolas Gisin, Serge Massar, Stefano Pironio and Valerio Scarani

50

2. Theory of Quantum Information A Coarse-Grained Schrödinger Cat Johannes Kofler and Časlav Brukner

63

Measures of Multiparticle Entanglement Marek Kuś

69

Bell Inequalities Based on Equalities Adán Cabello

75

A Quantum de Finetti Theorem for the Unitary Group Matthias Christandl, Robert König, Graeme Mitchison and Renato Renner

83

xx

Production of Information and Entropy in Measurement of Entangled States Constantin V. Usenko

89

Better Bell Inequalities Richard D. Gill

99

3. Production of Entangled States, Experimental Techniques The Entanglement of the Symmetric Four-Photon Dicke State Christian Schmid, Nikolai Kiesel, Wiesław Laskowski, Enrique Solano, Geza Tóth, Marek Żukowski and Harald Weinfurter

113

Security of Quantum Key Distribution Protocol Based on Ququarts Alexander P. Shurupov and Sergei P. Kulik

123

Linear-Optics Manipulations of Photon-Loss Codes Konrad Banaszek and Wojciech Wasilewski

133

Long Distance Quantum Communication: From Practical QKD to Unpractical Quantum Relays Hugo Zbinden, Alexios Beveratos, Nicolas Gisin, Olivier Landry, Rob Thew, Valerio Scarani, Damien Stucki and Jeroen van Houwelingen Generating Triggered Single and Entangled Photons with a Semiconductor Source Robert J. Young, R. Mark Stevenson, Andy Hudson, Paola Atkinson, Ken Cooper, David A. Ritchie and Andrew J. Shields Quantum Memory via Coherent Scattering of Light by Optically Thick Atomic Medium Oksana S. Mishina and Dmitriy V. Kupriyanov Exponential Superradiance and Macroscopic Entangled States Valery N. Gorbachev, Alexander Ya. Kazakov and Andrey I. Trubilko

139

146

155 163

4. Quantum Communication and Computation Quantum Cryptography: A Practical Information Security Perspective Kenneth G. Paterson, Fred Piper and Rüdiger Schack

175

Biased Reconstruction: Homodyne Tomography Dmitri Mogilevtsev, Jaroslav Řeháček and Zdenĕk Hradil

181

Entanglement Conditions for Two- and Three-Mode States Mark Hillery

190

Entanglement Measures: State Ordering vs. Local Operations Mário Ziman and Vladimír Bužek

196

Diamond-Based Quantum Information Technologies Sergei Kilin, Alexander Nizovtsev, Alexander Bukach, Jean-François Roch, François Treussart, Jörg Wrachtrup and Fedor Jelezko

205

xxi

Towards Quantum-Based Election Scheme Vladimír Bužek, Mark Hillery and Mário Ziman

215

Author Index

225

This page intentionally left blank

1. Quantum Cryptography

This page intentionally left blank

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

3

Three Topics in Quantum Communication: Error filtration, Quantum String Flipping, Photon Pair Generation in Periodically Poled Twin Hole Fibers Serge MASSAR, a,1 Kien PHAN HUY a , Edouard BRAINIS b , Anh-Tuan NGUYEN b , Marc HAELTERMAN b , Philippe EMPLIT b , Nicolas CERF g , Louis-Philippe LAMOUREUX g , David AMANS c , Costantino CORBARI d , Albert CANAGASABEY d , Morten IBSEN d , Peter G. KAZANSKY d , Andrei FOTIADI e , Patrice MÉGRET e , Olivier DEPARIS f a

Laboratoire d’Information Quantique, Université Libre de Bruxelles, Brussels, Belgium b Service d’Optique et d’Acoustique, Université Libre de Bruxelles, Brussels, Belgium c Université de Lyon, F-69003, Lyon; Université Lyon 1, F-69622 Villeurbanne; CNRS, UMR5620, Laboratoire de Physico-Chimie des Matériaux Luminescents, F-69622 Villeurbane, France d Optoelectronic Research Centre, University of Southampton, Southampton, United Kingdom e Service d’Electromagnétisme et de Télécommunications, Faculté Polytechnique de Mons, Mons, Belgium f Solid State Physics Lab., Facultés Universitaires Notre-Dame de la Paix, Namur, Belgium g QUIC, CP 165/59, Université Libre de Bruxelles, Brussels, Belgium Abstract. We briefly present three topics in quantum communication. First of all a method, called error filtration, to reduce errors during quantum communication. We apply this method to quantum cryptography in a noisy environment, and describe an experimental realisation thereof. Second we describe an experimental realisation of quantum string flipping, in which two parties that do not trust each other want to generate a string of random bits. Finally we present the experimental realisation of a source of photon pairs at telecommunication wavelengths based on parametric fluorescence in periodically poled twin hole fibers. Keywords. Quantum communication, error filtration, string tossing, parametric fluorescence, periodically poled twin hole fibers

1 Corresponding Author: Serge Massar: Laboratoire d’Information Quantique, CP 225, Université Libre de Bruxelles, Boulevard du Triomphe, B-1050 Bruxelles, Belgium; E-mail: [email protected].

4

S. Massar et al. / Three Topics in Quantum Communication

Introduction At the NATO Advanced Research Workshop "Quantum Communication and Security" several results in the field of quantum communication obtained by the group at Université Libre de Bruxelles and their collaborators were presented. The first two topics are concerned with applications, other than the usual Quantum Key Distribution (QKD), which can be realised with the techniques[1] developped for long distance QKD in fiber optics at telecommunication wavelengths (1550nm). First of all we presented a method to reduce errors in quantum communication [2] and an implementation thereof[3]. Second we presented an experimental realisation of quantum string flipping[4], which is the task of generating, using only (quantum) communication, a string of random bits, between two parties that do not trust each other. This shows that fiber optics is a versatile medium in which to carry out quantum information processing. The above two applications use attenuated coherent pulses as a substitute for a true single photon source. However for some applications of quantum communication, such as those based on quantum non locality, or realisation of quantum relays, one needs entangled photons. The third topic presented at the workshop was the realisation of a source of photon pairs based on periodically poled twin hole fibers that produces photon pairs at 1550nm. As the source is entirely fiber based it could be easily integrated into telecommunication networks. The first two results have already been published, but not the last topic. For this reason in what follows we shall pass very rapidly on the first results, and present more in depth the photon pair source.

1. Error Filtration Error correction is an essential feature of information theory. Indeed it guarantees that, given the inevitable presence of imperfections, one can nevertheless store and transmit information reliably. The proof that one can in principle correct errors that occur in quantum memories[5] and in quantum communication[6] means that all the idealised protocols of quantum information invented by theorists can in principle be realised in a real world environment. However such error correction schemes are very difficult to implement in practice because they require multi particle interactions. So far only a few proof of principle laboratory demonstrations have been realized. A simpler approach is to only try to detect if errors occured. If an error is detected, the message is discarded: one only keeps the occurences when no error was detected. This is of course much weaker than error correction. But if the error rate is not too high, it may suffice for some applications, such as quantum key distribution (QKD). In [2] it was shown that such an approach can be easily implemented using present technology. Such a realisation of error detection was called “error filtration”. Error filtration can be applied when one can encode a small dimensional system, say one qubit, in a single particle. One then encodes this quantum state in a Hilbert space of large dimension. This encoding must be done in such a way that the Hilbert space H can be decomposed into a sum of Hilbert spaces H = ⊕i Hi such that the noise acts independently on the different subspaces Hi . It is then possible, using an interferometer, to detect with high probability whether an error has occurred, and, if so, to discard the state.

S. Massar et al. / Three Topics in Quantum Communication

5

Thus let us suppose that the Hilbert spaces Hi all have dimension d and that one prepares a d dimensional quantum state |ψ of a single particle. One then puts this particle N into an equal superposition of the difference “channels”: |ψ → √1N i=1 |ψi  where |ψi  ∈ Hi . The effect of noise can always be modeled as the entanglement of the system with an environment. The hypothesis that the noise is independent corresponds to the fact that the different channels get entangled with orthogonal environments. This can always be realised by separating the channels sufficiently far either in space or in time. Thus one obtains the state N N 1  1  √ √ Ui |ψi |0 = α|ψi |0 + β(W |ψi )|Ei  N i=1 N i=1

(1)

where Ui describes the interaction of channel i with its environment, we have supposed that if the environment of channel i is unchanged then the state propagating in that channel is unchanged, and W is an operator acting on the state. Finally we recombine the channels in such a way that if there is no noise (α = 1, β = 0) the state exits a single output channel. In the presence of noise, the state in the output channel is α|ψ|0 + β(W |ψ)

N 1  |Ei  . N i=1

(2)

One sees that whereas the weight of the first term |α|2 is independent of N , the weight of the second term decreases as 1/N . Thus the probability that the state is affected by noise decreases as 1/N , and in the limit of large N the state is completely unaffected by noise. Our experimental implementation of error filtration [3] is described in Fig. 1. In this implementation a 2 dimensional state, corresponding to 2 time bins propagating in optical fibers, is produced using a short laser pulse and an unbalanced Mach-Zehnder interferometer. Subsequently each time bin is transformed, using a second Mach-Zehnder interferometer, into a superposition of two time bins. This superposition of 4 time bins is then sent from Bob to Alice. Alice encodes  a quantum state using a phase modulator, in such as way to obtain a state of the form |0 + |1 + eiφ |2 + eiφ |3 /2. Corresponding to an encoding when N = 2 and the dimension of each Hilbert space Hi is 2. This state is reflected back to Bob’s site by a Faraday mirror at Alice’s end of the fiber. The decoding of the error filtration and the measurement of the state is carried out using the same Mach-Zehnder interferometers that were used to produce the superposition of 4 time bins to start. Using this setup we were able to transform (the optical part of) a QKD scheme that was too noisy to produce a secure key into a QKD scheme that was secure.

2. String Flipping Coin tossing is a cryptographic primitive in which 2 parties which do not trust each other want to choose a random bit. Any classical communication protocol that does not use a trusted third party is necessarily completely imperfect: one of the parties can cheat perfectly. String flipping is a generalization in which the two mistrustful parties want

6

S. Massar et al. / Three Topics in Quantum Communication l p1 C

id200

c1

p2

2l

PBS

Filtration

p3

pB ΦB

c2

ΦA

⊕

PC

Pulse/delay gener.

Bob

Noise gener.

A Laser

Patterns gener. Conv. : time → num.

FM

pA

c3

Alice

Figure 1. Experimental setup for error filtration: A, Attenuator; C, Circulator; PBS, Polarisation Beam Splitter; FM, Faraday Mirror; φA and φB , Phase Modulators; id200, Single Photon detector (IDQuantique); c1 , c2 , c3 , 50/50 couplers; p1 , p2 , p3 , pA , Polarisation Controllers; l and 2l, delay lines in the two interferometers of length l and 2l.

to choose a string of n random bits. Classical protocols exist which generate strings with high, but not perfect, randomness. In particular one of the parties can always cheat perfectly on a one bit function of the string, so that no contradiction is obtained with the single coin constraint. It is known that using quantum communication two parties can generate a coin with a non zero degree of randomness, thereby doing better than any classical protocol. In [4] we reported on a fiber optics implementation of a string flipping protocol. Very carefull attention was payed to how much a quantum adversary could cheat, and how much he could bias the string. Strict bounds on the quality of the string were obtained. However, as mentioned above, classical protocols exist which can generate strings with a high degree of randomness. It is therefore not clear whether this experiment attained a degree of randomness impossible classicaly.

3. Photon Pair Production in Periodically Poled Twin Hole Fibers Since several years, photon pairs have become an important resource for quantum communication. Lately, effort has been concentrated on generating those pairs in waveguiding structures to avoid collection and insertion losses. For instance, photon pair sources based on parametric fluorescence in periodically poled lithium niobate waveguide or on four-wave mixing in silica fibre have been extensively studied. In 1999, G. Bonfrate et al. reported the observation of quasi-phase matched parametric fluorescence in periodically poled D-shape silica fiber [7]. This suggested another promising photon pair source based on second-order non linearity in fiber. However, since that first demonstration, no further results have been reported on parametric fluorescence in periodically poled silica fiber. Here we report the observation of quasi-phase matched parametric fluorescence in periodically poled twin-hole silica fiber (PPSF). Compared with the periodically poled D-shape fibers used in [7], twin-hole fibers have several advantages: they can be directly spliced to optical fibers so that any photon pair is readily collected. Moreover, the technology for periodic poling in twin-hole fibers is compatible with tens of centimetres of interaction lengths, thus potentially ensuring higher conversion efficiency compared to D-shape fibers. Finally longer interaction length also induces narrower spectral width of

S. Massar et al. / Three Topics in Quantum Communication

7

the created photon pairs which makes quantum communication schemes easier to implement. The twin-hole fiber we used has a slightly elliptical core of diameter 3 × 3.3 μm and a numerical aperture of 0.27 ± 0.01. For poling, gold plated tungsten wires having 25 μm diameters were inserted in the two holes of the twin-hole fiber. The poled area is defined by the region where the electrodes overlapped. The fiber is placed on top of a hot plate and poling was carried out in air by heating the fiber to 250 o C with 4 kV applied. Cooling down to room temperature occurred in a few seconds as the heater was removed from under the fiber. After poling, the wires were extracted from the sample and the device spliced to standard telecom fiber (SMF-28). The periodic nonlinearity for quasi-phase matching was created step by step, by focusing, on the core of the poled fibre, the 5 mW output from a frequency doubled Ar+ -laser (λ = 244 nm, spot size 2w0 = 5 μm× 350 μm) and translating the fiber relative to the focused spot with a stage. The UV light was flashed intermittently in synchronization with the movement of the stage. As mention before, the 8 cm long poled region was spliced to standard single mode optical fiber at both ends to make easier the injection of the pump beam and the collection of the photon pairs. However in this sample, the mode matching the twin-hole fiber and the single mode fiber was not optimized, leading to significant losses at the splices. This prevents us from knowing exactly how much pump power we inject in the fundamental mode of the poled fiber. This same sample has already been used in other experiments based on second harmonic generation[8]. The experimental setup is described in Fig.2. It consists of cw Ti-Sa laser tunable around 775 nm. The polarization of the pump beam is adjusted using a polarizing beam splitter (PBS) and a half-wave plate (HWP). The pump power is chosen by the mean of neutral-density filters (NF). The pump is injected in the fiber through a ×20 microscope objective. Finally, at the output of the fiber, the pump is removed by dielectric long-wave pass filters (LWP) and then sent to an InGaAs/InP avalanche photodiode operating as single photon detector (APD’s - ID Quantique’s id200).

Figure 2. Experimental setup: ISO, isolator; PBS, polarizing beam splitter; NF, neutral density filter; HWP, half-wave plate; X20, microscope objective X20; SMF, single mode fiber; PPSF, periodically poled silica fiber; LWP, long-wave pass filter; APD, avalanche photodiode; TAC, time to amplitude converter

By carefully scanning the wavelength and the polarization of the pump field, we have found the poling resonance to be at 778.2 nm, leading to the generation of a degenerate signal field at 1556.4 nm in the fiber-optic communication band (Fig.3). This has been confirmed by independent measurements based on second harmonic generation (SHG)

8

S. Massar et al. / Three Topics in Quantum Communication

in this same poled fiber [8]. At the maximum gain, the measured signal power is 0.2 pW. The pump power at the output of the single mode fiber was 20 mW which is 15 times smaller than the value reported in Ref.7. Theoretically, at degeneracy and in the low gain condition, the signal power can be approximated by Psignal ≈

¯ ωs h Bω ηSH Ppump 2π

(3)

where ηSH the second harmonic generation efficiency and Bω is the FWHM of the signal spectrum in rad/s. At degeneracy, in a second order approximation, the latter reads  Bω =

2π δ 2 βs δωs2 |ωs0 L

(4)

where βs is the signal wave vector, ωs0 the signal pulsation at degeneracy and L the length of the poled section. δ 2 βs δωs2 |ωs0 has been estimated using the method described in Ref.9 and based on white light interferometry, leading to a signal spectral width of 17 THz. The second harmonic efficiency ηSH has been measured to be 0.02 %/W. Using Eq.3, this lead to a signal power of 8.7 pW at the output of the poled section. The losses induced from the splice (not optimized) and the pump filtration setup have been estimated to -11 dB. Combined with the 10% detection efficiency of our detector, this leads to a predicted output power of 3.6 pW fW in qualitative agreement with parametric fluorescence measured value. The residual discrepancy is attributed to the imprecision on value of the pump power injected in the fundamental mode of the poled fiber. Finally, we estimated the conversion efficiency Psignal /Ppump at 9 · 10−11 . If all the pump power was injected in the fundamental mode, we estimate that the conversion efficiency would be 4 · 10−10 which is almost an order of magnitude higher than the value (6.4 · 10−11 ) reported in Ref.7. The signal was also sent to two single photon detectors via a 3dB fiber coupler. A time to amplitude converter (TAC) allowed us to plot the delay between the detection times of the two APD’s. In the setup, one of the two photon of a pair has to travel 3m of fiber more than the other; it corresponds to a 15 ns delay between the photons arrival times at the detectors. Thus, the presence of a peak at 15 ns in the histogram is a strong sign that the measured signal arises from photon pairs created by parametric fluorescence in the poled fiber. A signal to noise ratio (SNR) of 2 is obtained (Fig.4) improving the 1.5 SNR reported in Ref.7. This could still be significantly improved by reducing the losses of the splices between the poled section and the single mode fiber, and by using an all fiber setup to remove the pump. In conclusion, we show that with lower pump power than previously [7], we were able to observe parametric fluorescence in periodically poled silica fiber and measure a coincidence peak with a SNR of 2. The poled region was spliced to standard single mode fibers which ensures that the source could be easily integrated in fiber-optics quantum communication applications. Finally, today, poled fibers up to 25 cm long and nonlinearity up to four times the one induced here, are available. This promisses large improvements for a photon pair source based on parametric fluorescence in periodically poled twin-hole silica fiber.

S. Massar et al. / Three Topics in Quantum Communication

9

Figure 3. Measured parametric fluorescence power to pump power ratio versus pump wavelength. The periodic poling resonance lies at 778.2 nm.

Figure 4. Number of coincidences measured in 3 hours with 20 mW pump injected into the fiber. (Note that the amount of pump power coupled to the fundamental mode is different than reported in the main text). The presence of a peak in the histogram is a strong sign that the measured signal arises from photon pairs created by parametric fluorescence in the poled fiber.

Acknowledgements We acknowledge the support of the Fonds pour la formation à la Recherche dans l´Industrie et dans l´Agriculture (FRIA, Belgium), of the Interuniversity Attraction Pole program of the Belgian government under Grants IAP5-18 and IAP6-10, and of the EU project QAP.

10

S. Massar et al. / Three Topics in Quantum Communication

References [1] [2] [3]

G. Ribordy, J-D. Gautier, N. Gisin, O. Guinnard and H. Zbinden, Elect. Lett. 34, 2116 (1998). N. Gisin, N. Linden, S. Massar, S. Popescu, Phys. Rev. A, 72, 012338 (2005). L.-P. Lamoureux, E. Brainis, N. J. Cerf, Ph. Emplit, M. Haelterman, and S. Massar, Phys. Rev. Lett. 94, 230501 (2005). [4] L. P. Lamoureux, E. Brainis, D. Amans, J. Barrett, and S. Massar, Phys. Rev. Lett. 94, 050503 (2005). [5] P. Shor, Phys. Rev. A 52, 2493 (1995). [6] C. H. Bennett, et al., Phys. Rev. Lett., 76, 722 (1996). [7] G. Bonfrate, V. Pruneri, P.G. Kazansky, P. Tapster and J.G. Rarity, Appl. Phys. Lett. 75, 2356 (1999). [8] A.Fotiadi, O. Deparis, P. Mégret, C. Corbari, A. Canagasabey, M. Ibsen, P.G. Kazansky, CLEO/QELS 2006 Long Beach 21-26 May 2006 CTuI3 "All fiber frequency doubled Er/Brillouin laser". [9] P. Merritt, R.P. Tatam and D.A. Jackson, J. Lightwave Technol. 7(4), 703 (1989).

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

11

Entanglement and Eavesdropping in Quantum Cryptography Dmitri HOROSHKO 1 , Sergei KILIN B.I. Stepanov Institute of Physics, Belarus National Academy of Sciences, Minsk 220072 Belarus Abstract. We discuss the importance of entanglement creation for successful eavesdropping in quantum cryptography. We give a definition of asymmetric universal entangling machine which entangles a system in an unknown state to a specially prepared ancilla. We describe explicitly such a machine for any quantum system having finite number of levels and prove its optimality. We show that the asymmetric universal entangling machine is a device, required for optimal individual eavesdropping on the 6-state protocol of quantum cryptography. Keywords. Entanglement, entangling machine, quantum cryptography

Introduction The main topic of interest of the modern quantum cryptography is quantum key distribution (QKD), a technology for generating two identical random sequences of bits at two stations, Alice’s and Bob’s, by means of a quantum channel in such a way that any successful attempt to eavesdrop on the channel is detectable [1,2]. The last property of a QKD line is crucial for the possibility to use the generated sequences as a secure cryptographic key. Therefore, the analysis of possible eavesdropping attacks is absolutely indispensable for determining the security of a given QKD protocol. In a typical realization of QKD line Alice encodes a single photon in one of several possible polarization or phase states and sends it down the optical fibre to Bob, who decodes the state of the photon by quantum measurement, obtaining a bit for his sequence. Let us look at the QKD line from the viewpoint of the eavesdropper Eve, who can get access to the fibre and manipulate photons on their way to Bob. What is the general strategy for Eve? The common answer to this question is: cloning of photons. Indeed, obtaining imperfect clones of photons and storing them in quantum memory, Eve can measure them later at convenient moment and obtain some information about the key. However, building a cloning machine [3,4] is a rather complicated task. Perhaps, the goal can be reached by simpler tools? To answer this question let us look at classical cryptography. In classical cryptography Alice sends a message to Bob by a classical channel, e.g. electrical wire, and the Eve’s primary goal is to get an exact copy of this message for future analysis. From the 1 Corresponding Author: Dmitri Horoshko, B.I.Stepanov Institute of Physics, NASB, Nezavisimosti Ave., 68, Minsk 220072 Belarus; E-mail: [email protected].

12

D. Horoshko and S. Kilin / Entanglement and Eavesdropping in Quantum Cryptography

viewpoint of information theory the copy of message, stored in the memory of Eve’s computer is a "clone" of the message in the channel. However, from the physical viewpoint the state of the memory cell is by no means a "clone" of an electric pulse in the wire. It is more correct to say that the state of the memory cell is correlated to the state of the wire. Therefore, the main goal of Eve is to produce correlation. Coming back to quantum scenario, we conjecture that the Eve’s goal is to reach the maximal possible correlation between the state of the quantum memory cell and the state of photon in the fibre. In the quantum world the maximal correlation is given by entanglement. Therefore, the Eve’s strategy is formulated as: entangling photons to memory. Thus, for the purpose of eavesdropping Eve needs a machine producing entanglement between unknown state of photon and the known initial state of the memory cell. In the present paper we study such a machine from the first principles. Quantum machines generating entanglement in a universal (input state-independent) way have been considered by Bu z˘ ek and Hillery [5] and by Alber, Delgado, and Jex [6]. Both approaches aim at entangling two similar systems (having the same number of levels) in either symmetric [5] or antisymmetric [6] way. The former type of entangling interaction has been recently realized (probabilistically) in an experiment [7]. In the present paper we develop an alternative approach which does not require two systems to be similar to one another (a memory cell may have more levels for quantum encoding than a photon). As a consequence, our approach does not impose any symmetry condition on the output, and the machine of our interest can be called asymmetric universal entangling machine (AUEM). As we will see later, to obtain a non-trivial machine we will need to impose an additional constraint, linking the machine output to its input.

1. Definition of machine We consider a signal system S having a state space H S of d dimensions and initially prepared in an unknown state |ψ S . Another quantum system A with a state space H A of da dimensions is called ancilla; it is initially prepared in a definite state |Blank A . We define quantum entangling machine as a physical device which takes as input these two systems and produces as output two systems S  and A with the same number of dimensions of state space d and d a respectively. In the future we will often omit primes and call the output systems S  and A “signal” and “ancilla” as well, though they are not necessarily the same physical objects which entered the machine. We demand for our machine that the joint state of signal and ancilla at the output is a pure state |Ψ SA , which generally is not a product of two local states, i.e. a state for S  and a state for A . To obtain a universal (input state independent) quantum entangling machine we demand that the degree of entanglement contained in |Ψ SA is independent of the input signal state |ψS . The entanglement for pure states is defined as von Neumann entropy of the signal system alone [8]: E = −T r {ρS log2 ρS } ,

(1)

where ρS is the density operator of the signal at the output of the entangling machine:   ρS = T rA |ΨSA SA Ψ| . (2)

D. Horoshko and S. Kilin / Entanglement and Eavesdropping in Quantum Cryptography

13

The entanglement E defined in Eq. (1) varies within the limits 0 ≤ E ≤ log 2 d, with E = log2 d realized for maximally entangled systems and E = 0 for statistically independent ones. Now the condition of universal entanglement can be formulated as follows: a machine should produce the same amount of entanglement E for any input signal state |ψS . However, this condition alone can be satisfied by a trivial machine with da = d, which discards the input and produces as output the maximally entangled state d of signal and ancilla: |Ψ max SA = √1d k=1 |ψk S |φk A , where |ψk S and |φk A are two sets of orthonormal vectors in the state spaces of signal and ancilla respectively. The entanglement of the output is E = log 2 d and of course it does not depend on the input state which is simply discarded. To obtain a non-trivial machine it is necessary that the output state, but not the degree of its entanglement, be related in some way to the unknown input state of the signal. The most simple and natural way to do this, is to demand some “similarity” between the output and the input of the signal system: the signal output should in some sense “resemble” the input, so that the latter cannot be discarded. A natural measure of similarity of two quantum states is the so-called fidelity [9]. In our case the fidelity between the signal output and the signal input is defined as F = S ψ| ρS |ψS ,

(3)

and we may formulate the condition of universal similarity as follows: a machine should change the signal system in such a way that the fidelity of the signal output with respect to the signal input is constant for any input signal state |ψ S . Thus we define an AUEM as a physical device having as input systems S and A in states |ψS and |BlankA respectively and producing as output systems S  and A in a pure state |ΨSA such that both entanglement Eq. (1) and fidelity Eq. (3) are independent of the state |ψS . We suppose that the entanglement is non-zero and the fidelity satisfies 1 1 d < F < 1. The fidelity equal to or below d is not interesting because in this case the output is not more similar to the input than the totally mixed state with the density matrix I/d, where I is the unity matrix. We expect that E(F ) will be a decreasing function of F , i.e. that we need to “pay” for the entanglement by a degradation of the signal state fidelity. The obvious limiting points are E( 1d ) = log2 d (trivial machine above) and E(1) = 0 (no interaction). The most important question now is if the machine defined in this way is possible to realized by physical means. If AUEM would prove to be possible, another important problem would be to find the optimal machine, producing maximal degree of entanglement for a given degradation of the signal state fidelity.

2. Properties of optimal machine Let us suppose that the entangling machine defined in the previous section is possible and analyze the properties of the optimal one. While deducing the properties of the optimal machine we will find its explicit form and thus prove its existence. 2.1. Purity In the definition of the entangling machine we demanded that the joint output state of signal and ancilla is pure. Let us now show that if this state is mixed, entanglement is

14

D. Horoshko and S. Kilin / Entanglement and Eavesdropping in Quantum Cryptography

not greater. Suppose that the joint state of the signal and the ancilla at the output of the entangling machine is a mixed state ρ SA . The entanglement of this state can be measured by a measure such as the entanglement of formation [10], which is found in the following way. First we unravel the state ρ SA , i.e. represent it as a sum of pure states with some weights, then calculate the entanglement of each pure state according to Eq. (1) and take a weighted sum of them, which will give us the entanglement of that unravelling. The minimum of this quantity over all possible unravelling of a mixed state is called its entanglement of formation. For pure states it coincides with the entanglement given by Eq. (1). It has been proven that the entanglement of formation is the upper bound for all other measures of entanglement [11]. Let us denote the entanglement of formation of ρ SA as E  . Now we wish to show that for the same output signal state ρ S = T rA ρSA we can construct a machine producing no less entanglement than E  , but having pure state at the output. The output state ρ SA , as any mixed state, can be purified on a larger state space: a second ancilla Z can be added and a pure state |Λ SAZ can be found on the state space of the signal and both ancillas, such that ρSA = T rZ {|Λ Λ|}. It can be easily proven from the convexity of von Neumann entropy that E  is not greater than the entanglement between S and AZ in |ΛSAZ (see the second Lemma in Ref. [10]). It means that for any mixed output state ρSA we always can construct another entangling machine with a bigger ancilla and pure output |Λ SAZ , which produces no less entanglement and results in the same transformation of the signal state. 2.2. Output state of the optimal machine Now we analyze the structure of the pure output state of our machine. As any bipartite pure state, it can be written in the form of Schmidt decomposition |ΨSA =

d  k=1

λk |ψk S |φk A ,

(4)

where {|ψk S , k = 1, ..., d} is an orthonormal basis in H S , {|φk A , k = 1, ..., d} is an orthonormal set of vectors in H A , whose dimensionality is d a ≥ d, and λk are some complex numbers (Schmidt coefficients), satisfying the normalization condition d 2 k=1 |λk | = 1. We accept that the vectors are numbered so that |λ 1 | ≥ |λ2 | ≥ ... ≥ |λd |. The input signal state can be decomposed in the basis {|ψ k S , k = 1, ..., d} as: |ψ =

d 

ck |ψk ,

(5)

k=1

 where ck are complex numbers, satisfying the normalization condition dk=1 |ck |2 = 1. Now the fidelity, Eq. (3), and the entanglement, Eq. (1), can be expressed as F =

d 

|λk |2 |ck |2 ,

(6)

k=1

E = H(|λ1 |2 , |λ2 |2 , ..., |λk |2 ),

(7)

D. Horoshko and S. Kilin / Entanglement and Eavesdropping in Quantum Cryptography

15

d where H(x1 , x2 , ..., xd ) = − k=1 xk log2 xk , is Boltzmann’s H-function. Now our task is to find such form of the output state which (i) maximizes E for given F and (ii) maximizes F for given E. We start with solving the first problem. Let us consider F and E as functions on the coordinate space V created by {|λ k |2 } and {|ck |2 }, satisfying the normalization conditions and the ordering of λ’s. Let us define on V a subspace V 0 by |c1 |2 = 1. Now, for given F on V 0 : |λ1 |2 = F and the entanglement is E0 = −F log2 F + H(|λ2 |2 , |λ3 |2 , ..., |λd |2 ).

(8)

The H-function is maximal when all its arguments are equal. Letus denoteby V 1 the one-parameter subspace of V 0 with |λ2 |2 = |λ3 |2 = ... = |λd |2 = 1 − |λ1 |2 /(d − 1). On this subspace E0 reaches its maximum E 0max = hd (F ), where the function h d (F ) is defined as hd (F ) = −F log2 F − (1 − F ) log2

1−F , d−1

(9)

and has the meaning of maximum of the H-function over d arguments summing up to unity, with the fixed maximal argument F . This function is strictly decreasing for 1/d < F < 1, because its derivative h d (F ) = log2 [(1 − F )/(F d − F )] is strictly negative in this region. In the entire space V the relation |λ 1 |2 ≥ F holds (from Eq. (6)) and for any given λ 1 , the entanglement is bounded from above by the value h d (|λ1 |2 ) (from the meaning of the latter). Since h d (F ) is a decreasing function of F , it follows that E ≤ hd (|λ1 |2 ) ≤ hd (F ) = E0max , i.e. E0max is the entanglement maximum for the given fidelity. Now we turn to the second problem. Let us fix the entanglement E 1 satisfying 0 < E1 < log2 d. We define the fidelity F1 by equation h d (F1 ) = E1 , which has a unique solution, since h d (F ) is strictly decreasing on 1/d < F < 1. This fidelity corresponds to a point in the subspace V 1 (see above). Let us prove that F 1 is the fidelity maximum for the given entanglement. Suppose that there is a point in V, giving the fidelity F2 > F1 and entanglement E 2 . The maximal value of E 2 is given by hd (F2 ), as proven above. Since the function h d (F ) is strictly decreasing on 1/d < F < 1, it follows that max(E2 ) < E1 , that is, the value E1 is unreachable for fidelity higher than F 1 . This completes the proof. Summing up, we see that there is a one-parameter subspace (V 1 ), where both conditions (i) and (ii) are satisfied simultaneously. On this subspace |ψ S = |ψ1 S and the output state can be written as |ΨSA =

√

F |ψS |φ1 A +

d 1−F  |ψk S |φk A , d−1

(10)

k=2

where the phases of coefficients are absorbed by {|φ k }. Both the fidelity F and the entanglement E = hd (F ) of the state Eq. (10) are independent of the input state |ψ S , and therefore, a machine transforming |ψ S |BlankA into the state Eq. (10) is an AUEM and an optimal AUEM. We still need to prove that such a machine exist. It will be done in the next subsections by deducing the explicit form of the necessary unitary transformation.

16

D. Horoshko and S. Kilin / Entanglement and Eavesdropping in Quantum Cryptography

2.3. Transformation of signal state Now we look how the optimal AUEM is “seen” by the signal system alone. For the signal the AUEM acts as a quantum channel, which transforms its state from a pure state |ψ ψ| to a mixed state ρS . This transformation can be found by substituting Eq. (10) into Eq. (2), which gives ρS = (1 − πs ) |ψ ψ| +

πs I, d

(11)

where πs is connected to F by the relation F = 1 − π s + πs /d. The quantum channel defined by Eq. (11) is called “depolarizing channel” and the parameter π s varying from 0 to 1 is known as “depolarized fraction”. The depolarizing channel is typically taken as the starting point for the discussion of universal quantum machines, e.g. quantum cloners [3,4]. In contrast, we start with the most general form of channel and show that the depolarizing one is optimal for our purpose. 2.4. Generalized Bell states and generalized Pauli operators In the future it will be useful to implement the formalism of generalized Bell basis and Pauli operators to systems with number of dimensions greater than 2 [4,12]. Let us consider two quantum systems X and Y having state spaces H X and HY respectively of d dimensions each. We denote by |j X and |jY , j = 0, ..., d − 1, the orthonormal bases in HX and HY respectively. Generalized Bell (GB) states on H X ⊗ HY are: d−1

1  2πi(jn/d) |ψmn XY = √ e |jX |j + mY , d j=0

(12)

where the indices m and n take values from 0 to d − 1. Note that here and below the summation in all indices is taken modulo d. The states Eq. (12) are normalized to unity and mutually orthogonal, thus creating an orthonormal basis on H X ⊗ HY . For d = 2 these states coincide with the usual Bell basis. We also introduce on each space H X and HY a set of d2 generalized Pauli operators: Um,n =

d−1 

e2πi(kn/d) |k + m k|,

(13)

k=0

where m and n again run from 0 to d − 1. For d = 2 these operators are proportional to Pauli spin operators: U 0,1 = σz , U1,0 = σx , U1,1 = −iσy . 2.5. Kraus representation We can rewrite the output state of the depolarizing channel Eq. (11) in the so-called Kraus form: ρS =

d−1  d−1  m=0 n=0

where

† Km,n |ψ ψ| Km,n ,

(14)

D. Horoshko and S. Kilin / Entanglement and Eavesdropping in Quantum Cryptography

Km,n =

aU0,0 , bUm,n ,

m, n = 0, 0, m, n = 0, 0,

17

(15)

are Kraus operators and the parameters a and b determine their  relative weights and are connected to the depolarizing fraction by the relations a = 1 − πs + πs /d2 , b = √ πs /d. Kraus representation helps to find the form of the output state of signal and ancilla, namely:

 |ΨSA = Km,n |ψ |φmn  , (16) m,n

where {|φmn } is any set of d2 orthonormal vectors in the state space of ancilla. It is straightforward to verify that substituting Eq. (16) in Eq. (2) gives Eq. (14). We see that we need only d 2 dimensions of ancilla to store the possible transformations of the signal state. Thus we can use for our ancilla a pair of d-level systems X and Y and identify the states {|φm,n } as phase-shifted GB states on HA ≡ HX ⊗ HY :

iϕ m, n = 0, 0, e |ψ00  , (17) |φmn  = e2πi(mn/d) |ψ−m −n  , m, n = 0, 0, where ϕ is a free parameter which will be used for the “fine tuning” of the overall systemancilla transformation. Substituting Eqs. (17), (15) into Eq. (16) after some algebra we get |ΨSXY = M |ψS |ψ00 XY ,

(18)

where the operator M is defined as M = α + βd |ψ00 SX SX ψ00 | , where the complex parameter α = ae iϕ − b and the real parameter β = bd = satisfy the relation 2 |α|2 + Re{α}β + β 2 = 1. d

(19) √ πs

(20)

2.6. Existence of AUEM Eq. (18) allows us to find the explicit form of AUEM and thus prove its existence. First, we prove that M is unitary on a subspace W spanned by possible input states of the machine, namely the states of the form |k S |ψ00 XY , where {|kS , k = 0, ..., d − 1} is some basis in HS . From Eqs. (18), (19) we find: M |kS |ψ00 XY = α |kS |ψ00 XY + β |ψ00 SX |kY .

(21)

Let us denote the subspace spanned by vectors given by Eq. (21) as W  . We can easily calculate with the help of Eq. (20) XY

ψ00 | S k| M † M |lS |ψ00 XY = δkl ,

(22)

18

D. Horoshko and S. Kilin / Entanglement and Eavesdropping in Quantum Cryptography

that is M is unitary on W as required. It means that the orthonormal set of d states on W is transformed into an orthonormal set of d states on W  . We can define a transformation UM : H −→ H so that it acts as M on W and transforms an orthonormal set of d 3 − d states on H \ W into an orthonormal set on H \ W  . This transformation maps one basis on H onto another and therefore is unitary and realizable by physical means. Thus the optimal machine is realized by restricting our ancilla to a pair of d-level systems X and Y , preparing its input state in the GB state |ψ 00 XY and applying to the signal and ancilla the unitary transformation U M , constructed as described above. This completes the proof of existence of AUEM.

3. Entangling machine for one qubit In this section we consider the simplest case of d = 2, where all three systems S, X and Y are represented by two-level systems or “qubits”. We describe the quantum circuit realizing the optimal AUEM and show how AUEM can be applied to eavesdropping on a quantum cryptographic line. 3.1. Quantum circuit A quantum circuit realizing the optimal AUEM for one qubit can be build with the help of the two-qubit circuit depicted in Fig. 1. Horizontal lines represent qubits, vertical lines are two-qubit CNOT gates, and the squares and circles represent one-qubit rotations exp (−iσz ξ/2) and exp (−iσy ξ/2) respectively by the specified angle ξ. It is straightforward to verifythat the four Bell states of the input  qubits, defined as |Φ±  = (|0 |0 ± |1 |1) / (2), |Ψ±  = (|0 |1 ± |1 |0) / (2) are transformed as follows: |Φ+  −→ ei3θ/4 |Φ+ , |Φ−  −→ e−iθ/4 |Φ− , |Ψ±  −→ e−iθ/4 |Ψ± , i.e. they are not mixed with one another, each acquiring a phase shift in such a way that there is a phase difference of θ between |Φ +  and the other three Bell states. This circuit alone realizes an optimal AUEM, if one of its entries is considered as input (qubit S) and the other (qubit X) is prepared in the Bell state |Φ + XY with the third qubit (Y ). The fidelity of the machine is F = (3 + cos θ)/4.

Figure 1. Quantum circuit for AUEM. The Bell states of two qubits pass the gate unchanged, but acquiring a phase shift. The phase of Φ+ state is shifted by 3θ/4 and the phases of the other three Bell states are shifted by −θ/4. Two-qubit gates are CNOT gates, while one-qubit gates are rotations around z (squares) or y (circles) axis by the specified angle.

Other representations of AUEM for one qubit can be obtained by concatenating this circuit with a similar one applied to the qubits X and Y and with θ replaced by ϕ − ϕ 0 (see Fig. 2), where

19

D. Horoshko and S. Kilin / Entanglement and Eavesdropping in Quantum Cryptography

cos ϕ0 = −

1−F . 3F − 1

(23)

For example, the asymmetric cloner [4] may be realized in this way by putting ϕ = 0.

Figure 2. AUEM for one qubit. S is the signal qubit in an unknown state. Qubits X and Y compose the 4-level ancilla and are initially prepared in the Φ+ Bell state. The gate G(θ) is shown in Fig. 1. The angles θ and ϕ0 are determined by fidelity F (see text). ϕ is a free parameter. The output state is a pure entangled state of the three qubits.

The symmetric entangler, acting at the same time as the symmetric cloner, is realized by putting ϕ = 0, θ = arccos (1/3). The circuit depicted in Fig. 2 can be compared to the circuits suggested for the universal (symmetric) cloning machine [13], where both ancillary qubits interact with the signal. Our scheme has the advantage of minimizing the number of qubits involved into the interaction with the signal system. 3.2. Application of AUEM to eavesdropping Let us show that the optimal AUEM for one qubit realizes the interaction necessary for the optimal eavesdropping in the so-called six state protocol of quantum cryptography. In this protocol the value of a bit is encoded into the state of a qubit S, chosen from three bases: the “rectilinear” one, created by two √ and |1, the “diag√ orthonormal vectors |0 ¯ 2, | 1 = (|0 − |1) / 2, and the “circular” onal” one, created by | ¯ 0 = (|0 + |1) / √ √ one: |0  = (|0 + i |1) / 2, |1  = (|0 − i |1) / 2. The protocol of quantum key distribution is similar to BB84 [14], the only difference is that three bases are used instead of two. The advantage of this protocol over BB84, is that the former is more secure against the eavesdropping. It has been shown [15] that the optimal strategy of individual eavesdropping on the six-state protocol is to attach to the qubit S a 4-level ancilla in some state |χ and to make the following transformation: √ √ (24) |0 |χ −→ F |0 |A + 1 − F |1 |B , √ √ |1 |χ −→ F |1 |C + 1 − F |0 |D , (25) where F , as usual, is the channel fidelity for the qubit S, and the four states in the ancilla state space are chosen so that {|A , |C} ⊥ |B ⊥ |D, and Re A| C = 2 − 1/F . For optimal AUEM to be used for entangling the qubit S to the ancilla, we obtain from Eq. (18) for d = 2:   α+β α β |0 Φ+ −→ √ |000 + √ |011 + √ |110 , 2 2 2   α+β α β |1 Φ+ −→ √ |111 + √ |100 + √ |001 , 2 2 2

(26) (27)

20

D. Horoshko and S. Kilin / Entanglement and Eavesdropping in Quantum Cryptography

where the kets are written in the SXY order. It is straightforward to verify that the four states of ancilla entangled with the states of the qubit S satisfy the demands imposed on the states |A, |B, |C, |D for any value of ϕ. That is, the optimal AUEM can be used for optimal individual eavesdropping for the six state protocol of quantum cryptography. As we have seen, the entangling interaction can be designed in such way, that it comprise only two qubits of three, which may be a significant advantage in the practical applications of the eavesdropping techniques.

Conclusions We have given a definition of asymmetric universal entangling machine for a d-level system and have proven its existence. We have shown that such a machine requires a d 2 -level ancilla and have found the transformation producing maximal possible entanglement for a given degradation of the signal system fidelity. The obtained machine could also be called “depolarizing channel purificator”, since it realizes the most general unitary transformation of three d-level systems acting as a depolarizing channel in the state space of one of them. Thus, this machine represents a generic quantum model for studying various universal quantum processes. Besides, we have confirmed our conjecture that the optimal strategy for eavesdropping on a QKD line is entangling the information carriers to the ancillas stored in quantum memory. We have shown that AUEM is optimal for individual eavesdropping on the 6-state protocol of QKD, and that this machine is simpler than the alternative tool for this purpose - the asymmetric cloning machine.

Acknowledgments This work was supported in part by INTAS and in part by Belarussian Republican Foundation for Basic Research.

References [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13]

S. Ya. Kilin, Usp. Fiz. Nauk 169, 507 (1999) [Phys. Usp. 42, 435 (1999)]; S. Ya. Kilin, in Progress in Optics, ed. E. Wolf, 42, 1 (2001). N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev. Mod. Phys. 74, 145 (2002). V. Bu˘zek and M. Hillery, Phys. Rev. A 54, 1844 (1996); V. Bu˘zek and M. Hillery, Phys. Rev. Lett. 81, 5003 (1998). N. J. Cerf, Acta Phys. Slov. 48, 115 (1998); N. J. Cerf, Phys. Rev. Lett. 84, 4497 (2000); N. J. Cerf, J. Mod. Opt. 47, 187 (2000). V. Bu˘zek and M. Hillery, Phys. Rev. A 62, 022303 (2000). G. Alber, A. Delgado, and I. Jex, Quant. Inf. Comp. 1, 33 (2001). M. Ricci, F. Sciarrino, C. Sias, and F. De Martini, Phys. Rev. Lett. 92, 047901 (2004). C. H. Bennett, H. J. Bernstein, S. Popescu, B. Schumacher, Phys. Rev. A 53, 2046 (1996). R. Josza, J. Mod. Opt. 41, 2315 (1994). C. H. Bennett, D. P. DiVincenzo, J. A. Smolin, W. K. Wootters, Phys. Rev. A 54, 3824 (1996). M. Horodecki, P. Horodecki, and R. Horodecki, Phys. Rev. Lett. 84, 2014 (2000). D. I. Fivel, Phys. Rev. Lett. 74, 835 (1995). V. Bu˘zek, S. L. Braunstein, M. Hillery, and D. Bruss, Phys. Rev. A 56, 3446 (1997); V. Bu˘zek, M. Hillery, and P. L. Knight, Fortschr. Phys. 46, 521 (1998).

D. Horoshko and S. Kilin / Entanglement and Eavesdropping in Quantum Cryptography

[14]

21

C. H. Bennett and G. Brassard, in Proceedings of IEEE International Conference on Computers, Systems and Signal Processing, Bangalore, India, 175 (IEEE, New York, 1984). [15] D. Bruss, Phys. Rev. Lett. 81, 3018 (1998).

22

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

Experimental Single Qubit Quantum Multiparty Communication Mohamed BOURENNANE a,1 , Christian SCHMID b , Pavel TROJEK b , e ˇ ˙ BRUKNER d , Marek ZUKOWSKI , and Christain KURTSIEFER c , Caslav b Harald WEINFURTER a Physics Department, Stockholm University, Stockholm, Sweden b Sektion Physik, Ludwig-Maximilians-Universität, D-80797 München, Germany and Max-Planck-Institut für Quantenoptik, D-85748 Garching, Germany c Department of Physics, National University of Singapore, Singapore 117 542, Singapore d Institut für Experimentalphysik, Universität Wien, A-1090, Wien, Austria e Instytut Fizyki Teoretycznej i Astrofizyki, Uniwersytet Gda´nski, PL-80-952 Gda´nsk, Poland

Abstract. We present simple and practical quantum solution for secure multiparty communication protocols, the secret sharing and the communication complexity and their proof-of-principle experimental realizations. In the secret sharing protocol, a secret is split among several parties in a way that its reconstruction requires the collaboration of the participating parties. In the communication complexity problem, the goal is to maximize the success probability of the partners for solving for giving communication resources some N partner communication complexity tasks. Our quantum solution is based on sequential transformations on a single qubit. In contrast with recently proposed schemes involving multiparticle GHZ states. Keywords. Quantum cryptography, communication complexity, quantum information

Introduction Quantum information science breaks limitations of conventional information transfer, cryptography and computation. Here we will consider two multiparty protocols, secret sharing and communication complexity. The communication complexity problems (CCPs) [1] were shown to have quantum protocols, which outperform any classical ones. In a CCP separated parties performing local computations exchange information in order to accomplish a globally defined task, which is impossible to solve singlehandedly. Two types of CCPs can be distinguished: the first one minimizes the amount of information exchange necessary to solve a task with certainty [2,3,4]. The second one maximizes the probability of successfully solving a task with a restricted amount of communication 1 Corresponding

Author: E-mail: [email protected]

M. Bourennane et al. / Experimental Single Qubit Quantum Multiparty Communication

23

[3,5,6]. Such studies aim, e.g., at a speed-up of a distributed computation by increasing the communication efficiency, or at an optimization of VLSI circuits and data structures [7]. In the secret sharing protocol (SSP), the secret is splitted in way that a single person is not able to reconstruct it. Suppose for example that the launch sequence of a nuclear missile is protected by a secret code. Yet, it should be ensured that a single lunatic alone is not able to activate it, but at least two lunatics are required. Solutions for this problem, and its generalization and variations, are studied in classical cryptography [8]. In such problems the aim here is to split information, using some mathematical algorithms, and to distribute the resulting pieces to two or more legitimate parties. However classical communication is susceptible to eavesdropping attacks. Quantum protocols for the CCPs [2,3,4,5,6] and the SSPs [9,10,11,12] involving multiparty entangled states were shown to be superior to classical protocols. However,current methods of production of such states do not work for more than four particles, and suffer from high noise. Here we propose a quantum protocol for the CCPs and SSPs for N parties, in which a sequential single qubit communication between them is used with no need for GHZstates. As our protocol requires only single qubits it is realizable with the current stateof-the-art technologies, they become technologically comparable to quantum key distribution, so far the only commercial application of quantum information.

1. Single qubit secret sharing protocol Here we present An N party SSP [13], where only the sequential communication of a single qubit is used, runs as follows (see Figure 1). The qubit is initially prepared in the state 1 | +x  = √ (| 0  + | 1 ). 2

(1)

During the protocol the qubit is sequentially communicated from partner to partner, each j (ϕj ) ≡ | 0  → | 0  and | 1  → eiϕj | 1  acting on it with the unitary phase operator U with the randomly chosen value of ϕj ∈ {0, π, π/2, 3π/2}. Therefore, having passed all parties, the qubit will end up in the state   N 1 i( ϕj ) j |0  + e |1  . (2) | χN  = √ 2 The last party performs a measurement on the qubit in the basis | ±x  = √12 (| 0  ± | 1 ) leading to the result ±1. As it will be clarified later, for her/him it suffices to choose only between ϕN = 0 or ϕN = π/2. The expectation value of the measurement is ⎞ ⎛ N  E(ϕ1 , . . . , ϕN ) = cos ⎝ ϕj ⎠ . (3) j

Note that this expectation value (Eqn. 3) has the same structure like the correlation function obtained using the GHZ state and can therefore also be used to obtain a shared se-

24

M. Bourennane et al. / Experimental Single Qubit Quantum Multiparty Communication

Figure 1. Scheme for N party single qubit secret sharing. A qubit is prepared in an initial state and sequentially (ϕj ), applying a randomly chosen communicated from party to party, each acting on it with a phase operator U phase ϕj . The last recipient performs a measurement on the qubit leading to the result ±1. In half of the cases the phases add up such that the measurement result is deterministic. These instances can be used to achieve the aim of secret sharing.

cret. For this purpose each participant divides his action for every run into two classes: a class X corresponding to the choice of ϕj ∈ {0, π} and a class Y corresponding to ϕj ∈ {π/2, 3π/2}. Following this classification they broadcast the class of their action for each run, but keep the particular value of ϕj secret. This corresponds in the GHZ scheme to the announcement of φj while keeping kj secret. In our scheme the partners announce their class choice in the reversed order with respect to the order of the qubit transmission [14]. From that procedure they can determine which runs lead to a deterN ministic measurement result, i.e. when cos( j ϕj ) equals to either 1 or -1. Such sets of ϕ’s occur on average in half of the runs. These are valid runs of the protocol. In such cases any subset of N − 1 parties is able to infer the choice of ϕR of the remaining partner, if themselves their values of ϕj . In case that this subset contains the last partner, he/she must reveal the measurement result. Thus, the collaboration of all recipients is necessary. The task of secret sharing is now achieved via local manipulation of phases on a communicated single qubit, and no multiparticle entangled GHZ state is required anymore. In order to ensure the security of the protocol against eavesdropping or cheating the partner PR arbitrarily selects a certain subset (which depends on the degree of security requirements) of valid runs. For these runs the value of ϕR is compared with the one inferred by the recipients. To this end each of the recipients sends the value of his/her phase ϕj . The comparison reveals any eavesdropping or cheating strategy. The security of the presented protocol against a general eavesdropping attack follows from the proven security of the well known BB84 protocol [15,16]. Each communication step between two successive parties can be regarded as a BB84 protocol using the bases x and y. Any set of dishonest parties in our scheme can be viewed as an eavesdropper in BB84 protocol.

2. Single qubit quantum communication complexity problem Let us introduce the CCP analyzed and implemented here, the so-called modulo-4 sum problem [3,4,18]. Imagine N separated partners P1 , . . . , PN . Each of them receives a

M. Bourennane et al. / Experimental Single Qubit Quantum Multiparty Communication

25

two-bit input string Xk , (Xk = 0, 1, 2, 3; k = 1, . . . , N ). The Xk s are distributed such N that their sum is even, i.e. ( k=1 Xk )mod2 = 0. No partner has any information whatsoever on the values received by the others. Next, the partners communicate with the goal that one of them, say PN , can tell whether the sum modulo-4 of all inputs is equal 0 value of a dichotomic, i.e. of values ±1, function or 2. That is, PN should announce the N T (X1 , . . . , XN ) given by T = 1 − ( k=1 Xk mod4). The partners can freely choose the communication protocol, e.g. they can choose between sequential communication from one to the other, or any arbitrary tree-like structure ending at the last party PN . The total amount of communication is restricted to only N − 1 bits (classical scenario). For further convenience, one can introduce a different more handy notation, we put Xk = (1 − yk ) + xk , where yk ∈ {−1, 1}, xk ∈ {0, 1}. For the task B we write Xk = π(1 − yk )/2 + xk , with yk ∈ {−1, 1}, xk ∈ [0, π). Note that, the dichotomic variables yk are not restricted by the probability distributions, p, for the Xk s. Theyare completely N random. The task function T can now be put as T = f (x1 , . . . , xN ) k=1 yk , where −N  p (x1 , . . . , xN ). f : xN k → {1, −1}, and p(X1 , . . . , XN ) = 2 Since T is proportional to the product of all yk s, the answer eN = ±1 of PN is completely random with respect to T , if it does not depend on every yk . Thus, an unbroken communication structure is necessary: the information from all N − 1 partners must directly or indirectly reach PN . Due to the restriction to N − 1 bits of communication each of the partners, Pk , where k = 1, . . . , N − 1, sends only a one-bit message, which for convenience will be denoted as ek = ±1. For a correct answer T eN = 1, otherwise, T eN = −1, and the average success can be quantified with fidelity F = X1 ,...,XN pT eN , or equivalently F = ×

1 2N

 x1 ,...,xN =0,1



y1 ,...,yN =±1

N

k=1

p (x1 , . . . , xN )f (x1 , . . . , xN )

yk eN (x1 , . . . , xN ; y1 , . . . , yN )

(4)

We have shown that the classical fidelity bound is by Bell-like inequality. This classical bound decrease exponentially with N . One has Fc ≤ 2−K+1 , where K = N/2 and K = (N + 1)/2 for even and odd number of parties, respectively [17]. This analytic result confirms the numerical simulations of [18] for small N . For the quantum protocols, we note that the Holevo bound [19] limits the information storage capacity of a qubit to no more than one bit. Thus, we must now restrict the communication to N −1 qubits, or alternatively, to N −1-fold exchange of a single qubit. The solution of task starts with a qubit in the state | ψ0  = 2−1/2 (| 0  + | 1 ). Parties sequentially act on it with the phase-shift transformation | 0  0 | + eiπXk /2 | 1  1 |, in accordance with their local data. After all N phase shifts one has N 1 (5) | ψN  = √ (| 0  + eiπ( k=1 Xk )/2 | 1 ). 2 N Since the sum over Xk is even, the phase factor eiπ( k=1 Xk )/2 is equal to the dichotomic function √ T to be computed. Thus, a measurement of the qubit in the basis (| 0  ± | 1 )/ 2 reveals the value of T with fidelity Fq = 1, that is, always correctly [17].

26

M. Bourennane et al. / Experimental Single Qubit Quantum Multiparty Communication

The classical fidelity Fc or the probability of success Pc decreases exponentially with growing N to the value corresponding to a random guess by PN . I.e., communication becomes useless. In contrast, Pq does not change with N and it equals 1. The simple, one qubit assisted quantum protocol, without any shared multi-particle entanglement (!), clearly outperforms the best classical protocols.

3. Experiment We have experimentally implemented the two SSPs and CCPs. We encoded the protocol qubit in a single photon. The basis states | 0  and | 1  were represented by the polarization states | H  and | V  respectively (horizontal (H) and vertical (V) linear polarization). The single photons were provided by a heralded single photon source. The setup is shown in A pair of polarization entangled photons is created via a spontaneous parametric down conversion (SPDC) process. As the photons of a pair are strongly correlated in time the detection of one photon in DT heralds the existence of the other one which is used for the protocol. A coincidence detection between DT and D+ /D− , within a chosen time window of 4 ns, implies communication of only a single photon. The SPDC process was run by pumping a 2 mm long β-barium borate (BBO) crystal with a blue single mode laser diode (402.5 nm), at an optical output power of 10 mW. Type-II phase matching was used, at the degenerate case leading to pairs of orthogonally polarized photons at a wavelength of λ = 805 nm (Δλ ≈ 6 nm) (see Figure 2. In order to prepare the initial polarization state a polarizer transmitting vertically polarized photons was put in front of the trigger detector DT ensuring that only (initially) horizontally polarized photons can lead to a coincidence detection. This single qubit source will used to implement our two multiparty protocols [13,17]. 3.1. Experimental single qubit N = 6 secret sharing The first partner was equipped with a motorized half-wave plate (HWP1 ) followed by quarter-wave plate (QWP) at an angle of 45 ◦ . By rotation of HWP1 to the angles 0 ◦ , 45 ◦ and 22.5 ◦ , −22.5 ◦ he could transform the horizontally polarized photons coming from the source to | ±y  and | ±x . This corresponds to applying the phase-shifts

Figure 2. Setup for single qubit secret sharing. Pairs of orthogonally polarized photons are generated via a type II SPDC process in a BBO crystal. The detection of one photon from the pair by DT heralds the existence of the other one used in the protocol. The initial polarization state is prepared by placing a polarizer in front of the trigger detector. Each of the recipients (R1 . . . R6 ) introduces one out of four phase shifts, according to the output of a pseudo random number generator (RNG), using half- and quarter wave plate (HWP1 , QWP) or YVO4 crystals (C1 ...C5 ), respectively. The last party analyzes additionally the final polarization state of the photon by detecting it behind a half-wave plate (HWP2 ) and a polarizing beam splitter.

M. Bourennane et al. / Experimental Single Qubit Quantum Multiparty Communication

27

ϕ ∈ {π/2, 3π/2} and ϕ ∈ {0, π} respectively. As the phase-shifts of the other partners had to be applied independently from the incoming polarization state the usage of standard wave plates was not possible. Therefore the unitary phase operator was implemented using birefringent uniaxial 200 μm thick Yttrium Vanadate (YVO4 ) crystals (Ci ). The crystals were cut such that their optic axis lies parallel to the surface and is aligned in such a way that H and V polarization states correspond to their normal modes. Therefore by rotating the crystals along the optic axis for a certain angle a specific relative phase shift was applied independently from the incoming polarization state. An additional YVO4 crystal (Ccomp , 1000 μm thick) was used to compensate for dispersion effects (see fig. 2. The last party performed the measurement behind a half-wave plate (HWP2 ) at an angle of 22.5 ◦ followed by polarizing beam-splitter (PBS). The photons were detected at D+ /D− and DT by passively quenched silicon avalanche photo diodes (Si-APD) with an efficiency of about 35 % [13]. The protocol was repeated ztotal = 25000 times. One run consisted of choosing pseudo-random variables, rotating the crystals accordingly and opening the detectors for a collection time window τ = 200 μs, what took together about 1 s. The requirement of communicating a single photon imposes that only those runs were included into the protocol in which just one coincidence between DT and either D+ or D− (coincidence gate time τc ≈ 7ns) was detected during τ . In these runs a single coincidence detection provided us with the raw key. From happened zraw = 2107 times which N this we extracted N zval = 982 valid runs where | cos( j ϕj )| = 1 (506 times cos( j ϕj ) = 1 and 476 N times cos( j ϕj ) = −1 ) with a quantum bit error rate (QBER) of 2.34 ± 0.48 [13]. 3.2. Experimental single qubit N = 5 communication complexity We implemented the quantum protocols for N = 5 parties, using a our heralded single photon as the carrier of the qubit communicated sequentially by the partners. A halfwave plate (HWP1 ) transforms the qubit to the initial state 2−1/2 (| H  + | V ). The data Xk of each party was encoded on the qubit via a phase shift, using birefringent materials. The last party performed a measurement in the 2−1/2 (| H  ± | V ) basis to obtain the answer eN [17]. For a fair comparison of the quantum protocols with the classical ones, no heralded events are discarded, even if the detection of the protocol photon failed. In such a case

Figure 3. Color online) Set-up for qubit-assisted CCPs. Pairs of orthogonally polarized photons are emitted from a BBO crystal via the type-II SPDC process. The detection of one trigger photon at DT indicates the existence of the protocol photon. The polarization state is prepared with a half-wave plate (HWP1 ) and a polarizer, placed in the trigger arm. Each of the parties introduces a phase-shift by the rotation of a birefringent YVO4 crystal (C1 to C5 ). The last party performs the analysis of a photon-polarization state using a half-wave plate (HWP2 ) followed by a polarizing beam-splitter (PBS).

28

M. Bourennane et al. / Experimental Single Qubit Quantum Multiparty Communication

one can still guess the value of T , but with success rate of only 1/2. Therefore high detection efficiency of the heralded photons, i.e., high coincidence/single ratio for our set-up, is essential for an unambiguous demonstration of the superiority of qubit-assisted protocol [18]. The individual phase shifts of parties are also implemented by rotating 200 μm thick Yttrium-Vanadate (YVO4 ) birefringent crystals (Ci ) along their optic axis. To analyze the polarization state of photons in the desired basis, a half wave-plate (HWP2 ) followed by polarizing beam-splitter (PBS) is used (see Figure 3). The protocols were run many times, to obtain sufficient statistics. Each run took about one second. It consisted of generating a set of pseudorandom numbers obeying the specific distribution, subsequent setting of the corresponding phase shifts, and opening detectors for a collection time window τ . The limitation of communicating one qubit per run requires that only these runs, in which exactly one trigger photon is detected during τ , are selected for the evaluation of the probability of success Pexp . In order to determine the probability of success from the data acquired during the runs we have to distinguish the following two cases. First, the heralded photon is detected, which happens with probability η, given by the coincidence/single ratio. Then, the answer eN can be based on the measurement result. However, due to experimental imperfections in the preparation of the initial state, the setting of the desired phase shifts, and the polarization analysis, the answer is correct only with a probability γ, which must be compared with the theoretical limits given by Pq . Second, with the probability 1 − η the detection of the heralded photon fails. Forced to make a random guess, the answer is correct in half of the cases. This leads to an overall success probability Pexp = ηγ + (1 − η)0.5, or a fidelity of Fexp = η(2γ − 1). Due to a finite measurement sample, our experimental results for the success probability are distributed around the value Pexp as shown in Figure 4. The width of the distribution is interpreted as the error in the experimental success probability. For task A we obtain a quantum success probability of Pexp = 0.711 ± 0.005. The bound Pc = 5/8 for the optimal classical protocol is violated by 17 standard deviations. We have obtained for n = 6692 the values η = 0.452 ± 0.010 and γ = 0.966 ± 0.003.

Figure 4. Histograms of measured quantum success probabilities. The bounds for optimum classical protocols are displayed as well.

M. Bourennane et al. / Experimental Single Qubit Quantum Multiparty Communication

29

Summary In summary, we introduced a new scheme for solving the multi-party secret sharing and communication complexity protocols. Unlike other quantum schemes employing multiparticle entangled states our protocols uses only the sequential communication of a single qubit. As single qubit operations using linear optical elements and the analysis of photon polarization states are quite well accomplishable with present day technology we were therefore able to present the first experimental demonstration of the secret sharing protocol for N = 6 parties. This is to our knowledge the highest number of actively performing parties in a quantum protocol ever implemented. we have experimentally demonstrated the superiority of quantum communication over its classical counterpart for distributed computational tasks by solving two examples of CCPs. In our experiment we have reached higher-than-classical performance even when including all imperfections of state-of-the-art technologies. Thus, by successfully performing a fair and real comparison with the best classical scenario, we clearly illustrate the potential of the implemented scheme in real applications of multi-party quantum communication. In principle we see no experimental barrier to extend the performed protocol to even significantly higher number of participants. Most importantly, our method gives a generic prescription to simplify many multi-party quantum communication protocols.

Acknowledgements This work was supported by Polish MNiI, German DFG, Swedish Research Council (VR) grants, and the European Commission through the IST FET QIPC QAP.

References [1] A. C.-C. Yao, Proceedings of the 11th Annual ACM Symposium on Theory of Computing, ACM Press, NewYork, 209 (1979). [2] R. Cleve and H. Buhrman, Phys. Rev. A 56, 1201 (1997). [3] H. Buhrman, R. Cleve, and W. van Dam, SIAM J. Comput. 30, 1829 (2001). [4] H. Buhrman, W. van Dam, P. Høyer, and A. Tapp, Phys. Rev. A 60, 2737 (1999). [5] L. Hardy and W. van Dam, Phys. Rev. A 59, 2635 (1999). ˇ Brukner, M. Zukowski, ˙ ˙ [6] C. and A. Zeilinger, Phys. Rev. Lett. 89 197901 (2002); Cˇ Brukner, M. Zukowski, J.-W. Pan, and A. Zeilinger, Phys. Rev. Lett. 92, 127901 (2004). [7] E. Kushilevitz and N. Nisan, Communication complexity, Cambridge University Press, England, 1997. [8] B. Schneier,Applied Cryptography, John Wiley & Sons, Inc., 1996. ˙ [9] M. Zukowski, A. Zeilinger, M. A. Horne, and H. Weinfurter, Acta Phys. Pol 93 187, (1998). [10] M. Hillery, V. Bužek, and A. Berthiaume, Phys. Rev. A 59, 1829 (1999). [11] R. Cleve, D. Gottesma, and H.-K. Lo, Phys. Rev. Lett. 83, 648 (1999). [12] A. Karlsson, M. Koashi, and N. Imoto, Phys. Rev. A 59, 162 (1998). ˙ [13] C. Schmid, P. Trojek, M. Bourennane, C. Kurtsiefer, M. Zukowski, and H. Weinfurter, Phys. Rev. Lett. 95, 230505 (2005). ˙ [14] C. Schmid, P. Trojek, M. Bourennane, C. Kurtsiefer, M. Zukowski, and H. Weinfurter, Phys. Rev. Lett. 98 028902 (2007). [15] C. Bennett and G. Brassard, Proc. of IEEE International Conference on Computer, Systems & Signal Processing, Bangalore, India, 175 (1984). [16] N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev. Mod. Phys. 74, 145 (2002). ˇ ˙ [17] P. Trojek, C. Schmid, M. Bourennane, Caslav Brukner, M. Zukowski, and H. Weinfurter, Phys. Rev. A 72, 050305(R) (2005).

30

M. Bourennane et al. / Experimental Single Qubit Quantum Multiparty Communication

[18] E. F. Galvão, Phys. Rev. A 65, 012318 (2002). [19] A. S. Holevo, Probl. Peredachi Inf. 9, 3 (1973) [Probl. Inf. Transm. 9, 177 (1973)].

31

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

Relativistic No-Cloning Theorem Sergey N. MOLOTKOV 1 and D.I. POMOZOV Computer Science Department, Moscow M.V. Lomonosov State University, 119889 Russia Abstract. Whereas quantum cryptography ensures security by virtue of complete indistinguishability of nonorthogonal quantum states, attenuation in quantum communication channels and unavailability of single-photon sources present major problems. Since the restrictions imposed by non-relativistic quantum mechanics and used to formulate key distribution protocols are largely exhausted, new principle is required. The fundamental relativistic causality principle in quantum cryptography can be used to propose a new approach to ensuring unconditional security of quantum cryptography that eliminates these difficulties. Photons represent truly relativistic massless particles (the massless quantized field states) which travel at a maximum permissible speed. That is why in the development and realization of quantum cryptography in open space it would be unnatural to take no advantage of the additional possibilities offered by nature. Keywords. No-cloning, quantum cryptography

Introduction In quantum cryptography security is based on fundamental limitations imposed by the laws of quantum mechanichs, rather than on any assumption about the eavesdropper’s technical or computational resources. In quantum cryptography, any eavesdropping attempt is detected by virtue of the following interrelated fundamental limitations in quantum mechanics.

1. Non-relativistic no-cloning theorem I. The process |ϕ0  ⊗ |A −→ |ϕ0  ⊗ |ϕ0  ⊗ |A0  |ϕ1  ⊗ |A −→ |ϕ1  ⊗ |ϕ1  ⊗ |A1 

(1)

if ϕ0 |ϕ1  = 0. (copying of unknown quantum states) is forbidden by the no-cloning theorem [1]. 1 Corresponding Author: S. N. Molotkov, Computer Science Department, Moscow M.V.Lomonosov State University, 119889 Russia

32

S.N. Molotkov and D.I. Pomozov / Relativistic No-Cloning Theorem

II. No information can be extracted about a nonorthogonal state without perturbing it, i.e. following process is forbidden [2]: |ϕ0  ⊗ |A −→ U (|ϕ0  ⊗ |A) = |ϕ0  ⊗ |A0  |ϕ1  ⊗ |A −→ U (|ϕ1  ⊗ |A) = |ϕ1  ⊗ |A1 

(2)

if |A0  = |A1 , where |A is a detector state, and U is a unitary operator describing simultaneous evolution of the detected and detector states. In essense, these limitation follow from Heisenberg’s uncertainty principle, which rules out simultaneous measurement of observables associated with non commuting operators. For orthogonal states, there are no prohibitions on their cloning or information extraction without their perturbation. In the framework of nonrelativistic quantum mechanics, to the observables ρ 0 = |ϕ0 ϕ0 | and ρ1 = |ϕ1 ϕ1 | there correspond commutative measureming operators, which are orthogonal projectors P 0,1 = |ϕ0,1 ϕ0,1 | ([P0 , P1 ] = 0). Restrictions (1) and (2) follow from geometric properties of the states |ϕ0,1  in Hilbert space corresponding to a quantum system. Unless some additional basic restrictions on the measurability of orthogonal quantum states are employed, they cannot be used for the purposes of quantum cryptography owing to certain distinguishability. The restrictions on the measurability of quantum states imposed by special relativity represent such additional basic restrictions.

2. Relativistic no-cloning theorem For orthogonal states, there is no prohibition against certain distinquishing without their perturbation, or to be more precise, the theorem [2] states nothing about it. The statement that an orthogonal state "passes" through an auxilary system |A, interacts with it during the passage, and changes its state, which is frequently made in the interpretetion of this theorem, does not correspond to the contents of the theorem. The theorem contains nothing of the kind, in the sense that it is purely geometric in nature and states that the state vector of auxilary system |A may be unitarily turned, depending on the input vector |φ0,1 , and transfered to a new state |A 0  or |A1  with no change of the input vector. In this case, it is implicitly assumed that the input vector |φ 0,1  is accessible as a whole - that is, to perform the unitary transformation U requires having access to the entire space H|φ0,1  of states, in which the state carrier is nonzero, otherwise the transformation will not be unitary. The fact that in the proff there appeares only the state vector as an integral object |φ0,1  without inner coordinate "filling" just means that the state vector participates as whole in the transformation. The Hibert space H|ϕ0,1  representing a real physical system is tied to the Minkowskii spacetime, where each state is characterized by a wavefunction amplitude. Access to the Hilbert space of the states implies access to the spacetime domain of nonvanishing state amplitude (wavefunction). If only the domain in space where the state amplitudes do not vanish is accessible, then even orthogonal states cannot be realibly copied or distinquished. This is more or less obvious, because no manipulation (including copying and identification) cannot have an outcome with a probability higher than

S.N. Molotkov and D.I. Pomozov / Relativistic No-Cloning Theorem

33

the partial norm corresponding to the states lying in the accessible spacetime domain, i.e. in the accessible part of the Hilbert space. An orthogonal state to be reliably copied or distinguished must be available instantly and as a whole. So, when the amplitude of a state is nonzero in some finite domain of spacetime, the statement that the state is entirely accessible signifies access to this domain. In nonrelativistic quantum mechanics, which imposes no restrictions on the limiting speed, access to any finite domain may be instantly obtained. In quantum field theory, which imposes restrictions on a limiting speed, access to the state as a whole may be obtained only when the lengthy state is initially unitarily transformed to a state with an amplitude which is nonzero only an arbitrarily small spatial domain. After that, advantage can be taken of the theorem [2]. According to the relativistic causality principle [3], this unitary transformation of the state defined in a finte spatio-temporal domain to a state localized in an arbitrarily small spatial domain may be realized in a finite time only. The minimum required time is determined from the condition that a part of the light cone relevant to the past covers the initial spatial domain in which the state amplitude was nonzero (Fig.1a)). The vertex of a light cone resides in an arbitrarily strongly localized domain (at a point) to which the initial state amplitude is unitarily transformed. Each of the pairs of orthogonal states unitarily transformed to ("collected in") a localized domain may be thereafter be cloned with certainty or distinguished. Since we are dealing with massless states of a quantized field (photons), which propagate at the maximum allowable speed, this unitary transformation and subsequent cloning will result in a shift (delay) of the states in spacetime to those in the case of their free evolution (propagation).

Figure 1.

34

S.N. Molotkov and D.I. Pomozov / Relativistic No-Cloning Theorem

This effect makes it possible to reveal any eavesdropping attemps. Note that relativistic limitations on measurements were exmined by Landau and Peierls in a pioneering study [4] continued by Bohr and Rosenfeld [5]. In other words, for orthogonal states of the massless particles the no-cloning theorem looks like this. Orthogonal states may be cloned with a probability arbitrarily close to unity. The cloning results in production of states with the same amplitude but shifted (translated in spacetime). This is weaker than in the non-relativistic case (1). Therefore, we have |ϕ0  → (UL |ϕ0 ) ⊗ (UL |ϕ0 ),

(3)

|ϕ1  → (UL |ϕ1 ) ⊗ (UL |ϕ1 ). Here UL is the translation operator along the branch of the light cone in spacetime, L = Δ(x − t) is the dimension of the domain in which the state amplitude is nonzero (for brevity we assume that both states are nonzero in the same spatio-temporal domain but differ in amplitude φ 0,1 (x − t)). Similarly modified is the Bennett theorem [2] about distinguishability orthogonal states – only weaker process in comparisson with that in the nonrelativistic case (2) is allowed. |ϕ0 |A → (UL |ϕ0 ) ⊗ |A0 , |ϕ1  ⊗ |A → (UL |ϕ1 ) ⊗ |A1 ,

(4) |A0  = |A1 .

The aforementioned is illustrated by the diagrams given in Figs.1a)-c). Since the amplitude of massless quantum-field states propagating in a certain direction along the x axis depend only on x − t, it will suffice to consider the case in which time is fixed and coordinate is treted as variable (or vice versa). Consider one of the orthogonal states propagating at the speed of light, with amplitude φ(x − t) (c = 1), and index 0 or 1 is omitted for brevity), Suppose that the state is localized within a domain L  in the sense that L |ϕ(x − t0 )|2 dx ≈ 1, where ϕ(x − t0 ) is amplitude at t0 . To determine the values of the state amplitude at t 0 for all x in the localized domain simultaneously, a unitary transformation must be applied to the entire state: U ϕ0,1 (x − t0 ) = ϕ˜0,1 (x − t) (t > t0 ). The new state ϕ(x ˜  − t) has nonzero amplitude within a smaller spatial domain. The minimum domain size in x  at time t is dictated by relativistic causality principle, which was formulated in its final form by Bogolyubov [3]. The unitary operator has nonzero matrix elements only if the points (x, t 0 ) and (x , t ) lie in the past light cone with apex at the point Γ, which contains the domain of nonzero state amplitude at t0 . In any moment that precedes L, the orthogonal state amplitude can be mapped by a unitary transformation to a state amplitude localized in an arbitrary small neighborhood of Γ. It is essential that this state is different from φ(x − t 0 ). By the instant Γ, the values of state amplitude at all x can be accessed instantly. Now, a measurement result can be obtained instantly, and complete information about the state is available with probability one. If the states in the original pair are orthogonal, then unitary transformation can be executed to obtain another pair of orthogonal states at instant Γ and, therefore, one state can be reliably distinguished from the other (by the theorem on complete distinguishability of orthogonal state [2], which is now applicable).

S.N. Molotkov and D.I. Pomozov / Relativistic No-Cloning Theorem

35

It should be emphasized that these orthogonal states differ from the original ones. A state can be recovered or copied by executing the inverse unitary transformation "directed" forward in time. A state amplitude with shape identical to the original one cannot be obtained earlier than dictated by the relativistic causality principle. The state amplitude with amplitude identical to the original one is localized in future light cone with apex at Γ. Moreover, the resulting state also differs from the original one in the sense that it is delayed in time relatively to the original state, which would have traveled the distance L forward along the x axis by the moment L if no copying or informationextraction operations were attempted (see Fig.1a)). These considerations apply to extraction of information about states in a channel with probability one. A similar reasoning is true for extraction of information with probability less than one, in which case the corresponding delay is shorter than L (see Fig.1a)). A similar analysis can be developed in the nonrelativistic case. If limitations imposed by special relativity are ignored, the part of the analysis concerning the light cone should be removed. Formally unitary transformation can be executed instantly, and even the coordinate can be left out of analysis, while it should be kept in mind that any state subject to a unitary transformation can be instantly accessed as a whole (and so is the corresponding spatial domain). Similar reasoning may be employed when a state is unitarily transformed to the state of an auxiliary localized system. An example of such a unitary transformation is provided by the "stopping" of light [6]. This unitary transformation transfers the photon field to a vacuum state due to its masslessness and the impossibility of possessing the zero propagation velocity, while the state of an atomic system is transformed to some new state. Being unitary, the transformation also requires access to all values of the photon packet amplitude at the point of atomic system localization. This access is achieved in the natural way during propagation of the wave packet at the speed of light and its arrival at the localized atomic system ("entry" of the whole packet into the atomic system). When obtaining result with the probability one is involved, this process also requires a time L (the single-photon packet should completely "enter" the atomic system). As this takes place, the photon field finds itself in a new state, depending on the input photon state. By the point in time L with the probability one it is possible to find out what state it is and prepare the same one with a delay L, which is inevitable in this case, unlike the case of free propagation of the initial wave packet (see Fig.1b)). Therefore, any acquisition of information about one of the orthogonal states inevitably leads to their modification – translation in Minkowsii spacetime (delay). It is also important that the evolution of massless quantum field interacting with its environment (other quantum and classical degrees of freedom in communication channel) cannot lead to "contraction" of a state in the sense that the partial norm of the state corresponds to smaller spatial domain extending beyond the light cone as compared to free propagation (see Fig.1c)). Normally, the interaction gives rise to a mixed state, but the support of the density matrix in spacetime cannot be "contracted" and "pushed" out of the light cone (see Fig.1c)). Otherwise, information could be transmitted by using quantum state faster then at speed of light. Indeed, consider one of a pair of orthogonal states. Alice cannot extract classical information from a quantum state before the instant defined be the condition that the state amplitude is covered by the past light cone. After that, classical information can be transmitted to Bob, but not faster than at the speed of light (the partners are connected

36

S.N. Molotkov and D.I. Pomozov / Relativistic No-Cloning Theorem

by a branch of the light cone in Fig.1c)). If a quantum state evolving in channel could be "contracted" so that the cone with apex at point A and with a branch passing through point B when the past light cone contains the state, then Bob could extract classical information from the quantum state before it would have been transmitted at the speed of light to Alice, because the apex of the light cone containing the "contracted" quantum state extends into the spacelike reqion.

Conclusion With regard to quantum cryptography, the analysis developed above implies that the eavesdropper can neither copy quantum state nor extract information about it from a noisy channel before the instants depicted in Figs.1a)-c). This observation is of key importance for security of relativistic quatum cryptography, which remains secure irrespective of arbitrary attenuation. Since the security in question relies on the relativistic causality principle applied to evolution of quantum states, the limitations dictated by relativistic causality cannot be eliminated by any attenuation [7].

Acknowledgments This work was supported in part by INTAS (project 77-7284).

References [1] [2] [3] [4] [5] [6] [7]

Wootters W.K., Zurek W.H., Nature, 299,(1982) 802. Bennett C.H., Phys. Rev. Lett., 68, (1992) 3121. Bogolyubov N.N., Shirkov D.V., Introduction to Quantum Field Theory, Moscow, "Nauka", 1973. Landau L.D., Peierls R., Zeits. für Phys., 69 (1931), 56; Zeits. für Phys., 62, (1930) 188. Bohr N., Rosenfeld L., Math.-Fys. Medd., 12, (1933) 3. Fleischhauer M., Lukin M.D., Phys. Rev. Lett., 84, (2000) 5094. Molotkov S.N., JEPT, 99, (2004) 669.

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

37

Fast Quantum Key Distribution with Photon Number Decoys Daryl ACHILLES, Ekaterina ROGACHEVA and Alexei TRIFONOV1 MagiQ Technologies, Inc., 11 Ward Street Suite 300, Somerville, MA 02143

Abstract. We investigate the use of photon number states to identify eavesdropping attacks on quantum key distribution (QKD) schemes. The technique is based on the fact that different photon numbers traverse a channel with different transmittivity. We then describe a QKD scheme utilizing this method, which overcomes the upper limit on the key generation rate imposed by the dead time of detectors when using a heralded source of photons. Keywords. Quantum cryptography, nonclassical states

Introduction Quantum key distribution (QKD) is a method of generating a secret key between two parties (Alice, the sender, and Bob, the receiver) that is provably secure assuming that the laws of quantum physics are correct and that any eavesdropper (Eve) must work within the framework of these laws. Introduced in 1984, the BB84 protocol for QKD is based on the use of single photons for encoding the quantum information [1]. The uncertainty principle guarantees the security of the protocol since Eve does not have any a priori information about the basis that Alice used for encoding the information, ensuring the impossibility of a precise measurement of the secure bit due to the Heisenberg uncertainty principle. Sometimes the security is formulated in terms of the no-cloning theorem by Wooters and Zurek [2], which asserts that it is impossible for Eve to generate a precise copy of the unknown photonic information being sent from Alice to Bob without destroying said information. If Alice sometimes sends pulses containing two or more photons, then the situation drastically changes. Eve can now split the photons without destroying the information encoded in the initial state using the photon-number splitting (PNS) attack, the security is no longer protected by laws of quantum mechanics. This fact was acknowledged by the fathers of quantum cryptography [3] and has spurred long-lasting discussions on practical QKD security in the research community [4-10]. 1

Corresponding Author: Alexei Trifonov, MagiQ Technologies, Inc., 11 Ward Street Suite 300, Somerville, MA 02143.

38

D. Achilles et al. / Fast Quantum Key Distribution with Photon Number Decoys

In most of the experimental realizations of the BB84 protocol weak coherent states (attenuated laser pulses) are used as the light source thus making a certain amount of multiphoton pulses available for Eve. There is a trade off in the pulse intensity between security (low mean photon number) and key generation rate (large mean photon number). But even when using so-called “true” single-photon sources, such as those based on a heralded single photon source (HSPS) using parametric downconversion (PDC) [11-13] or single photon emitters such as quantum dots [14] and diamond color centers [15], any practical device will produce multiple photon pulses with some non-zero probability. If the channel loss between Alice and Bob is relatively small, then Eve’s attack on multiple photon pulses can be easily rejected by lowering the mean photon number and re-examining the privacy amplification model. The presence of multiple photons will result in information leakage, but this leakage can be leveraged. The presence of single photons gives enough protection to distill an unconditionally secure key. A simple rule of thumb is: Alice and Bob must ensure that a certain amount of clicks at Bob’s side result from single photon pulses sent by Alice. If in turn the channel loss is high, and this is the most interesting situation from a practical point of view, in addition to photon splitting Eve can take advantage of the channel loss by promoting the quantum states originating from the initial pulses containing two and more photons and suppressing the original single photon pulses [5]. We refer to this attack as the PNS attack with blocking and boosting. Lowering the mean photon number per pulse is no longer a good strategy for Alice and Bob since: 1) the key generation rate will be significantly reduced and 2) Bob’s detector noise may increase the quantum bit error rate up to the level where secure key distillation is no longer possible. Let us stress again that the crucial component of the PNS attack with blocking and boosting is Eve’s ability to use a loss-free channel to boost the channel transmittivity for the quantum states that she can efficiently eavesdrop, while blocking the single photon pulses. To protect against blocking and boosting and maximize both the key generation rates and the possible distance over which BB84 can be used, we must supplement the standard protocol with additional security measures to protect the key. One such method is the introduction into the channel of “decoy states”, which are used to detect an eavesdropper performing blocking and boosting [16-20]. In the original decoy state method by Hwang, the decoys are weak coherent pulses which are equivalent to the pulses used to send the key in all aspects except the mean number of photons. Since Eve can not distinguish between decoy pulses and real QKD pulses, she attacks all pulses; Alice and Bob can then identify blocking and boosting by comparing the gain and quantum bit error rate (QBER) for the different subsets of decoy states. Note that the Ekert protocol is immune to this type of attack since Bell’s inequality is sensitive to the presence of additional photon pairs [21-24]. For this reason utilizing remote state preparation [25, 26] (sometimes referred to as passive state preparation [27]) does not require decoys to identify an eavesdropper because performing a Bell’s inequality test can reveal blocking and boosting. In the same way that single photon states can be conditionally prepared from PDC, higher order number states can also be prepared [28-30]. This requires the use of photon-number resolving detectors, which have recently become available [31-34]. Very recently the decoy state concept has been adapted to utilize higher order number

D. Achilles et al. / Fast Quantum Key Distribution with Photon Number Decoys

39

states to detect an eavesdropper [35, 36]. In a similar fashion, this manuscript investigates the use of nonlinear photon number transmittivities to identify eavesdropping attacks on QKD. We also present a QKD scheme that overcomes the speed limitation imposed when a HSPS is used for both the decoy and key distribution pulses.

1. Generating Photon Number States In the scheme, Alice and Bob will use decoy states that are one- and two-photon number states, which can be prepared by conditional state preparation of PDC with a photon-number-resolving detector (PNRD) [28-30]. Alice uses PDC to generate a twomode squeezed state, described by:

ψ PDC = 1 − λ

2

∞

∑λ

n

n

n =0

A

n B,

(1)

where the two modes are labeled as Alice’s photon (A) and Bob’s photon (B), and λ is the parametric gain of the two-mode squeezed state. She then detects her mode with a PNRD with quantum efficiency η a , which is described by the POVM elements: ∞

ˆ = ∑ B n (η ) n n , Π k k a

(2)

n=k

where the coefficients are given by the binomial distribution

⎛n⎞ Bkn (ηa ) = ⎜ ⎟ηa k (1 − ηa )n −k , ⎝k ⎠

(3)

n is the number of photons in the pulse, and k is the number of photons registered by Alice’s PNRD. This POVM can be written in terms of measurement operators, or

ˆ = Mˆ Mˆ where Kraus operators, as [37] Π k k k †

∞

M k = ∑ Bkn (ηa ) n n .

(4)

n=k

The simplicity of the relation between the Kraus operators and the POVM elements is due to each term of the sum being the form of a projector. The state of the light after the measurement of Alice’s mode is then determined by

ψ' =

Mˆ k ψ PDC ˆ ψ ψ PDC Π k PDC

,

(5)

40

D. Achilles et al. / Fast Quantum Key Distribution with Photon Number Decoys

Figure 1. Possible conditional photon number distributions prepared by Alice as determined by Eqn. (6) for different values of Alice’s detector efficiency and the parametric gain. (a) With a high detector efficiency ( η a = 0.8 ), the parametric gain can be large ( λ = 0.5 ) and the photon number distribution is close to a photon number state. (b) When the detector efficiency is lower ( η a = 0.1 ), the parametric gain must be lowered ( λ = 0.1 ) in order to approximate a photon number state well. (c) The photon number distribution is very different from a photon number state when the efficiency is low ( η a = 0.1 ) and the parametric gain is large ( λ = 0.5 ). Note that for all situations there is no chance the conditionally prepared state contains zero photons.

D. Achilles et al. / Fast Quantum Key Distribution with Photon Number Decoys

41

which gives the photon probability distribution for Bob’s mode conditionally prepared by the registering of k photons by Alice’s PNRD:

P (n | k ) = λ

2( n − k )

(1 − (1 −η ) λ )

2 k +1

a

Note that as

⎛n⎞ n−k ⎜ ⎟ (1 − ηa ) . ⎝k ⎠

(6)

η a → 1 the probability distribution becomes the delta

function P (n | k ) = δ n , k , i.e. Bob is sent exactly the same photon number as Alice measured [38]. The same is true when the parametric interaction is kept weak (λ

2

→ 0 ). The situation when Alice detects a single photon is demonstrated in

Fig. 1. If Alice’s detector efficiency is high, then she will generate photon number states with high fidelity, even with strong parametric gain, as shown in Fig. 1(a). If η a is low, however, she will need to be cautious of how powerful the PDC interaction is and will have to use a low parametric gain to ensure that she generates photon number eigenstates with high fidelity. Fig. 1(b) shows the case where the efficiency is low, but the parametric gain has been lowered to ensure the conditional state is approximately a photon number state. The conditionally prepared state no longer emulates a photon number state when the parametric gain remains high and the efficiency is low, as demonstrated in Fig. 1(c). Qualitatively similar results occur when Alice detects two photons ( k = 2 ) with her PNRD, except in this case there is no chance for a pulse to contain either zero or one. 2. Fock State Transmittivity Estimation The state that Alice sends is, in general, a statistical mixture of Fock states: ∞

ρˆ = ∑ p A (n) n n ,

(7)

n =0

where p A (n) is the probability that Alice emits an n photon state. We will define the transmittivity of a pulse sent by Alice as the probability that the pulse contains at least one photon when it arrives at Bob. Accordingly, each number state has a different transmittivity η

(n)

equal to the probability that all the photons in the pulse are not lost:

η ( n ) = 1 − (1 − ηc ) n ,

(8)

where the channel efficiency ηc is defined as the probability that a single photon arrives at Bob given that Alice emitted a single photon pulse. The one- and two-photon states that will be used to estimate the channel loss have transmittivities

42

D. Achilles et al. / Fast Quantum Key Distribution with Photon Number Decoys

η (1) = ηc

and

η (2) = ηc 2 + 2ηc (1 − ηc ) ≈ 2ηc

(9)

where the approximation is valid for high channel loss ( ηc